Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump py7zr from 0.11.3 to 0.20.2 in /shuffle-tools/1.2.0 #328

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Dec 6, 2022

Bumps py7zr from 0.11.3 to 0.20.2.

Release notes

Sourced from py7zr's releases.

v0.20.2: Fix bad path checker

No release notes provided.

Release v0.20.0

No release notes provided.

v0.19.2: Security fix backport

Backport secuirty fix and improvements from v0.20.2

v0.19.0

No release notes provided.

v0.18.2: secuirty fix backport

Backport secuirty fix and improvements from v0.20.2

v0.18.10

No release notes provided.

v0.18.9

No release notes provided.

v0.18.7

No release notes provided.

v0.18.6

No release notes provided.

v0.18.5

No release notes provided.

v0.18.4

No release notes provided.

v0.18.3

No release notes provided.

v0.18.1

No release notes provided.

v0.18.0

No release notes provided.

v0.17.4

No release notes provided.

v0.17.3

No release notes provided.

v0.17.2

No release notes provided.

... (truncated)

Changelog

Sourced from py7zr's changelog.

v0.20.2_

Fixed

  • Fix error with good path data, when detecting wrong path with new canonical_path(), and drop resolve() call on path.

v0.20.1_

Security

  • Fix sanity check for path traversal attack(#480)
  • Add path checker in writef() and writestr() methods that ignores evil pass.
    • When pass arcname as evil path such as "../../../../tmp/evil.sh"
    • it raises ValueError
  • Check symlink and junction is under target folder when extraction

v0.20.0_

Added

  • Support enhanced deflate compression.(#472)

Changed

  • Bump setuptools@63 and setuptools_scm@7 (#473)
  • CI: update script (#473)
  • Update tox config (#473)
  • Actions: change pypy version to 3.7 (#473)
  • Update readthedocs.yml (#473)

Deprecated

  • Deprecate Python 3.6 support (#473)

v0.19.0_

Changed

  • Replace deflate64(tm) decompressor to inflate64(#459)
  • test: improve checks of deflate64 case(#463)

... (truncated)

Commits
  • 777f408 Release v0.20.2
  • 3c3c5c0 Merge pull request #483 from miurahr/topic/miurahr/security/get-canonical-path
  • 1a61ba2 Introduce helpers.canonical_path()
  • 35b32f5 Merge pull request #481 from miurahr/topic/miurahr/security/symlink-attack-test
  • f6220b0 Add test against symlink attach
  • 3b83939 Release v0.20.1
  • 3a4b4de Merge pull request #480 from miurahr/topic/miurahr/security/fix-check-logic-z...
  • 8366b67 Update Changelog.rst
  • 1bb43f1 Fix sanity check for path traversal attack
  • 04e3af5 Bump inflate64@v0.3.1
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [py7zr](https://github.com/miurahr/py7zr) from 0.11.3 to 0.20.2.
- [Release notes](https://github.com/miurahr/py7zr/releases)
- [Changelog](https://github.com/miurahr/py7zr/blob/master/docs/Changelog.rst)
- [Commits](miurahr/py7zr@v0.11.3...v0.20.2)

---
updated-dependencies:
- dependency-name: py7zr
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Dec 6, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants