Bump httplib2 from 0.6.0 to 0.19.0

[dependabot]

Bumps httplib2 from 0.6.0 to 0.19.0.

Changelog

Sourced from httplib2's changelog.

0.19.0

auth: parse headers using pyparsing instead of regexp httplib2/httplib2#182

auth: WSSE token needs to be string not bytes httplib2/httplib2#179

0.18.1

explicit build-backend workaround for pip build isolation bug "AttributeError: 'module' object has no attribute 'legacy'" on pip install httplib2/httplib2#169

0.18.0

IMPORTANT security vulnerability CWE-93 CRLF injection Force %xx quote of space, CR, LF characters in uri. Special thanks to Recar https://github.com/Ciyfly for discrete notification. https://cwe.mitre.org/data/definitions/93.html

0.17.4

Ship test suite in source dist httplib2/httplib2#168

0.17.3

IronPython2.7: relative import iri2uri fixes ImportError httplib2/httplib2#163

0.17.2

python3 + debug + IPv6 disabled: https raised "IndexError: Replacement index 1 out of range for positional args tuple" httplib2/httplib2#161

0.17.1

python3: no_proxy was not checked with https httplib2/httplib2#160

0.17.0

feature: Http().redirect_codes set, works after follow(_all)_redirects check This allows one line workaround for old gcloud library that uses 308 response without redirect semantics. httplib2/httplib2#156

0.16.0

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

[localhankio]

Can someone remove my account from the Chartbeat GitHub account? I’ll sometimes get emails about PRs being merged. Its not often, but its strange and annoying when I do. Thanks, Hank From: dependabot[bot] Sent: Monday, February 8, 2021 15:17 To: chartbeat/oauth_provider Cc: Subscribed Subject: [chartbeat/oauth_provider] Bump httplib2 from 0.6.0 to 0.19.0 (#5) Bumps httplib2 from 0.6.0 to 0.19.0. Changelog Sourced from httplib2's changelog. 0.19.0 auth: parse headers using pyparsing instead of regexp httplib2/httplib2#182 auth: WSSE token needs to be string not bytes httplib2/httplib2#179 0.18.1 explicit build-backend workaround for pip build isolation bug "AttributeError: 'module' object has no attribute 'legacy'" on pip install httplib2/httplib2#169 0.18.0 IMPORTANT security vulnerability CWE-93 CRLF injection Force %xx quote of space, CR, LF characters in uri. Special thanks to Recar https://github.com/Ciyfly for discrete notification. https://cwe.mitre.org/data/definitions/93.html 0.17.4 Ship test suite in source dist httplib2/httplib2#168 0.17.3 IronPython2.7: relative import iri2uri fixes ImportError httplib2/httplib2#163 0.17.2 python3 + debug + IPv6 disabled: https raised "IndexError: Replacement index 1 out of range for positional args tuple" httplib2/httplib2#161 0.17.1 python3: no_proxy was not checked with https httplib2/httplib2#160 0.17.0 feature: Http().redirect_codes set, works after follow(_all)_redirects check This allows one line workaround for old gcloud library that uses 308 response without redirect semantics. httplib2/httplib2#156 0.16.0 ... (truncated) Commits • See full diff in compare view Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase. Dependabot commands and options You can trigger Dependabot actions by commenting on this PR: • @dependabot rebase will rebase this PR • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it • @dependabot merge will merge this PR after your CI passes on it • @dependabot squash and merge will squash and merge this PR after your CI passes on it • @dependabot cancel merge will cancel a previously requested merge and block automerging • @dependabot reopen will reopen this PR if it is closed • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the Security Alerts page. You can view, comment on, or merge this pull request online at:   #5 Commit Summary • Bump httplib2 from 0.6.0 to 0.19.0 File Changes • M requirements.txt (2) Patch Links: • https://github.com/chartbeat/oauth_provider/pull/5.patch • https://github.com/chartbeat/oauth_provider/pull/5.diff — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or unsubscribe.

[localhankio]

nvm i clicked the unsubscribe button.

[jonwiggins]

@rcuza is this a security issue?

[joshschwartz]

Thanks all. This is not a security issue: this is an open source repo. We will look into unsubscribing former interns from open source repos in the future — our current practices don’t include that by default.

…

On Mon, Feb 8, 2021 at 8:31 PM Jon Wiggins ***@***.***> wrote: @rcuza <https://github.com/rcuza> is this a security issue? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#5 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AANH2ZUCIQAOZ6NK2TAQMGTS6CF7FANCNFSM4XJUYJ7Q> .