apiclarity
apiclarity copied to clipboard
Bump the pip group across 1 directory with 4 updates
Bumps the pip group with 4 updates in the /plugins/gateway/f5-bigip/F5BigIPBundle.template/ApiClarityAgent directory: certifi, idna, requests and urllib3.
Updates certifi
from 2022.9.24 to 2023.7.22
Commits
8fb96ed
2023.07.22afe7722
Bump actions/setup-python from 4.6.1 to 4.7.0 (#230)2038739
Bump dessant/lock-threads from 3.0.0 to 4.0.1 (#229)44df761
Hash pin Actions and enable dependabot (#228)8b3d7ba
2023.05.0753da240
ci: Add Python 3.12-dev to the testing (#224)c2fc3b1
Create a Security Policy (#222)c211ef4
Set up permissions to github workflows (#218)2087de5
Don't let deprecation warning fail CI (#219)e0b9fc5
remove paragraphs about 1024-bit roots from README- Additional commits viewable in compare view
Updates idna
from 3.4 to 3.7
Release notes
Sourced from idna's releases.
v3.7
What's Changed
- Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]
Thanks to Guido Vranken for reporting the issue.
Full Changelog: https://github.com/kjd/idna/compare/v3.6...v3.7
Changelog
Sourced from idna's changelog.
3.7 (2024-04-11) ++++++++++++++++
- Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]
Thanks to Guido Vranken for reporting the issue.
3.6 (2023-11-25) ++++++++++++++++
- Fix regression to include tests in source distribution.
3.5 (2023-11-24) ++++++++++++++++
- Update to Unicode 15.1.0
- String codec name is now "idna2008" as overriding the system codec "idna" was not working.
- Fix typing error for codec encoding
- "setup.cfg" has been added for this release due to some downstream lack of adherence to PEP 517. Should be removed in a future release so please prepare accordingly.
- Removed reliance on a symlink for the "idna-data" tool to comport with PEP 517 and the Python Packaging User Guide for sdist archives.
- Added security reporting protocol for project
Thanks Jon Ribbens, Diogo Teles Sant'Anna, Wu Tingfeng for contributions to this release.
Commits
1d365e1
Release v3.7c1b3154
Merge pull request #172 from kjd/optimize-contextj0394ec7
Merge branch 'master' into optimize-contextjcd58a23
Merge pull request #152 from elliotwutingfeng/dev5beb28b
More efficient resolution of joiner contexts1b12148
Update ossf/scorecard-action to v2.3.1d516b87
Update Github actions/checkout to v4c095c75
Merge branch 'master' into dev60a0a4c
Fix typo in GitHub Actions workflow key5918a0e
Merge branch 'master' into dev- Additional commits viewable in compare view
Updates requests
from 2.27.1 to 2.31.0
Release notes
Sourced from requests's releases.
v2.31.0
2.31.0 (2023-05-22)
Security
Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential forwarding of
Proxy-Authorization
headers to destination servers when following HTTPS redirects.When proxies are defined with user info (https://user:pass@proxy:8080), Requests will construct a
Proxy-Authorization
header that is attached to the request to authenticate with the proxy.In cases where Requests receives a redirect response, it previously reattached the
Proxy-Authorization
header incorrectly, resulting in the value being sent through the tunneled connection to the destination server. Users who rely on defining their proxy credentials in the URL are strongly encouraged to upgrade to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy credentials once the change has been fully deployed.Users who do not use a proxy or do not supply their proxy credentials through the user information portion of their proxy URL are not subject to this vulnerability.
Full details can be read in our Github Security Advisory and CVE-2023-32681.
v2.30.0
2.30.0 (2023-05-03)
Dependencies
⚠️ Added support for urllib3 2.0. ⚠️
This may contain minor breaking changes so we advise careful testing and reviewing https://urllib3.readthedocs.io/en/latest/v2-migration-guide.html prior to upgrading.
Users who wish to stay on urllib3 1.x can pin to
urllib3<2
.v2.29.0
2.29.0 (2023-04-26)
Improvements
... (truncated)
Changelog
Sourced from requests's changelog.
2.31.0 (2023-05-22)
Security
Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential forwarding of
Proxy-Authorization
headers to destination servers when following HTTPS redirects.When proxies are defined with user info (
https://user:pass@proxy:8080
), Requests will construct aProxy-Authorization
header that is attached to the request to authenticate with the proxy.In cases where Requests receives a redirect response, it previously reattached the
Proxy-Authorization
header incorrectly, resulting in the value being sent through the tunneled connection to the destination server. Users who rely on defining their proxy credentials in the URL are strongly encouraged to upgrade to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy credentials once the change has been fully deployed.Users who do not use a proxy or do not supply their proxy credentials through the user information portion of their proxy URL are not subject to this vulnerability.
Full details can be read in our Github Security Advisory and CVE-2023-32681.
2.30.0 (2023-05-03)
Dependencies
⚠️ Added support for urllib3 2.0. ⚠️
This may contain minor breaking changes so we advise careful testing and reviewing https://urllib3.readthedocs.io/en/latest/v2-migration-guide.html prior to upgrading.
Users who wish to stay on urllib3 1.x can pin to
urllib3<2
.2.29.0 (2023-04-26)
Improvements
- Requests now defers chunked requests to the urllib3 implementation to improve standardization. (#6226)
- Requests relaxes header component requirements to support bytes/str subclasses. (#6356)
2.28.2 (2023-01-12)
... (truncated)
Commits
147c851
v2.31.074ea7cf
Merge pull request from GHSA-j8r2-6x86-q33q3022253
test on pypy 3.8 and pypy 3.9 on windows and macos (#6424)b639e66
test on py3.12 (#6448)d3d5044
Fixed a small typo (#6452)2ad18e0
v2.30.0f2629e9
Remove strict parameter (#6434)87d63de
v2.29.051716c4
enable the warnings plugin (#6416)a7da1ab
try on ubuntu 22.04 (#6418)- Additional commits viewable in compare view
Updates urllib3
from 1.26.12 to 1.26.18
Release notes
Sourced from urllib3's releases.
1.26.18
- Made body stripped from HTTP requests changing the request method to GET after HTTP 303 "See Other" redirect responses. (GHSA-g4mx-q9vg-27p4)
1.26.17
- Added the
Cookie
header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set viaRetry.remove_headers_on_redirect
. (GHSA-v845-jxx5-vc9f)1.26.16
- Fixed thread-safety issue where accessing a
PoolManager
with many distinct origins would cause connection pools to be closed while requests are in progress (#2954)1.26.15
- Fix socket timeout value when HTTPConnection is reused (urllib3/urllib3#2645)
- Remove "!" character from the unreserved characters in IPv6 Zone ID parsing (urllib3/urllib3#2899)
- Fix IDNA handling of 'x80' byte (urllib3/urllib3#2901)
1.26.14
- Fixed parsing of port 0 (zero) returning None, instead of 0 (#2850)
- Removed deprecated
HTTPResponse.getheaders()
calls inurllib3.contrib
module.1.26.13
- Deprecated the
HTTPResponse.getheaders()
andHTTPResponse.getheader()
methods.- Fixed an issue where parsing a URL with leading zeroes in the port would be rejected even when the port number after removing the zeroes was valid.
- Fixed a deprecation warning when using cryptography v39.0.0.
- Removed the
<4
in theRequires-Python
packaging metadata field.
Changelog
Sourced from urllib3's changelog.
1.26.18 (2023-10-17)
- Made body stripped from HTTP requests changing the request method to GET after HTTP 303 "See Other" redirect responses.
1.26.17 (2023-10-02)
- Added the
Cookie
header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set viaRetry.remove_headers_on_redirect
. ([#3139](https://github.com/urllib3/urllib3/issues/3139) <https://github.com/urllib3/urllib3/pull/3139>
_)1.26.16 (2023-05-23)
- Fixed thread-safety issue where accessing a
PoolManager
with many distinct origins would cause connection pools to be closed while requests are in progress ([#2954](https://github.com/urllib3/urllib3/issues/2954) <https://github.com/urllib3/urllib3/pull/2954>
_)1.26.15 (2023-03-10)
- Fix socket timeout value when
HTTPConnection
is reused ([#2645](https://github.com/urllib3/urllib3/issues/2645) <https://github.com/urllib3/urllib3/issues/2645>
__)- Remove "!" character from the unreserved characters in IPv6 Zone ID parsing (
[#2899](https://github.com/urllib3/urllib3/issues/2899) <https://github.com/urllib3/urllib3/issues/2899>
__)- Fix IDNA handling of '\x80' byte (
[#2901](https://github.com/urllib3/urllib3/issues/2901) <https://github.com/urllib3/urllib3/issues/2901>
__)1.26.14 (2023-01-11)
- Fixed parsing of port 0 (zero) returning None, instead of 0. (
[#2850](https://github.com/urllib3/urllib3/issues/2850) <https://github.com/urllib3/urllib3/issues/2850>
__)- Removed deprecated getheaders() calls in contrib module. Fixed the type hint of
PoolKey.key_retries
by addingbool
to the union. ([#2865](https://github.com/urllib3/urllib3/issues/2865) <https://github.com/urllib3/urllib3/issues/2865>
__)1.26.13 (2022-11-23)
- Deprecated the
HTTPResponse.getheaders()
andHTTPResponse.getheader()
methods.- Fixed an issue where parsing a URL with leading zeroes in the port would be rejected even when the port number after removing the zeroes was valid.
- Fixed a deprecation warning when using cryptography v39.0.0.
- Removed the
<4
in theRequires-Python
packaging metadata field.
Commits
9c2c230
Release 1.26.18 (#3159)b594c5c
Merge pull request from GHSA-g4mx-q9vg-27p4944f0eb
[1.26] Use vendored six in urllib3.contrib.securetransportc9016bf
Release 1.26.170122035
Backport GHSA-v845-jxx5-vc9f (#3139)e63989f
Fix installingbrotli
extra on Python 2.72e7a24d
[1.26] Configure OS for RTD to fix building docs57181d6
[1.26] Improve error message when calling urllib3.request() (#3058)3c01480
[1.26] Run coverage even with failed jobsd94029b
Release 1.26.16- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase
.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
-
@dependabot rebase
will rebase this PR -
@dependabot recreate
will recreate this PR, overwriting any edits that have been made to it -
@dependabot merge
will merge this PR after your CI passes on it -
@dependabot squash and merge
will squash and merge this PR after your CI passes on it -
@dependabot cancel merge
will cancel a previously requested merge and block automerging -
@dependabot reopen
will reopen this PR if it is closed -
@dependabot close
will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually -
@dependabot show <dependency name> ignore conditions
will show all of the ignore conditions of the specified dependency -
@dependabot ignore <dependency name> major version
will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) -
@dependabot ignore <dependency name> minor version
will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) -
@dependabot ignore <dependency name>
will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) -
@dependabot unignore <dependency name>
will remove all of the ignore conditions of the specified dependency -
@dependabot unignore <dependency name> <ignore condition>
will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the Security Alerts page.