search

miracum / fhir-gateway

A thin layer between FHIR REST clients and resource processing pipelines.
Apache License 2.0
13 stars 7 forks source link

build(deps): bump urllib3 from 1.26.18 to 1.26.19 in /tests/e2e #151

Closed dependabot[bot] closed 4 months ago

dependabot[bot] commented 4 months ago

Bumps urllib3 from 1.26.18 to 1.26.19.

Release notes

Sourced from urllib3's releases.

1.26.19

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

  • Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.

Full Changelog: https://github.com/urllib3/urllib3/compare/1.26.18...1.26.19

Note that due to an issue with our release automation, no multiple.intoto.jsonl file is available for this release.

Changelog

Sourced from urllib3's changelog.

1.26.19 (2024-06-17)

  • Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.
  • Fixed handling of OpenSSL 3.2.0 new error message for misconfiguring an HTTP proxy as HTTPS. ([#3405](https://github.com/urllib3/urllib3/issues/3405) <https://github.com/urllib3/urllib3/issues/3405>__)
Commits


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/miracum/fhir-gateway/network/alerts).
github-actions[bot] commented 4 months ago

🦙 MegaLinter status: ✅ SUCCESS

Descriptor Linter Files Fixed Errors Elapsed time
✅ ACTION actionlint 4 0 0.03s
✅ DOCKERFILE hadolint 2 0 0.1s
✅ EDITORCONFIG editorconfig-checker 66 0 0.28s
✅ GROOVY npm-groovy-lint 2 0 8.94s
✅ JAVA checkstyle 18 0 4.72s
✅ JSON jsonlint 5 0 0.2s
✅ JSON prettier 5 0 1.95s
✅ JSON v8r 5 0 3.88s
✅ MARKDOWN markdownlint 2 0 0.76s
✅ PYTHON bandit 1 0 0.87s
✅ PYTHON black 1 0 0.62s
✅ PYTHON flake8 1 0 0.44s
✅ PYTHON isort 1 0 0.3s
✅ PYTHON mypy 1 0 7.28s
✅ PYTHON ruff 1 0 0.03s
✅ REPOSITORY checkov yes no 15.06s
✅ REPOSITORY gitleaks yes no 1.4s
✅ REPOSITORY git_diff yes no 0.02s
✅ REPOSITORY grype yes no 14.12s
✅ REPOSITORY kics yes no 4.45s
✅ REPOSITORY secretlint yes no 0.96s
✅ REPOSITORY syft yes no 2.57s
✅ REPOSITORY trivy yes no 8.18s
✅ REPOSITORY trivy-sbom yes no 6.54s
✅ REPOSITORY trufflehog yes no 3.9s
✅ SQL sql-lint 1 0 0.24s
✅ XML xmllint 1 0 0.02s
✅ YAML prettier 17 0 1.13s
✅ YAML yamllint 17 0 0.65s

See detailed report in MegaLinter reports

You could have same capabilities but better runtime performances if you request a new MegaLinter flavor.

_MegaLinter is graciously provided by OX Security_

github-actions[bot] commented 4 months ago

Trivy image scan report

ghcr.io/miracum/fhir-gateway:pr-151 (debian 12.5)

21 known vulnerabilities found (CRITICAL: 1 HIGH: 2 MEDIUM: 5 LOW: 13)

Show detailed table of vulnerabilities
Package ID Severity Installed Version Fixed Version
libc6 CVE-2024-33599 HIGH 2.36-9+deb12u6 2.36-9+deb12u7
libc6 CVE-2024-33600 MEDIUM 2.36-9+deb12u6 2.36-9+deb12u7
libc6 CVE-2024-33601 MEDIUM 2.36-9+deb12u6 2.36-9+deb12u7
libc6 CVE-2024-33602 MEDIUM 2.36-9+deb12u6 2.36-9+deb12u7
libc6 CVE-2010-4756 LOW 2.36-9+deb12u6
libc6 CVE-2018-20796 LOW 2.36-9+deb12u6
libc6 CVE-2019-1010022 LOW 2.36-9+deb12u6
libc6 CVE-2019-1010023 LOW 2.36-9+deb12u6
libc6 CVE-2019-1010024 LOW 2.36-9+deb12u6
libc6 CVE-2019-1010025 LOW 2.36-9+deb12u6
libc6 CVE-2019-9192 LOW 2.36-9+deb12u6
libexpat1 CVE-2023-52425 HIGH 2.5.0-1
libexpat1 CVE-2023-52426 LOW 2.5.0-1
libexpat1 CVE-2024-28757 LOW 2.5.0-1
libgcc-s1 CVE-2023-4039 MEDIUM 12.2.0-14
libgcc-s1 CVE-2022-27943 LOW 12.2.0-14
libpng16-16 CVE-2021-4214 LOW 1.6.39-2
libstdc++6 CVE-2023-4039 MEDIUM 12.2.0-14
libstdc++6 CVE-2022-27943 LOW 12.2.0-14
libuuid1 CVE-2022-0563 LOW 2.38.1-5+deb12u1
zlib1g CVE-2023-45853 CRITICAL 1:1.2.13.dfsg-1

No Misconfigurations found

github-actions[bot] commented 4 months ago

Code Coverage Report

Overall Project 28.96% :x:

There is no coverage information present for the Files changed

miracum-bot commented 4 months ago

:tada: This issue has been resolved in version 3.13.2 :tada:

The release is available on GitHub release

Your semantic-release bot :package::rocket: