Safety CI > dssg/triage

master

1 year, 11 months ago

1672a315

using password to push to pypi

scipy 1.8.0 and mkdocs-material 8.2.12 have known security vulnerabilities.

Package	Installed	Affected	Info
mkdocs-material	8.2.12	<9.5.5	show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b
mkdocs-material	8.2.12	<9.1.13	show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521
mkdocs-material	8.2.12	<9.5.32	show MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

Package

Installed

Affected

Info

mkdocs-material

8.2.12

<9.5.5

show

Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477.
https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b

mkdocs-material

8.2.12

<9.1.13

show

Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts.
https://github.com/squidfunk/mkdocs-material/issues/5515
https://github.com/squidfunk/mkdocs-material/issues/5521

mkdocs-material

8.2.12

<9.5.32

show

MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

master

1 year, 11 months ago

3df99267

ussing password for push

scipy 1.8.0 and mkdocs-material 8.2.12 have known security vulnerabilities.

Package	Installed	Affected	Info
mkdocs-material	8.2.12	<9.5.5	show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b
mkdocs-material	8.2.12	<9.1.13	show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521
mkdocs-material	8.2.12	<9.5.32	show MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

Package

Installed

Affected

Info

mkdocs-material

8.2.12

<9.5.5

show

Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477.
https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b

mkdocs-material

8.2.12

<9.1.13

show

Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts.
https://github.com/squidfunk/mkdocs-material/issues/5515
https://github.com/squidfunk/mkdocs-material/issues/5521

mkdocs-material

8.2.12

<9.5.32

show

MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

master

1 year, 11 months ago

0068159d

id-token misspelling

scipy 1.8.0 and mkdocs-material 8.2.12 have known security vulnerabilities.

Package	Installed	Affected	Info
mkdocs-material	8.2.12	<9.5.5	show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b
mkdocs-material	8.2.12	<9.1.13	show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521
mkdocs-material	8.2.12	<9.5.32	show MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

Package

Installed

Affected

Info

mkdocs-material

8.2.12

<9.5.5

show

Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477.
https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b

mkdocs-material

8.2.12

<9.1.13

show

Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts.
https://github.com/squidfunk/mkdocs-material/issues/5515
https://github.com/squidfunk/mkdocs-material/issues/5521

mkdocs-material

8.2.12

<9.5.32

show

MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

master

1 year, 11 months ago

1ad1085d

split build and publish steps

scipy 1.8.0 and mkdocs-material 8.2.12 have known security vulnerabilities.

Package	Installed	Affected	Info
mkdocs-material	8.2.12	<9.5.5	show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b
mkdocs-material	8.2.12	<9.1.13	show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521
mkdocs-material	8.2.12	<9.5.32	show MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

Package

Installed

Affected

Info

mkdocs-material

8.2.12

<9.5.5

show

Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477.
https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b

mkdocs-material

8.2.12

<9.1.13

show

Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts.
https://github.com/squidfunk/mkdocs-material/issues/5515
https://github.com/squidfunk/mkdocs-material/issues/5521

mkdocs-material

8.2.12

<9.5.32

show

MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

master

1 year, 11 months ago

cea5ecf2

steps to publish on pypi

scipy 1.8.0 and mkdocs-material 8.2.12 have known security vulnerabilities.

Package	Installed	Affected	Info
mkdocs-material	8.2.12	<9.5.5	show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b
mkdocs-material	8.2.12	<9.1.13	show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521
mkdocs-material	8.2.12	<9.5.32	show MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

Package

Installed

Affected

Info

mkdocs-material

8.2.12

<9.5.5

show

Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477.
https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b

mkdocs-material

8.2.12

<9.1.13

show

Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts.
https://github.com/squidfunk/mkdocs-material/issues/5515
https://github.com/squidfunk/mkdocs-material/issues/5521

mkdocs-material

8.2.12

<9.5.32

show

MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

master

1 year, 11 months ago

9221c8aa

push to pypi, tag version of triage

scipy 1.8.0 and mkdocs-material 8.2.12 have known security vulnerabilities.

Package	Installed	Affected	Info
mkdocs-material	8.2.12	<9.5.5	show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b
mkdocs-material	8.2.12	<9.1.13	show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521
mkdocs-material	8.2.12	<9.5.32	show MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

Package

Installed

Affected

Info

mkdocs-material

8.2.12

<9.5.5

show

Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477.
https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b

mkdocs-material

8.2.12

<9.1.13

show

Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts.
https://github.com/squidfunk/mkdocs-material/issues/5515
https://github.com/squidfunk/mkdocs-material/issues/5521

mkdocs-material

8.2.12

<9.5.32

show

MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

master

1 year, 11 months ago

b7c78bc0

Merge pull request #934 from dssg/dev Baseline rank multi feature

scipy 1.8.0 and mkdocs-material 8.2.12 have known security vulnerabilities.

Package	Installed	Affected	Info
mkdocs-material	8.2.12	<9.5.5	show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b
mkdocs-material	8.2.12	<9.1.13	show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521
mkdocs-material	8.2.12	<9.5.32	show MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

Package

Installed

Affected

Info

mkdocs-material

8.2.12

<9.5.5

show

Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477.
https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b

mkdocs-material

8.2.12

<9.1.13

show

Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts.
https://github.com/squidfunk/mkdocs-material/issues/5515
https://github.com/squidfunk/mkdocs-material/issues/5521

mkdocs-material

8.2.12

<9.5.32

show

MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

master

1 year, 11 months ago

3cc96c81

Update README.md

scipy 1.8.0, wheel 0.37.1 and 4 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
wheel	0.37.1	<0.38.1	show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.
pymdown-extensions	9.4	>=1.5,<10.0	show Pymdown-extensions 10.0 includes a fix for CVE-2023-32309: In affected versions an arbitrary file read is possible when using include file syntax. Any readable file on the host where the plugin is executing may have its content exposed. This can impact any use of Snippets that exposes the use of Snippets to external users. Users unable to upgrade may restrict relative paths by filtering input. https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-jh85-wwv9-24hv
mkdocs-material	8.2.12	<9.5.5	show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b
mkdocs-material	8.2.12	<9.1.13	show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521
mkdocs-material	8.2.12	<9.5.32	show MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

master

1 year, 11 months ago

5463593c

Update README.md

scipy 1.8.0, wheel 0.37.1 and 4 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
wheel	0.37.1	<0.38.1	show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.
pymdown-extensions	9.4	>=1.5,<10.0	show Pymdown-extensions 10.0 includes a fix for CVE-2023-32309: In affected versions an arbitrary file read is possible when using include file syntax. Any readable file on the host where the plugin is executing may have its content exposed. This can impact any use of Snippets that exposes the use of Snippets to external users. Users unable to upgrade may restrict relative paths by filtering input. https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-jh85-wwv9-24hv
mkdocs-material	8.2.12	<9.5.5	show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b
mkdocs-material	8.2.12	<9.1.13	show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521
mkdocs-material	8.2.12	<9.5.32	show MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

ba4d5ff1

Update tox from 3.25.0 to 4.11.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

95e55835

Update codecov from 2.1.12 to 2.1.13

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

6d8a48a3

Update fakeredis from 1.7.1 to 2.18.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

8509f67e

Update moto from 3.1.7 to 4.2.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

73dd709d

Update flake8 from 4.0.1 to 6.1.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

253b6b0b

Update pytest-cov from 3.0.0 to 4.1.0

No dependencies with known security vulnerabilities.