search

miracum / ahd2fhir

A REST service for mapping text analysis results from Averbis Health Discovery to FHIR resources.
Apache License 2.0
8 stars 0 forks source link

chore(deps): update dependency black to v24.3.0 [security] #153

Closed renovate[bot] closed 8 months ago

renovate[bot] commented 8 months ago

Mend Renovate

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
black (changelog) ==24.2.0 -> ==24.3.0 age adoption passing confidence

GitHub Vulnerability Alerts

CVE-2024-21503

Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_expanded function in the strings.py file. An attacker could exploit this vulnerability by crafting a malicious input that causes a denial of service.

Exploiting this vulnerability is possible when running Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings.

Release Notes

psf/black (black) ### [`v24.3.0`](https://togithub.com/psf/black/blob/HEAD/CHANGES.md#2430) [Compare Source](https://togithub.com/psf/black/compare/24.2.0...24.3.0) ##### Highlights This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix [CVE-2024-21503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21503). This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher. ##### Stable style - Don't move comments along with delimiters, which could cause crashes ([#​4248](https://togithub.com/psf/black/issues/4248)) - Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. ([#​4270](https://togithub.com/psf/black/issues/4270)) - Fix a bug where line-ranges exceeding the last code line would not work as expected ([#​4273](https://togithub.com/psf/black/issues/4273)) ##### Performance - Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes [CVE-2024-21503](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21503). ([#​4278](https://togithub.com/psf/black/issues/4278)) ##### Documentation - Note what happens when `--check` is used with `--quiet` ([#​4236](https://togithub.com/psf/black/issues/4236))

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

This PR has been generated by Mend Renovate. View repository job log here.

github-actions[bot] commented 8 months ago

🦙 MegaLinter status: ✅ SUCCESS

Descriptor Linter Files Fixed Errors Elapsed time
✅ ACTION actionlint 5 0 0.04s
✅ BASH bash-exec 2 0 0.03s
✅ BASH shellcheck 2 0 0.02s
✅ BASH shfmt 2 0 0.0s
✅ DOCKERFILE hadolint 2 0 0.14s
✅ JSON eslint-plugin-jsonc 17 0 2.39s
✅ JSON jsonlint 17 0 0.28s
✅ JSON npm-package-json-lint yes no 0.79s
✅ JSON prettier 17 0 2.28s
✅ MARKDOWN markdownlint 3 0 0.64s
✅ PYTHON bandit 31 0 1.91s
✅ PYTHON black 31 0 2.55s
✅ PYTHON flake8 31 0 1.16s
✅ PYTHON isort 31 0 0.45s
✅ PYTHON mypy 31 0 11.34s
✅ PYTHON pyright 31 0 11.37s
✅ PYTHON ruff 31 0 0.07s
✅ REPOSITORY checkov yes no 17.92s
✅ REPOSITORY gitleaks yes no 0.1s
✅ REPOSITORY git_diff yes no 0.01s
✅ REPOSITORY grype yes no 14.19s
✅ REPOSITORY kics yes no 39.4s
✅ REPOSITORY secretlint yes no 1.37s
✅ REPOSITORY syft yes no 0.76s
✅ REPOSITORY trivy yes no 11.11s
✅ REPOSITORY trivy-sbom yes no 6.73s
✅ REPOSITORY trufflehog yes no 12.17s
✅ YAML prettier 15 0 1.22s
✅ YAML yamllint 15 0 0.5s

See detailed report in MegaLinter reports

You could have same capabilities but better runtime performances if you request a new MegaLinter flavor.

_MegaLinter is graciously provided by OX Security_

miracum-bot commented 8 months ago

:tada: This PR is included in version 3.1.5 :tada:

The release is available on GitHub release

Your semantic-release bot :package::rocket: