Safety CI > hXtreme/tasks3

pyup-update-twine-4.0.2-to-5.1.0

1 day ago

12fd435d

Update twine from 4.0.2 to 5.1.0

pip 23.3 and black 24.2.0 have known security vulnerabilities.

Package	Installed	Affected	Info
pip	23.3	>=0	show DISPUTED An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
black	24.2.0	<24.3.0	show Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file. https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

Package

Installed

Affected

Info

pip

23.3

>=0

show

** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.

black

24.2.0

<24.3.0

show

Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file.	
https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

pyup-update-sqlalchemy-2.0.17-to-2.0.30

1 week, 4 days ago

e6627a96

Update sqlalchemy from 2.0.17 to 2.0.30

pip 23.3 and black 24.2.0 have known security vulnerabilities.

Package	Installed	Affected	Info
pip	23.3	>=0	show DISPUTED An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
black	24.2.0	<24.3.0	show Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file. https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

Package

Installed

Affected

Info

pip

23.3

>=0

show

** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.

black

24.2.0

<24.3.0

show

Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file.	
https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

pyup-update-coverage-7.4.3-to-7.5.1

1 week, 5 days ago

0eb855c4

Update coverage from 7.4.3 to 7.5.1

pip 23.3 and black 24.2.0 have known security vulnerabilities.

Package	Installed	Affected	Info
pip	23.3	>=0	show DISPUTED An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
black	24.2.0	<24.3.0	show Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file. https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

Package

Installed

Affected

Info

pip

23.3

>=0

show

** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.

black

24.2.0

<24.3.0

show

Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file.	
https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

pyup-update-tox-4.6.4-to-4.15.0

2 weeks, 6 days ago

d346a9fe

Update tox from 4.6.4 to 4.15.0

pip 23.3 and black 24.2.0 have known security vulnerabilities.

Package	Installed	Affected	Info
pip	23.3	>=0	show DISPUTED An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
black	24.2.0	<24.3.0	show Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file. https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

Package

Installed

Affected

Info

pip

23.3

>=0

show

** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.

black

24.2.0

<24.3.0

show

Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file.	
https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

pyup-update-black-24.2.0-to-24.4.2

3 weeks ago

f6dd7755

Update black from 24.2.0 to 24.4.2

pip 23.3 has known security vulnerabilities.

Package	Installed	Affected	Info
pip	23.3	>=0	show DISPUTED An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.

Package

Installed

Affected

Info

pip

23.3

>=0

show

** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.

pyup-update-black-24.2.0-to-24.4.1

3 weeks, 2 days ago

d587c9bd

Update black from 24.2.0 to 24.4.1

pip 23.3 has known security vulnerabilities.

Package	Installed	Affected	Info
pip	23.3	>=0	show DISPUTED An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.

Package

Installed

Affected

Info

pip

23.3

>=0

show

** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.

pyup-update-coverage-7.4.3-to-7.5.0

3 weeks, 2 days ago

9dbdd010

Update coverage from 7.4.3 to 7.5.0

pip 23.3 and black 24.2.0 have known security vulnerabilities.

Package	Installed	Affected	Info
pip	23.3	>=0	show DISPUTED An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
black	24.2.0	<24.3.0	show Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file. https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

Package

Installed

Affected

Info

pip

23.3

>=0

show

** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.

black

24.2.0

<24.3.0

show

Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file.	
https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

pyup-update-sphinx-6.2.1-to-7.3.7

4 weeks ago

d62beb4b

Update sphinx from 6.2.1 to 7.3.7

pip 23.3 and black 24.2.0 have known security vulnerabilities.

Package	Installed	Affected	Info
pip	23.3	>=0	show DISPUTED An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
black	24.2.0	<24.3.0	show Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file. https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

Package

Installed

Affected

Info

pip

23.3

>=0

show

** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.

black

24.2.0

<24.3.0

show

Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file.	
https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

pyup-update-sphinx-6.2.1-to-7.3.6

4 weeks, 1 day ago

bba27d81

Update sphinx from 6.2.1 to 7.3.6

pip 23.3 and black 24.2.0 have known security vulnerabilities.

Package	Installed	Affected	Info
pip	23.3	>=0	show DISPUTED An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
black	24.2.0	<24.3.0	show Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file. https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

Package

Installed

Affected

Info

pip

23.3

>=0

show

** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.

black

24.2.0

<24.3.0

show

Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file.	
https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

pyup-update-sphinx-6.2.1-to-7.3.5

1 month ago

04138163

Update sphinx from 6.2.1 to 7.3.5

pip 23.3 and black 24.2.0 have known security vulnerabilities.

Package	Installed	Affected	Info
pip	23.3	>=0	show DISPUTED An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
black	24.2.0	<24.3.0	show Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file. https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

Package

Installed

Affected

Info

pip

23.3

>=0

show

** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.

black

24.2.0

<24.3.0

show

Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file.	
https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

pyup-update-black-24.2.0-to-24.4.0

1 month ago

12dfdf21

Update black from 24.2.0 to 24.4.0

pip 23.3 has known security vulnerabilities.

Package	Installed	Affected	Info
pip	23.3	>=0	show DISPUTED An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.

Package

Installed

Affected

Info

pip

23.3

>=0

show

** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.

pyup-update-sqlalchemy-2.0.17-to-2.0.29

1 month, 3 weeks ago

5da841b0

Update sqlalchemy from 2.0.17 to 2.0.29

black 24.2.0 has known security vulnerabilities.

Package	Installed	Affected	Info
black	24.2.0	<24.3.0	show Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file. https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

Package

Installed

Affected

Info

black

24.2.0

<24.3.0

show

Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file.	
https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

pyup-update-tox-4.6.4-to-4.14.2

1 month, 3 weeks ago

4eac9e12

Update tox from 4.6.4 to 4.14.2

black 24.2.0 has known security vulnerabilities.

Package	Installed	Affected	Info
black	24.2.0	<24.3.0	show Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file. https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

Package

Installed

Affected

Info

black

24.2.0

<24.3.0

show

Black before 24.3.0 have a security vulnerability where specific code formatting patterns could lead to arbitrary code execution. This issue arises from the unsafe handling of AST nodes, potentially allowing an attacker to execute code when Black formats a maliciously crafted Python file.	
https://github.com/psf/black/commit/f00093672628d212b8965a8993cee8bedf5fe9b8

dependabot/pip/black-24.3.0

1 month, 4 weeks ago

897fcfaa

Bump black from 24.2.0 to 24.3.0 Bumps [black](https://github.com/psf/black) from 24.2.0 to 24.3.0.

No dependencies with known security vulnerabilities.

pyup-update-black-24.2.0-to-24.3.0

2 months ago

cf49be38

Update black from 24.2.0 to 24.3.0

No dependencies with known security vulnerabilities.