pyup-update-bandit-1.4.0-to-1.7.5
2 years, 4 months ago
Update bandit from 1.4.0 to 1.7.5
Sphinx 1.8.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
pyup-update-mypy-0.630-to-1.1.1
2 years, 4 months ago
Update mypy from 0.630 to 1.1.1
bandit 1.4.0, Sphinx 1.8.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bandit | 1.4.0 | <1.7.7 |
show Bandit 1.7.7 identifies the str.replace method as a potential risk for SQL injection because it can be misused in constructing SQL queries, potentially enabling the execution of arbitrary SQL code. https://github.com/PyCQA/bandit/pull/1044/commits/d909043ba20853c90a7cad4a5b58a180f6937bf8 |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
pyup-update-pytest-3.6.1-to-7.2.2
2 years, 4 months ago
Update pytest from 3.6.1 to 7.2.2
bandit 1.4.0, Sphinx 1.8.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bandit | 1.4.0 | <1.7.7 |
show Bandit 1.7.7 identifies the str.replace method as a potential risk for SQL injection because it can be misused in constructing SQL queries, potentially enabling the execution of arbitrary SQL code. https://github.com/PyCQA/bandit/pull/1044/commits/d909043ba20853c90a7cad4a5b58a180f6937bf8 |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
pyup-update-watchdog-0.9.0-to-2.3.1
2 years, 5 months ago
Update watchdog from 0.9.0 to 2.3.1
bandit 1.4.0, Sphinx 1.8.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bandit | 1.4.0 | <1.7.7 |
show Bandit 1.7.7 identifies the str.replace method as a potential risk for SQL injection because it can be misused in constructing SQL queries, potentially enabling the execution of arbitrary SQL code. https://github.com/PyCQA/bandit/pull/1044/commits/d909043ba20853c90a7cad4a5b58a180f6937bf8 |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
pyup-update-coverage-4.5.1-to-7.2.1
2 years, 5 months ago
Update coverage from 4.5.1 to 7.2.1
bandit 1.4.0, Sphinx 1.8.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bandit | 1.4.0 | <1.7.7 |
show Bandit 1.7.7 identifies the str.replace method as a potential risk for SQL injection because it can be misused in constructing SQL queries, potentially enabling the execution of arbitrary SQL code. https://github.com/PyCQA/bandit/pull/1044/commits/d909043ba20853c90a7cad4a5b58a180f6937bf8 |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
pyup-update-watchdog-0.9.0-to-2.3.0
2 years, 5 months ago
Update watchdog from 0.9.0 to 2.3.0
bandit 1.4.0, Sphinx 1.8.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bandit | 1.4.0 | <1.7.7 |
show Bandit 1.7.7 identifies the str.replace method as a potential risk for SQL injection because it can be misused in constructing SQL queries, potentially enabling the execution of arbitrary SQL code. https://github.com/PyCQA/bandit/pull/1044/commits/d909043ba20853c90a7cad4a5b58a180f6937bf8 |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
pyup-update-coverage-4.5.1-to-7.2.0
2 years, 5 months ago
Update coverage from 4.5.1 to 7.2.0
bandit 1.4.0, Sphinx 1.8.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bandit | 1.4.0 | <1.7.7 |
show Bandit 1.7.7 identifies the str.replace method as a potential risk for SQL injection because it can be misused in constructing SQL queries, potentially enabling the execution of arbitrary SQL code. https://github.com/PyCQA/bandit/pull/1044/commits/d909043ba20853c90a7cad4a5b58a180f6937bf8 |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
pyup-update-mypy-0.630-to-1.0.1
2 years, 5 months ago
Update mypy from 0.630 to 1.0.1
bandit 1.4.0, Sphinx 1.8.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bandit | 1.4.0 | <1.7.7 |
show Bandit 1.7.7 identifies the str.replace method as a potential risk for SQL injection because it can be misused in constructing SQL queries, potentially enabling the execution of arbitrary SQL code. https://github.com/PyCQA/bandit/pull/1044/commits/d909043ba20853c90a7cad4a5b58a180f6937bf8 |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
pyup-update-sphinx-rtd-theme-0.4.1-to-1.2.0
2 years, 5 months ago
Update sphinx-rtd-theme from 0.4.1 to 1.2.0
bandit 1.4.0, Sphinx 1.8.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bandit | 1.4.0 | <1.7.7 |
show Bandit 1.7.7 identifies the str.replace method as a potential risk for SQL injection because it can be misused in constructing SQL queries, potentially enabling the execution of arbitrary SQL code. https://github.com/PyCQA/bandit/pull/1044/commits/d909043ba20853c90a7cad4a5b58a180f6937bf8 |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
pyup-update-mypy-0.630-to-1.0.0
2 years, 5 months ago
Update mypy from 0.630 to 1.0.0
bandit 1.4.0, Sphinx 1.8.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bandit | 1.4.0 | <1.7.7 |
show Bandit 1.7.7 identifies the str.replace method as a potential risk for SQL injection because it can be misused in constructing SQL queries, potentially enabling the execution of arbitrary SQL code. https://github.com/PyCQA/bandit/pull/1044/commits/d909043ba20853c90a7cad4a5b58a180f6937bf8 |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
pyup-update-mypy-0.630-to-0.982
2 years, 9 months ago
Update mypy from 0.630 to 0.982
bandit 1.4.0, Sphinx 1.8.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bandit | 1.4.0 | <1.7.7 |
show Bandit 1.7.7 identifies the str.replace method as a potential risk for SQL injection because it can be misused in constructing SQL queries, potentially enabling the execution of arbitrary SQL code. https://github.com/PyCQA/bandit/pull/1044/commits/d909043ba20853c90a7cad4a5b58a180f6937bf8 |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
pyup-update-sphinx-1.8.0-to-5.2.3
2 years, 10 months ago
Update sphinx from 1.8.0 to 5.2.3
bandit 1.4.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bandit | 1.4.0 | <1.7.7 |
show Bandit 1.7.7 identifies the str.replace method as a potential risk for SQL injection because it can be misused in constructing SQL queries, potentially enabling the execution of arbitrary SQL code. https://github.com/PyCQA/bandit/pull/1044/commits/d909043ba20853c90a7cad4a5b58a180f6937bf8 |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
pyup-update-coverage-4.5.1-to-6.5.0
2 years, 10 months ago
Update coverage from 4.5.1 to 6.5.0
bandit 1.4.0, Sphinx 1.8.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bandit | 1.4.0 | <1.7.7 |
show Bandit 1.7.7 identifies the str.replace method as a potential risk for SQL injection because it can be misused in constructing SQL queries, potentially enabling the execution of arbitrary SQL code. https://github.com/PyCQA/bandit/pull/1044/commits/d909043ba20853c90a7cad4a5b58a180f6937bf8 |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
pyup-update-pytest-cov-2.6.0-to-4.0.0
2 years, 10 months ago
Update pytest-cov from 2.6.0 to 4.0.0
bandit 1.4.0, Sphinx 1.8.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bandit | 1.4.0 | <1.7.7 |
show Bandit 1.7.7 identifies the str.replace method as a potential risk for SQL injection because it can be misused in constructing SQL queries, potentially enabling the execution of arbitrary SQL code. https://github.com/PyCQA/bandit/pull/1044/commits/d909043ba20853c90a7cad4a5b58a180f6937bf8 |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.8.0 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| Sphinx | 1.8.0 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
pyup-update-sphinx-1.8.0-to-5.2.2
2 years, 10 months ago
Update sphinx from 1.8.0 to 5.2.2
bandit 1.4.0 and requests 2.18.4 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| bandit | 1.4.0 | <1.7.7 |
show Bandit 1.7.7 identifies the str.replace method as a potential risk for SQL injection because it can be misused in constructing SQL queries, potentially enabling the execution of arbitrary SQL code. https://github.com/PyCQA/bandit/pull/1044/commits/d909043ba20853c90a7cad4a5b58a180f6937bf8 |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| bandit | 1.4.0 | <1.6.3 |
show Bandit 1.6.3 updates its dependency 'pyyaml' to v5.3.1 to include security fixes. |
| requests | 2.18.4 | <2.32.4 |
show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session. |
| requests | 2.18.4 | <2.32.2 |
show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. |
| requests | 2.18.4 | <=2.19.1 |
show Requests before 2.20.0 sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network. |
| requests | 2.18.4 | >=2.3.0,<2.31.0 |
show Affected versions of Requests are vulnerable to proxy credential leakage. When redirected to an HTTPS endpoint, the Proxy-Authorization header is forwarded to the destination server due to the use of rebuild_proxies to reattach the header. This may allow a malicious actor to exfiltrate sensitive information. |
Python 3 badge
URL
https://pyup.io/repos/github/inplat/aioapp-project-template/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/inplat/aioapp-project-template/)
Restructured Text
.. image:: https://pyup.io/repos/github/inplat/aioapp-project-template/python-3-shield.svg
:target: https://pyup.io/repos/github/inplat/aioapp-project-template/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/inplat/aioapp-project-template/"><img src="https://pyup.io/repos/github/inplat/aioapp-project-template/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/inplat/aioapp-project-template/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/inplat/aioapp-project-template/
RDoc
{<img src="https://pyup.io/repos/github/inplat/aioapp-project-template/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/inplat/aioapp-project-template/]
pyup.io badge
URL
https://pyup.io/repos/github/inplat/aioapp-project-template/shield.svg
Markdown
[](https://pyup.io/repos/github/inplat/aioapp-project-template/)
Restructured Text
.. image:: https://pyup.io/repos/github/inplat/aioapp-project-template/shield.svg
:target: https://pyup.io/repos/github/inplat/aioapp-project-template/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/inplat/aioapp-project-template/"><img src="https://pyup.io/repos/github/inplat/aioapp-project-template/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/inplat/aioapp-project-template/shield.svg(Updates)!:https://pyup.io/repos/github/inplat/aioapp-project-template/
RDoc
{<img src="https://pyup.io/repos/github/inplat/aioapp-project-template/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/inplat/aioapp-project-template/]