PyPI/dbt-core: low 3.2
dbt-core's secret env vars written to package-lock.json in plaintext
Action: Upgrade dbt-core to 1.7.3 or later.
pip install dbt-core==1.7.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.7.0 | 1.7.3 | - |
Fixed versions
| 1.7.3 |
Sources
- osv: GHSA-j4g3-3q8x-jxqp
- https://github.com/dbt-labs/dbt-core/security/advisories/GHSA-j4g3-3q8x-jxqp
- https://github.com/dbt-labs/dbt-core/commit/09f5bb3dcffeda7a60ad2b22c2891f237628ecd1
- https://github.com/dbt-labs/dbt-core
- https://github.com/dbt-labs/dbt-core/releases/tag/v1.7.3
published · modified · JSON