Test

.github/workflows/snyk.yml

@@ -0,0 +1,13 @@
+name: Example workflow for Python using Snyk
+on: push
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      - name: Run Snyk to check for vulnerabilities
+        uses: snyk/actions/python-3.8@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+        with:
+          args: --all-projects

README.md

@@ -1 +1,8 @@
-# python-goof
+# Poetry
+## Exploiting the vulnerabilities
+This app uses dependencies holding known vulnerabilities - two are direct and one is transitive.
+
+Here are the exploitable vulnerable packages: 
+- [fastecdsa - Timing Attack](https://snyk.io/vuln/SNYK-PYTHON-FASTECDSA-511943)
+- [flask-cors - Directory Traversal](https://snyk.io/vuln/SNYK-PYTHON-FLASKCORS-608972)
+- [ihatemoney - Authorization Bypass](https://snyk.io/vuln/SNYK-PYTHON-IHATEMONEY-595715)

pip-sample/requirements.txt

@@ -13,7 +13,6 @@ gtfs-realtime-bindings==0.0.5
 html5lib==1.0.1
 idna==2.7
 ipykernel==5.0.0
-ipython==7.1.1
 ipython-genutils==0.2.0
 ipywidgets==7.4.2
 itsdangerous==1.1.0
@@ -22,7 +21,6 @@ Jinja2==2.10
 jsonschema==2.6.0
 jupyter==1.0.0
 jupyter-client==5.2.3
-jupyter-console==5.2.0
 jupyter-core==4.4.0
 kiwisolver==1.0.1
 MarkupSafe==1.0
@@ -32,15 +30,14 @@ nbconvert==5.4.0
 nbformat==4.4.0
 nltk==3.3
 notebook==5.7.0
-numpy==1.15.3
+numpy==1.16.3
 oauthlib==2.1.0
 pandas==0.23.3
 pandocfilters==1.4.2
 parso==0.3.1
 pexpect==4.6.0
 pickleshare==0.7.5
 prometheus-client==0.3.1
-prompt-toolkit==2.0.7
 protobuf==3.6.1
 protobuf-to-dict==0.1.0
 ptyprocess==0.6.0
@@ -51,7 +48,7 @@ python-dateutil==2.7.3
 pytz==2018.5
 pyzmq==17.1.2
 qtconsole==4.4.1
-requests==2.19.1
+requests==2.31.0
 requests-oauthlib==1.0.0
 Send2Trash==1.5.0
 simplegeneric==0.8.1