Safety CI > BarthJr/libpythonpro

pyup-update-pytest-cov-2.7.1-to-2.10.1

5 years, 7 months ago

Update pytest-cov from 2.7.1 to 2.10.1

bleach 3.1.0, twine 1.13.0 and codecov 2.0.15 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
twine	1.13.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-tqdm-4.32.1-to-4.48.2

5 years, 8 months ago

a58fe6cf

Update tqdm from 4.32.1 to 4.48.2

bleach 3.1.0, twine 1.13.0 and codecov 2.0.15 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
twine	1.13.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-tqdm-4.32.1-to-4.48.1

5 years, 8 months ago

d7bd65ed

Update tqdm from 4.32.1 to 4.48.1

bleach 3.1.0, twine 1.13.0 and codecov 2.0.15 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
twine	1.13.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-pytest-4.4.1-to-6.0.1

5 years, 8 months ago

4d4562f3

Update pytest from 4.4.1 to 6.0.1

bleach 3.1.0, twine 1.13.0 and codecov 2.0.15 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
twine	1.13.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-pytest-4.4.1-to-6.0.0

5 years, 8 months ago

10c883eb

Update pytest from 4.4.1 to 6.0.0

bleach 3.1.0, twine 1.13.0 and codecov 2.0.15 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
twine	1.13.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-coverage-4.5.3-to-5.2.1

5 years, 8 months ago

80233453

Update coverage from 4.5.3 to 5.2.1

bleach 3.1.0, twine 1.13.0 and codecov 2.0.15 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
twine	1.13.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-urllib3-1.24.2-to-1.25.10

5 years, 8 months ago

120d0123

Update urllib3 from 1.24.2 to 1.25.10

bleach 3.1.0, twine 1.13.0 and codecov 2.0.15 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
twine	1.13.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-tqdm-4.32.1-to-4.48.0

5 years, 8 months ago

4b4671f1

Update tqdm from 4.32.1 to 4.48.0

bleach 3.1.0, twine 1.13.0 and codecov 2.0.15 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
twine	1.13.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-codecov-2.0.15-to-2.1.8

5 years, 8 months ago

eacddb7d

Update codecov from 2.0.15 to 2.1.8

bleach 3.1.0 and twine 1.13.0 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
twine	1.13.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-pytest-mock-1.10.4-to-3.2.0

5 years, 9 months ago

c01e29f3

Update pytest-mock from 1.10.4 to 3.2.0

bleach 3.1.0, twine 1.13.0 and codecov 2.0.15 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
twine	1.13.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-coverage-4.5.3-to-5.2

5 years, 9 months ago

27d36a2f

Update coverage from 4.5.3 to 5.2

bleach 3.1.0, twine 1.13.0 and codecov 2.0.15 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
twine	1.13.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-tqdm-4.32.1-to-4.47.0

5 years, 9 months ago

ffd49ad2

Update tqdm from 4.32.1 to 4.47.0

bleach 3.1.0, twine 1.13.0 and codecov 2.0.15 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
twine	1.13.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-idna-2.8-to-2.10

5 years, 9 months ago

49db0918

Update idna from 2.8 to 2.10

bleach 3.1.0, twine 1.13.0 and codecov 2.0.15 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
twine	1.13.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-py-1.8.0-to-1.9.0

5 years, 9 months ago

6252990d

Update py from 1.8.0 to 1.9.0

bleach 3.1.0, twine 1.13.0 and codecov 2.0.15 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).
twine	1.13.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-twine-1.13.0-to-3.2.0

5 years, 9 months ago

bc30a5d0

Update twine from 1.13.0 to 3.2.0

bleach 3.1.0 and codecov 2.0.15 have known security vulnerabilities.

Package	Installed	Affected	Info
bleach	3.1.0	<3.3.0	show Bleach 3.3.0 includes a fix for CVE-2021-23980: A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscript, script, textarea, noframes, iframe, or xmp in allowed tags the keyword argument strip_comments=False Note: none of the above tags are in the default allowed tags and strip_comments defaults to True.
bleach	3.1.0	>=2.1,<3.1.1	show Affected versions of the Bleach package are vulnerable to Cross-site Scripting (XSS) due to improper handling of whitelisted tags in the bleach.clean function. The vulnerability exists because the bleach.clean function allows certain raw tags, such as "noscript" and "script", to be whitelisted, which can lead to unintended HTML mutations. An attacker can exploit this by crafting malicious HTML content that includes these tags, potentially executing arbitrary scripts in the context of the user's browser session.
bleach	3.1.0	<3.1.2	show Bleach 3.1.2 includes a fix for CVE-2020-6816: Mutation XSS via whitelisted math or svg and RCDATA tag with strip=False. https://github.com/mozilla/bleach/security/advisories/GHSA-m6xf-fq7q-8743
bleach	3.1.0	<=3.1.3	show Bleach 3.1.4 includes a fix for CVE-2020-6817: bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS). Calls to bleach.clean with an allowed tag with an allowed style attribute are vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).