New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update dependency setuptools to v70 [SECURITY] #107

Open

renovate wants to merge 1 commit into master from renovate/pypi-setuptools-vulnerability

Contributor

renovate bot commented Aug 6, 2024 •

edited

Loading

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
setuptools (changelog)	`==68.2.2` -> `==70.0.0`

GitHub Vulnerability Alerts

CVE-2024-6345

A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to code injection. If these functions are exposed to user-controlled inputs, such as package URLs, they can execute arbitrary commands on the system. The issue is fixed in version 70.0.

Release Notes

pypa/setuptools (setuptools)

`v70.0.0`

`v69.5.1`

`v69.5.0`

`v69.4.2`

`v69.4.1`

`v69.4.0`

`v69.3.1`

`v69.3.0`

`v69.2.0`

`v69.1.1`

`v69.1.0`

`v69.0.3`

`v69.0.2`

`v69.0.1`

`v69.0.0`

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Contributor Author

renovate bot commented Aug 6, 2024 •

edited

Loading

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: python/Pipfile.lock

Command failed: pipenv lock
Creating a virtualenv for this project...
Pipfile: /tmp/renovate/repos/github/asecurityteam/sdcli/python/Pipfile
Using /usr/local/bin/python3.7 (3.7.17) to create virtualenv...

⠋ Creating virtual environment...�
⠙ Creating virtual environment...�
⠹ Creating virtual environment...�
⠸ Creating virtual environment...�
⠼ Creating virtual environment...�
⠴ Creating virtual environment...�
⠦ Creating virtual environment...�
⠧ Creating virtual environment...�
⠇ Creating virtual environment...�
⠏ Creating virtual environment...�
⠋ Creating virtual environment...�
⠙ Creating virtual environment...�
⠹ Creating virtual environment...created virtual environment CPython3.7.17.final.0-64 in 532ms
  creator Venv(dest=/tmp/renovate/cache/others/virtualenvs/python-Mcc2Xu_y, clear=False, no_vcs_ignore=False, global=False, describe=CPython3Posix)
  seeder FromAppData(download=False, pip=bundle, setuptools=bundle, wheel=bundle, via=copy, app_data_dir=/tmp/containerbase/cache/.local/share/virtualenv)
    added seed packages: pip==24.0, setuptools==68.0.0, wheel==0.42.0
  activators BashActivator,CShellActivator,FishActivator,NushellActivator,PowerShellActivator,PythonActivator

�✔ Successfully created virtual environment! 
Virtualenv location: /tmp/renovate/cache/others/virtualenvs/python-Mcc2Xu_y
Locking [packages] dependencies...

⠋ Locking...
Building requirements...
�
⠙ Locking...�
⠹ Locking...�
⠸ Locking...
Resolving dependencies...
�
⠼ Locking...�
⠴ Locking...�
⠦ Locking...�
⠧ Locking...�
⠇ Locking...�
⠏ Locking...�
⠋ Locking...�
⠙ Locking...�
⠹ Locking...�
⠸ Locking...�
⠼ Locking...�
⠴ Locking...�
⠦ Locking...�
⠧ Locking...�
⠇ Locking...�
⠏ Locking...�
⠋ Locking...�
⠙ Locking...�
⠹ Locking...�
⠸ Locking...�
⠼ Locking...�
⠴ Locking...�
⠦ Locking...�
⠧ Locking...�
⠇ Locking...�
⠏ Locking...�
⠋ Locking...�
⠙ Locking...�
⠹ Locking...�
⠸ Locking...�
⠼ Locking...�
⠴ Locking...�
⠦ Locking...�
⠧ Locking...�
⠇ Locking...�
⠏ Locking...�
⠋ Locking...�
⠙ Locking...�
⠹ Locking...�
⠸ Locking...�
⠼ Locking...�
⠴ Locking...�
⠦ Locking...�
⠧ Locking...�
⠇ Locking...�
⠏ Locking...�
⠋ Locking...�
⠙ Locking...�
⠹ Locking...�
⠸ Locking...�
⠼ Locking...�✘ Locking Failed! 

CRITICAL:pipenv.patched.pip._internal.resolution.resolvelib.factory:Ignored the following versions that require a different python version: 7.3.0 Requires-Python >=3.8; 7.3.1 Requires-Python >=3.8; 7.3.2 Requires-Python >=3.8; 7.3.3 Requires-Python >=3.8; 7.3.4 Requires-Python >=3.8; 7.4.0 Requires-Python >=3.8; 7.4.1 Requires-Python >=3.8; 7.4.2 Requires-Python >=3.8; 7.4.3 Requires-Python >=3.8; 7.4.4 Requires-Python >=3.8; 7.5.0 Requires-Python >=3.8; 7.5.1 Requires-Python >=3.8; 7.5.2 Requires-Python >=3.8; 7.5.3 Requires-Python >=3.8; 7.5.4 Requires-Python >=3.8; 7.6.0 Requires-Python >=3.8; 7.6.1 Requires-Python >=3.8; 7.6.2 Requires-Python >=3.9; 7.6.3 Requires-Python >=3.9; 7.6.4 Requires-Python >=3.9; 7.6.5 Requires-Python >=3.9; 7.6.6 Requires-Python >=3.9; 7.6.7 Requires-Python >=3.9
CRITICAL:pipenv.patched.pip._internal.resolution.resolvelib.factory:Could not find a version that satisfies the requirement coverage==7.3.2 (from versions: 3.0b3, 3.0, 3.0.1, 3.1b1, 3.1, 3.2b1, 3.2b2, 3.2b3, 3.2b4, 3.2, 3.3, 3.3.1, 3.4b1, 3.4b2, 3.4, 3.5b1, 3.5, 3.5.1b1, 3.5.1, 3.5.2b1, 3.5.2, 3.5.3, 3.6b1, 3.6b2, 3.6b3, 3.6, 3.7, 3.7.1, 4.0a1, 4.0a2, 4.0a3, 4.0a4, 4.0a5, 4.0a6, 4.0b1, 4.0b2, 4.0b3, 4.0, 4.0.1, 4.0.2, 4.0.3, 4.1b1, 4.1b2, 4.1b3, 4.1, 4.2b1, 4.2, 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.4b1, 4.4, 4.4.1, 4.4.2, 4.5, 4.5.1, 4.5.2, 4.5.3, 4.5.4, 5.0a1, 5.0a2, 5.0a3, 5.0a4, 5.0a5, 5.0a6, 5.0a7, 5.0a8, 5.0b1, 5.0b2, 5.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.1, 5.2, 5.2.1, 5.3, 5.3.1, 5.4, 5.5, 5.6b1, 6.0b1, 6.0, 6.0.1, 6.0.2, 6.1, 6.1.1, 6.1.2, 6.2, 6.3, 6.3.1, 6.3.2, 6.3.3, 6.4, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.5.0, 6.6.0b1, 7.0.0b1, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.1.0, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7)
[ResolutionFailure]:   File "/opt/containerbase/tools/pipenv/2022.10.4/3.7.17/lib/python3.7/site-packages/pipenv/resolver.py", line 783, in _main
[ResolutionFailure]:       pre, clear, verbose, system, write, requirements_dir, packages, dev
[ResolutionFailure]:   File "/opt/containerbase/tools/pipenv/2022.10.4/3.7.17/lib/python3.7/site-packages/pipenv/resolver.py", line 738, in resolve_packages
[ResolutionFailure]:       requirements_dir=requirements_dir,
[ResolutionFailure]:   File "/opt/containerbase/tools/pipenv/2022.10.4/3.7.17/lib/python3.7/site-packages/pipenv/resolver.py", line 718, in resolve
[ResolutionFailure]:       req_dir=requirements_dir,
[ResolutionFailure]:   File "/opt/containerbase/tools/pipenv/2022.10.4/3.7.17/lib/python3.7/site-packages/pipenv/utils/resolver.py", line 1114, in resolve_deps
[ResolutionFailure]:       req_dir=req_dir,
[ResolutionFailure]:   File "/opt/containerbase/tools/pipenv/2022.10.4/3.7.17/lib/python3.7/site-packages/pipenv/utils/resolver.py", line 894, in actually_resolve_deps
[ResolutionFailure]:       resolver.resolve()
[ResolutionFailure]:   File "/opt/containerbase/tools/pipenv/2022.10.4/3.7.17/lib/python3.7/site-packages/pipenv/utils/resolver.py", line 689, in resolve
[ResolutionFailure]:       raise ResolutionFailure(message=str(e))
[pipenv.exceptions.ResolutionFailure]: Warning: Your dependencies could not be resolved. You likely have a mismatch in your sub-dependencies.
  You can use $ pipenv install --skip-lock to bypass this mechanism, then run $ pipenv graph to inspect the situation.
  Hint: try $ pipenv lock --pre if it is a pre-release dependency.
ERROR: No matching distribution found for coverage==7.3.2

renovate bot force-pushed the renovate/pypi-setuptools-vulnerability branch from 22e81ff to 318dc41 Compare

August 20, 2024 18:44

renovate bot force-pushed the renovate/pypi-setuptools-vulnerability branch 3 times, most recently from 2984d21 to 751637f Compare

October 2, 2024 16:38


          Update dependency setuptools to v70 [SECURITY]

f3fcf57

renovate bot force-pushed the renovate/pypi-setuptools-vulnerability branch from 751637f to f3fcf57 Compare

November 15, 2024 17:37

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet