Safety CI > aguiardafa/projeto-base-stack-django

pyup-scheduled-update-2025-06-09

3 months, 3 weeks ago

d099e0a1

Update typing-extensions from 4.13.2 to 4.14.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2025-06-09

3 months, 3 weeks ago

57942ba9

Update setuptools from 80.3.1 to 80.9.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2025-06-09

3 months, 3 weeks ago

1ddc9987

Update django from 5.2 to 5.2.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2025-06-09

3 months, 3 weeks ago

fe1d3ddd

Update dj-database-url from 2.3.0 to 3.0.0

django 5.2 has known security vulnerabilities.

Package	Installed	Affected	Info
django	5.2	>=5.2,<5.2.2 , >=5.0a1,<5.1.10 , <4.2.22	show An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
django	5.2	<4.2.21 , >=5.2a1,<5.2.1 , >=5.1.0a1,<5.1.9	show An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().

Package

Installed

Affected

Info

django

5.2

>=5.2,<5.2.2 , >=5.0a1,<5.1.10 , <4.2.22

show

An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.

django

5.2

<4.2.21 , >=5.2a1,<5.2.1 , >=5.1.0a1,<5.1.9

show

An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1. The django.utils.html.strip_tags() function is vulnerable to a potential denial-of-service (slow performance) when processing inputs containing large sequences of incomplete HTML tags. The template filter striptags is also vulnerable, because it is built on top of strip_tags().

pyup-scheduled-update-2025-05-12

4 months, 3 weeks ago

dea16741

Update setuptools from 80.3.1 to 80.4.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2025-05-12

4 months, 3 weeks ago

cd35953c

Update django from 5.2 to 5.2.1

No dependencies with known security vulnerabilities.

main

4 months, 3 weeks ago

7013a9e0

Merge pull request #171 from aguiardafa/pyup-scheduled-update-2025-05-05 Scheduled weekly dependenc

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2025-05-05

4 months, 4 weeks ago

f626d14d

Update typing-extensions from 4.12.2 to 4.13.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2025-05-05

4 months, 4 weeks ago

596bc2de

Update sqlparse from 0.5.2 to 0.5.3

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2025-05-05

4 months, 4 weeks ago

b9ac70ac

Update pyflakes from 3.2.0 to 3.3.2

setuptools 75.5.0 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	75.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Package

Installed

Affected

Info

setuptools

75.5.0

<78.1.1

show

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

pyup-scheduled-update-2025-05-05

4 months, 4 weeks ago

3510995e

Update setuptools from 75.5.0 to 80.3.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2025-05-05

4 months, 4 weeks ago

73b86445

Update pycodestyle from 2.12.1 to 2.13.0

setuptools 75.5.0 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	75.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Package

Installed

Affected

Info

setuptools

75.5.0

<78.1.1

show

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

pyup-scheduled-update-2025-05-05

4 months, 4 weeks ago

c5d8883f

Update pillow from 11.0.0 to 11.2.1

setuptools 75.5.0 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	75.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Package

Installed

Affected

Info

setuptools

75.5.0

<78.1.1

show

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

pyup-scheduled-update-2025-05-05

4 months, 4 weeks ago

4b5a5055

Update flake8 from 7.1.1 to 7.2.0

setuptools 75.5.0 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	75.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Package

Installed

Affected

Info

setuptools

75.5.0

<78.1.1

show

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

pyup-scheduled-update-2025-05-05

4 months, 4 weeks ago

3bc8f11f

Update django-storages from 1.14.4 to 1.14.6

setuptools 75.5.0 has known security vulnerabilities.

Package	Installed	Affected	Info
setuptools	75.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

Package

Installed

Affected

Info

setuptools

75.5.0

<78.1.1

show

Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.