search

DS-Homebrew / twlmenu-extras

This is the repository where extra files for TWiLight Menu++ are hosted
https://skins.ds-homebrew.com
124 stars 50 forks source link

Bump py7zr from 0.14.1 to 0.20.2 #116

Closed dependabot[bot] closed 1 year ago

dependabot[bot] commented 1 year ago

Bumps py7zr from 0.14.1 to 0.20.2.

Release notes

Sourced from py7zr's releases.

v0.20.2: Fix bad path checker

No release notes provided.

Release v0.20.0

No release notes provided.

v0.19.2: Security fix backport

Backport secuirty fix and improvements from v0.20.2

v0.19.0

No release notes provided.

v0.18.2: secuirty fix backport

Backport secuirty fix and improvements from v0.20.2

v0.18.10

No release notes provided.

v0.18.9

No release notes provided.

v0.18.7

No release notes provided.

v0.18.6

No release notes provided.

v0.18.5

No release notes provided.

v0.18.4

No release notes provided.

v0.18.3

No release notes provided.

v0.18.1

No release notes provided.

v0.18.0

No release notes provided.

v0.17.4

No release notes provided.

v0.17.3

No release notes provided.

v0.17.2

No release notes provided.

... (truncated)

Changelog

Sourced from py7zr's changelog.

v0.20.2_

Fixed

  • Fix error with good path data, when detecting wrong path with new canonical_path(), and drop resolve() call on path.

v0.20.1_

Security

  • Fix sanity check for path traversal attack(#480)
  • Add path checker in writef() and writestr() methods that ignores evil pass.
    • When pass arcname as evil path such as "../../../../tmp/evil.sh"
    • it raises ValueError
  • Check symlink and junction is under target folder when extraction

v0.20.0_

Added

  • Support enhanced deflate compression.(#472)

Changed

  • Bump setuptools@63 and setuptools_scm@7 (#473)
  • CI: update script (#473)
  • Update tox config (#473)
  • Actions: change pypy version to 3.7 (#473)
  • Update readthedocs.yml (#473)

Deprecated

  • Deprecate Python 3.6 support (#473)

v0.19.0_

Changed

  • Replace deflate64(tm) decompressor to inflate64(#459)
  • test: improve checks of deflate64 case(#463)

... (truncated)

Commits
  • 777f408 Release v0.20.2
  • 3c3c5c0 Merge pull request #483 from miurahr/topic/miurahr/security/get-canonical-path
  • 1a61ba2 Introduce helpers.canonical_path()
  • 35b32f5 Merge pull request #481 from miurahr/topic/miurahr/security/symlink-attack-test
  • f6220b0 Add test against symlink attach
  • 3b83939 Release v0.20.1
  • 3a4b4de Merge pull request #480 from miurahr/topic/miurahr/security/fix-check-logic-z...
  • 8366b67 Update Changelog.rst
  • 1bb43f1 Fix sanity check for path traversal attack
  • 04e3af5 Bump inflate64@v0.3.1
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/DS-Homebrew/twlmenu-extras/network/alerts).
dependabot[bot] commented 1 year ago

Looks like py7zr is up-to-date now, so this is no longer needed.