Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update requests to fix CVEs (security) #6062

Closed
wants to merge 21 commits into from
Closed

Update requests to fix CVEs (security) #6062

wants to merge 21 commits into from

Commits on Nov 7, 2023

  1. Bump gitpython to 3.1.37 

    Fixes:
* CVE-2023-40267
* CVE-2023-41040
* CVE-2023-40590
* CVE-2022-24439
* XRAY-198950
    @jk464
    jk464 committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    2bb9a6d View commit details
    Browse the repository at this point in the history

  2. Bump requests to 2.31.0 

    Fixes:
* CVE-2023-32681
    @jk464
    jk464 committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    c6fd050 View commit details
    Browse the repository at this point in the history

  3. Bump importlib-metadata to 4.10.1 

    Fixes:
* XRAY-195083
    @jk464
    jk464 committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    f26c1fb View commit details
    Browse the repository at this point in the history

  4. Bump virtualenv to 20.16.7 

    Fixes:
* CVE-2019-20916
    @jk464
    jk464 committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    ee92b82 View commit details
    Browse the repository at this point in the history

  5. CHANGELOG for CVE fixes StackStorm#6062

    @jk464
    jk464 committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    62f6f27 View commit details
    Browse the repository at this point in the history

  6. Bump, for py3.7+, cryptography to 41.0.4, pyopenssl to 23.2.0 

    Fixes:
* CVE-2023-4807
* CVE-2023-2650
* CVE-2023-3446

For StackStorm on Python 3.8 only
    @jk464
    jk464 committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    38a7f74 View commit details
    Browse the repository at this point in the history

  7. Add support for evaluating requirement markers

    @jk464
    jk464 committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    61b47db View commit details
    Browse the repository at this point in the history

  8. Revert "Add support for evaluating requirement markers" 

    This reverts commit b1aa079357c2e8a7b0f9a30f4fb5f03ac7abec2f.
    @jk464
    jk464 committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    020c261 View commit details
    Browse the repository at this point in the history

  9. Revert "Bump virtualenv to 20.16.7" 

    This reverts commit ee92b82.
    @jk464
    jk464 committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    62835c6 View commit details
    Browse the repository at this point in the history

  10. fixup! Bump importlib-metadata to 4.10.1

    @jk464
    jk464 committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    e733e5d View commit details
    Browse the repository at this point in the history

  11. fixup! Bump importlib-metadata to 4.10.1

    @jk464
    jk464 committed Nov 7, 2023
    Configuration menu
    Copy the full SHA
    21468f1 View commit details
    Browse the repository at this point in the history

Commits on Nov 24, 2023

  1. Merge branch 'master' into bugfix/cves

    @arm4b
    arm4b committed Nov 24, 2023
    Configuration menu
    Copy the full SHA
    9e42739 View commit details
    Browse the repository at this point in the history

  2. Update requests and importlib-metadata only

    @arm4b
    arm4b committed Nov 24, 2023
    Configuration menu
    Copy the full SHA
    e2a07d9 View commit details
    Browse the repository at this point in the history

  3. Update the Changelog

    @arm4b
    arm4b committed Nov 24, 2023
    Configuration menu
    Copy the full SHA
    de32bf6 View commit details
    Browse the repository at this point in the history

  4. Update argcomplete to 1.12.3 to be compatible with importlib-metadata<5 

    See https://kislyuk.github.io/argcomplete/changelog.html#changes-for-v1-12-3-2021-04-19

kislyuk/argcomplete#345
    @arm4b
    arm4b committed Nov 24, 2023
    Configuration menu
    Copy the full SHA
    04e3360 View commit details
    Browse the repository at this point in the history

  5. Add code comments for updated dependencies for py3.6 vs py3.8

    @arm4b
    arm4b committed Nov 24, 2023
    Configuration menu
    Copy the full SHA
    98cb808 View commit details
    Browse the repository at this point in the history

  6. Update st2-auth-ldap sha in pants lock 

    Following the StackStorm/st2-auth-ldap#111
    @arm4b
    arm4b committed Nov 24, 2023
    Configuration menu
    Copy the full SHA
    9c19042 View commit details
    Browse the repository at this point in the history

  7. Workaround conflict when incompatible urllib3 v2 is installed under t… 

    …he py3.6
    @arm4b
    arm4b committed Nov 24, 2023
    Configuration menu
    Copy the full SHA
    c7f13e7 View commit details
    Browse the repository at this point in the history

  8. Try1: fix urllib3 py3.6

    @arm4b
    arm4b committed Nov 24, 2023
    Configuration menu
    Copy the full SHA
    0a553fd View commit details
    Browse the repository at this point in the history

  9. Revert urllib3 py3.6 workarounds

    @arm4b
    arm4b committed Nov 24, 2023
    Configuration menu
    Copy the full SHA
    0d94e19 View commit details
    Browse the repository at this point in the history

Commits on Nov 27, 2023

  1. Merge branch 'master' into bugfix/cves

    @arm4b
    arm4b committed Nov 27, 2023
    Configuration menu
    Copy the full SHA
    e16b325 View commit details
    Browse the repository at this point in the history