chore(deps): update dependency requests to v2.32.4 [security] #2403
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
4e0e331 to
c14a2eb
Compare
c14a2eb to
9f3368a
Compare
9f3368a to
8fa26d3
Compare
8fa26d3 to
7e021f8
Compare
7e021f8 to
0aebf10
Compare
0aebf10 to
1502688
Compare
1502688 to
0b6068f
Compare
0b6068f to
28bc3b0
Compare
28bc3b0 to
1d37aaf
Compare
1d37aaf to
1a4a0ed
Compare
1a4a0ed to
690f972
Compare
690f972 to
71be113
Compare
71be113 to
53021c1
Compare
53021c1 to
eb8fb0b
Compare
eb8fb0b to
2f565d6
Compare
2f565d6 to
ad72538
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==2.32.3->==2.32.4GitHub Vulnerability Alerts
CVE-2024-47081
Impact
Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.
Workarounds
For older versions of Requests, use of the .netrc file can be disabled with
trust_env=Falseon your Requests Session (docs).References
https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2
Release Notes
psf/requests (requests)
v2.32.4Compare Source
Security
environment will retrieve credentials for the wrong hostname/machine from a
netrc file.
Improvements
Deprecations
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.