Safety CI > rnag/wystia

Docs | Support

rnag/wystia

Requirements Safety CI

pyup/scheduled-update-2021-08-01

4 years, 7 months ago

8263f4e4

Update pylint from 2.9.5 to 2.9.6

coverage 5.5 has known security vulnerabilities.

Package	Installed	Affected	Info

pyup/scheduled-update-2021-08-01

4 years, 7 months ago

da6a0b4d

Update pip from 21.1.3 to 21.2.2

coverage 5.5 has known security vulnerabilities.

Package	Installed	Affected	Info

main

4 years, 8 months ago

aa976f6b

Update twine from 3.4.1 to 3.4.2 (#31) Co-authored-by: Ritvik Nag <nagrim7@gmail.com>

No dependencies with known security vulnerabilities.

pyup-update-twine-3.4.1-to-3.4.2

4 years, 8 months ago

12320eaa

Merge branch 'main' into pyup-update-twine-3.4.1-to-3.4.2

No dependencies with known security vulnerabilities.

main

4 years, 8 months ago

83667721

Update sphinx from 4.0.2 to 4.1.1 (#29)

No dependencies with known security vulnerabilities.

main

4 years, 8 months ago

c8a7e096

Update tox from 3.23.1 to 3.24.0 (#28) Co-authored-by: Ritvik Nag <nagrim7@gmail.com>

No dependencies with known security vulnerabilities.

pyup-update-tox-3.23.1-to-3.24.0

4 years, 8 months ago

b34210ed

Merge branch 'main' into pyup-update-tox-3.23.1-to-3.24.0

No dependencies with known security vulnerabilities.

main

4 years, 8 months ago

ce002cb9

Update pylint from 2.9.0 to 2.9.5 (#32)

No dependencies with known security vulnerabilities.

main

4 years, 8 months ago

0adea9ee

fix so pyup is now working

No dependencies with known security vulnerabilities.

main

4 years, 8 months ago

b948dcc1

Add PyUP config file

pip 20.3.4, pylint 2.6.2 and twine 1.15.0 have known security vulnerabilities.

Package	Installed	Affected	Info
pip	20.3.4	<25.2	show Affected versions of the pip package are vulnerable to Arbitrary File Overwrite due to improper validation of symbolic link targets in the fallback tar extraction code. In src/pip/_internal/utils/unpacking.py, the _untar_without_filter routine used when the Python tarfile module lacks PEP 706 (no tarfile.data_filter) extracted symlink members with tar._extract_member without verifying that link destinations resolve under the extraction root, a check later added via the is_symlink_target_in_tar helper.
pip	20.3.4	<21.1	show A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity.
pip	20.3.4	<21.1	show An issue was discovered in Pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). A warning was added about this behavior in version 21.1. NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
pip	20.3.4	<21.1	show Pip 21.1 updates its dependency 'urllib3' to v1.26.4 due to security issues.
pip	20.3.4	<26.0	show Affected versions of the pip package are vulnerable to Path Traversal due to an incorrect directory containment check when extracting wheel archives. In src/pip/_internal/utils/unpacking.py, the is_within_directory() helper used os.path.commonprefix() (character-by-character) to compare directory and target paths, allowing crafted paths like a parent-directory substring match to be treated as safely inside the installation directory.
pip	20.3.4	<23.3	show Affected versions of Pip are vulnerable to Command Injection. When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
pip	20.3.4	<25.0	show Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.
pylint	2.6.2	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.6.2	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
twine	1.15.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-pin-dataclasses-0.8

4 years, 8 months ago

904fa9a1

Pin dataclasses to latest version 0.8

pip 20.3.4, pylint 2.6.2 and twine 1.15.0 have known security vulnerabilities.

Package	Installed	Affected	Info
pip	20.3.4	<25.2	show Affected versions of the pip package are vulnerable to Arbitrary File Overwrite due to improper validation of symbolic link targets in the fallback tar extraction code. In src/pip/_internal/utils/unpacking.py, the _untar_without_filter routine used when the Python tarfile module lacks PEP 706 (no tarfile.data_filter) extracted symlink members with tar._extract_member without verifying that link destinations resolve under the extraction root, a check later added via the is_symlink_target_in_tar helper.
pip	20.3.4	<21.1	show A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity.
pip	20.3.4	<21.1	show An issue was discovered in Pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). A warning was added about this behavior in version 21.1. NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
pip	20.3.4	<21.1	show Pip 21.1 updates its dependency 'urllib3' to v1.26.4 due to security issues.
pip	20.3.4	<26.0	show Affected versions of the pip package are vulnerable to Path Traversal due to an incorrect directory containment check when extracting wheel archives. In src/pip/_internal/utils/unpacking.py, the is_within_directory() helper used os.path.commonprefix() (character-by-character) to compare directory and target paths, allowing crafted paths like a parent-directory substring match to be treated as safely inside the installation directory.
pip	20.3.4	<23.3	show Affected versions of Pip are vulnerable to Command Injection. When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
pip	20.3.4	<25.0	show Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.
pylint	2.6.2	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.6.2	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
twine	1.15.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-pytest-mock-3.5.1-to-3.6.1

4 years, 8 months ago

45500f86

Update pytest-mock from 3.5.1 to 3.6.1

pip 20.3.4, pylint 2.6.2 and twine 1.15.0 have known security vulnerabilities.

Package	Installed	Affected	Info
pip	20.3.4	<25.2	show Affected versions of the pip package are vulnerable to Arbitrary File Overwrite due to improper validation of symbolic link targets in the fallback tar extraction code. In src/pip/_internal/utils/unpacking.py, the _untar_without_filter routine used when the Python tarfile module lacks PEP 706 (no tarfile.data_filter) extracted symlink members with tar._extract_member without verifying that link destinations resolve under the extraction root, a check later added via the is_symlink_target_in_tar helper.
pip	20.3.4	<21.1	show A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity.
pip	20.3.4	<21.1	show An issue was discovered in Pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). A warning was added about this behavior in version 21.1. NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
pip	20.3.4	<21.1	show Pip 21.1 updates its dependency 'urllib3' to v1.26.4 due to security issues.
pip	20.3.4	<26.0	show Affected versions of the pip package are vulnerable to Path Traversal due to an incorrect directory containment check when extracting wheel archives. In src/pip/_internal/utils/unpacking.py, the is_within_directory() helper used os.path.commonprefix() (character-by-character) to compare directory and target paths, allowing crafted paths like a parent-directory substring match to be treated as safely inside the installation directory.
pip	20.3.4	<23.3	show Affected versions of Pip are vulnerable to Command Injection. When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
pip	20.3.4	<25.0	show Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.
pylint	2.6.2	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.6.2	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
twine	1.15.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-pytest-6.1.2-to-6.2.4

4 years, 8 months ago

ec91511e

Update pytest from 6.1.2 to 6.2.4

pip 20.3.4, pylint 2.6.2 and twine 1.15.0 have known security vulnerabilities.

Package	Installed	Affected	Info
pip	20.3.4	<25.2	show Affected versions of the pip package are vulnerable to Arbitrary File Overwrite due to improper validation of symbolic link targets in the fallback tar extraction code. In src/pip/_internal/utils/unpacking.py, the _untar_without_filter routine used when the Python tarfile module lacks PEP 706 (no tarfile.data_filter) extracted symlink members with tar._extract_member without verifying that link destinations resolve under the extraction root, a check later added via the is_symlink_target_in_tar helper.
pip	20.3.4	<21.1	show A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity.
pip	20.3.4	<21.1	show An issue was discovered in Pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). A warning was added about this behavior in version 21.1. NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
pip	20.3.4	<21.1	show Pip 21.1 updates its dependency 'urllib3' to v1.26.4 due to security issues.
pip	20.3.4	<26.0	show Affected versions of the pip package are vulnerable to Path Traversal due to an incorrect directory containment check when extracting wheel archives. In src/pip/_internal/utils/unpacking.py, the is_within_directory() helper used os.path.commonprefix() (character-by-character) to compare directory and target paths, allowing crafted paths like a parent-directory substring match to be treated as safely inside the installation directory.
pip	20.3.4	<23.3	show Affected versions of Pip are vulnerable to Command Injection. When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
pip	20.3.4	<25.0	show Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.
pylint	2.6.2	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.6.2	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
twine	1.15.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-update-watchdog-0.10.7-to-2.1.3

4 years, 8 months ago

35514e36

Update watchdog from 0.10.7 to 2.1.3

pip 20.3.4, pylint 2.6.2 and twine 1.15.0 have known security vulnerabilities.

Package	Installed	Affected	Info
pip	20.3.4	<25.2	show Affected versions of the pip package are vulnerable to Arbitrary File Overwrite due to improper validation of symbolic link targets in the fallback tar extraction code. In src/pip/_internal/utils/unpacking.py, the _untar_without_filter routine used when the Python tarfile module lacks PEP 706 (no tarfile.data_filter) extracted symlink members with tar._extract_member without verifying that link destinations resolve under the extraction root, a check later added via the is_symlink_target_in_tar helper.
pip	20.3.4	<21.1	show A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity.
pip	20.3.4	<21.1	show An issue was discovered in Pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). A warning was added about this behavior in version 21.1. NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely.
pip	20.3.4	<21.1	show Pip 21.1 updates its dependency 'urllib3' to v1.26.4 due to security issues.
pip	20.3.4	<26.0	show Affected versions of the pip package are vulnerable to Path Traversal due to an incorrect directory containment check when extracting wheel archives. In src/pip/_internal/utils/unpacking.py, the is_within_directory() helper used os.path.commonprefix() (character-by-character) to compare directory and target paths, allowing crafted paths like a parent-directory substring match to be treated as safely inside the installation directory.
pip	20.3.4	<23.3	show Affected versions of Pip are vulnerable to Command Injection. When installing a package from a Mercurial VCS URL (ie "pip install hg+...") with pip prior to v23.3, the specified Mercurial revision could be used to inject arbitrary configuration options to the "hg clone" call (ie "--config"). Controlling the Mercurial configuration can modify how and which repository is installed. This vulnerability does not affect users who aren't installing from Mercurial.
pip	20.3.4	<25.0	show Pip solves a security vulnerability that previously allowed maliciously crafted wheel files to execute unauthorized code during installation.
pylint	2.6.2	<2.7.0	show Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'. https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e
pylint	2.6.2	<2.13.0	show Pylint 2.13.0 fixes a crash when using the doc_params extension. https://github.com/PyCQA/pylint/issues/5322
twine	1.15.0	<2.0.0	show Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

pyup-pin-pip-21.1.3

4 years, 8 months ago

d652ad7a

Pin pip to latest version 21.1.3

pylint 2.6.2 and twine 1.15.0 have known security vulnerabilities.

Package

Installed

Affected

Info

pylint

2.6.2

<2.7.0

show

Pylint 2.7.0 includes a fix for vulnerable regular expressions in 'pyreverse'.
https://github.com/pylint-dev/pylint/commit/5405dd5115d598fa69e49538d50ec79202b1b52e

pylint

2.6.2

<2.13.0

show

Pylint 2.13.0 fixes a crash when using the doc_params extension.
https://github.com/PyCQA/pylint/issues/5322

twine

1.15.0

<2.0.0

show

Twine 2.0.0 updates requests to 2.20 (or later) to include a security fix.

older