Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: fix an issue where package category would not be present #20

Merged
merged 1 commit into from
Sep 24, 2024

Conversation

DimitriKouliche
Copy link
Contributor

No description provided.

Copy link

deps-report 🔍

Commit scanned: a3c90c7

Vulnerable dependencies

7 dependencies have vulnerabilities 😱
Dependency Advisory Versions impacted
aiohttp Aiohttp 3.8.6 updates vendored copy of 'llhttp' to v9.1.3 to include a security fix. GHSA-pjjw-qhg8-p2p9 <3.8.6
black (dev) Affected versions of Black are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service. <24.3.0
certifi (transitive) Certifi 2022.12.07 includes a fix for CVE-2022-23491: Certifi 2022.12.07 removes root certificates from "TrustCor" from the root store. These are in the process of being removed from Mozilla's trust store. TrustCor's root certificates are being removed pursuant to an investigation prompted by media reporting that TrustCor's ownership also operated a business that produced spyware. Conclusions of Mozilla's investigation can be found in the linked google group discussion. GHSA-43fp-rhv2-5gv8 https://groups.google.com/a/mozilla.org/g/dev-security-policy/c/oxX69KFvsm4/m/yLohoVqtCgAJ <2022.12.07
idna (transitive) Affected versions of Idna are vulnerable to Denial Of Service via the idna.encode(), where a specially crafted argument could lead to significant resource consumption. In version 3.7, this function has been updated to reject such inputs efficiently, minimizing resource use. A practical workaround involves enforcing a maximum domain name length of 253 characters before encoding, as the vulnerability is triggered by unusually large inputs that normal operations wouldn't encounter. <3.7
py (dev,transitive) ** DISPUTED ** Py throughout 1.11.0 allows remote attackers to conduct a ReDoS (Regular expression Denial of Service) attack via a Subversion repository with crafted info data because the InfoSvnCommand argument is mishandled. pytest-dev/py#287 <=1.11.0
pygments (dev,transitive) Pygments 2.15.0 includes a fix for CVE-2022-40896: The regular expressions used when parsing Smithy, SQL/SQL+Jinja, and Java properties files were discovered to be vulnerable. As a result, pygmentizing a maliciously-crafted file of these kinds would have resulted in high resources consumption or crashing of the application. https://pyup.io/posts/pyup-discovers-redos-vulnerabilities-in-top-python-packages-part-2 <2.15.0
requests (transitive) Affected versions of Requests, when making requests through a Requests Session, if the first request is made with verify=False to disable cert verification, all subsequent requests to the same host will continue to ignore cert verification regardless of changes to the value of verify. This behavior will continue for the lifecycle of the connection in the connection pool. Requests 2.32.0 fixes the issue, but versions 2.32.0 and 2.32.1 were yanked due to conflicts with CVE-2024-35195 mitigation. <2.32.2

Outdated dependencies

47 outdated dependencies found (including 14 outdated major versions)😢
Dependency Installed version Latest version
attrs (transitive) 22.1.0 24.2.0
black (dev) 22.8.0 24.8.0
certifi (transitive) 2022.6.15 2024.8.30
charset-normalizer (transitive) 2.1.1 3.3.2
flake8 (dev) 5.0.4 7.1.1
iniconfig (dev,transitive) 1.1.1 2.0.0
mypy (dev) 0.971 1.11.2
mypy-extensions (dev,transitive) 0.4.3 1.0.0
packaging 21.3 24.1
platformdirs (dev,transitive) 2.5.2 4.3.6
pyflakes (dev,transitive) 2.5.0 3.2.0
pygithub (transitive) 1.55 2.4.0
pytest (dev) 7.1.2 8.3.3
urllib3 1.26.12 2.2.3
Dependency Installed version Latest version
aiohttp 3.8.1 3.10.5
aiosignal (transitive) 1.2.0 1.3.1
async-timeout (transitive) 4.0.2 4.0.3
beautifulsoup4 4.11.1 4.12.3
cffi (transitive) 1.15.1 1.17.1
click 8.1.3 8.1.7
colorama 0.4.5 0.4.6
deprecated (transitive) 1.2.13 1.2.14
flake8-docstrings (dev) 1.6.0 1.7.0
flake8-pyproject (dev) 1.1.0.post0 1.2.3
frozenlist (transitive) 1.3.1 1.4.1
idna (transitive) 3.3 3.10
isort (dev) 5.10.1 5.13.2
multidict (transitive) 6.0.2 6.1.0
pathspec (dev,transitive) 0.10.0 0.12.1
pluggy (dev,transitive) 1.0.0 1.5.0
pycodestyle (dev,transitive) 2.9.1 2.12.1
pycparser (transitive) 2.21 2.22
pydocstyle (dev,transitive) 6.1.1 6.3.0
pygments (dev,transitive) 2.13.0 2.18.0
pyjwt (transitive) 2.4.0 2.9.0
pyparsing (transitive) 3.0.9 3.1.4
python-dateutil 2.8.2 2.9.0.post0
requests (transitive) 2.28.1 2.32.3
soupsieve (transitive) 2.3.2.post1 2.6
tabulate 0.8.10 0.9.0
types-python-dateutil (dev) 2.8.19 2.9.0.20240906
types-tabulate (dev) 0.8.11 0.9.0.20240106
types-toml (dev) 0.10.8 0.10.8.20240310
typing-extensions (dev,transitive) 4.3.0 4.12.2
wmctrl (dev,transitive) 0.4 0.5
wrapt (transitive) 1.14.1 1.16.0
yarl (transitive) 1.8.1 1.12.1

Logs

@DimitriKouliche DimitriKouliche merged commit dc93916 into master Sep 24, 2024
2 checks passed
@DimitriKouliche DimitriKouliche deleted the hotfix/packages_categories branch September 24, 2024 16:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant