Update dependency urllib3 to v1.26.5 [SECURITY] #43
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
⚠ Artifact update problemRenovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below: File name: Pipfile.lock |
renovate
bot
force-pushed
the
renovate/pypi-urllib3-vulnerability
branch
from
aa7c6d1 to
2e0d6d8
Compare
renovate
bot
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==1.25.10->==1.26.5==1.25.10->==1.26.5GitHub Vulnerability Alerts
CVE-2021-33503
Impact
When provided with a URL containing many
@characters in the authority component the authority regular expression exhibits catastrophic backtracking causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.Patches
The issue has been fixed in urllib3 v1.26.5.
References
For more information
If you have any questions or comments about this advisory:
Release Notes
urllib3/urllib3
v1.26.5Compare Source
===================
sixlibrary to 1.16.0.the authority component.
v1.26.4Compare Source
===================
SSLContextwhen connecting to HTTPS proxyduring HTTPS requests. The default
SSLContextnow setscheck_hostname=True.v1.26.3Compare Source
===================
Fixed bytes and string comparison issue with headers (Pull #2141)
Changed
ProxySchemeUnknownerror message to bemore actionable if the user supplies a proxy URL without
a scheme. (Pull #2107)
v1.26.2Compare Source
===================
wrap_socketandCERT_REQUIREDwouldn'tbe imported properly on Python 2.7.8 and earlier (Pull #2052)
v1.26.1Compare Source
===================
User-Agentheaders would be sent if aUser-Agentheader key is passed asbytes(Pull #2047)v1.26.0Compare Source
===================
NOTE: urllib3 v2.0 will drop support for Python 2.
Read more in the v2.0 Roadmap <https://urllib3.readthedocs.io/en/latest/v2-roadmap.html>_.Added support for HTTPS proxies contacting HTTPS servers (Pull #1923, Pull #1806)
Deprecated negotiating TLSv1 and TLSv1.1 by default. Users that
still wish to use TLS earlier than 1.2 without a deprecation warning
should opt-in explicitly by setting
ssl_version=ssl.PROTOCOL_TLSv1_1(Pull #2002)Starting in urllib3 v2.0: Connections that receive a
DeprecationWarningwill failDeprecated
RetryoptionsRetry.DEFAULT_METHOD_WHITELIST,Retry.DEFAULT_REDIRECT_HEADERS_BLACKLISTand
Retry(method_whitelist=...)in favor ofRetry.DEFAULT_ALLOWED_METHODS,Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT, andRetry(allowed_methods=...)(Pull #2000) Starting in urllib3 v2.0: Deprecated options will be removed
Added default
User-Agentheader to every request (Pull #1750)Added
urllib3.util.SKIP_HEADERfor skippingUser-Agent,Accept-Encoding,and
Hostheaders from being automatically emitted with requests (Pull #2018)Collapse
transfer-encoding: chunkedrequest data and framing intothe same
socket.send()call (Pull #1906)Send
http/1.1ALPN identifier with every TLS handshake by default (Pull #1894)Properly terminate SecureTransport connections when CA verification fails (Pull #1977)
Don't emit an
SNIMissingWarningwhen passingserver_hostname=Noneto SecureTransport (Pull #1903)
Disabled requesting TLSv1.2 session tickets as they weren't being used by urllib3 (Pull #1970)
Suppress
BrokenPipeErrorwhen writing request body after the serverhas closed the socket (Pull #1524)
Wrap
ssl.SSLErrorthat can be raised from reading a socket (e.g. "bad MAC")into an
urllib3.exceptions.SSLError(Pull #1939)v1.25.11Compare Source
====================
Fix retry backoff time parsed from
Retry-Afterheader when givenin the HTTP date format. The HTTP date was parsed as the local timezone
rather than accounting for the timezone in the HTTP date (typically
UTC) (Pull #1932, Pull #1935, Pull #1938, Pull #1949)
Fix issue where an error would be raised when the
SSLKEYLOGFILEenvironment variable was set to the empty string. Now
SSLContext.keylog_fileis not set in this situation (Pull #2016)
Configuration
📅 Schedule: "" (UTC).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR has been generated by WhiteSource Renovate. View repository job log here.