Safety CI > dssg/triage

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

Update retrying from 1.3.3 to 1.3.4

scipy 1.8.0, sqlparse 0.4.2 and requests 2.27.1 have known security vulnerabilities.

Package	Installed	Affected	Info
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

c66d583d

Update numpy from 1.22.3 to 1.25.2

scipy 1.8.0, sqlparse 0.4.2 and requests 2.27.1 have known security vulnerabilities.

Package	Installed	Affected	Info
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

4a23dbc7

Update click from 8.1.3 to 8.1.7

scipy 1.8.0, sqlparse 0.4.2 and requests 2.27.1 have known security vulnerabilities.

Package	Installed	Affected	Info
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

6af59669

Update boto3 from 1.22.4 to 1.28.39

scipy 1.8.0, sqlparse 0.4.2 and requests 2.27.1 have known security vulnerabilities.

Package	Installed	Affected	Info
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

9057897e

Update psycopg2-binary from 2.9.3 to 2.9.7

scipy 1.8.0, sqlparse 0.4.2 and requests 2.27.1 have known security vulnerabilities.

Package	Installed	Affected	Info
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

4898a6da

Update pyyaml from 6.0 to 6.0.1

scipy 1.8.0, sqlparse 0.4.2 and requests 2.27.1 have known security vulnerabilities.

Package	Installed	Affected	Info
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

071fa4b0

Update alembic from 1.7.7 to 1.12.0

scipy 1.8.0, sqlparse 0.4.2 and requests 2.27.1 have known security vulnerabilities.

Package	Installed	Affected	Info
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

71dcfc65

Update black from 22.3.0 to 23.7.0

scipy 1.8.0, wheel 0.37.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
wheel	0.37.1	<0.38.1	show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

6286600c

Update wheel from 0.37.1 to 0.41.2

scipy 1.8.0, sqlparse 0.4.2 and requests 2.27.1 have known security vulnerabilities.

Package	Installed	Affected	Info
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

d5728df7

Update mkdocs from 1.3.0 to 1.5.2

scipy 1.8.0, wheel 0.37.1 and 4 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
wheel	0.37.1	<0.38.1	show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.
pymdown-extensions	9.4	>=1.5,<10.0	show Pymdown-extensions 10.0 includes a fix for CVE-2023-32309: In affected versions an arbitrary file read is possible when using include file syntax. Any readable file on the host where the plugin is executing may have its content exposed. This can impact any use of Snippets that exposes the use of Snippets to external users. Users unable to upgrade may restrict relative paths by filtering input. https://github.com/facelessuser/pymdown-extensions/security/advisories/GHSA-jh85-wwv9-24hv
mkdocs-material	8.2.12	<9.5.5	show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b
mkdocs-material	8.2.12	<9.1.13	show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521
mkdocs-material	8.2.12	<9.5.32	show MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

e7daa86a

Update pymdown-extensions from 9.4 to 10.2.1

scipy 1.8.0, wheel 0.37.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
wheel	0.37.1	<0.38.1	show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.
mkdocs-material	8.2.12	<9.5.5	show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b
mkdocs-material	8.2.12	<9.1.13	show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521
mkdocs-material	8.2.12	<9.5.32	show MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

16a9ea05

Update mkdocstrings from 0.18.1 to 0.22.0

scipy 1.8.0, wheel 0.37.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
wheel	0.37.1	<0.38.1	show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

pyup-scheduled-update-2023-09-01

1 year, 11 months ago

7da485b4

Update mkdocs-material from 8.2.12 to 9.2.6

scipy 1.8.0, wheel 0.37.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
wheel	0.37.1	<0.38.1	show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages
sqlparse	0.4.2	>=0.1.15,<0.4.4	show Sqlparse 0.4.4 includes a fix for CVE-2023-30608: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service). https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-rrm6-wvj7-cwh2
sqlparse	0.4.2	<0.5.0	show Sqlparse 0.5.0 addresses a potential denial of service (DoS) vulnerability related to recursion errors in deeply nested SQL statements. To mitigate this issue, the update replaces recursion errors with a general SQLParseError, improving the resilience and stability of the parsing process.
requests	2.27.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.27.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.27.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

postmodeling_revision_2023

2 years ago

0ed9c702

Merge branch 'postmodeling_revision_2023' of https://github.com/dssg/triage into postmodeling_revisi

scipy 1.8.0 and mkdocs-material 8.2.12 have known security vulnerabilities.

Package	Installed	Affected	Info
mkdocs-material	8.2.12	<9.5.5	show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b
mkdocs-material	8.2.12	<9.1.13	show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521
mkdocs-material	8.2.12	<9.5.32	show MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

Package

Installed

Affected

Info

mkdocs-material

8.2.12

<9.5.5

show

Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477.
https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b

mkdocs-material

8.2.12

<9.1.13

show

Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts.
https://github.com/squidfunk/mkdocs-material/issues/5515
https://github.com/squidfunk/mkdocs-material/issues/5521

mkdocs-material

8.2.12

<9.5.32

show

MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

postmodeling_revision_2023

2 years ago

9562fbc8

expand crosstabs to use user specified matrix and predictions table

scipy 1.8.0 and mkdocs-material 8.2.12 have known security vulnerabilities.

Package	Installed	Affected	Info
mkdocs-material	8.2.12	<9.5.5	show Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477. https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b
mkdocs-material	8.2.12	<9.1.13	show Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts. https://github.com/squidfunk/mkdocs-material/issues/5515 https://github.com/squidfunk/mkdocs-material/issues/5521
mkdocs-material	8.2.12	<9.5.32	show MKDocs Material addresses an RXSS vulnerability found in deep links within search results.

Package

Installed

Affected

Info

mkdocs-material

8.2.12

<9.5.5

show

Mkdocs-material 9.5.5 includes a change in its dependency on Pillow. Previously set to approximately version 9.4, it has now been updated to version 10.22. This change was made in response to the security vulnerability identified as CVE-2023-504477.
https://github.com/squidfunk/mkdocs-material/commit/fe11bc0cabd692d37bc4cc4e8034dbe6783ef36b

mkdocs-material

8.2.12

<9.1.13

show

Mkdocs-material 9.1.13 includes a fix for a Race Condition Vulnerability. Social plugin triggers the race condition vulnerability when downloading fonts.
https://github.com/squidfunk/mkdocs-material/issues/5515
https://github.com/squidfunk/mkdocs-material/issues/5521

mkdocs-material

8.2.12

<9.5.32

show

MKDocs Material addresses an RXSS vulnerability found in deep links within search results.