Safety CI > crim-ca/weaver

fix-input-location-for-directory-type

3 years, 4 months ago

e01984e1

Fix import error

No dependencies with known security vulnerabilities.

fix-warnings

3 years, 4 months ago

37258b5e

fix test accept-language execute forwarded to WPS

No dependencies with known security vulnerabilities.

add-weaver-cwl-schemas

3 years, 4 months ago

93af15fb

add custom weaver schema definitions to avoid warnings when loading them in CWL packages

No dependencies with known security vulnerabilities.

fix-warnings

3 years, 4 months ago

e5fc9639

fix/ignore relevant warnings + fix deprecate accept media-type/language best_match method

No dependencies with known security vulnerabilities.

fix-warnings

3 years, 4 months ago

de375a69

Merge branch 'master' into fix-warnings

No dependencies with known security vulnerabilities.

fix-warnings

3 years, 4 months ago

9d41535b

ignore expected warnings by weaver configuration for tests

No dependencies with known security vulnerabilities.

master

3 years, 4 months ago

3dcd6b9c

Merge pull request #527 from crim-ca/update-cwltool update to most recent cwltool version

No dependencies with known security vulnerabilities.

update-cwltool

3 years, 4 months ago

a67a3f1c

update to most recent cwltool version

No dependencies with known security vulnerabilities.

master

3 years, 4 months ago

26bbd79f

Merge pull request #526 from crim-ca/fix-lint fix linting issues

No dependencies with known security vulnerabilities.

fix-lint

3 years, 4 months ago

c09296f2

add geotiff!=0.2.6,!=0.2.7 to avoid issue when attempting to install zarr package (relates to https:

No dependencies with known security vulnerabilities.

fix-lint

3 years, 4 months ago

67fcc6a1

add geotiff!=2.6,!=2.7 to avoid issue when attempting to install zarr package (relates to https://gi

No dependencies with known security vulnerabilities.

fix-lint

3 years, 4 months ago

c56673ef

ignore legacy requirements vulnerabilities

No dependencies with known security vulnerabilities.

fix-lint

3 years, 4 months ago

46660dd8

fix broken documentation references

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

fix-lint

3 years, 4 months ago

db003500

fix linting issues

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.

docker-quoting-estimator

3 years, 4 months ago

9567f148

[wip] fix tests

json2xml 3.18.0 and setuptools 57.5.0 have known security vulnerabilities.

Package	Installed	Affected	Info
json2xml	3.18.0	<3.20.0	show Json2xml 3.20.0 uses SystemRandom as a secure way for generating Random Integers. https://github.com/vinitkumar/json2xml/commit/8a685197b2e36319f1703e0e9cc16f05e389dce7
setuptools	57.5.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.
setuptools	57.5.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	57.5.0	<78.1.1	show Affected versions of Setuptools are vulnerable to Path Traversal via PackageIndex.download(). The impact is Arbitrary File Overwrite: An attacker would be allowed to write files to arbitrary locations on the filesystem with the permissions of the process running the Python code, which could escalate to RCE depending on the context.