chore(deps): update dependency requests to v2.32.4 [security] #693
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
316d253 to
2f4ff82
Compare
2f4ff82 to
de7125d
Compare
de7125d to
207883e
Compare
207883e to
5561926
Compare
5561926 to
37476be
Compare
37476be to
04e0f75
Compare
04e0f75 to
4b0df82
Compare
4b0df82 to
5a108f4
Compare
5a108f4 to
86d5d71
Compare
db4f637 to
35c8449
Compare
35c8449 to
8f33590
Compare
8f33590 to
25b1930
Compare
25b1930 to
3957d5d
Compare
3957d5d to
dc9645d
Compare
dc9645d to
c93d19e
Compare
c93d19e to
09ec478
Compare
09ec478 to
7826d85
Compare
7826d85 to
465a95b
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==2.32.3->==2.32.4GitHub Vulnerability Alerts
CVE-2024-47081
Impact
Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.
Workarounds
For older versions of Requests, use of the .netrc file can be disabled with
trust_env=Falseon your Requests Session (docs).References
https://github.com/psf/requests/pull/6965
https://seclists.org/fulldisclosure/2025/Jun/2
Release Notes
psf/requests (requests)
v2.32.4Compare Source
Security
environment will retrieve credentials for the wrong hostname/machine from a
netrc file.
Improvements
Deprecations
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.