You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
docs: clarify dependency-confusion warning refers to --extra-index-url (#13611)
Make the warning in the pip install docs explicitly name --extra-index-url
so readers cannot misinterpret which option the warning refers to.
Co-authored-by: Paul Moore <[email protected]>
an attacker can claim the package on the public repository in a way that
487
-
will ensure it gets chosen over the private package.
482
+
Using the ``--extra-index-url`` option to search for packages which are
483
+
not in the main repository (for example, private packages) is unsafe.
484
+
This is a class of security issue known as `dependency confusion <https://azure.microsoft.com/en-us/resources/3-ways-to-mitigate-risk-using-private-package-feeds/>`_: an
485
+
attacker can publish a package with the same name to a public index,
486
+
which may then be chosen instead of your private package.
0 commit comments