GemAlmelo/DataplatformTwente
18
5
Fork 0
Code Issues 9 Pull requests Projects Releases Packages 1 Wiki Activity Actions

Dependency vulnerabilities found in DataplatformTwente #40

New issue
Open
opened 2026-10-05 06:00:33 +00:00 by forgejo-actions · 0 comments
forgejo-actions commented 2026-10-05 06:00:33 +00:00
Copy link

Dependency audit

pip-audit heeft kwetsbaarheden gevonden in de Python-dependencies.

  • Kwetsbaarheden: 5
  • Nieuwe kwetsbaarheden: 5
  • Bekende/genegeerde kwetsbaarheden: 0
Package Geïnstalleerd Advisory Oplossing Omschrijving
fsspec 2026.4.0 PYSEC-2026-4217, CVE-2026-104851, GHSA-27vj-qcqg-25rc 2026.6.0 ### Summary fsspec.implementations.reference.ReferenceFileSystem parses a "references" JSON document (Kerchunk format) supplied either inline or via a URL. The parser renders fields from this JSON through un-sandboxed jinja2.Template(...).render(...) calls in three locat…
multidict 6.7.1 PYSEC-2026-4244, CVE-2026-104874, GHSA-54p9-h82j-f925 6.9.1 ## Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 (C extension) lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value o…
urllib3 2.7.0 PYSEC-2026-4177, CVE-2026-97689, GHSA-vxq7-64xx-v4gw 2.8.0 ## Impact urllib3's streaming API is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When d…
urllib3 2.7.0 PYSEC-2026-4176, CVE-2026-97688, GHSA-gh4c-6fx4-qh6g 2.8.0 ### Impact urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once. urllib3 can decompress response bodies according to the HTTP Content-Encoding header.…
urllib3 2.7.0 PYSEC-2026-4175, GHSA-8988-9cw3-xx77, CVE-2026-97687 2.8.0 ## Impact urllib3 supports configuring TLS independently for an HTTPS proxy and the target server. proxy_ssl_context, proxy_assert_hostname, and proxy_assert_fingerprint configure the TLS connection to the proxy. ssl_context and the other target-specific TLS parameters c…

Werk de dependencies bij en verwijder een advisory uit .pip-audit-known-vurnerabilities zodra deze is opgelost.

## Dependency audit `pip-audit` heeft kwetsbaarheden gevonden in de Python-dependencies. - Kwetsbaarheden: **5** - Nieuwe kwetsbaarheden: **5** - Bekende/genegeerde kwetsbaarheden: **0** | Package | Geïnstalleerd | Advisory | Oplossing | Omschrijving | | --- | ---: | --- | --- | --- | | fsspec | 2026.4.0 | PYSEC-2026-4217, CVE-2026-104851, GHSA-27vj-qcqg-25rc | 2026.6.0 | ### Summary `fsspec.implementations.reference.ReferenceFileSystem` parses a "references" JSON document (Kerchunk format) supplied either inline or via a URL. The parser renders fields from this JSON through **un-sandboxed** `jinja2.Template(...).render(...)` calls in three locat… | | multidict | 6.7.1 | PYSEC-2026-4244, CVE-2026-104874, GHSA-54p9-h82j-f925 | 6.9.1 | ## Description A reference leak in the items-view union and subtraction operators of aio-libs/multidict 6.7.0 through 6.9.0 (C extension) lets a remote client drive unbounded, unreclaimable memory growth by having each operand element leak one key-identity object and one value o… | | urllib3 | 2.7.0 | PYSEC-2026-4177, CVE-2026-97689, GHSA-vxq7-64xx-v4gw | 2.8.0 | ## Impact urllib3's [streaming API](https://urllib3.readthedocs.io/en/2.7.0/advanced-usage.html#streaming-and-i-o) is designed for efficiently handling large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When d… | | urllib3 | 2.7.0 | PYSEC-2026-4176, CVE-2026-97688, GHSA-gh4c-6fx4-qh6g | 2.8.0 | ### Impact urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading content in chunks instead of loading the entire response body into memory at once. urllib3 can decompress response bodies according to the HTTP `Content-Encoding` header.… | | urllib3 | 2.7.0 | PYSEC-2026-4175, GHSA-8988-9cw3-xx77, CVE-2026-97687 | 2.8.0 | ## Impact urllib3 supports configuring TLS independently for an HTTPS proxy and the target server. `proxy_ssl_context`, `proxy_assert_hostname`, and `proxy_assert_fingerprint` configure the TLS connection to the proxy. `ssl_context` and the other target-specific TLS parameters c… | Werk de dependencies bij en verwijder een advisory uit `.pip-audit-known-vurnerabilities` zodra deze is opgelost.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
dagster
rx-mission
naamgeving_schema_tabel
No results found.
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
GemAlmelo/DataplatformTwente#40
No description provided.