Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fixing Vulnerabilities #8

Open
wants to merge 127 commits into
base: master
Choose a base branch
from
Open

Fixing Vulnerabilities #8

wants to merge 127 commits into from

Conversation

4k4xs4pH1r3
Copy link

Please look at the commits to view each file's details and their objectives.

snyk-bot and others added 12 commits December 15, 2021 12:52
@snyk-bot
fix: requirements.txt to reduce vulnerabilities
dd1a80c 
The following vulnerabilities are fixed by pinning transitive dependencies:
- https://snyk.io/vuln/SNYK-PYTHON-LXML-2316995
@mend-bolt-for-github
Add .whitesource configuration file
9408a30
@dependabot
Bump certifi from 2018.11.29 to 2023.7.22
2b07231 
Bumps [certifi](https://github.com/certifi/python-certifi) from 2018.11.29 to 2023.7.22.
- [Commits](certifi/python-certifi@2018.11.29...2023.07.22)

---
updated-dependencies:
- dependency-name: certifi
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@4k4xs4pH1r3
Merge pull request #1 from 4k4xs4pH1r3/snyk-fix-5f4b09b2a58e9754b3fbf…
639c625 
…d6982dbd997

[Snyk] Security upgrade lxml from 4.3.2 to 4.6.5
@4k4xs4pH1r3
Merge pull request #2 from 4k4xs4pH1r3/whitesource/configure
9720f42 
Configure WhiteSource Bolt for GitHub
@dependabot
Bump cryptography from 2.6.dev1 to 41.0.3
6267621 
Bumps [cryptography](https://github.com/pyca/cryptography) from 2.6.dev1 to 41.0.3.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/commits/41.0.3)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump future from 0.16.0 to 0.18.3
1ff3032 
Bumps [future](https://github.com/PythonCharmers/python-future) from 0.16.0 to 0.18.3.
- [Release notes](https://github.com/PythonCharmers/python-future/releases)
- [Changelog](https://github.com/PythonCharmers/python-future/blob/master/docs/changelog.rst)
- [Commits](PythonCharmers/python-future@v0.16.0...v0.18.3)

---
updated-dependencies:
- dependency-name: future
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@4k4xs4pH1r3
Merge pull request #4 from 4k4xs4pH1r3/dependabot/pip/certifi-2023.7.22
318281e 
Bump certifi from 2018.11.29 to 2023.7.22
@4k4xs4pH1r3
Merge pull request #5 from 4k4xs4pH1r3/dependabot/pip/future-0.18.3
82687bc 
Bump future from 0.16.0 to 0.18.3
@dependabot
Bump lxml from 4.3.2 to 4.9.1
dacfeb8 
Bumps [lxml](https://github.com/lxml/lxml) from 4.3.2 to 4.9.1.
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-4.3.2...lxml-4.9.1)

---
updated-dependencies:
- dependency-name: lxml
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@4k4xs4pH1r3
Merge pull request #6 from 4k4xs4pH1r3/dependabot/pip/cryptography-41…
c82db01 
….0.3

Bump cryptography from 2.6.dev1 to 41.0.3
@4k4xs4pH1r3
Merge pull request #7 from 4k4xs4pH1r3/dependabot/pip/lxml-4.9.1
877cc46 
Bump lxml from 4.3.2 to 4.9.1
@google-cla
Copy link

google-cla bot commented Aug 10, 2023

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

dependabot bot and others added 17 commits November 28, 2023 23:55
@dependabot
Bump cryptography from 41.0.3 to 41.0.6
685c53b 
Bumps [cryptography](https://github.com/pyca/cryptography) from 41.0.3 to 41.0.6.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@41.0.3...41.0.6)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@step-security-bot
[StepSecurity] Apply security best practices
49ab830 
Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
@4k4xs4pH1r3
Merge pull request #12 from step-security-bot/stepsecurity_remediatio…
7049943 
…n_1709550625

[StepSecurity] Apply security best practices
@4k4xs4pH1r3
Merge pull request #9 from 4k4xs4pH1r3/dependabot/pip/cryptography-41…
5814c84 
….0.6

Bump cryptography from 41.0.3 to 41.0.6
@dependabot
Bump cryptography from 41.0.6 to 42.0.4
431e67d 
Bumps [cryptography](https://github.com/pyca/cryptography) from 41.0.6 to 42.0.4.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@41.0.6...42.0.4)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@4k4xs4pH1r3
Merge pull request #13 from 4k4xs4pH1r3/dependabot/pip/cryptography-4…
9fed023 
…2.0.4

Bump cryptography from 41.0.6 to 42.0.4
@dependabot
Bump signxml from 2.6.0 to 3.2.2
d568b6f 
Bumps [signxml](https://github.com/kislyuk/signxml) from 2.6.0 to 3.2.2.
- [Release notes](https://github.com/kislyuk/signxml/releases)
- [Changelog](https://github.com/XML-Security/signxml/blob/develop/Changes.rst)
- [Commits](XML-Security/signxml@v2.6.0...v3.2.2)

---
updated-dependencies:
- dependency-name: signxml
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump future from 0.18.3 to 1.0.0
a43be13 
Bumps [future](https://github.com/PythonCharmers/python-future) from 0.18.3 to 1.0.0.
- [Release notes](https://github.com/PythonCharmers/python-future/releases)
- [Changelog](https://github.com/PythonCharmers/python-future/blob/master/docs/changelog.rst)
- [Commits](PythonCharmers/python-future@v0.18.3...v1.0.0)

---
updated-dependencies:
- dependency-name: future
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump asn1crypto from 0.24.0 to 1.5.1
79fc892 
Bumps [asn1crypto](https://github.com/wbond/asn1crypto) from 0.24.0 to 1.5.1.
- [Changelog](https://github.com/wbond/asn1crypto/blob/master/changelog.md)
- [Commits](wbond/asn1crypto@0.24.0...1.5.1)

---
updated-dependencies:
- dependency-name: asn1crypto
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@4k4xs4pH1r3
Merge pull request #25 from 4k4xs4pH1r3/dependabot/pip/signxml-3.2.2
aae149e 
Bump signxml from 2.6.0 to 3.2.2
@4k4xs4pH1r3
Merge branch 'master' into dependabot/pip/future-1.0.0
aa18683
@4k4xs4pH1r3
Merge pull request #27 from 4k4xs4pH1r3/dependabot/pip/future-1.0.0
5cd4456 
Bump future from 0.18.3 to 1.0.0
@4k4xs4pH1r3
Merge branch 'master' into dependabot/pip/asn1crypto-1.5.1
753938b
@4k4xs4pH1r3
Merge pull request #28 from 4k4xs4pH1r3/dependabot/pip/asn1crypto-1.5.1
151df52 
Bump asn1crypto from 0.24.0 to 1.5.1
@dependabot
Bump certifi from 2023.7.22 to 2024.2.2
ab0817f 
Bumps [certifi](https://github.com/certifi/python-certifi) from 2023.7.22 to 2024.2.2.
- [Commits](certifi/python-certifi@2023.07.22...2024.02.02)

---
updated-dependencies:
- dependency-name: certifi
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@4k4xs4pH1r3
Merge pull request #29 from 4k4xs4pH1r3/dependabot/pip/certifi-2024.2.2
0c7d66f 
Bump certifi from 2023.7.22 to 2024.2.2
@dependabot
Bump six from 1.12.0 to 1.16.0
bed1db2 
Bumps [six](https://github.com/benjaminp/six) from 1.12.0 to 1.16.0.
- [Changelog](https://github.com/benjaminp/six/blob/master/CHANGES)
- [Commits](benjaminp/six@1.12.0...1.16.0)

---
updated-dependencies:
- dependency-name: six
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
4k4xs4pH1r3 and others added 30 commits August 8, 2024 19:59
@4k4xs4pH1r3
Update auto_merge.yml
318c390 
Signed-off-by: ҉αkα x⠠⠵ <32862241+4k4xs4pH1r3@users.noreply.github.com>
@4k4xs4pH1r3
Merge branch 'master' into master
f986c2f
@dependabot
Bump lxml from 5.2.2 to 5.3.0
25ba45b 
Bumps [lxml](https://github.com/lxml/lxml) from 5.2.2 to 5.3.0.
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-5.2.2...lxml-5.3.0)

---
updated-dependencies:
- dependency-name: lxml
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Merge branch 'dependabot/pip/lxml-5.3.0'
cb30915
@dependabot
Bump signxml from 3.2.2 to 4.0.0
53149eb 
Bumps [signxml](https://github.com/kislyuk/signxml) from 3.2.2 to 4.0.0.
- [Release notes](https://github.com/kislyuk/signxml/releases)
- [Changelog](https://github.com/XML-Security/signxml/blob/develop/Changes.rst)
- [Commits](XML-Security/signxml@v3.2.2...v4.0.0)

---
updated-dependencies:
- dependency-name: signxml
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Merge branch 'dependabot/pip/signxml-4.0.0'
58b2d13
@dependabot
Bump certifi from 2024.7.4 to 2024.8.30
6c70c50 
Bumps [certifi](https://github.com/certifi/python-certifi) from 2024.7.4 to 2024.8.30.
- [Commits](certifi/python-certifi@2024.07.04...2024.08.30)

---
updated-dependencies:
- dependency-name: certifi
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Merge branch 'dependabot/pip/certifi-2024.8.30'
3552dff
@dependabot
Bump signxml from 4.0.0 to 4.0.1
9571356 
Bumps [signxml](https://github.com/kislyuk/signxml) from 4.0.0 to 4.0.1.
- [Release notes](https://github.com/kislyuk/signxml/releases)
- [Changelog](https://github.com/XML-Security/signxml/blob/develop/Changes.rst)
- [Commits](XML-Security/signxml@v4.0.0...v4.0.1)

---
updated-dependencies:
- dependency-name: signxml
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Merge branch 'dependabot/pip/signxml-4.0.1'
3035a95
@dependabot
Bump cryptography from 43.0.0 to 43.0.1 in the pip group
87a915c 
Bumps the pip group with 1 update: [cryptography](https://github.com/pyca/cryptography).


Updates `cryptography` from 43.0.0 to 43.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@43.0.0...43.0.1)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Merge branch 'dependabot/pip/pip-18e15a66a3'
c2bc768
@dependabot
Bump cffi from 1.17.0 to 1.17.1
634bde3 
Bumps [cffi](https://github.com/python-cffi/cffi) from 1.17.0 to 1.17.1.
- [Release notes](https://github.com/python-cffi/cffi/releases)
- [Commits](python-cffi/cffi@v1.17.0...v1.17.1)

---
updated-dependencies:
- dependency-name: cffi
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Merge branch 'dependabot/pip/cffi-1.17.1'
edc5eb3
@dependabot
Bump pyasn1 from 0.6.0 to 0.6.1
09c3549 
Bumps [pyasn1](https://github.com/pyasn1/pyasn1) from 0.6.0 to 0.6.1.
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.0...v0.6.1)

---
updated-dependencies:
- dependency-name: pyasn1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump signxml from 4.0.1 to 4.0.2
7e2225c 
Bumps [signxml](https://github.com/kislyuk/signxml) from 4.0.1 to 4.0.2.
- [Release notes](https://github.com/kislyuk/signxml/releases)
- [Changelog](https://github.com/XML-Security/signxml/blob/develop/Changes.rst)
- [Commits](XML-Security/signxml@v4.0.1...v4.0.2)

---
updated-dependencies:
- dependency-name: signxml
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Merge branch 'dependabot/pip/pyasn1-0.6.1'
cb459b6
@github-actions
Merge branch 'dependabot/pip/signxml-4.0.2'
0fc4134
@dependabot
Bump cryptography from 43.0.1 to 43.0.3
e616963 
Bumps [cryptography](https://github.com/pyca/cryptography) from 43.0.1 to 43.0.3.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@43.0.1...43.0.3)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Merge branch 'dependabot/pip/cryptography-43.0.3'
493d810
@dependabot
Bump signxml from 4.0.2 to 4.0.3
fc2785c 
Bumps [signxml](https://github.com/kislyuk/signxml) from 4.0.2 to 4.0.3.
- [Release notes](https://github.com/kislyuk/signxml/releases)
- [Changelog](https://github.com/XML-Security/signxml/blob/develop/Changes.rst)
- [Commits](XML-Security/signxml@v4.0.2...v4.0.3)

---
updated-dependencies:
- dependency-name: signxml
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Merge branch 'dependabot/pip/signxml-4.0.3'
f1143bc
@dependabot
Bump cryptography from 43.0.3 to 44.0.0
55c4f0f 
Bumps [cryptography](https://github.com/pyca/cryptography) from 43.0.3 to 44.0.0.
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@43.0.3...44.0.0)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
Bump pyopenssl from 24.2.1 to 24.3.0
8f64fea 
Bumps [pyopenssl](https://github.com/pyca/pyopenssl) from 24.2.1 to 24.3.0.
- [Changelog](https://github.com/pyca/pyopenssl/blob/main/CHANGELOG.rst)
- [Commits](pyca/pyopenssl@24.2.1...24.3.0)

---
updated-dependencies:
- dependency-name: pyopenssl
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Merge branch 'dependabot/pip/cryptography-44.0.0'
6a92a24
@github-actions
Merge branch 'dependabot/pip/pyopenssl-24.3.0'
3daf2e4
@dependabot
Bump six from 1.16.0 to 1.17.0
5989cca 
Bumps [six](https://github.com/benjaminp/six) from 1.16.0 to 1.17.0.
- [Changelog](https://github.com/benjaminp/six/blob/main/CHANGES)
- [Commits](benjaminp/six@1.16.0...1.17.0)

---
updated-dependencies:
- dependency-name: six
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Merge branch 'dependabot/pip/six-1.17.0'
cbcce19
@dependabot
Bump certifi from 2024.8.30 to 2024.12.14
fef5362 
Bumps [certifi](https://github.com/certifi/python-certifi) from 2024.8.30 to 2024.12.14.
- [Commits](certifi/python-certifi@2024.08.30...2024.12.14)

---
updated-dependencies:
- dependency-name: certifi
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions
Merge branch 'dependabot/pip/certifi-2024.12.14'
e89893c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@4k4xs4pH1r3 @snyk-bot @step-security-bot