Safety CI > merlink01/fs.github

pyup-scheduled-update-2024-04-01

11 months, 2 weeks ago

28cac233

Update codecov from 2.0.15 to 2.1.13

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-04-01

11 months, 2 weeks ago

1d87285d

Update pygments from 2.4.2 to 2.17.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-04-01

11 months, 2 weeks ago

d6fad5b9

Update docutils from 0.15.2 to 0.20.1

Pygments 2.4.2 has known security vulnerabilities.

Package

Installed

Affected

Info

Pygments

2.4.2

<2.15.0

show

Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2

Pygments

2.4.2

>=1.5,<2.7.4

show

Pygments 2.7.4 includes a fix for CVE-2021-20270: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

Pygments

2.4.2

>=1.1,<2.7.4

show

Pygments 2.7.4 includes a fix for CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.

pyup-scheduled-update-2024-04-01

11 months, 2 weeks ago

07a44635

Update setuptools from 41.2.0 to 69.2.0

Pygments 2.4.2 has known security vulnerabilities.

Package

Installed

Affected

Info

Pygments

2.4.2

<2.15.0

show

Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2

Pygments

2.4.2

>=1.5,<2.7.4

show

Pygments 2.7.4 includes a fix for CVE-2021-20270: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

Pygments

2.4.2

>=1.1,<2.7.4

show

Pygments 2.7.4 includes a fix for CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.

pyup-scheduled-update-2024-04-01

11 months, 2 weeks ago

1f1645eb

Update pygithub from 1.43.8 to 2.3.0

Pygments 2.4.2 and setuptools 41.2.0 have known security vulnerabilities.

Package	Installed	Affected	Info
Pygments	2.4.2	<2.15.0	show Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2
Pygments	2.4.2	>=1.5,<2.7.4	show Pygments 2.7.4 includes a fix for CVE-2021-20270: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Pygments	2.4.2	>=1.1,<2.7.4	show Pygments 2.7.4 includes a fix for CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
setuptools	41.2.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	41.2.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

pyup-scheduled-update-2024-04-01

11 months, 2 weeks ago

ceafae0e

Update fs from 2.4.11 to 2.4.16

Pygments 2.4.2 and setuptools 41.2.0 have known security vulnerabilities.

Package	Installed	Affected	Info
Pygments	2.4.2	<2.15.0	show Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2
Pygments	2.4.2	>=1.5,<2.7.4	show Pygments 2.7.4 includes a fix for CVE-2021-20270: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Pygments	2.4.2	>=1.1,<2.7.4	show Pygments 2.7.4 includes a fix for CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
setuptools	41.2.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	41.2.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

pyup-scheduled-update-2024-03-01

1 year ago

d14dd666

Update green from 3.0.0 to 4.0.1

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-03-01

1 year ago

88ae1ab6

Update docutils from 0.15.2 to 0.20.1

Pygments 2.4.2 has known security vulnerabilities.

Package

Installed

Affected

Info

Pygments

2.4.2

<2.15.0

show

Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2

Pygments

2.4.2

>=1.5,<2.7.4

show

Pygments 2.7.4 includes a fix for CVE-2021-20270: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

Pygments

2.4.2

>=1.1,<2.7.4

show

Pygments 2.7.4 includes a fix for CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.

pyup-scheduled-update-2024-03-01

1 year ago

a94e25bf

Update mock from 3.0.5 to 5.1.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-03-01

1 year ago

1f5f0947

Update coverage from 4.5.4 to 7.4.3

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-03-01

1 year ago

8df394c8

Update codecov from 2.0.15 to 2.1.13

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-03-01

1 year ago

0ef8e56f

Update pygments from 2.4.2 to 2.17.2

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-03-01

1 year ago

51c3f5e3

Update setuptools from 41.2.0 to 69.1.1

Pygments 2.4.2 has known security vulnerabilities.

Package

Installed

Affected

Info

Pygments

2.4.2

<2.15.0

show

Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application.
https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2

Pygments

2.4.2

>=1.5,<2.7.4

show

Pygments 2.7.4 includes a fix for CVE-2021-20270: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.

Pygments

2.4.2

>=1.1,<2.7.4

show

Pygments 2.7.4 includes a fix for CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.

pyup-scheduled-update-2024-03-01

1 year ago

0f8cee62

Update pygithub from 1.43.8 to 2.2.0

Pygments 2.4.2 and setuptools 41.2.0 have known security vulnerabilities.

Package	Installed	Affected	Info
Pygments	2.4.2	<2.15.0	show Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2
Pygments	2.4.2	>=1.5,<2.7.4	show Pygments 2.7.4 includes a fix for CVE-2021-20270: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Pygments	2.4.2	>=1.1,<2.7.4	show Pygments 2.7.4 includes a fix for CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
setuptools	41.2.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	41.2.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.

pyup-scheduled-update-2024-03-01

1 year ago

f6f0c342

Update fs from 2.4.11 to 2.4.16

Pygments 2.4.2 and setuptools 41.2.0 have known security vulnerabilities.

Package	Installed	Affected	Info
Pygments	2.4.2	<2.15.0	show Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2
Pygments	2.4.2	>=1.5,<2.7.4	show Pygments 2.7.4 includes a fix for CVE-2021-20270: An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the "exception" keyword.
Pygments	2.4.2	>=1.1,<2.7.4	show Pygments 2.7.4 includes a fix for CVE-2021-27291: In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions. Some of the regular expressions have exponential or cubic worst-case complexity and are vulnerable to ReDoS. By crafting malicious input, an attacker can cause a denial of service.
setuptools	41.2.0	<70.0.0	show Affected versions of Setuptools allow for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system.
setuptools	41.2.0	<65.5.1	show Setuptools 65.5.1 includes a fix for CVE-2022-40897: Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom PackageIndex page. There is a Regular Expression Denial of Service (ReDoS) in package_index.py.