Safety CI > NeonGraal/script-venv

pyup-update-pytest-8.1.1-to-8.2.0

2 years, 6 months ago

e5171bd2

Update pytest from 8.1.1 to 8.2.0

No dependencies with known security vulnerabilities.

pyup-update-pytest-8.1.1-to-8.1.2

2 years, 6 months ago

cd2346d9

Merge branch 'master' into pyup-update-pytest-8.1.1-to-8.1.2

No dependencies with known security vulnerabilities.

master

2 years, 6 months ago

fb979d07

Merge pull request #1044 from NeonGraal/pyup-update-tox-4.14.2-to-4.15.0 Update tox to 4.15.0

No dependencies with known security vulnerabilities.

pyup-update-pytest-8.1.1-to-8.1.2

2 years, 6 months ago

12f56b94

Update pytest from 8.1.1 to 8.1.2

No dependencies with known security vulnerabilities.

pyup-update-tox-4.14.2-to-4.15.0

2 years, 6 months ago

dba57d8e

Update tox from 4.14.2 to 4.15.0

No dependencies with known security vulnerabilities.

master

2 years, 6 months ago

5521f64a

Merge pull request #1042 from NeonGraal/pyup-update-click-8.1.6-to-8.1.7 Update click from 8.1.6 to

No dependencies with known security vulnerabilities.

pyup-update-click-8.1.6-to-8.1.7

2 years, 6 months ago

a496abc9

Merge branch 'master' into pyup-update-click-8.1.6-to-8.1.7

No dependencies with known security vulnerabilities.

master

2 years, 6 months ago

eda6f05c

Merge pull request #1039 from NeonGraal/pyup-update-types-setuptools-69.5.0.20240415-to-69.5.0.20240

No dependencies with known security vulnerabilities.

pyup-update-click-8.1.6-to-8.1.7

2 years, 6 months ago

b156ccac

Merge branch 'master' into pyup-update-click-8.1.6-to-8.1.7

No dependencies with known security vulnerabilities.

pyup-update-types-setuptools-69.5.0.20240415-to-69.5.0.20240423

2 years, 6 months ago

fb0c68e1

Merge branch 'master' into pyup-update-types-setuptools-69.5.0.20240415-to-69.5.0.20240423

No dependencies with known security vulnerabilities.

master

2 years, 6 months ago

3ec2b62d

Merge pull request #1041 from NeonGraal/pyup-update-mypy-1.9.0-to-1.10.0 Update mypy to 1.10.0

No dependencies with known security vulnerabilities.

pyup-update-mypy-1.9.0-to-1.10.0

2 years, 6 months ago

b2d20193

Ignore pip from pyup bot

No dependencies with known security vulnerabilities.

pyup-update-mypy-1.9.0-to-1.10.0

2 years, 6 months ago

f012926d

Update mypy from 1.9.0 to 1.10.0

pip 24.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pip	24.0	<26.0	show Affected versions of the pip package are vulnerable to Path Traversal due to an incorrect directory containment check when extracting wheel archives. In src/pip/_internal/utils/unpacking.py, the is_within_directory() helper used os.path.commonprefix() (character-by-character) to compare directory and target paths, allowing crafted paths like a parent-directory substring match to be treated as safely inside the installation directory.
pip	24.0	<25.2	show Affected versions of the pip package are vulnerable to Arbitrary File Overwrite due to improper validation of symbolic link targets in the fallback tar extraction code. In src/pip/_internal/utils/unpacking.py, the _untar_without_filter routine used when the Python tarfile module lacks PEP 706 (no tarfile.data_filter) extracted symlink members with tar._extract_member without verifying that link destinations resolve under the extraction root, a check later added via the is_symlink_target_in_tar helper.
pip	24.0	<25.0	show Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.

Package

Installed

Affected

Info

pip

24.0

<26.0

show

Affected versions of the pip package are vulnerable to Path Traversal due to an incorrect directory containment check when extracting wheel archives. In src/pip/_internal/utils/unpacking.py, the is_within_directory() helper used os.path.commonprefix() (character-by-character) to compare directory and target paths, allowing crafted paths like a parent-directory substring match to be treated as safely inside the installation directory.

pip

24.0

<25.2

show

Affected versions of the pip package are vulnerable to Arbitrary File Overwrite due to improper validation of symbolic link targets in the fallback tar extraction code. In src/pip/_internal/utils/unpacking.py, the _untar_without_filter routine used when the Python tarfile module lacks PEP 706 (no tarfile.data_filter) extracted symlink members with tar._extract_member without verifying that link destinations resolve under the extraction root, a check later added via the is_symlink_target_in_tar helper.

pip

24.0

<25.0

show

Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.

master

2 years, 6 months ago

5e980fcd

Merge pull request #1040 from NeonGraal/pyup-update-coverage-7.4.4-to-7.5.0 Update coverage to 7.5.

pip 24.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pip	24.0	<26.0	show Affected versions of the pip package are vulnerable to Path Traversal due to an incorrect directory containment check when extracting wheel archives. In src/pip/_internal/utils/unpacking.py, the is_within_directory() helper used os.path.commonprefix() (character-by-character) to compare directory and target paths, allowing crafted paths like a parent-directory substring match to be treated as safely inside the installation directory.
pip	24.0	<25.2	show Affected versions of the pip package are vulnerable to Arbitrary File Overwrite due to improper validation of symbolic link targets in the fallback tar extraction code. In src/pip/_internal/utils/unpacking.py, the _untar_without_filter routine used when the Python tarfile module lacks PEP 706 (no tarfile.data_filter) extracted symlink members with tar._extract_member without verifying that link destinations resolve under the extraction root, a check later added via the is_symlink_target_in_tar helper.
pip	24.0	<25.0	show Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.

Package

Installed

Affected

Info

pip

24.0

<26.0

show

Affected versions of the pip package are vulnerable to Path Traversal due to an incorrect directory containment check when extracting wheel archives. In src/pip/_internal/utils/unpacking.py, the is_within_directory() helper used os.path.commonprefix() (character-by-character) to compare directory and target paths, allowing crafted paths like a parent-directory substring match to be treated as safely inside the installation directory.

pip

24.0

<25.2

show

Affected versions of the pip package are vulnerable to Arbitrary File Overwrite due to improper validation of symbolic link targets in the fallback tar extraction code. In src/pip/_internal/utils/unpacking.py, the _untar_without_filter routine used when the Python tarfile module lacks PEP 706 (no tarfile.data_filter) extracted symlink members with tar._extract_member without verifying that link destinations resolve under the extraction root, a check later added via the is_symlink_target_in_tar helper.

pip

24.0

<25.0

show

Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.

pyup-update-coverage-7.4.4-to-7.5.0

2 years, 6 months ago

993b859c

Update coverage from 7.4.4 to 7.5.0

pip 24.0 has known security vulnerabilities.

Package	Installed	Affected	Info
pip	24.0	<26.0	show Affected versions of the pip package are vulnerable to Path Traversal due to an incorrect directory containment check when extracting wheel archives. In src/pip/_internal/utils/unpacking.py, the is_within_directory() helper used os.path.commonprefix() (character-by-character) to compare directory and target paths, allowing crafted paths like a parent-directory substring match to be treated as safely inside the installation directory.
pip	24.0	<25.2	show Affected versions of the pip package are vulnerable to Arbitrary File Overwrite due to improper validation of symbolic link targets in the fallback tar extraction code. In src/pip/_internal/utils/unpacking.py, the _untar_without_filter routine used when the Python tarfile module lacks PEP 706 (no tarfile.data_filter) extracted symlink members with tar._extract_member without verifying that link destinations resolve under the extraction root, a check later added via the is_symlink_target_in_tar helper.
pip	24.0	<25.0	show Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.

Package

Installed

Affected

Info

pip

24.0

<26.0

show

Affected versions of the pip package are vulnerable to Path Traversal due to an incorrect directory containment check when extracting wheel archives. In src/pip/_internal/utils/unpacking.py, the is_within_directory() helper used os.path.commonprefix() (character-by-character) to compare directory and target paths, allowing crafted paths like a parent-directory substring match to be treated as safely inside the installation directory.

pip

24.0

<25.2

show

Affected versions of the pip package are vulnerable to Arbitrary File Overwrite due to improper validation of symbolic link targets in the fallback tar extraction code. In src/pip/_internal/utils/unpacking.py, the _untar_without_filter routine used when the Python tarfile module lacks PEP 706 (no tarfile.data_filter) extracted symlink members with tar._extract_member without verifying that link destinations resolve under the extraction root, a check later added via the is_symlink_target_in_tar helper.

pip

24.0

<25.0

show

Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.