Safety CI > hXtreme/tasks3

pyup-update-wheel-0.42.0-to-0.43.0

2 years ago

8f632172

Update wheel from 0.42.0 to 0.43.0

No dependencies with known security vulnerabilities.

pyup-update-tox-4.6.4-to-4.14.1

2 years ago

44f35482

Update tox from 4.6.4 to 4.14.1

No dependencies with known security vulnerabilities.

pyup-update-tox-4.6.4-to-4.14.0

2 years ago

dc115001

Update tox from 4.6.4 to 4.14.0

No dependencies with known security vulnerabilities.

pyup-update-sqlalchemy-2.0.17-to-2.0.28

2 years ago

29d2d66b

Update sqlalchemy from 2.0.17 to 2.0.28

No dependencies with known security vulnerabilities.

pyup-update-tox-4.6.4-to-4.13.0

2 years ago

cba4b11b

Merge branch 'master' into pyup-update-tox-4.6.4-to-4.13.0

No dependencies with known security vulnerabilities.

pyup-update-sqlalchemy-2.0.17-to-2.0.27

2 years ago

33003c53

Merge branch 'master' into pyup-update-sqlalchemy-2.0.17-to-2.0.27

No dependencies with known security vulnerabilities.

master

2 years ago

800f962e

Update wheel from 0.38.4 to 0.42.0

No dependencies with known security vulnerabilities.

master

2 years ago

4e9d48f3

Update flake8 from 6.1.0 to 7.0.0

No dependencies with known security vulnerabilities.

master

2 years ago

430c50cd

Update ruamel.yaml from 0.17.32 to 0.18.6

No dependencies with known security vulnerabilities.

master

2 years ago

69ab5e10

Update black from 23.7.0 to 24.2.0

No dependencies with known security vulnerabilities.

master

2 years ago

6beba54a

Update coverage from 7.2.7 to 7.4.3

No dependencies with known security vulnerabilities.

master

2 years ago

bbfdaa8e

Bump pip from 23.2.1 to 23.3 Bumps [pip](https://github.com/pypa/pip) from 23.2.1 to 23.3. - [Chang

No dependencies with known security vulnerabilities.

pyup-update-coverage-7.2.7-to-7.4.3

2 years ago

96f40f32

Update coverage from 7.2.7 to 7.4.3

pip 23.2.1 has known security vulnerabilities.

Package	Installed	Affected	Info
pip	23.2.1	<25.2	show Affected versions of the pip package are vulnerable to Arbitrary File Overwrite due to improper validation of symbolic link targets in the fallback tar extraction code. In src/pip/_internal/utils/unpacking.py, the _untar_without_filter routine used when the Python tarfile module lacks PEP 706 (no tarfile.data_filter) extracted symlink members with tar._extract_member without verifying that link destinations resolve under the extraction root, a check later added via the is_symlink_target_in_tar helper.
pip	23.2.1	<26.0	show Affected versions of the pip package are vulnerable to Path Traversal due to an incorrect directory containment check when extracting wheel archives. In src/pip/_internal/utils/unpacking.py, the is_within_directory() helper used os.path.commonprefix() (character-by-character) to compare directory and target paths, allowing crafted paths like a parent-directory substring match to be treated as safely inside the installation directory.
pip	23.2.1	<23.3	show Affected versions of Pip are vulnerable to Command Injection. When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
pip	23.2.1	<25.0	show Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.

pyup-update-coverage-7.2.7-to-7.4.2

2 years ago

59eb44e9

Update coverage from 7.2.7 to 7.4.2

pip 23.2.1 has known security vulnerabilities.

Package	Installed	Affected	Info
pip	23.2.1	<25.2	show Affected versions of the pip package are vulnerable to Arbitrary File Overwrite due to improper validation of symbolic link targets in the fallback tar extraction code. In src/pip/_internal/utils/unpacking.py, the _untar_without_filter routine used when the Python tarfile module lacks PEP 706 (no tarfile.data_filter) extracted symlink members with tar._extract_member without verifying that link destinations resolve under the extraction root, a check later added via the is_symlink_target_in_tar helper.
pip	23.2.1	<26.0	show Affected versions of the pip package are vulnerable to Path Traversal due to an incorrect directory containment check when extracting wheel archives. In src/pip/_internal/utils/unpacking.py, the is_within_directory() helper used os.path.commonprefix() (character-by-character) to compare directory and target paths, allowing crafted paths like a parent-directory substring match to be treated as safely inside the installation directory.
pip	23.2.1	<23.3	show Affected versions of Pip are vulnerable to Command Injection. When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
pip	23.2.1	<25.0	show Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.

pyup-update-tox-4.6.4-to-4.13.0

2 years ago

beffa825

Update tox from 4.6.4 to 4.13.0

pip 23.2.1 has known security vulnerabilities.

Package	Installed	Affected	Info
pip	23.2.1	<25.2	show Affected versions of the pip package are vulnerable to Arbitrary File Overwrite due to improper validation of symbolic link targets in the fallback tar extraction code. In src/pip/_internal/utils/unpacking.py, the _untar_without_filter routine used when the Python tarfile module lacks PEP 706 (no tarfile.data_filter) extracted symlink members with tar._extract_member without verifying that link destinations resolve under the extraction root, a check later added via the is_symlink_target_in_tar helper.
pip	23.2.1	<26.0	show Affected versions of the pip package are vulnerable to Path Traversal due to an incorrect directory containment check when extracting wheel archives. In src/pip/_internal/utils/unpacking.py, the is_within_directory() helper used os.path.commonprefix() (character-by-character) to compare directory and target paths, allowing crafted paths like a parent-directory substring match to be treated as safely inside the installation directory.
pip	23.2.1	<23.3	show Affected versions of Pip are vulnerable to Command Injection. When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
pip	23.2.1	<25.0	show Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.