Skip to content

chore(deps): update dependency requests to v2.32.4 [security] - autoclosed - #53

Closed
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pypi-requests-vulnerability
Closed

chore(deps): update dependency requests to v2.32.4 [security] - autoclosed#53
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/pypi-requests-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Jun 10, 2025

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
requests (source, changelog) ==2.32.3 -> ==2.32.4 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-47081

Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

Workarounds

For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).

References

https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2


Release Notes

psf/requests (requests)

v2.32.4

Compare Source

Security

  • CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted
    environment will retrieve credentials for the wrong hostname/machine from a
    netrc file.

Improvements

  • Numerous documentation improvements

Deprecations

  • Added support for pypy 3.11 for Linux and macOS.
  • Dropped support for pypy 3.9 following its end of support.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

Copy link
Copy Markdown
Contributor

Test results for commit 00b736c

Test coverage for 00b736c

Name                       Stmts   Miss Branch BrPart  Cover   Missing
----------------------------------------------------------------------
src/charm.py                  96     22     14      5    75%   74, 78, 82, 86-87, 94-95, 122->126, 127, 135->139, 160-166, 170-174, 177-180
src/charm_types.py            30      1      4      1    94%   79
src/constants.py              20      0      0      0   100%
src/database_observer.py      33      2      6      2    90%   66, 84
src/exceptions.py             12      2      0      0    83%   52, 68
src/irc.py                   162     21     24     10    83%   80-83, 172->177, 181->exit, 213-219, 224-225, 239, 259-266, 284, 289->292, 290->292, 292->295, 300->310, 305-307, 319-320
src/matrix_observer.py        25      8      2      0    63%   46-47, 55, 63-67
----------------------------------------------------------------------
TOTAL                        378     56     50     18    82%

Static code analysis report

Run started:2025-06-10 18:34:09.600570

Test results:
  No issues identified.

Code scanned:
  Total lines of code: 1897
  Total lines skipped (#nosec): 6
  Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
  Total issues (by severity):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
  Total issues (by confidence):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
Files skipped (0):

@renovate renovate Bot changed the title chore(deps): update dependency requests to v2.32.4 [security] chore(deps): update dependency requests to v2.32.4 [security] - autoclosed Jun 24, 2025
@renovate renovate Bot closed this Jun 24, 2025
@renovate
renovate Bot deleted the renovate/pypi-requests-vulnerability branch June 24, 2025 12:05
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants