Skip to content

Commit e1c021d

Browse files
isaacamanpfmoore
andauthored
docs: clarify dependency-confusion warning refers to --extra-index-url (#13611)
Make the warning in the pip install docs explicitly name --extra-index-url so readers cannot misinterpret which option the warning refers to. Co-authored-by: Paul Moore <[email protected]>
1 parent a119d57 commit e1c021d

File tree

1 file changed

+5
-6
lines changed

1 file changed

+5
-6
lines changed

docs/html/cli/pip_install.rst

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -479,12 +479,11 @@ Examples
479479

480480
.. warning::
481481

482-
Using this option to search for packages which are not in the main
483-
repository (such as private packages) is unsafe, per a security
484-
vulnerability called
485-
`dependency confusion <https://azure.microsoft.com/en-us/resources/3-ways-to-mitigate-risk-using-private-package-feeds/>`_:
486-
an attacker can claim the package on the public repository in a way that
487-
will ensure it gets chosen over the private package.
482+
Using the ``--extra-index-url`` option to search for packages which are
483+
not in the main repository (for example, private packages) is unsafe.
484+
This is a class of security issue known as `dependency confusion <https://azure.microsoft.com/en-us/resources/3-ways-to-mitigate-risk-using-private-package-feeds/>`_: an
485+
attacker can publish a package with the same name to a public index,
486+
which may then be chosen instead of your private package.
488487

489488
.. tab:: Unix/macOS
490489

0 commit comments

Comments
 (0)