Safety CI > mzollin/qr-pirate

pyup-update-urllib3-2.2.1-to-2.2.2

2 years, 1 month ago

8892319c

Update urllib3 from 2.2.1 to 2.2.2

No dependencies with known security vulnerabilities.

master

2 years, 1 month ago

4de31a9f

Merge pull request #271 from mzollin/pyup-update-certifi-2024.2.2-to-2024.6.2 Update certifi to 202

No dependencies with known security vulnerabilities.

pyup-update-certifi-2024.2.2-to-2024.6.2

2 years, 1 month ago

1a00d4ce

Update certifi from 2024.2.2 to 2024.6.2

No dependencies with known security vulnerabilities.

master

2 years, 1 month ago

56b3dadb

Merge pull request #270 from mzollin/pyup-update-icrawler-0.6.8-to-0.6.9 Update icrawler to 0.6.9

No dependencies with known security vulnerabilities.

pyup-update-icrawler-0.6.8-to-0.6.9

2 years, 1 month ago

741378b4

Update icrawler from 0.6.8 to 0.6.9

No dependencies with known security vulnerabilities.

master

2 years, 1 month ago

24ec6f90

Merge pull request #269 from mzollin/pyup-update-requests-2.32.2-to-2.32.3 Update requests to 2.32.

No dependencies with known security vulnerabilities.

pyup-update-requests-2.32.2-to-2.32.3

2 years, 1 month ago

421e29f6

Update requests from 2.32.2 to 2.32.3

No dependencies with known security vulnerabilities.

master

2 years, 1 month ago

df2b7e0a

Merge pull request #268 from mzollin/pyup-update-requests-2.31.0-to-2.32.2 Update requests to 2.32.

No dependencies with known security vulnerabilities.

master

2 years, 1 month ago

50a0085a

Merge pull request #266 from mzollin/pyup-update-icrawler-0.6.7-to-0.6.8 Update icrawler to 0.6.8

requests 2.31.0 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.31.0	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.31.0	<2.33.0	show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content.
requests	2.31.0	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

Package

Installed

Affected

Info

requests

2.31.0

<2.32.2

show

Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

requests

2.31.0

<2.33.0

show

Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content.

requests

2.31.0

<2.32.4

show

Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

master

2 years, 1 month ago

1b94040a

Merge pull request #265 from mzollin/pyup-update-lxml-5.2.1-to-5.2.2 Update lxml to 5.2.2

requests 2.31.0 has known security vulnerabilities.

Package	Installed	Affected	Info
requests	2.31.0	<2.32.2	show Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.
requests	2.31.0	<2.33.0	show Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content.
requests	2.31.0	<2.32.4	show Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

Package

Installed

Affected

Info

requests

2.31.0

<2.32.2

show

Affected versions of Requests, when making requests through a Requests `Session`, if the first request is made with `verify=False` to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of `verify`. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation.

requests

2.31.0

<2.33.0

show

Affected versions of the requests package are vulnerable to Insecure Temporary File reuse due to predictable temporary filename generation in extract_zipped_paths(). The requests.utils.extract_zipped_paths() utility extracts files from zip archives into the system temporary directory using a deterministic path, and if that file already exists, the function reuses it without validating that it is the expected extracted content.

requests

2.31.0

<2.32.4

show

Requests is an HTTP library. Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs. Users should upgrade to version 2.32.4 to receive a fix. For older versions of Requests, use of the .netrc file can be disabled with `trust_env=False` on one's Requests Session.

pyup-update-requests-2.31.0-to-2.32.2

2 years, 2 months ago

262f433b

Update requests from 2.31.0 to 2.32.2

No dependencies with known security vulnerabilities.

pyup-update-requests-2.31.0-to-2.32.1

2 years, 2 months ago

3e78723c

Update requests from 2.31.0 to 2.32.1

No dependencies with known security vulnerabilities.

pyup-update-icrawler-0.6.7-to-0.6.8

2 years, 2 months ago

c18d4c49

Update icrawler from 0.6.7 to 0.6.8

No dependencies with known security vulnerabilities.

pyup-update-lxml-5.2.1-to-5.2.2

2 years, 2 months ago

0f888e2a

Update lxml from 5.2.1 to 5.2.2

No dependencies with known security vulnerabilities.

master

2 years, 3 months ago

8806e088

Merge pull request #263 from mzollin/pyup-update-idna-3.6-to-3.7 Update idna to 3.7

No dependencies with known security vulnerabilities.