Upgrade out of CVEs

[bbemis]

Hi,

I’m using a trivy image scan to detect vulnerabilities on my project and noticed that the there are a few vulnerabilities being detected inside the temporal python sdk. Actually, they appear to be nested fairly deep in the rust libraries.

CVE-2024-27308
CVE-2024-32650
GHSA-q6cp-qfwq-4gcv

Is it possible to upgrade out of these in the next sdk release?

[Chad_Retz]

Yes, see [Feature Request] Update rustls and mio in Rust dependencies · Issue #520 · temporalio/sdk-python · GitHub. We will look to do this before next release.