Safety CI > mlsploit/mlsploit-py

pyup-update-zarr-2.4.0-to-3.1.1

3 days, 1 hour ago

Update zarr from 2.4.0 to 3.1.1

pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

pyup-pin-numpy-2.3.2

1 week, 1 day ago

9d0c7538

Pin numpy to latest version 2.3.2

pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

pyup-update-zarr-2.4.0-to-3.1.0

1 week, 4 days ago

8d5b7905

Update zarr from 2.4.0 to 3.1.0

pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

pyup-update-zarr-2.4.0-to-3.0.10

4 weeks ago

42be4c78

Update zarr from 2.4.0 to 3.0.10

pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

pyup-update-typing-extensions-3.7.4.2-to-4.14.1

4 weeks ago

b5ea777e

Update typing-extensions from 3.7.4.2 to 4.14.1

pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

pyup-pin-numpy-2.3.1

1 month, 1 week ago

f52c293d

Pin numpy to latest version 2.3.1

pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

pyup-update-pytest-5.4.1-to-8.4.1

1 month, 2 weeks ago

0c644b9f

Update pytest from 5.4.1 to 8.4.1

pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

pyup-update-pydantic-1.4-to-2.11.7

1 month, 2 weeks ago

db01cc24

Update pydantic from 1.4 to 2.11.7

pyyaml 5.3.1, yamale 2.0.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

pyup-update-pydantic-1.4-to-2.11.6

1 month, 2 weeks ago

8eab8f92

Update pydantic from 1.4 to 2.11.6

pyyaml 5.3.1, yamale 2.0.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

pyup-pin-numpy-2.3.0

1 month, 3 weeks ago

71eb6356

Pin numpy to latest version 2.3.0

pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

pyup-update-pytest-5.4.1-to-8.4.0

1 month, 4 weeks ago

8c69ef93

Update pytest from 5.4.1 to 8.4.0

pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

pyup-update-typing-extensions-3.7.4.2-to-4.14.0

2 months ago

64dbe052

Update typing-extensions from 3.7.4.2 to 4.14.0

pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

pyup-update-zarr-2.4.0-to-3.0.8

2 months, 1 week ago

0b55e684

Update zarr from 2.4.0 to 3.0.8

pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

pyup-update-pydantic-1.4-to-2.11.5

2 months, 1 week ago

32e3c134

Update pydantic from 1.4 to 2.11.5

pyyaml 5.3.1, yamale 2.0.1 and 2 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

pyup-pin-numpy-2.2.6

2 months, 2 weeks ago

e324f3a1

Pin numpy to latest version 2.2.6

pydantic 1.4, pyyaml 5.3.1 and 3 other dependencies have known security vulnerabilities.

Package	Installed	Affected	Info
pydantic	1.4	<1.10.2	show Pydantic 1.10.2 prevents long strings as int inputs to fix CVE-2020-10735. https://github.com/pydantic/pydantic/commit/eccd85e4d012e70ffbd81f379179da900d4621c5
pydantic	1.4	>=1.8.0a1,<1.8.2 , >=1.7.0a0,<1.7.4 , <1.6.2	show Pydantic 1.8.2, 1.7.4 and 1.6.2 include a fix for CVE-2021-29510: In affected versions of Pydantic passing either `'infinity'`, `'inf'` or `float('inf')` (or their negatives) to `datetime` or `date` fields causes validation to run forever with 100% CPU usage (on one CPU). Pydantic has been patched with fixes available in the following versions: v1.8.2, v1.7.4, v1.6.2. All these versions are available on pypi(https://pypi.org/project/pydantic/#history), and will be available on conda-forge(https://anaconda.org/conda-forge/pydantic) soon. See the changelog(https://pydantic-docs.helpmanual.io/) for details. If you absolutely can't upgrade, you can work around this risk using a validator(https://pydantic-docs.helpmanual.io/usage/validators/) to catch these values. This is not an ideal solution (in particular you'll need a slightly different function for datetimes), instead of a hack like this you should upgrade pydantic. If you are not using v1.8.x, v1.7.x or v1.6.x and are unable to upgrade to a fixed version of pydantic, please create an issue at https://github.com/samuelcolvin/pydantic/issues requesting a back-port, and we will endeavour to release a patch for earlier versions of pydantic.
pydantic	1.4	>=2.0.0,<2.4.0 , <1.10.13	show Regular expression denial of service in Pydanic affected versions allows remote attackers to cause denial of service via a crafted email string.
pydantic	1.4	<1.10.13 , >=2.0a1,<2.4.0	show Pydantic 1.10.13 and 2.4.0 include a fix for a regular expression denial of service vulnerability (REDoS). https://github.com/pydantic/pydantic/pull/7360 https://github.com/pydantic/pydantic/pull/7673
pyyaml	5.3.1	<5.4	show Pyyaml version 5.4 includes a fix for CVE-2020-14343: A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. This flaw allows an attacker to execute arbitrary code on the system by abusing the python/object/new constructor. This flaw is due to an incomplete fix for CVE-2020-1747. https://bugzilla.redhat.com/show_bug.cgi?id=1860466
yamale	2.0.1	<3.0.8	show Yamale 3.0.8 includes a fix for CVE-2021-38305: 23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing, and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema, each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus, by exploiting the vulnerability, an attacker can run arbitrary code on the image that invokes Yamale. https://github.com/23andMe/Yamale/pull/165 https://github.com/23andMe/Yamale/releases/tag/3.0.8
yamale	2.0.1	>0	show Yamale does not protect against intentionally malicious schemas. Ensure that your schema definitions come from internal or trusted sources.
yamale	2.0.1	<4.0.0	show Yamale version 4.0.0 includes a fix for a RCE vulnerability. https://github.com/23andMe/Yamale/issues/167
pylint	2.4.4	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.4.4	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
pylint	2.4.4	<2.5.0	show Pylint 2.5.0 no longer allows ``python -m pylint ...`` to import user code. Previously, it added the current working directory as the first element of ``sys.path``. This opened up a potential security hole where ``pylint`` would import user level code as long as that code resided in modules having the same name as stdlib or pylint's own modules.
pylint	2.4.4	>=0,<2.6.1	show Pylint before 2.6.1 is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to issues in its pyreverse component. This issue arises from certain regular expressions in pyreverse that can be exploited by causing catastrophic backtracking, significantly slowing down the service by forcing it to take a disproportionate amount of time to process inputs. This vulnerability allows attackers to use specially crafted inputs that increase the processing time exponentially, potentially leading to a service becoming inaccessible to legitimate users. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
black	19.10b0	<24.3.0	show Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.