pyup-scheduled-update-2024-05-06
3 days, 9 hours ago
Update plotly from 3.1.1 to 5.22.0
pip 18.0, click 6.7, click 6.7 and 14 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 18.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| pip | 18.0 | <21.1 |
show A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1. |
| pip | 18.0 | <23.3 |
show Affected versions of Pip are vulnerable to Command Injection. When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial. |
| pip | 18.0 | <19.2 |
show Versions of Pip prior to 19.2 are vulnerable to a directory traversal attack during the installation process from a URL. This vulnerability stems from improperly handling filenames in the Content-Disposition header that include path traversal sequences, potentially allowing unauthorized overwrite of critical files such as /root/.ssh/authorized_keys. The flaw is specifically found in the _download_http_url function within _internal/download.py. |
| pip | 18.0 | <21.1 |
show Pip 21.1 updates its dependency 'urllib3' to v1.26.4 due to security issues. |
| click | 6.7 | <8.0.0 |
show Click 8.0.0 uses 'mkstemp()' instead of the deprecated & insecure 'mktemp()'. https://github.com/pallets/click/issues/1752 |
| click | 6.7 | <8.0.0 |
show Click 8.0.0 uses 'mkstemp()' instead of the deprecated & insecure 'mktemp()'. https://github.com/pallets/click/issues/1752 |
| dash | 0.26.0 | <1.20.0 |
show Dash 1.20.0 fixes a potential XSS vulnerability by starting to validate callback request fields. https://github.com/plotly/dash/pull/1546 |
| dash | 0.26.0 | <1.21.0 |
show Dash 1.21.0 updates its dependency 'Plotly.js' to v2.2.1 to include a security fix. |
| dash | 0.26.0 | <2.15.0 |
show Dash 2.15.0 validates the URL to prevent XSS attacks identified on the 'dash-core-components'. https://github.com/plotly/dash/pull/2732 |
| dash | 0.26.0 | <2.13.0 , >=2.14.0,<2.15.0 |
show Earlier versions of Dash and its components are susceptible to an XSS vulnerability, specifically through the manipulation of the href attribute in a tags by an attacker. This flaw could potentially allow an authenticated attacker to access or manipulate user data and tokens, assuming the ability to store and present manipulated views to other users. The vulnerability notably requires the presence of user input storage mechanisms within Dash applications to be exploitable. Further details are covered under CVE-2024-21485. #Note: This is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user. See CVE-2024-21485. |
| scipy | 1.1.0 | <1.8.0 |
show Scipy 1.8.0 includes a fix for an Use After Free vulnerability. https://github.com/scipy/scipy/issues/14713 |
| scipy | 1.1.0 | <1.10.0rc1 |
show Scipy 1.10.0rc1 includes a fix for a Denial of Service vulnerability. https://github.com/scipy/scipy/issues/16235 |
| scipy | 1.1.0 | <1.8.0 |
show Scipy 1.8.0 includes a fix for an Use After Free vulnerability. https://github.com/scipy/scipy/issues/14713 |
| scipy | 1.1.0 | <1.10.0rc1 |
show Scipy 1.10.0rc1 includes a fix for a Denial of Service vulnerability. https://github.com/scipy/scipy/issues/16235 |
| dash | 0.26.0 | <1.20.0 |
show Dash 1.20.0 fixes a potential XSS vulnerability by starting to validate callback request fields. https://github.com/plotly/dash/pull/1546 |
| dash | 0.26.0 | <1.21.0 |
show Dash 1.21.0 updates its dependency 'Plotly.js' to v2.2.1 to include a security fix. |
| dash | 0.26.0 | <2.15.0 |
show Dash 2.15.0 validates the URL to prevent XSS attacks identified on the 'dash-core-components'. https://github.com/plotly/dash/pull/2732 |
| dash | 0.26.0 | <2.13.0 , >=2.14.0,<2.15.0 |
show Earlier versions of Dash and its components are susceptible to an XSS vulnerability, specifically through the manipulation of the href attribute in a tags by an attacker. This flaw could potentially allow an authenticated attacker to access or manipulate user data and tokens, assuming the ability to store and present manipulated views to other users. The vulnerability notably requires the presence of user input storage mechanisms within Dash applications to be exploitable. Further details are covered under CVE-2024-21485. #Note: This is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user. See CVE-2024-21485. |
| numpy | 1.15.1 | <1.16.3 |
show Numpy 1.16.3 includes a fix for CVE-2019-6446: It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: Third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources. https://github.com/numpy/numpy/commit/89b688732b37616c9d26623f81aaee1703c30ffb |
| numpy | 1.15.1 | <1.21.0rc1 |
show Numpy 1.21.0rc1 includes a fix for CVE-2021-33430: A Buffer Overflow vulnerability in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulnerability. In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user. https://github.com/numpy/numpy/issues/18939 |
| numpy | 1.15.1 | <1.22.2 |
show Numpy 1.22.2 includes a fix for CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place. https://github.com/numpy/numpy/issues/19038 |
| numpy | 1.15.1 | <1.22.0 |
show Numpy 1.22.0 includes a fix for CVE-2021-34141: An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless." https://github.com/numpy/numpy/issues/18993 |
| numpy | 1.15.1 | <1.22.0 |
show Numpy 1.22.0 includes a fix for CVE-2021-41496: Buffer overflow in the array_from_pyobj function of fortranobject.c, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally). https://github.com/numpy/numpy/issues/19000 |
| wheel | 0.31.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| twine | 1.11.0 | <2.0.0 |
show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix. |
| numpy | 1.15.1 | <1.16.3 |
show Numpy 1.16.3 includes a fix for CVE-2019-6446: It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: Third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources. https://github.com/numpy/numpy/commit/89b688732b37616c9d26623f81aaee1703c30ffb |
| numpy | 1.15.1 | <1.21.0rc1 |
show Numpy 1.21.0rc1 includes a fix for CVE-2021-33430: A Buffer Overflow vulnerability in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulnerability. In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user. https://github.com/numpy/numpy/issues/18939 |
| numpy | 1.15.1 | <1.22.2 |
show Numpy 1.22.2 includes a fix for CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place. https://github.com/numpy/numpy/issues/19038 |
| numpy | 1.15.1 | <1.22.0 |
show Numpy 1.22.0 includes a fix for CVE-2021-34141: An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless." https://github.com/numpy/numpy/issues/18993 |
| numpy | 1.15.1 | <1.22.0 |
show Numpy 1.22.0 includes a fix for CVE-2021-41496: Buffer overflow in the array_from_pyobj function of fortranobject.c, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally). https://github.com/numpy/numpy/issues/19000 |
| joblib | 0.12.2 | <1.2.0 |
show Joblib 1.2.0 includes a fix for CVE-2022-21797: The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement. https://github.com/joblib/joblib/issues/1128 |
| joblib | 0.12.2 | <1.2.0 |
show Joblib 1.2.0 fixes a security issue where 'eval(pre_dispatch)' could potentially run arbitrary code. Now only basic numerics are supported. https://github.com/joblib/joblib/pull/1327 |
| joblib | 0.12.2 | <1.1.1 |
show Joblib 1.1.1 fixes a security issue where 'eval(pre_dispatch)' could potentially run arbitrary code. Now only basic numerics are supported. https://github.com/joblib/joblib/pull/1327 |
| joblib | 0.12.2 | <1.2.0 |
show Joblib 1.2.0 includes a fix for CVE-2022-21797: The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement. https://github.com/joblib/joblib/issues/1128 |
| joblib | 0.12.2 | <1.2.0 |
show Joblib 1.2.0 fixes a security issue where 'eval(pre_dispatch)' could potentially run arbitrary code. Now only basic numerics are supported. https://github.com/joblib/joblib/pull/1327 |
| joblib | 0.12.2 | <1.1.1 |
show Joblib 1.1.1 fixes a security issue where 'eval(pre_dispatch)' could potentially run arbitrary code. Now only basic numerics are supported. https://github.com/joblib/joblib/pull/1327 |
| pytest-runner | 4.2 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
| scikit-learn | 0.19.2 | <1.1.0rc1 |
show Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. https://github.com/scikit-learn/scikit-learn/commit/1bf13d567d3cd74854aa8343fd25b61dd768bb85 |
| scikit-learn | 0.19.2 | <0.24.2 |
show Scikit-learn 0.24.2 includes a fix for a ReDoS vulnerability. https://github.com/scikit-learn/scikit-learn/issues/19522 |
| scikit-learn | 0.19.2 | <1.1.0rc1 |
show Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. https://github.com/scikit-learn/scikit-learn/commit/1bf13d567d3cd74854aa8343fd25b61dd768bb85 |
| scikit-learn | 0.19.2 | <0.24.2 |
show Scikit-learn 0.24.2 includes a fix for a ReDoS vulnerability. https://github.com/scikit-learn/scikit-learn/issues/19522 |
pyup-scheduled-update-2024-05-06
3 days, 9 hours ago
Update plotly from 3.1.1 to 5.22.0
pip 18.0, click 6.7, click 6.7 and 15 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 18.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| pip | 18.0 | <21.1 |
show A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1. |
| pip | 18.0 | <23.3 |
show Affected versions of Pip are vulnerable to Command Injection. When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial. |
| pip | 18.0 | <19.2 |
show Versions of Pip prior to 19.2 are vulnerable to a directory traversal attack during the installation process from a URL. This vulnerability stems from improperly handling filenames in the Content-Disposition header that include path traversal sequences, potentially allowing unauthorized overwrite of critical files such as /root/.ssh/authorized_keys. The flaw is specifically found in the _download_http_url function within _internal/download.py. |
| pip | 18.0 | <21.1 |
show Pip 21.1 updates its dependency 'urllib3' to v1.26.4 due to security issues. |
| click | 6.7 | <8.0.0 |
show Click 8.0.0 uses 'mkstemp()' instead of the deprecated & insecure 'mktemp()'. https://github.com/pallets/click/issues/1752 |
| click | 6.7 | <8.0.0 |
show Click 8.0.0 uses 'mkstemp()' instead of the deprecated & insecure 'mktemp()'. https://github.com/pallets/click/issues/1752 |
| dash | 0.26.0 | <1.20.0 |
show Dash 1.20.0 fixes a potential XSS vulnerability by starting to validate callback request fields. https://github.com/plotly/dash/pull/1546 |
| dash | 0.26.0 | <1.21.0 |
show Dash 1.21.0 updates its dependency 'Plotly.js' to v2.2.1 to include a security fix. |
| dash | 0.26.0 | <2.15.0 |
show Dash 2.15.0 validates the URL to prevent XSS attacks identified on the 'dash-core-components'. https://github.com/plotly/dash/pull/2732 |
| dash | 0.26.0 | <2.13.0 , >=2.14.0,<2.15.0 |
show Earlier versions of Dash and its components are susceptible to an XSS vulnerability, specifically through the manipulation of the href attribute in a tags by an attacker. This flaw could potentially allow an authenticated attacker to access or manipulate user data and tokens, assuming the ability to store and present manipulated views to other users. The vulnerability notably requires the presence of user input storage mechanisms within Dash applications to be exploitable. Further details are covered under CVE-2024-21485. #Note: This is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user. See CVE-2024-21485. |
| scipy | 1.1.0 | <1.8.0 |
show Scipy 1.8.0 includes a fix for an Use After Free vulnerability. https://github.com/scipy/scipy/issues/14713 |
| scipy | 1.1.0 | <1.10.0rc1 |
show Scipy 1.10.0rc1 includes a fix for a Denial of Service vulnerability. https://github.com/scipy/scipy/issues/16235 |
| scipy | 1.1.0 | <1.8.0 |
show Scipy 1.8.0 includes a fix for an Use After Free vulnerability. https://github.com/scipy/scipy/issues/14713 |
| scipy | 1.1.0 | <1.10.0rc1 |
show Scipy 1.10.0rc1 includes a fix for a Denial of Service vulnerability. https://github.com/scipy/scipy/issues/16235 |
| dash | 0.26.0 | <1.20.0 |
show Dash 1.20.0 fixes a potential XSS vulnerability by starting to validate callback request fields. https://github.com/plotly/dash/pull/1546 |
| dash | 0.26.0 | <1.21.0 |
show Dash 1.21.0 updates its dependency 'Plotly.js' to v2.2.1 to include a security fix. |
| dash | 0.26.0 | <2.15.0 |
show Dash 2.15.0 validates the URL to prevent XSS attacks identified on the 'dash-core-components'. https://github.com/plotly/dash/pull/2732 |
| dash | 0.26.0 | <2.13.0 , >=2.14.0,<2.15.0 |
show Earlier versions of Dash and its components are susceptible to an XSS vulnerability, specifically through the manipulation of the href attribute in a tags by an attacker. This flaw could potentially allow an authenticated attacker to access or manipulate user data and tokens, assuming the ability to store and present manipulated views to other users. The vulnerability notably requires the presence of user input storage mechanisms within Dash applications to be exploitable. Further details are covered under CVE-2024-21485. #Note: This is only exploitable in Dash apps that include some mechanism to store user input to be reloaded by a different user. See CVE-2024-21485. |
| numpy | 1.15.1 | <1.16.3 |
show Numpy 1.16.3 includes a fix for CVE-2019-6446: It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: Third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources. https://github.com/numpy/numpy/commit/89b688732b37616c9d26623f81aaee1703c30ffb |
| numpy | 1.15.1 | <1.21.0rc1 |
show Numpy 1.21.0rc1 includes a fix for CVE-2021-33430: A Buffer Overflow vulnerability in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulnerability. In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user. https://github.com/numpy/numpy/issues/18939 |
| numpy | 1.15.1 | <1.22.2 |
show Numpy 1.22.2 includes a fix for CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place. https://github.com/numpy/numpy/issues/19038 |
| numpy | 1.15.1 | <1.22.0 |
show Numpy 1.22.0 includes a fix for CVE-2021-34141: An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless." https://github.com/numpy/numpy/issues/18993 |
| numpy | 1.15.1 | <1.22.0 |
show Numpy 1.22.0 includes a fix for CVE-2021-41496: Buffer overflow in the array_from_pyobj function of fortranobject.c, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally). https://github.com/numpy/numpy/issues/19000 |
| wheel | 0.31.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| twine | 1.11.0 | <2.0.0 |
show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix. |
| plotly | 3.1.1 | <4.8.2 |
show Plotly 4.8.2 includes plotly.js version 1.54.5, which contains a security fix of a transitive dependency (ecstatic). |
| plotly | 3.1.1 | <4.9.0 |
show Plotly 4.9.0 builds Javascript extensions using Node 12 with an updated 'package-lock.json' that has many fewer security warnings. |
| numpy | 1.15.1 | <1.16.3 |
show Numpy 1.16.3 includes a fix for CVE-2019-6446: It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: Third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources. https://github.com/numpy/numpy/commit/89b688732b37616c9d26623f81aaee1703c30ffb |
| numpy | 1.15.1 | <1.21.0rc1 |
show Numpy 1.21.0rc1 includes a fix for CVE-2021-33430: A Buffer Overflow vulnerability in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. NOTE: The vendor does not agree this is a vulnerability. In (very limited) circumstances a user may be able provoke the buffer overflow, the user is most likely already privileged to at least provoke denial of service by exhausting memory. Triggering this further requires the use of uncommon API (complicated structured dtypes), which is very unlikely to be available to an unprivileged user. https://github.com/numpy/numpy/issues/18939 |
| numpy | 1.15.1 | <1.22.2 |
show Numpy 1.22.2 includes a fix for CVE-2021-41495: Null Pointer Dereference vulnerability exists in numpy.sort in NumPy in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays. NOTE: While correct that validation is missing, an error can only occur due to an exhaustion of memory. If the user can exhaust memory, they are already privileged. Further, it should be practically impossible to construct an attack which can target the memory exhaustion to occur at exactly this place. https://github.com/numpy/numpy/issues/19038 |
| numpy | 1.15.1 | <1.22.0 |
show Numpy 1.22.0 includes a fix for CVE-2021-34141: An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless." https://github.com/numpy/numpy/issues/18993 |
| numpy | 1.15.1 | <1.22.0 |
show Numpy 1.22.0 includes a fix for CVE-2021-41496: Buffer overflow in the array_from_pyobj function of fortranobject.c, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values. NOTE: The vendor does not agree this is a vulnerability; the negative dimensions can only be created by an already privileged user (or internally). https://github.com/numpy/numpy/issues/19000 |
| joblib | 0.12.2 | <1.2.0 |
show Joblib 1.2.0 includes a fix for CVE-2022-21797: The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement. https://github.com/joblib/joblib/issues/1128 |
| joblib | 0.12.2 | <1.2.0 |
show Joblib 1.2.0 fixes a security issue where 'eval(pre_dispatch)' could potentially run arbitrary code. Now only basic numerics are supported. https://github.com/joblib/joblib/pull/1327 |
| joblib | 0.12.2 | <1.1.1 |
show Joblib 1.1.1 fixes a security issue where 'eval(pre_dispatch)' could potentially run arbitrary code. Now only basic numerics are supported. https://github.com/joblib/joblib/pull/1327 |
| joblib | 0.12.2 | <1.2.0 |
show Joblib 1.2.0 includes a fix for CVE-2022-21797: The package joblib from 0 and before 1.2.0 is vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement. https://github.com/joblib/joblib/issues/1128 |
| joblib | 0.12.2 | <1.2.0 |
show Joblib 1.2.0 fixes a security issue where 'eval(pre_dispatch)' could potentially run arbitrary code. Now only basic numerics are supported. https://github.com/joblib/joblib/pull/1327 |
| joblib | 0.12.2 | <1.1.1 |
show Joblib 1.1.1 fixes a security issue where 'eval(pre_dispatch)' could potentially run arbitrary code. Now only basic numerics are supported. https://github.com/joblib/joblib/pull/1327 |
| pytest-runner | 4.2 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
| scikit-learn | 0.19.2 | <1.1.0rc1 |
show Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. https://github.com/scikit-learn/scikit-learn/commit/1bf13d567d3cd74854aa8343fd25b61dd768bb85 |
| scikit-learn | 0.19.2 | <0.24.2 |
show Scikit-learn 0.24.2 includes a fix for a ReDoS vulnerability. https://github.com/scikit-learn/scikit-learn/issues/19522 |
| scikit-learn | 0.19.2 | <1.1.0rc1 |
show Scikit-learn 1.1.0rc1 includes a fix for CVE-2020-28975: svm_predict_values in svm.cpp in Libsvm v324, as used in scikit-learn and other products, allows attackers to cause a denial of service (segmentation fault) via a crafted model SVM (introduced via pickle, json, or any other model permanence standard) with a large value in the _n_support array. NOTE: the scikit-learn vendor's position is that the behavior can only occur if the library's API is violated by an application that changes a private attribute. https://github.com/scikit-learn/scikit-learn/commit/1bf13d567d3cd74854aa8343fd25b61dd768bb85 |
| scikit-learn | 0.19.2 | <0.24.2 |
show Scikit-learn 0.24.2 includes a fix for a ReDoS vulnerability. https://github.com/scikit-learn/scikit-learn/issues/19522 |
pyup-scheduled-update-2024-04-29
1 week, 3 days ago
Update pytest-runner from 4.2 to 6.0.1
pip 24.0 and pytest-runner 6.0.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 24.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| pytest-runner | 6.0.1 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
pyup-scheduled-update-2024-04-29
1 week, 3 days ago
Update groundwork-sphinx-theme from 1.0.8 to 1.1.1
pip 24.0 and pytest-runner 6.0.1 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 24.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| pytest-runner | 6.0.1 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
pyup-scheduled-update-2024-04-29
1 week, 3 days ago
Update pytest from 3.7.2 to 8.2.0
pip 24.0 and pytest-runner 4.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 24.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| pytest-runner | 4.2 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
pyup-scheduled-update-2024-04-29
1 week, 3 days ago
Update twine from 1.11.0 to 5.0.0
pip 24.0 and pytest-runner 4.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 24.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| pytest-runner | 4.2 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
pyup-scheduled-update-2024-04-29
1 week, 3 days ago
Update sphinx from 1.7.7 to 7.3.7
pip 24.0, twine 1.11.0 and pytest-runner 4.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 24.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| twine | 1.11.0 | <2.0.0 |
show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix. |
| pytest-runner | 4.2 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
pyup-scheduled-update-2024-04-29
1 week, 3 days ago
Update coverage from 4.5.1 to 7.5.0
pip 24.0, Sphinx 1.7.7, twine 1.11.0 and pytest-runner 4.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 24.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| twine | 1.11.0 | <2.0.0 |
show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix. |
| pytest-runner | 4.2 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
pyup-scheduled-update-2024-04-29
1 week, 3 days ago
Update flake8 from 3.5.0 to 7.0.0
pip 24.0, Sphinx 1.7.7, twine 1.11.0 and pytest-runner 4.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 24.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| twine | 1.11.0 | <2.0.0 |
show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix. |
| pytest-runner | 4.2 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
pyup-scheduled-update-2024-04-29
1 week, 3 days ago
Update tox from 3.2.1 to 4.15.0
pip 24.0, Sphinx 1.7.7, twine 1.11.0 and pytest-runner 4.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 24.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| twine | 1.11.0 | <2.0.0 |
show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix. |
| pytest-runner | 4.2 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
pyup-scheduled-update-2024-04-29
1 week, 3 days ago
Update watchdog from 0.8.3 to 4.0.0
pip 24.0, Sphinx 1.7.7, twine 1.11.0 and pytest-runner 4.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 24.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| twine | 1.11.0 | <2.0.0 |
show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix. |
| pytest-runner | 4.2 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
pyup-scheduled-update-2024-04-29
1 week, 3 days ago
Update wheel from 0.31.1 to 0.43.0
pip 24.0, Sphinx 1.7.7, twine 1.11.0 and pytest-runner 4.2 have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 24.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| twine | 1.11.0 | <2.0.0 |
show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix. |
| pytest-runner | 4.2 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
pyup-scheduled-update-2024-04-29
1 week, 3 days ago
Update bumpversion from 0.5.3 to 0.6.0
pip 24.0, wheel 0.31.1, Sphinx 1.7.7 and 2 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 24.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| wheel | 0.31.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| twine | 1.11.0 | <2.0.0 |
show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix. |
| pytest-runner | 4.2 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
pyup-scheduled-update-2024-04-29
1 week, 3 days ago
Update pip from 18.0 to 24.0
pip 24.0, wheel 0.31.1, Sphinx 1.7.7 and 2 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 24.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| wheel | 0.31.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| twine | 1.11.0 | <2.0.0 |
show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix. |
| pytest-runner | 4.2 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
pyup-scheduled-update-2024-04-29
1 week, 3 days ago
Update scipy from 1.1.0 to 1.13.0
pip 18.0, wheel 0.31.1, Sphinx 1.7.7 and 2 other dependencies have known security vulnerabilities.
| Package | Installed | Affected | Info |
|---|---|---|---|
| pip | 18.0 | >=0 |
show ** DISPUTED ** An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely. |
| pip | 18.0 | <21.1 |
show A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity. This is fixed in python-pip version 21.1. |
| pip | 18.0 | <23.3 |
show Affected versions of Pip are vulnerable to Command Injection. When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial. |
| pip | 18.0 | <19.2 |
show Versions of Pip prior to 19.2 are vulnerable to a directory traversal attack during the installation process from a URL. This vulnerability stems from improperly handling filenames in the Content-Disposition header that include path traversal sequences, potentially allowing unauthorized overwrite of critical files such as /root/.ssh/authorized_keys. The flaw is specifically found in the _download_http_url function within _internal/download.py. |
| pip | 18.0 | <21.1 |
show Pip 21.1 updates its dependency 'urllib3' to v1.26.4 due to security issues. |
| wheel | 0.31.1 | <0.38.1 |
show Wheel 0.38.1 includes a fix for CVE-2022-40898: An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.0.4 |
show Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons. |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in inventory. https://github.com/sphinx-doc/sphinx/issues/8175 https://github.com/sphinx-doc/sphinx/commit/f7b872e673f9b359a61fd287a7338a28077840d2 |
| Sphinx | 1.7.7 | <3.3.0 |
show Sphinx 3.3.0 includes a fix for a ReDoS vulnerability in docstring. https://github.com/sphinx-doc/sphinx/issues/8172 https://github.com/sphinx-doc/sphinx/commit/f00e75278c5999f40b214d8934357fbf0e705417 |
| twine | 1.11.0 | <2.0.0 |
show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix. |
| pytest-runner | 4.2 | >0 |
show Pytest-runner depends on deprecated features of setuptools and relies on features that break security mechanisms in pip. For example ‘setup_requires’ and ‘tests_require’ bypass pip --require-hashes. See also pypa/setuptools#1684. It is recommended that you: - Remove 'pytest-runner' from your setup_requires, preferably removing the setup_requires option. - Remove 'pytest' and any other testing requirements from tests_require, preferably removing the tests_requires option. - Select a tool to bootstrap and then run tests such as tox. https://github.com/pytest-dev/pytest-runner/blob/289a77b179535d8137118e3b8591d9e727130d6d/README.rst |
Python 3 badge
URL
https://pyup.io/repos/github/netzkontrast/prometheus_ml/python-3-shield.svg
Markdown
[](https://pyup.io/repos/github/netzkontrast/prometheus_ml/)
Restructured Text
.. image:: https://pyup.io/repos/github/netzkontrast/prometheus_ml/python-3-shield.svg
:target: https://pyup.io/repos/github/netzkontrast/prometheus_ml/
:alt: Python 3
HTML
<a href="https://pyup.io/repos/github/netzkontrast/prometheus_ml/"><img src="https://pyup.io/repos/github/netzkontrast/prometheus_ml/shield.svg" alt="Python 3" /></a>
Textile
!https://pyup.io/repos/github/netzkontrast/prometheus_ml/python-3-shield.svg(Python 3)!:https://pyup.io/repos/github/netzkontrast/prometheus_ml/
RDoc
{<img src="https://pyup.io/repos/github/netzkontrast/prometheus_ml/python-3-shield.svg" alt="Python 3" />}[https://pyup.io/repos/github/netzkontrast/prometheus_ml/]
pyup.io badge
URL
https://pyup.io/repos/github/netzkontrast/prometheus_ml/shield.svg
Markdown
[](https://pyup.io/repos/github/netzkontrast/prometheus_ml/)
Restructured Text
.. image:: https://pyup.io/repos/github/netzkontrast/prometheus_ml/shield.svg
:target: https://pyup.io/repos/github/netzkontrast/prometheus_ml/
:alt: Updates
HTML
<a href="https://pyup.io/repos/github/netzkontrast/prometheus_ml/"><img src="https://pyup.io/repos/github/netzkontrast/prometheus_ml/shield.svg" alt="Updates" /></a>
Textile
!https://pyup.io/repos/github/netzkontrast/prometheus_ml/shield.svg(Updates)!:https://pyup.io/repos/github/netzkontrast/prometheus_ml/
RDoc
{<img src="https://pyup.io/repos/github/netzkontrast/prometheus_ml/shield.svg" alt="Updates" />}[https://pyup.io/repos/github/netzkontrast/prometheus_ml/]