getcontact
getcontact copied to clipboard
[security] chore(deps): bump pyyaml from 5.3 to 5.4.1
Bumps pyyaml from 5.3 to 5.4.1.
Changelog
Sourced from pyyaml's changelog.
5.4.1 (2021-01-20)
- yaml/pyyaml#480 -- Fix stub compat with older pyyaml versions that may unwittingly load it
5.4 (2021-01-19)
- yaml/pyyaml#407 -- Build modernization, remove distutils, fix metadata, build wheels, CI to GHA
- yaml/pyyaml#472 -- Fix for CVE-2020-14343, moves arbitrary python tags to UnsafeLoader
- yaml/pyyaml#441 -- Fix memory leak in implicit resolver setup
- yaml/pyyaml#392 -- Fix py2 copy support for timezone objects
- yaml/pyyaml#378 -- Fix compatibility with Jython
5.3.1 (2020-03-18)
- yaml/pyyaml#386 -- Prevents arbitrary code execution during python/object/new constructor
Commits
ee37f46
5.4.1 release2b37f15
Fix stub compat with older pyyaml versions that may unwittingly load it58d0cb7
5.4 releasea60f7a1
Fix compatibility with Jythonee98abd
Run CI on PR base branch changesddf2033
constructor.timezone: _copy & deepcopyfc914d5
Avoid repeatedly appending to yaml_implicit_resolversa001f27
Fix for CVE-2020-14343fe15062
Add 3.9 to appveyor file for completeness sake1e1c7fb
Add a newline character to end of pyproject.toml- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase
.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
-
@dependabot rebase
will rebase this PR -
@dependabot recreate
will recreate this PR, overwriting any edits that have been made to it -
@dependabot merge
will merge this PR after your CI passes on it -
@dependabot squash and merge
will squash and merge this PR after your CI passes on it -
@dependabot cancel merge
will cancel a previously requested merge and block automerging -
@dependabot reopen
will reopen this PR if it is closed -
@dependabot close
will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually -
@dependabot ignore this major version
will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) -
@dependabot ignore this minor version
will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) -
@dependabot ignore this dependency
will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) -
@dependabot use these labels
will set the current labels as the default for future PRs for this repo and language -
@dependabot use these reviewers
will set the current reviewers as the default for future PRs for this repo and language -
@dependabot use these assignees
will set the current assignees as the default for future PRs for this repo and language -
@dependabot use this milestone
will set the current milestone as the default for future PRs for this repo and language -
@dependabot badge me
will comment on this PR with code to add a "Dependabot enabled" badge to your readme
Additionally, you can set the following in your Dependabot dashboard:
- Update frequency (including time of day and day of week)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)
We've just been alerted that this update fixes a security vulnerability:
Sourced from The GitHub Security Advisory Database.
Improper Input Validation in PyYAML
A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.
Affected versions: ["< 5.3.1"]