Safety CI > merlink01/fs.github

pyup-scheduled-update-2024-07-01

8 months, 2 weeks ago

78a133e8

Update mock from 3.0.5 to 5.1.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-07-01

8 months, 2 weeks ago

8f2cc11e

Update coverage from 4.5.4 to 7.5.4

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-07-01

8 months, 2 weeks ago

85823207

Update green from 3.0.0 to 4.0.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-07-01

8 months, 2 weeks ago

8503dc94

Update codecov from 2.0.15 to 2.1.13

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-07-01

8 months, 2 weeks ago

73dc54d1

Update pygments from 2.4.2 to 2.18.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-07-01

8 months, 2 weeks ago

3ebc425c

Update docutils from 0.15.2 to 0.21.2

Pygments 2.4.2 has known security vulnerabilities.

Package

Installed

Affected

Info

Pygments

2.4.2

<2.15.0

show

Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2

Pygments

2.4.2

>=1.5,<2.7.4

show

Pygments 2.7.4 includes a fix for CVE-2021-20270: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

Pygments

2.4.2

>=1.1,<2.7.4

show

Pygments 2.7.4 includes a fix for CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.

pyup-scheduled-update-2024-07-01

8 months, 2 weeks ago

639807ab

Update setuptools from 41.2.0 to 70.1.1

Pygments 2.4.2 has known security vulnerabilities.

Package

Installed

Affected

Info

Pygments

2.4.2

<2.15.0

show

Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2

Pygments

2.4.2

>=1.5,<2.7.4

show

Pygments 2.7.4 includes a fix for CVE-2021-20270: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

Pygments

2.4.2

>=1.1,<2.7.4

show

Pygments 2.7.4 includes a fix for CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.

pyup-scheduled-update-2024-07-01

8 months, 2 weeks ago

269f970f

Update pygithub from 1.43.8 to 2.3.0

Pygments 2.4.2 and setuptools 41.2.0 have known security vulnerabilities.

Package	Installed	Affected	Info
Pygments	2.4.2	<2.15.0	show Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2
Pygments	2.4.2	>=1.5,<2.7.4	show Pygments 2.7.4 includes a fix for CVE-2021-20270: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Pygments	2.4.2	>=1.1,<2.7.4	show Pygments 2.7.4 includes a fix for CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
setuptools	41.2.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	41.2.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

pyup-scheduled-update-2024-07-01

8 months, 2 weeks ago

fcb744e5

Update fs from 2.4.11 to 2.4.16

Pygments 2.4.2 and setuptools 41.2.0 have known security vulnerabilities.

Package	Installed	Affected	Info
Pygments	2.4.2	<2.15.0	show Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2
Pygments	2.4.2	>=1.5,<2.7.4	show Pygments 2.7.4 includes a fix for CVE-2021-20270: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Pygments	2.4.2	>=1.1,<2.7.4	show Pygments 2.7.4 includes a fix for CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
setuptools	41.2.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	41.2.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

pyup-scheduled-update-2024-06-01

9 months, 2 weeks ago

ae1dc5d7

Update mock from 3.0.5 to 5.1.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-06-01

9 months, 2 weeks ago

0d96cfef

Update coverage from 4.5.4 to 7.5.3

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-06-01

9 months, 2 weeks ago

e2ceff7f

Update codecov from 2.0.15 to 2.1.13

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-06-01

9 months, 2 weeks ago

54f9f796

Update green from 3.0.0 to 4.0.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-06-01

9 months, 2 weeks ago

3d807f1e

Update pygments from 2.4.2 to 2.18.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-06-01

9 months, 2 weeks ago

47da0dfd

Update docutils from 0.15.2 to 0.21.2

Pygments 2.4.2 has known security vulnerabilities.

Package

Installed

Affected

Info

Pygments

2.4.2

<2.15.0

show

Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2

Pygments

2.4.2

>=1.5,<2.7.4

show

Pygments 2.7.4 includes a fix for CVE-2021-20270: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

Pygments

2.4.2

>=1.1,<2.7.4

show

Pygments 2.7.4 includes a fix for CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.