Skip to content
This repository was archived by the owner on Aug 14, 2025. It is now read-only.

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Jun 10, 2025

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
requests (source, changelog) ==2.32.3 -> ==2.32.4 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-47081

Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

Workarounds

For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).

References

https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2


Release Notes

psf/requests (requests)

v2.32.4

Compare Source

Security

  • CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted
    environment will retrieve credentials for the wrong hostname/machine from a
    netrc file.

Improvements

  • Numerous documentation improvements

Deprecations

  • Added support for pypy 3.11 for Linux and macOS.
  • Dropped support for pypy 3.9 following its end of support.

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot requested a review from a team as a code owner June 10, 2025 09:47
@renovate
Copy link
Contributor Author

renovate bot commented Jun 11, 2025

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@github-actions
Copy link

Test results for commit 0818673

Test coverage for 0818673

Name                             Stmts   Miss Branch BrPart  Cover   Missing
----------------------------------------------------------------------------
src/charm.py                        52      3      4      1    93%   98-100
src/charm_state.py                  35      1      2      1    95%   21
src/constants.py                     4      0      0      0   100%
src/exceptions.py                    3      0      0      0   100%
src/github_actions_exporter.py      24      0      0      0   100%
----------------------------------------------------------------------------
TOTAL                              118      4      6      2    95%

Static code analysis report

Run started:2025-06-11 10:48:53.969200

Test results:
  No issues identified.

Code scanned:
  Total lines of code: 588
  Total lines skipped (#nosec): 0
  Total potential issues skipped due to specifically being disabled (e.g., #nosec BXXX): 0

Run metrics:
  Total issues (by severity):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
  Total issues (by confidence):
  	Undefined: 0
  	Low: 0
  	Medium: 0
  	High: 0
Files skipped (0):

@arturo-seijas arturo-seijas enabled auto-merge (squash) June 11, 2025 11:05
@amandahla amandahla disabled auto-merge July 3, 2025 14:12
@amandahla amandahla merged commit 8fa9277 into main Jul 3, 2025
48 of 67 checks passed
@amandahla amandahla deleted the renovate/pypi-requests-vulnerability branch July 3, 2025 14:13
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants