Safety CI > toonarmycaptain/dionysus

dependabot/pip/development/sqlalchemy-2.0.10

2 years, 6 months ago

c1be2ecc

Bump sqlalchemy from 2.0.9 to 2.0.10 Bumps [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) f

No dependencies with known security vulnerabilities.

master

2 years, 6 months ago

ab243ac9

Merge pull request #612 from toonarmycaptain/development Pull recent changes, CI/dependencies/

No dependencies with known security vulnerabilities.

development

2 years, 6 months ago

00b80b1f

Merge branch 'master' into development

No dependencies with known security vulnerabilities.

development

2 years, 6 months ago

9b63e6d8

Update CHANGELOG.md

No dependencies with known security vulnerabilities.

snyk-fix-c94008154dbc8a1e56c069b6435f281b

2 years, 6 months ago

1b01a5e3

fix: requirements.txt to reduce vulnerabilities The following vulnerabilities are fixed by pinning

Pillow 9.2.0 and sqlalchemy 1.4.29 have known security vulnerabilities.

Package	Installed	Affected	Info
Pillow	9.2.0	>=2.5.0,<10.0.1	show Pillow 10.0.1 updates its C dependency 'libwebp' to 1.3.2 to include a fix for a high-risk vulnerability. https://pillow.readthedocs.io/en/stable/releasenotes/10.0.1.html
Pillow	9.2.0	>=9.2.0,<9.3.0	show Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. https://pillow.readthedocs.io/en/stable/releasenotes/9.3.0.html#limit-samplesperpixel-to-avoid-runtime-dos
Pillow	9.2.0	<10.3.0	show Pillow 10.3.0 introduces a security update addressing CVE-2024-28219 by replacing certain functions with strncpy to prevent buffer overflow issues.
Pillow	9.2.0	<10.2.0	show Pillow is affected by an arbitrary code execution vulnerability. If an attacker has control over the keys passed to the environment argument of PIL.ImageMath.eval(), they may be able to execute arbitrary code. https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html
Pillow	9.2.0	<10.0.0	show Pillow 10.0.0 includes a fix for CVE-2023-44271: Denial of Service that uncontrollably allocates memory to process a given task, potentially causing a service to crash by having it run out of memory. This occurs for truetype in ImageFont when textlength in an ImageDraw instance operates on a long text argument. https://github.com/python-pillow/Pillow/pull/7244
Pillow	9.2.0	>=9.1.0,<9.3.0	show Pillow 9.3.0 includes a security fix: Pillow will now decode the data in its natural CMYK mode, then convert it to RGB and rearrange the channels afterwards. Trying to load the data in an incorrect mode could result in a segmentation fault. https://pillow.readthedocs.io/en/stable/releasenotes/9.3.0.html#decode-jpeg-compressed-blp1-data-in-original-mode
Pillow	9.2.0	<10.2.0	show Pillow is potentially vulnerable to DoS attacks through PIL.ImageFont.ImageFont.getmask(). A decompression bomb check has also been added to the affected function.
sqlalchemy	1.4.29	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563

dependabot/pip/development/coverage-7.2.3

2 years, 6 months ago

3753330b

Bump coverage from 6.5.0 to 7.2.3 Bumps [coverage](https://github.com/nedbat/coveragepy) from 6.5.0

No dependencies with known security vulnerabilities.

development

2 years, 6 months ago

74fc2ac3

Merge pull request #610 from toonarmycaptain/dependabot/pip/development/pytest-7.3.1 Bump pytest fr

No dependencies with known security vulnerabilities.

development

2 years, 6 months ago

5d89964f

Merge pull request #609 from toonarmycaptain/dependabot/pip/development/sqlalchemy-2.0.9 Bump sqlal

No dependencies with known security vulnerabilities.

dependabot/pip/development/pytest-7.3.1

2 years, 6 months ago

4d47a4e0

Bump pytest from 7.3.0 to 7.3.1 Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.3.0 to

No dependencies with known security vulnerabilities.

dependabot/pip/development/sqlalchemy-2.0.9

2 years, 6 months ago

edbce4f7

Bump sqlalchemy from 2.0.3 to 2.0.9 Bumps [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) fr

No dependencies with known security vulnerabilities.

development

2 years, 6 months ago

89617a42

Merge pull request #592 from toonarmycaptain/dependabot/pip/development/sqlalchemy-2.0.3 Bump sqlal

No dependencies with known security vulnerabilities.

dependabot/pip/development/sqlalchemy-2.0.3

2 years, 6 months ago

8302075f

Rm sqlalchemy2-stubs, explicitly declare sqlalchemy mypy plugin.

No dependencies with known security vulnerabilities.

dependabot/pip/development/coverage-7.2.3

2 years, 6 months ago

32dce300

Bump coverage from 6.5.0 to 7.2.3 Bumps [coverage](https://github.com/nedbat/coveragepy) from 6.5.0

sqlalchemy 1.4.46 has known security vulnerabilities.

Package	Installed	Affected	Info
sqlalchemy	1.4.46	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563

development

2 years, 6 months ago

f9dae8f8

Change get_avatar_path to abstract method, rm NotImplemented

sqlalchemy 1.4.46 has known security vulnerabilities.

Package	Installed	Affected	Info
sqlalchemy	1.4.46	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563

dependabot/pip/development/coverage-7.2.3

2 years, 6 months ago

47569146

Bump coverage from 6.5.0 to 7.2.3 Bumps [coverage](https://github.com/nedbat/coveragepy) from 6.5.0

sqlalchemy 1.4.46 has known security vulnerabilities.

Package	Installed	Affected	Info
sqlalchemy	1.4.46	<2.0.0b1	show Sqlalchemy 2.0.0b1 avoids leaking cleartext passwords to the open for careless uses of str(engine.URL()) in logs and prints. https://github.com/sqlalchemy/sqlalchemy/pull/8563