Vulnerabilities for dbt-core

First version without a known vulnerability: 1.7.0b1

Details

• GHSA-p3f3-5ccg-83xq2024-07-17

  dbt has an implicit override for built-in materializations from installed packages

  Fixed in: 1.6.14, 1.7.14, 3c82a0296d227cb1be295356df314c11716f4ff6, 87ac4deb00cc9fe334706e42a365903a1d581624

• GHSA-pmrx-695r-43492024-05-28

  dbt allows Binding to an Unrestricted IP Address via socketsocket

  Fixed in: 1.6.15, 1.7.15, 1.8.1

• GHSA-p72q-h37j-3hq72024-04-22

  dbt uses a SQLparse version with a high vulnerability

  Fixed in: 1.6.13, 1.7.13

• GHSA-j4g3-3q8x-jxqp2023-12-08

  dbt-core's secret env vars written to package-lock.json in plaintext

  Fixed in: 1.7.3