search

theendsofinvention / esst

MIT License
4 stars 0 forks source link

[security] build(deps): bump psutil from 5.4.8 to 5.7.0 #185

Closed dependabot-preview[bot] closed 4 years ago

dependabot-preview[bot] commented 4 years ago

Bumps psutil from 5.4.8 to 5.7.0.

Changelog

Sourced from psutil's changelog.

5.7.0

2020-12-18

Enhancements

  • 1637: [SunOS] add partial support for old SunOS 5.10 Update 0 to 3.
  • 1648: [Linux] sensors_temperatures() looks into an additional /sys/device/ directory for additional data. (patch by Javad Karabi)
  • 1652: [Windows] dropped support for Windows XP and Windows Server 2003. Minimum supported Windows version now is Windows Vista.
  • 1671: [FreeBSD] add CI testing/service for FreeBSD (Cirrus CI).
  • 1677: [Windows] process exe() will succeed for all process PIDs (instead of raising AccessDenied).
  • 1679: [Windows] net_connections() and Process.connections() are 10% faster.
  • 1682: [PyPy] added CI / test integration for PyPy via Travis.
  • 1686: [Windows] added support for PyPy on Windows.
  • 1693: [Windows] boot_time(), Process.create_time() and users()'s login time now have 1 micro second precision (before the precision was of 1 second).

Bug fixes

  • 1538: [NetBSD] process cwd() may return ENOENT instead of NoSuchProcess.
  • 1627: [Linux] Process.memory_maps() can raise KeyError.
  • 1642: [SunOS] querying basic info for PID 0 results in FileNotFoundError.
  • 1646: [FreeBSD] many Process methods may cause a segfault on FreeBSD 12.0 due to a backward incompatible change in a C type introduced in 12.0.
  • 1656: [Windows] Process.memory_full_info() raises AccessDenied even for the current user and os.getpid().
  • 1660: [Windows] Process.open_files() complete rewrite + check of errors.
  • 1662: [Windows] process exe() may raise WinError 0.
  • 1665: [Linux] disk_io_counters() does not take into account extra fields added to recent kernels. (patch by Mike Hommey)
  • 1672: use the right C type when dealing with PIDs (int or long). Thus far (long) was almost always assumed, which is wrong on most platforms.
  • 1673: [OpenBSD] Process connections(), num_fds() and threads() returned improper exception if process is gone.
  • 1674: [SunOS] disk_partitions() may raise OSError.
  • 1684: [Linux] disk_io_counters() may raise ValueError on systems not having /proc/diskstats.
  • 1695: [Linux] could not compile on kernels <= 2.6.13 due to PSUTIL_HAVE_IOPRIO not being defined. (patch by Anselm Kruis)

5.6.7

2019-11-26

Bug fixes

  • 1630: [Windows] can't compile source distribution due to C syntax error.

5.6.6

2019-11-25

Bug fixes

  • 1179: [Linux] Process cmdline() now takes into account misbehaving processes renaming the command line and using inappropriate chars to separate args.
... (truncated)
Commits
  • f2e0c98 fix KeyError
  • 5e47e0b Add C linter script (#1698)
  • 41fcba5 revert process_iter() exactly how it was pre #1667
  • c9fc4fd revert #1667 process_iter() new_only param
  • 793148f fix Makefile for freebsd
  • 9069e25 Merge branch 'master' of github.com:giampaolo/psutil
  • 6c07622 Remove use of deprecated setuptools test_suite & tests_require (#1696)
  • 3ed4097 #1053 fix syntax incompatible with py2.6
  • 776016f remove deprecation test: it fails intermittently because warnings uses a glob...
  • 766541f get rid of pip_install() code for py2; move everything in runner.py
  • Additional commits viewable in compare view


Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Pull request limits (per update run and/or open at any time) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired)
dependabot-preview[bot] commented 4 years ago

We've just been alerted that this update fixes a security vulnerability:

Sourced from The GitHub Security Advisory Database.

Moderate severity vulnerability that affects psutil psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object.

Affected versions: ["<= 5.6.5"]

dependabot-preview[bot] commented 4 years ago

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.