-
Notifications
You must be signed in to change notification settings - Fork 143
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore(deps): update dependency certifi to v2024 [security] #1376
chore(deps): update dependency certifi to v2024 [security] #1376
Conversation
Hi @renovate[bot]. Thanks for your PR. I'm waiting for a janus-idp member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
The image is available at: |
7c0b494
to
315dff7
Compare
The image is available at: |
/ok-to-test |
verified this update does not cause dependency conflicts |
Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
315dff7
to
7e66c9a
Compare
Quality Gate passedIssues Measures |
The image is available at: |
/lgtm |
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: kim-tsao The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
This PR contains the following updates:
==2023.11.17
->==2024.7.4
GitHub Vulnerability Alerts
CVE-2024-39689
Certifi 2024.07.04 removes root certificates from "GLOBALTRUST" from the root store. These are in the process of being removed from Mozilla's trust store.
GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues". Conclusions of Mozilla's investigation can be found here.
Certifi removes GLOBALTRUST root certificate
CVE-2024-39689 / GHSA-248v-346w-9cwc
More information
Details
Certifi 2024.07.04 removes root certificates from "GLOBALTRUST" from the root store. These are in the process of being removed from Mozilla's trust store.
GLOBALTRUST's root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues". Conclusions of Mozilla's investigation can be found here.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References
This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).
Release Notes
certifi/python-certifi (certifi)
v2024.7.4
Compare Source
v2024.6.2
Compare Source
v2024.2.2
Compare Source
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.