CVE-2024-49768 - need waitress at v3.0.1+

[jacwalte]

Describe the bug
CVE-2024-49768

How To Reproduce the bug
CVE issue

Expected behavior
waitress at next major version allowed

Screenshots
see above

Running Information(please complete the following information):

• promptflow-devkit 1.16.1 requires waitress<3.0.0,>=2.1.2
• any
• Python Version using 3.10.11

Additional context
N/A

[DrGriff]

I had this issue, but for me it was a bit more complex.

I first had:

promptflow-runtime 20241115.0 requires waitress<4.0.0,>=3.0.1, but you have waitress 2.1.2 which is incompatible.

So I added waitress<4.0.0,>=3.0.1 to my requirements.txt file, saved and installed.

But then I got:

promptflow-devkit 1.16.1 requires waitress<3.0.0,>=2.1.2, but you have waitress 3.0.2 which is incompatible.

So, caught between a rock and a hard place since I needed a version of waitress that was newer than 3.0.1 but older than 3.0.0

Problem seems to have gone away about an hour ago, so re-try.

PS, I did previously need to have openai<=1.44.1 in my requirements.txt file because it was erroring on Nonetype but it seems that's not needed there either now.

[github-actions]

Hi, we're sending this friendly reminder because we haven't heard back from you in 30 days. We need more information about this issue to help address it. Please be sure to give us your input. If we don't hear back from you within 7 days of this comment, the issue will be automatically closed. Thank you!

[DrGriff]

You can close this, it just started working the next day, so guessing Microsoft fixed it covertly

[github-actions]

Hi, we're sending this friendly reminder because we haven't heard back from you in 30 days. We need more information about this issue to help address it. Please be sure to give us your input. If we don't hear back from you within 7 days of this comment, the issue will be automatically closed. Thank you!