Safety CI > kthy/uml.cs

main

1 year, 7 months ago

26b4b5e9

Merge pull request #249 from kthy/pyup-scheduled-update-2023-09-25 pyup Scheduled weekly dependency

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-25

1 year, 7 months ago

120e937b

Update gitpython from 3.1.36 to 3.1.37

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-25

1 year, 7 months ago

ccf2c3ba

Update astroid from 2.15.6 to 2.15.7

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-25

1 year, 7 months ago

37794baf

Update pylint from 2.17.5 to 2.17.6

No dependencies with known security vulnerabilities.

main

1 year, 7 months ago

c8289f9e

Merge pull request #248 from kthy/pyup-scheduled-update-2023-09-18 pyup Scheduled weekly dependency

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-18

1 year, 7 months ago

4ef587d6

Update smmap from 5.0.0 to 6.0.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-18

1 year, 7 months ago

b918245d

Update typing-extensions from 4.7.1 to 4.8.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-18

1 year, 7 months ago

98a85a43

Update rich from 13.5.2 to 13.5.3

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-18

1 year, 7 months ago

ce7acf15

Update gitpython from 3.1.35 to 3.1.36

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-18

1 year, 7 months ago

2ab83fd2

Update pytest from 7.4.0 to 7.4.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-18

1 year, 7 months ago

ccee37b5

Update click from 8.1.6 to 8.1.7

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2023-09-18

1 year, 7 months ago

495fc973

Update black from 23.7.0 to 23.9.1

No dependencies with known security vulnerabilities.

main

1 year, 8 months ago

749be23a

Merge pull request #247 from kthy/dependabot/pip/gitpython-3.1.35 Bump gitpython from 3.1.34 to 3.1

No dependencies with known security vulnerabilities.

dependabot/pip/gitpython-3.1.35

1 year, 8 months ago

f20531df

Bump gitpython from 3.1.34 to 3.1.35 Bumps [gitpython](https://github.com/gitpython-developers/GitP

No dependencies with known security vulnerabilities.

main

1 year, 8 months ago

8702322a

Merge pull request #245 from kthy/dependabot/pip/gitpython-3.1.34 Bump gitpython from 3.1.32 to 3.1

gitpython 3.1.34 has known security vulnerabilities.

Package	Installed	Affected	Info
gitpython	3.1.34	<3.1.41	show GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. #It only affects Windows users https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx
gitpython	3.1.34	<3.1.35	show GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.

Package

Installed

Affected

Info

gitpython

3.1.34

<3.1.41

show

GitPython 3.1.41 fixes a vulnerability (CVE-2024-22190) involving an untrusted search path issue on Windows, which could allow execution of malicious git.exe or bash.exe from untrusted repositories. This update addresses the incomplete fix from CVE-2023-40590. 
#It only affects Windows users
https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-2mqj-m65w-jghx

gitpython

3.1.34

<3.1.35

show

GitPython affected versions are vulnerable to Path Traversal (CWE-22). This vulnerability allows an attacker to potentially read arbitrary files from the system, which could lead to information disclosure or denial of service. The attack vector involves manipulating reference names to include path traversal sequences. The vulnerable functionality was in the handling of reference paths, which didn't properly validate user input. The initial fix was implemented with further security improvements in subsequent versions.