urllib3 2.1.0 flagging CVE-2024-37891 - can't resolve bc ibm-cos-sdk-core has a pin to <2.2
Opened this issue · 2 comments
bigpick commented
Info
Remediation for CVE-2024-37891 is in urllib3 2.2.2 but can't upgrade to that bc this repo pins urllib3 to under 2.2:
ibm-cos-sdk-core 2.13.5 requires urllib3<2.2,>=1.26.18; python_version >= "3.10", but you have urllib3 2.2.2 which is incompatible.
(python3.11 fwiw)