Safety CI > aguiardafa/projetopytools

pyup-scheduled-update-2024-01-22

1 year, 8 months ago

2b60f691

Update pyparsing from 3.1.0 to 3.1.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-22

1 year, 8 months ago

b1753f3c

Update pyflakes from 3.0.1 to 3.2.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-22

1 year, 8 months ago

f9f2ecf0

Update pycodestyle from 2.10.0 to 2.11.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-22

1 year, 8 months ago

4fb3281d

Update packaging from 23.1 to 23.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-22

1 year, 8 months ago

abc0b0b6

Update importlib-metadata from 6.7.0 to 7.0.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-22

1 year, 8 months ago

dc9e83f5

Update flake8 from 6.0.0 to 7.0.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-22

1 year, 8 months ago

7158ad1d

Update exceptiongroup from 1.1.1 to 1.2.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-22

1 year, 8 months ago

808e6dec

Update coverage from 7.2.7 to 7.4.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-22

1 year, 8 months ago

55c7431a

Update attrs from 23.1.0 to 23.2.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-22

1 year, 8 months ago

a7a9897e

Update urllib3 from 2.0.3 to 2.1.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-22

1 year, 8 months ago

5e8aee80

Update idna from 3.4 to 3.6

urllib3 2.0.3 has known security vulnerabilities.

Package	Installed	Affected	Info
urllib3	2.0.3	<2.5.0	show urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.
urllib3	2.0.3	<1.26.17 , >=2.0.0a1,<2.0.5	show Urllib3 1.26.17 and 2.0.5 include a fix for CVE-2023-43804: Urllib3 doesn't treat the 'Cookie' HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a 'Cookie' header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f
urllib3	2.0.3	<=1.26.18 , >=2.0.0a1,<=2.2.1	show Urllib3's ProxyManager ensures that the Proxy-Authorization header is correctly directed only to configured proxies. However, when HTTP requests bypass urllib3's proxy support, there's a risk of inadvertently setting the Proxy-Authorization header, which remains ineffective without a forwarding or tunneling proxy. Urllib3 does not recognize this header as carrying authentication data, failing to remove it during cross-origin redirects. While this scenario is uncommon and poses low risk to most users, urllib3 now proactively removes the Proxy-Authorization header during cross-origin redirects as a precautionary measure. Users are advised to utilize urllib3's proxy support or disable automatic redirects to handle the Proxy-Authorization header securely. Despite these precautions, urllib3 defaults to stripping the header to safeguard users who may inadvertently misconfigure requests.
urllib3	2.0.3	<1.26.18 , >=2.0.0a1,<2.0.7	show Affected versions of urllib3 are vulnerable to an HTTP redirect handling vulnerability that fails to remove the HTTP request body when a POST changes to a GET via 301, 302, or 303 responses. This flaw can expose sensitive request data if the origin service is compromised and redirects to a malicious endpoint, though exploitability is low when no sensitive data is used. The vulnerability affects automatic redirect behavior. It is fixed in versions 1.26.18 and 2.0.7; update or disable redirects using redirects=False. This vulnerability is specific to Python's urllib3 library.

pyup-scheduled-update-2024-01-22

1 year, 8 months ago

adef7558

Update chardet from 5.1.0 to 5.2.0

urllib3 2.0.3 has known security vulnerabilities.

Package	Installed	Affected	Info
urllib3	2.0.3	<2.5.0	show urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.
urllib3	2.0.3	<1.26.17 , >=2.0.0a1,<2.0.5	show Urllib3 1.26.17 and 2.0.5 include a fix for CVE-2023-43804: Urllib3 doesn't treat the 'Cookie' HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a 'Cookie' header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f
urllib3	2.0.3	<=1.26.18 , >=2.0.0a1,<=2.2.1	show Urllib3's ProxyManager ensures that the Proxy-Authorization header is correctly directed only to configured proxies. However, when HTTP requests bypass urllib3's proxy support, there's a risk of inadvertently setting the Proxy-Authorization header, which remains ineffective without a forwarding or tunneling proxy. Urllib3 does not recognize this header as carrying authentication data, failing to remove it during cross-origin redirects. While this scenario is uncommon and poses low risk to most users, urllib3 now proactively removes the Proxy-Authorization header during cross-origin redirects as a precautionary measure. Users are advised to utilize urllib3's proxy support or disable automatic redirects to handle the Proxy-Authorization header securely. Despite these precautions, urllib3 defaults to stripping the header to safeguard users who may inadvertently misconfigure requests.
urllib3	2.0.3	<1.26.18 , >=2.0.0a1,<2.0.7	show Affected versions of urllib3 are vulnerable to an HTTP redirect handling vulnerability that fails to remove the HTTP request body when a POST changes to a GET via 301, 302, or 303 responses. This flaw can expose sensitive request data if the origin service is compromised and redirects to a malicious endpoint, though exploitability is low when no sensitive data is used. The vulnerability affects automatic redirect behavior. It is fixed in versions 1.26.18 and 2.0.7; update or disable redirects using redirects=False. This vulnerability is specific to Python's urllib3 library.

pyup-scheduled-update-2024-01-22

1 year, 8 months ago

fc9efd05

Update certifi from 2023.5.7 to 2023.11.17

urllib3 2.0.3 has known security vulnerabilities.

Package	Installed	Affected	Info
urllib3	2.0.3	<2.5.0	show urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.
urllib3	2.0.3	<1.26.17 , >=2.0.0a1,<2.0.5	show Urllib3 1.26.17 and 2.0.5 include a fix for CVE-2023-43804: Urllib3 doesn't treat the 'Cookie' HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a 'Cookie' header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly. https://github.com/urllib3/urllib3/security/advisories/GHSA-v845-jxx5-vc9f
urllib3	2.0.3	<=1.26.18 , >=2.0.0a1,<=2.2.1	show Urllib3's ProxyManager ensures that the Proxy-Authorization header is correctly directed only to configured proxies. However, when HTTP requests bypass urllib3's proxy support, there's a risk of inadvertently setting the Proxy-Authorization header, which remains ineffective without a forwarding or tunneling proxy. Urllib3 does not recognize this header as carrying authentication data, failing to remove it during cross-origin redirects. While this scenario is uncommon and poses low risk to most users, urllib3 now proactively removes the Proxy-Authorization header during cross-origin redirects as a precautionary measure. Users are advised to utilize urllib3's proxy support or disable automatic redirects to handle the Proxy-Authorization header securely. Despite these precautions, urllib3 defaults to stripping the header to safeguard users who may inadvertently misconfigure requests.
urllib3	2.0.3	<1.26.18 , >=2.0.0a1,<2.0.7	show Affected versions of urllib3 are vulnerable to an HTTP redirect handling vulnerability that fails to remove the HTTP request body when a POST changes to a GET via 301, 302, or 303 responses. This flaw can expose sensitive request data if the origin service is compromised and redirects to a malicious endpoint, though exploitability is low when no sensitive data is used. The vulnerability affects automatic redirect behavior. It is fixed in versions 1.26.18 and 2.0.7; update or disable redirects using redirects=False. This vulnerability is specific to Python's urllib3 library.

pyup-scheduled-update-2024-01-15

1 year, 8 months ago

97bc0950

Update zipp from 3.15.0 to 3.17.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-15

1 year, 8 months ago

b87514be

Update wcwidth from 0.2.6 to 0.2.13

No dependencies with known security vulnerabilities.