Bump setuptools from 40.2.0 to 65.5.1 by dependabot[bot] · Pull Request #11 · threatworx/twigs

dependabot · 2022-12-27T15:34:37Z

Bumps setuptools from 40.2.0 to 65.5.1.

Release notes

v65.5.1

No release notes provided.

v65.5.0

No release notes provided.

v65.4.1

No release notes provided.

v65.4.0

No release notes provided.

v65.3.0

No release notes provided.

v65.2.0

No release notes provided.

v65.1.1

No release notes provided.

v65.1.0

No release notes provided.

v65.0.2

No release notes provided.

v65.0.1

No release notes provided.

v65.0.0

No release notes provided.

v64.0.3

No release notes provided.

v64.0.2

No release notes provided.

v64.0.1

No release notes provided.

v64.0.0

No release notes provided.

v63.4.3

No release notes provided.

v63.4.2

No release notes provided.

... (truncated)

Changelog

Sourced from setuptools's changelog.

v65.5.1

Misc ^^^^

#3638: Drop a test dependency on the mock package, always use :external+python:py:mod:unittest.mock -- by :user:hroncok

#3659: Fixed REDoS vector in package_index.

v65.5.0

Changes ^^^^^^^

#3624: Fixed editable install for multi-module/no-package src-layout projects.

#3626: Minor refactorings to support distutils using stdlib logging module.

Documentation changes ^^^^^^^^^^^^^^^^^^^^^

#3419: Updated the example version numbers to be compliant with PEP-440 on the "Specifying Your Project’s Version" page of the user guide.

Misc ^^^^

#3569: Improved information about conflicting entries in the current working directory and editable install (in documentation and as an informational warning).

#3576: Updated version of validate_pyproject.

v65.4.1

Misc ^^^^

#3613: Fixed encoding errors in expand.StaticModule when system default encoding doesn't match expectations for source files.

#3617: Merge with pypa/distutils@6852b20 including fix for pypa/distutils#181.

v65.4.0

Changes ^^^^^^^

#3609: Merge with pypa/distutils@d82d926 including support for DIST_EXTRA_CONFIG in pypa/distutils#177.

v65.3.0

... (truncated)

Commits

a462cb5 Bump version: 65.5.0 → 65.5.1
de35d8b Merge pull request #3656 from bmorris3/typos
58e23de Update changelog. Ref #3659.
43a9c9b Limit the amount of whitespace to search/backtrack. Fixes #3659.
5791343 Add test capturing failed expectation. Ref #3659.
1f97905 ⚫ Fade to black.
6254567 Remove workaround for emacs.
729b180 ⚫ Fade to black.
c068081 Typo corrections
f777a40 Suppress deprecation warning in --rsyncdir. Workaround for #3655.
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
@dependabot use these labels will set the current labels as the default for future PRs for this repo and language
@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [setuptools](https://github.com/pypa/setuptools) from 40.2.0 to 65.5.1. - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/CHANGES.rst) - [Commits](pypa/setuptools@v40.2.0...v65.5.1) --- updated-dependencies: - dependency-name: setuptools dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

ghost · 2022-12-27T15:34:41Z

ThreatWorx vulnerability assessment initiated

ghost · 2022-12-27T15:35:53Z

Below is the list of new vulnerabilities introduced in this pull request:


Vulnerability ID	CVE-2022-24302
CVSS Score	4.3
Reference	https://www.paramiko.org/changelog.html
Affected Dependency	paramiko 2.6.0
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	Upgrade paramiko to version >=2.10.1


Vulnerability ID	T1434634
CVSS Score	10.0
Reference	GHSA-8q59-q68h-6hv4
Affected Dependency	pyyaml 5.1
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	Upgrade pyyaml to version !=5.1


Vulnerability ID	CVE-2020-14343
CVSS Score	10.0
Reference	GHSA-8q59-q68h-6hv4
Affected Dependency	pyyaml 5.1
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	Upgrade pyyaml to version >=5.4


Vulnerability ID	CVE-2022-3996
CVSS Score	6.4
Reference	openssl/openssl@`4d0340a`
Affected Dependency	cryptography 3.3.2
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	Upgrade cryptography to latest available version


Vulnerability ID	CVE-2013-1633
CVSS Score	6.8
Reference	https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1633
Affected Dependency	setuptools 65.5.1
Dependency found in file	requirements.txt
Recommendation	Upgrade setuptools to version <0.7


Vulnerability ID	CVE-2021-29921
CVSS Score	7.5
Reference	https://bugzilla.redhat.com/show_bug.cgi?id=1957458
Affected Dependency	ipaddress 1.0.22
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	Upgrade ipaddress to latest available version


Vulnerability ID	T1413587
CVSS Score	6.4
Reference	GHSA-rhm9-p9w5-fwm7
Affected Dependency	cryptography 3.3.2
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	Upgrade cryptography to version <=3.1


Vulnerability ID	CVE-2018-18074
CVSS Score	5.0
Reference	GHSA-x84v-xcm2-53pg
Affected Dependency	requests
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	None


Vulnerability ID	T1095947
CVSS Score	0
Reference	pyca/cryptography#2334
Affected Dependency	cryptography 3.3.2
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	Upgrade cryptography to version <1.1


Vulnerability ID	CVE-2020-1747
CVSS Score	10.0
Reference	yaml/pyyaml@`5080ba5`
Affected Dependency	pyyaml 5.1
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	Upgrade pyyaml to latest available version


Vulnerability ID	CVE-2015-2296
CVSS Score	5.0
Reference	kennethreitz/requests@`3bd8afb`
Affected Dependency	requests
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	None


Vulnerability ID	T1148760
CVSS Score	8.5
Reference	https://github.com/pypa/setuptools/blob/master/CHANGES.rst#30
Affected Dependency	setuptools
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	None


Vulnerability ID	T1108727
CVSS Score	0
Reference	psf/requests#3422
Affected Dependency	requests
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	None


Vulnerability ID	T1286044
CVSS Score	7.5
Reference	yaml/pyyaml#420
Affected Dependency	pyyaml 5.1
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	Upgrade pyyaml to latest available version


Vulnerability ID	CVE-2016-9243
CVSS Score	5.0
Reference	https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-9243
Affected Dependency	cryptography 3.3.2
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	Upgrade cryptography to version <1.5.2


Vulnerability ID	CVE-2020-25659
CVSS Score	4.3
Reference	pyca/cryptography@`58494b4`
Affected Dependency	cryptography 3.3.2
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	Upgrade cryptography to latest available version


Vulnerability ID	T1482004
CVSS Score	5.0
Reference	pypa/setuptools@`58e23de`
Affected Dependency	setuptools
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	None


Vulnerability ID	CVE-2013-1633
CVSS Score	6.8
Reference	https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1633
Affected Dependency	setuptools
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	None


Vulnerability ID	CVE-2020-14422
CVSS Score	3.2
Reference	phihag/ipaddress#55
Affected Dependency	ipaddress 1.0.22
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	Upgrade ipaddress to latest available version


Vulnerability ID	T1124113
CVSS Score	5.0
Reference	boto/boto3#1017
Affected Dependency	boto3
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	None


Vulnerability ID	CVE-2013-7440
CVSS Score	4.3
Reference	https://bugs.python.org/issue17997
Affected Dependency	setuptools
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	None


Vulnerability ID	T1321777
CVSS Score	5.0
Reference	phihag/ipaddress#56 (comment)
Affected Dependency	ipaddress 1.0.22
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	Upgrade ipaddress to latest available version


Vulnerability ID	CVE-2014-1830
CVSS Score	5.0
Reference	https://github.com/kennethreitz/requests/issues/1885
Affected Dependency	requests
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	None


Vulnerability ID	CVE-2014-1829
CVSS Score	5.0
Reference	https://github.com/kennethreitz/requests/issues/1885
Affected Dependency	requests
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	None


Vulnerability ID	CVE-2013-2099
CVSS Score	3.2
Reference	https://bugs.python.org/issue17980
Affected Dependency	setuptools
Dependency found in file	/tmp/tmpvuef_1ih/setup.py
Recommendation	None

dependabot bot added the dependencies Pull requests that update a dependency file label Dec 27, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump setuptools from 40.2.0 to 65.5.1#11

Bump setuptools from 40.2.0 to 65.5.1#11
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/pip/setuptools-65.5.1

dependabot bot commented on behalf of github Dec 27, 2022

Uh oh!

ghost commented Dec 27, 2022

Uh oh!

ghost commented Dec 27, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Dec 27, 2022

v65.5.1

v65.5.0

v65.4.1

v65.4.0

v65.3.0

v65.2.0

v65.1.1

v65.1.0

v65.0.2

v65.0.1

v65.0.0

v64.0.3

v64.0.2

v64.0.1

v64.0.0

v63.4.3

v63.4.2

v65.5.1

v65.5.0

v65.4.1

v65.4.0

Uh oh!

ghost commented Dec 27, 2022

Uh oh!

ghost commented Dec 27, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants