Safety CI > toonarmycaptain/dionysus

snyk-fix-ee12707ac7b00376a2afb6190597dde6

1 year, 6 months ago

2d386843

fix: requirements.txt to reduce vulnerabilities The following vulnerabilities are fixed by pinning

No dependencies with known security vulnerabilities.

dependabot/pip/development/pytest-8.0.0

1 year, 6 months ago

3d792b68

Bump pytest from 7.4.3 to 8.0.0 Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.4.3 to

Pillow 10.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
Pillow	10.1.0	<10.3.0	show Pillow 10.3.0 introduces a security update addressing CVE-2024-28219 by replacing certain functions with strncpy to prevent buffer overflow issues.
Pillow	10.1.0	<10.2.0	show Pillow is potentially vulnerable to DoS attacks through PIL.ImageFont.ImageFont.getmask(). A decompression bomb check has also been added to the affected function.
Pillow	10.1.0	<10.2.0	show Pillow is affected by an arbitrary code execution vulnerability. If an attacker has control over the keys passed to the environment argument of PIL.ImageMath.eval(), they may be able to execute arbitrary code. https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html

Package

Installed

Affected

Info

Pillow

10.1.0

<10.3.0

show

Pillow 10.3.0 introduces a security update addressing CVE-2024-28219 by replacing certain functions with strncpy to prevent buffer overflow issues.

Pillow

10.1.0

<10.2.0

show

Pillow is potentially vulnerable to DoS attacks through PIL.ImageFont.ImageFont.getmask(). A decompression bomb check has also been added to the affected function.

Pillow

10.1.0

<10.2.0

show

Pillow is affected by an arbitrary code execution vulnerability. If an attacker has control over the keys passed to the environment argument of PIL.ImageMath.eval(), they may be able to execute arbitrary code.
https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html

dependabot/pip/development/coverage-7.4.1

1 year, 6 months ago

a12e761f

Bump coverage from 6.5.0 to 7.4.1 Bumps [coverage](https://github.com/nedbat/coveragepy) from 6.5.0

Pillow 10.1.0 has known security vulnerabilities.

Package	Installed	Affected	Info
Pillow	10.1.0	<10.3.0	show Pillow 10.3.0 introduces a security update addressing CVE-2024-28219 by replacing certain functions with strncpy to prevent buffer overflow issues.
Pillow	10.1.0	<10.2.0	show Pillow is potentially vulnerable to DoS attacks through PIL.ImageFont.ImageFont.getmask(). A decompression bomb check has also been added to the affected function.
Pillow	10.1.0	<10.2.0	show Pillow is affected by an arbitrary code execution vulnerability. If an attacker has control over the keys passed to the environment argument of PIL.ImageMath.eval(), they may be able to execute arbitrary code. https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html

Package

Installed

Affected

Info

Pillow

10.1.0

<10.3.0

show

Pillow 10.3.0 introduces a security update addressing CVE-2024-28219 by replacing certain functions with strncpy to prevent buffer overflow issues.

Pillow

10.1.0

<10.2.0

show

Pillow is potentially vulnerable to DoS attacks through PIL.ImageFont.ImageFont.getmask(). A decompression bomb check has also been added to the affected function.

Pillow

10.1.0

<10.2.0

show

Pillow is affected by an arbitrary code execution vulnerability. If an attacker has control over the keys passed to the environment argument of PIL.ImageMath.eval(), they may be able to execute arbitrary code.
https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html

dependabot/pip/pillow-10.2.0

1 year, 7 months ago

8a9fcbb1

Bump pillow from 10.1.0 to 10.2.0 Bumps [pillow](https://github.com/python-pillow/Pillow) from 10.1

No dependencies with known security vulnerabilities.

snyk-fix-6888c76103b86643819941e648e7bba4

1 year, 7 months ago

5bbd029f

fix: requirements.txt to reduce vulnerabilities The following vulnerabilities are fixed by pinning

No dependencies with known security vulnerabilities.

dependabot/pip/development/pillow-10.2.0

1 year, 7 months ago

c6312749

Bump pillow from 10.1.0 to 10.2.0 Bumps [pillow](https://github.com/python-pillow/Pillow) from 10.1

No dependencies with known security vulnerabilities.

dependabot/pip/development/sqlalchemy-2.0.25

1 year, 7 months ago

ad720af1

Bump sqlalchemy from 2.0.22 to 2.0.25 Bumps [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy)

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-01

1 year, 7 months ago

dae892c8

Update mypy from 1.6.1 to 1.8.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-01

1 year, 7 months ago

f2e64ad9

Update pytest from 7.4.3 to 7.4.4

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-01

1 year, 7 months ago

b5f5de61

Update coverage from 6.5.0 to 7.4.0

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-01

1 year, 7 months ago

0f779840

Update sqlalchemy from 2.0.22 to 2.0.24

No dependencies with known security vulnerabilities.

pyup-scheduled-update-2024-01-01

1 year, 7 months ago

eca63d4f

Update matplotlib from 3.7.2 to 3.8.2

No dependencies with known security vulnerabilities.

dependabot/pip/development/sqlalchemy-2.0.24

1 year, 7 months ago

d217bd2d

Bump sqlalchemy from 2.0.22 to 2.0.24 Bumps [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy)

No dependencies with known security vulnerabilities.

dependabot/pip/development/coverage-7.4.0

1 year, 7 months ago

84d0808f

Bump coverage from 6.5.0 to 7.4.0 Bumps [coverage](https://github.com/nedbat/coveragepy) from 6.5.0

No dependencies with known security vulnerabilities.

dependabot/pip/development/pytest-7.4.4

1 year, 7 months ago

822e7b70

Bump pytest from 7.4.3 to 7.4.4 Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.4.3 to

No dependencies with known security vulnerabilities.