Safety CI > griff-rees/ukboards

pyup-update-tox-4.5.1-to-4.6.4

2 years, 1 month ago

58e14bed

Update tox from 4.5.1 to 4.6.4

No dependencies with known security vulnerabilities.

dependabot/pip/pytest-cov-4.1.0

2 years, 1 month ago

7735bdbf

Bump pytest-cov from 4.0.0 to 4.1.0 Bumps [pytest-cov](https://github.com/pytest-dev/pytest-cov) fr

No dependencies with known security vulnerabilities.

dependabot/pip/watchdog-3.0.0

2 years, 1 month ago

a8ec2e11

Bump watchdog from 2.2.1 to 3.0.0 Bumps [watchdog](https://github.com/gorakhargosh/watchdog) from 2

No dependencies with known security vulnerabilities.

dependabot/pip/sphinx-7.0.1

2 years, 1 month ago

04be76bc

Bump sphinx from 6.1.3 to 7.0.1 Bumps [sphinx](https://github.com/sphinx-doc/sphinx) from 6.1.3 to

No dependencies with known security vulnerabilities.

dependabot/pip/pytest-7.4.0

2 years, 1 month ago

dae39e98

Bump pytest from 7.3.1 to 7.4.0 Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.3.1 to

No dependencies with known security vulnerabilities.

dependabot/pip/pytest-sugar-0.9.7

2 years, 1 month ago

b33ad365

Bump pytest-sugar from 0.9.6 to 0.9.7 Bumps [pytest-sugar](https://github.com/Teemu/pytest-sugar) f

No dependencies with known security vulnerabilities.

pyup-update-pytest-7.3.1-to-7.4.0

2 years, 1 month ago

4252c869

Update pytest from 7.3.1 to 7.4.0

No dependencies with known security vulnerabilities.

pyup-update-tox-4.5.1-to-4.6.3

2 years, 1 month ago

4d6e4f7d

Update tox from 4.5.1 to 4.6.3

No dependencies with known security vulnerabilities.

pyup-update-pytest-7.3.1-to-7.3.2

2 years, 1 month ago

583f6da9

Update pytest from 7.3.1 to 7.3.2

No dependencies with known security vulnerabilities.

main

2 years, 1 month ago

028a118f

Merge pull request #503 from griff-rees/dependabot/pip/requests-2.31.0 Bump requests from 2.28.1 to

No dependencies with known security vulnerabilities.

main

2 years, 1 month ago

87402318

Merge pull request #493 from griff-rees/dependabot/pip/tox-4.5.1 Bump tox from 4.4.5 to 4.5.1

requests 2.28.1 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.28.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.28.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.28.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

Package

Installed

Affected

Info

requests

2.28.1

<2.32.4

show

Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

requests

2.28.1

<2.32.2

show

Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

requests

2.28.1

>=2.3.0,<2.31.0

show

Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

main

2 years, 1 month ago

564c29f5

Merge pull request #480 from griff-rees/dependabot/pip/pytest-7.3.1 Bump pytest from 7.2.0 to 7.3.1

requests 2.28.1 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.28.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.28.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.28.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

Package

Installed

Affected

Info

requests

2.28.1

<2.32.4

show

Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

requests

2.28.1

<2.32.2

show

Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

requests

2.28.1

>=2.3.0,<2.31.0

show

Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

dependabot/pip/requests-2.31.0

2 years, 1 month ago

30631a92

Bump requests from 2.28.1 to 2.31.0 Bumps [requests](https://github.com/psf/requests) from 2.28.1 t

No dependencies with known security vulnerabilities.

main

2 years, 1 month ago

c30b75b4

Merge pull request #492 from griff-rees/dependabot/pip/pip-23.1.2 Bump pip from 23.0 to 23.1.2

requests 2.28.1 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.28.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.28.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.28.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

Package

Installed

Affected

Info

requests

2.28.1

<2.32.4

show

Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

requests

2.28.1

<2.32.2

show

Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

requests

2.28.1

>=2.3.0,<2.31.0

show

Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

main

2 years, 1 month ago

0db68ed0

Merge pull request #454 from griff-rees/dependabot/pip/python-dotenv-1.0.0 Bump python-dotenv from

requests 2.28.1 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.28.1	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.
requests	2.28.1	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.28.1	>=2.3.0,<2.31.0	show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.

Package

Installed

Affected

Info

requests

2.28.1

<2.32.4

show

Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

requests

2.28.1

<2.32.2

show

Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

requests

2.28.1

>=2.3.0,<2.31.0

show

Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information.