2
0
Fork 1

Update dependency requests to v2.31.0 #15

Zusammengeführt
nickslowinski hat 1 Commit von renovate/requests-2.x nach main 2023-06-25 15:54:06 +02:00 zusammengeführt
Mitglied

This PR contains the following updates:

Package Update Change
requests (source, changelog) minor ==2.28.2 -> ==2.31.0

Release Notes

psf/requests (requests)

v2.31.0

Compare Source

Security

  • Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential
    forwarding of Proxy-Authorization headers to destination servers when
    following HTTPS redirects.

    When proxies are defined with user info (https://user:pass@proxy:8080), Requests
    will construct a Proxy-Authorization header that is attached to the request to
    authenticate with the proxy.

    In cases where Requests receives a redirect response, it previously reattached
    the Proxy-Authorization header incorrectly, resulting in the value being
    sent through the tunneled connection to the destination server. Users who rely on
    defining their proxy credentials in the URL are strongly encouraged to upgrade
    to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy
    credentials once the change has been fully deployed.

    Users who do not use a proxy or do not supply their proxy credentials through
    the user information portion of their proxy URL are not subject to this
    vulnerability.

    Full details can be read in our Github Security Advisory
    and CVE-2023-32681.

v2.30.0

Compare Source

Dependencies

v2.29.0

Compare Source

Improvements

  • Requests now defers chunked requests to the urllib3 implementation to improve
    standardization. (#​6226)
  • Requests relaxes header component requirements to support bytes/str subclasses. (#​6356)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [requests](https://requests.readthedocs.io) ([source](https://github.com/psf/requests), [changelog](https://github.com/psf/requests/blob/master/HISTORY.md)) | minor | `==2.28.2` -> `==2.31.0` | --- ### Release Notes <details> <summary>psf/requests (requests)</summary> ### [`v2.31.0`](https://github.com/psf/requests/blob/HEAD/HISTORY.md#&#8203;2310-2023-05-22) [Compare Source](https://github.com/psf/requests/compare/v2.30.0...v2.31.0) **Security** - Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential forwarding of `Proxy-Authorization` headers to destination servers when following HTTPS redirects. When proxies are defined with user info (https://user:pass@proxy:8080), Requests will construct a `Proxy-Authorization` header that is attached to the request to authenticate with the proxy. In cases where Requests receives a redirect response, it previously reattached the `Proxy-Authorization` header incorrectly, resulting in the value being sent through the tunneled connection to the destination server. Users who rely on defining their proxy credentials in the URL are *strongly* encouraged to upgrade to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy credentials once the change has been fully deployed. Users who do not use a proxy or do not supply their proxy credentials through the user information portion of their proxy URL are not subject to this vulnerability. Full details can be read in our [Github Security Advisory](https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q) and [CVE-2023-32681](https://nvd.nist.gov/vuln/detail/CVE-2023-32681). ### [`v2.30.0`](https://github.com/psf/requests/blob/HEAD/HISTORY.md#&#8203;2300-2023-05-03) [Compare Source](https://github.com/psf/requests/compare/v2.29.0...v2.30.0) **Dependencies** - ⚠️ Added support for urllib3 2.0. ⚠️ This may contain minor breaking changes so we advise careful testing and reviewing https://urllib3.readthedocs.io/en/latest/v2-migration-guide.html prior to upgrading. Users who wish to stay on urllib3 1.x can pin to `urllib3<2`. ### [`v2.29.0`](https://github.com/psf/requests/blob/HEAD/HISTORY.md#&#8203;2290-2023-04-26) [Compare Source](https://github.com/psf/requests/compare/v2.28.2...v2.29.0) **Improvements** - Requests now defers chunked requests to the urllib3 implementation to improve standardization. ([#&#8203;6226](https://github.com/psf/requests/issues/6226)) - Requests relaxes header component requirements to support bytes/str subclasses. ([#&#8203;6356](https://github.com/psf/requests/issues/6356)) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNS4xMzcuMCIsInVwZGF0ZWRJblZlciI6IjM1LjEzNy4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiJ9-->
renovate-bot hat 1 Commit 2023-06-25 15:32:22 +02:00 hinzugefügt
renovate-bot hat 2023-06-25 15:44:47 +02:00 renovate/requests-2.x von d8b2228809 zu 856f740b85 force-gepusht Vergleichen
renovate-bot hat 2023-06-25 15:50:34 +02:00 renovate/requests-2.x von 856f740b85 zu 4d3ce3a34c force-gepusht Vergleichen
nickslowinski hat Commit 6fafa4a796 in main 2023-06-25 15:54:06 +02:00 zusammengeführt
Anmelden, um an der Diskussion teilzunehmen.
Keine Reviewer
Kein Meilenstein
Kein Projekt
Niemand zuständig
1 Beteiligter
Nachrichten
Fällig am
Das Fälligkeitsdatum ist ungültig oder außerhalb des zulässigen Bereichs. Bitte verwende das Format „jjjj-mm-tt“.

Kein Fälligkeitsdatum gesetzt.

Abhängigkeiten

Keine Abhängigkeiten gesetzt.

Referenz: nick-slowinski.de/docs#15
Keine Beschreibung angegeben.