Bump urllib3 from 1.26.18 to 2.2.2 #10424

dependabot · 2024-06-18T12:55:55Z

Bumps urllib3 from 1.26.18 to 2.2.2.

Release notes

2.2.2

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.

Allowed passing negative integers as amt to read methods of http.client.HTTPResponse as an alternative to None. (#3122)

Fixed return types representing copying actions to use typing.Self. (#3363)

Full Changelog: urllib3/urllib3@2.2.1...2.2.2

2.2.1

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

Fixed issue where InsecureRequestWarning was emitted for HTTPS connections when using Emscripten. (#3331)

Fixed HTTPConnectionPool.urlopen to stop automatically casting non-proxy headers to HTTPHeaderDict. This change was premature as it did not apply to proxy headers and HTTPHeaderDict does not handle byte header values correctly yet. (#3343)

Changed ProtocolError to InvalidChunkLength when response terminates before the chunk length is sent. (#2860)

Changed ProtocolError to be more verbose on incomplete reads with excess content. (#3261)

2.2.0

🖥️ urllib3 now works in the browser

🎉 This release adds experimental support for using urllib3 in the browser with Pyodide! 🎉

Thanks to Joe Marshall (@joemarshall) for contributing this feature. This change was possible thanks to work done in urllib3 v2.0 to detach our API from http.client. Please report all bugs to the urllib3 issue tracker.

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

Added support for Emscripten and Pyodide, including streaming support in cross-origin isolated browser environments where threading is enabled. (#2951)

Added support for HTTPResponse.read1() method. (#3186)

Added rudimentary support for HTTP/2. (#3284)

Fixed issue where requests against urls with trailing dots were failing due to SSL errors when using proxy. (#2244)

Fixed HTTPConnection.proxy_is_verified and HTTPSConnection.proxy_is_verified to be always set to a boolean after connecting to a proxy. It could be None in some cases previously. (#3130)

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.2.2 (2024-06-17)

Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.

Allowed passing negative integers as amt to read methods of http.client.HTTPResponse as an alternative to None. ([#3122](https://github.com/urllib3/urllib3/issues/3122) <https://github.com/urllib3/urllib3/issues/3122>__)

Fixed return types representing copying actions to use typing.Self. ([#3363](https://github.com/urllib3/urllib3/issues/3363) <https://github.com/urllib3/urllib3/issues/3363>__)

2.2.1 (2024-02-16)

Fixed issue where InsecureRequestWarning was emitted for HTTPS connections when using Emscripten. ([#3331](https://github.com/urllib3/urllib3/issues/3331) <https://github.com/urllib3/urllib3/issues/3331>__)

Fixed HTTPConnectionPool.urlopen to stop automatically casting non-proxy headers to HTTPHeaderDict. This change was premature as it did not apply to proxy headers and HTTPHeaderDict does not handle byte header values correctly yet. ([#3343](https://github.com/urllib3/urllib3/issues/3343) <https://github.com/urllib3/urllib3/issues/3343>__)

Changed InvalidChunkLength to ProtocolError when response terminates before the chunk length is sent. ([#2860](https://github.com/urllib3/urllib3/issues/2860) <https://github.com/urllib3/urllib3/issues/2860>__)

Changed ProtocolError to be more verbose on incomplete reads with excess content. ([#3261](https://github.com/urllib3/urllib3/issues/3261) <https://github.com/urllib3/urllib3/issues/3261>__)

2.2.0 (2024-01-30)

Added support for Emscripten and Pyodide <https://urllib3.readthedocs.io/en/latest/reference/contrib/emscripten.html>, including streaming support in cross-origin isolated browser environments where threading is enabled. ([#2951](https://github.com/urllib3/urllib3/issues/2951) <https://github.com/urllib3/urllib3/issues/2951>)

Added support for HTTPResponse.read1() method. ([#3186](https://github.com/urllib3/urllib3/issues/3186) <https://github.com/urllib3/urllib3/issues/3186>__)

Added rudimentary support for HTTP/2. ([#3284](https://github.com/urllib3/urllib3/issues/3284) <https://github.com/urllib3/urllib3/issues/3284>__)

Fixed issue where requests against urls with trailing dots were failing due to SSL errors when using proxy. ([#2244](https://github.com/urllib3/urllib3/issues/2244) <https://github.com/urllib3/urllib3/issues/2244>__)

Fixed HTTPConnection.proxy_is_verified and HTTPSConnection.proxy_is_verified to be always set to a boolean after connecting to a proxy. It could be None in some cases previously. ([#3130](https://github.com/urllib3/urllib3/issues/3130) <https://github.com/urllib3/urllib3/issues/3130>__)

Fixed an issue where headers passed in a request with json= would be mutated ([#3203](https://github.com/urllib3/urllib3/issues/3203) <https://github.com/urllib3/urllib3/issues/3203>__)

Fixed HTTPSConnection.is_verified to be set to False when connecting from a HTTPS proxy to an HTTP target. It was set to True previously. ([#3267](https://github.com/urllib3/urllib3/issues/3267) <https://github.com/urllib3/urllib3/issues/3267>__)

Fixed handling of new error message from OpenSSL 3.2.0 when configuring an HTTP proxy as HTTPS ([#3268](https://github.com/urllib3/urllib3/issues/3268) <https://github.com/urllib3/urllib3/issues/3268>__)

Fixed TLS 1.3 post-handshake auth when the server certificate validation is disabled ([#3325](https://github.com/urllib3/urllib3/issues/3325) <https://github.com/urllib3/urllib3/issues/3325>__)

Note for downstream distributors: To run integration tests, you now need to run the tests a second time with the --integration pytest flag. ([#3181](https://github.com/urllib3/urllib3/issues/3181) <https://github.com/urllib3/urllib3/issues/3181>__)

2.1.0 (2023-11-13)

Removed support for the deprecated urllib3[secure] extra. ([#2680](https://github.com/urllib3/urllib3/issues/2680) <https://github.com/urllib3/urllib3/issues/2680>__)

Removed support for the deprecated SecureTransport TLS implementation. ([#2681](https://github.com/urllib3/urllib3/issues/2681) <https://github.com/urllib3/urllib3/issues/2681>__)

Removed support for the end-of-life Python 3.7. ([#3143](https://github.com/urllib3/urllib3/issues/3143) <https://github.com/urllib3/urllib3/issues/3143>__)

Allowed loading CA certificates from memory for proxies. ([#3065](https://github.com/urllib3/urllib3/issues/3065) <https://github.com/urllib3/urllib3/issues/3065>__)

Fixed decoding Gzip-encoded responses which specified x-gzip content-encoding. ([#3174](https://github.com/urllib3/urllib3/issues/3174) <https://github.com/urllib3/urllib3/issues/3174>__)

2.0.7 (2023-10-17)

Made body stripped from HTTP requests changing the request method to GET after HTTP 303 "See Other" redirect responses.

... (truncated)

Commits

27e2a5c Release 2.2.2 (#3406)
accff72 Merge pull request from GHSA-34jh-p97f-mpxf
34be4a5 Pin CFFI to a new release candidate instead of a Git commit (#3398)
da41058 Bump browser-actions/setup-chrome from 1.6.0 to 1.7.1 (#3399)
b07a669 Bump github/codeql-action from 2.13.4 to 3.25.6 (#3396)
b8589ec Measure coverage with v4 of artifact actions (#3394)
f3bdc55 Allow triggering CI manually (#3391)
5239265 Fix HTTP version in debug log (#3316)
b34619f Bump actions/checkout to 4.1.4 (#3387)
9961d14 Bump browser-actions/setup-chrome from 1.5.0 to 1.6.0 (#3386)
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

dryrunsecurity · 2024-06-18T12:56:05Z

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Configured Codepaths Analyzer	✅	0 findings
IDOR Analyzer	✅	0 findings
Sensitive Files Analyzer	❕	1 finding
Server-Side Request Forgery Analyzer	✅	0 findings
SQL Injection Analyzer	✅	0 findings
Authn/Authz Analyzer	✅	0 findings
Secrets Analyzer	✅	0 findings

Note

🟢 Risk threshold not exceeded.

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The provided code change is an update to the requirements.txt file for the DefectDojo application, a web-based open-source vulnerability management tool. The primary change is the update of the urllib3 library from version 1.26.18 to 2.2.2. This update is significant from an application security perspective, as it likely addresses known security vulnerabilities in the previous version of the library.

Additionally, the requirements.txt file includes several libraries that are noted as being "very outdated", such as django-multiselectfield and django-tagging. While these libraries are not directly used, their inclusion in the project could indicate the presence of outdated or vulnerable dependencies that should be further investigated. On a positive note, the inclusion of security-related libraries, such as cryptography, argon2-cffi, and vulners, suggests that the DefectDojo project is taking security seriously and implementing secure coding practices.

Files Changed:

requirements.txt: The changes in this file update the version of the urllib3 library from 1.26.18 to 2.2.2. This update is important for maintaining the security of the application, as it likely addresses known vulnerabilities in the previous version of the library. The file also includes several outdated dependencies that should be further investigated to ensure the overall security of the application.

Powered by DryRun Security

github-actions · 2024-08-06T22:55:38Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

mtesauro · 2024-08-07T01:13:09Z

@dependabot rebase

Bumps [urllib3](https://github.com/urllib3/urllib3) from 1.26.18 to 2.2.2. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@1.26.18...2.2.2) --- updated-dependencies: - dependency-name: urllib3 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>

dryrunsecurity · 2024-08-07T01:13:56Z

DryRun Security Summary

The provided code changes primarily focus on updating the urllib3 library from version 1.26.18 to version 2.2.2 to address known security vulnerabilities, while the rest of the changes seem to be general library version updates.

Expand for full summary

Summary:

The provided code changes primarily focus on updating the urllib3 library from version 1.26.18 to version 2.2.2. This is a security-related update, as previous versions of urllib3 had several known vulnerabilities, including CVE-2022-29505 and CVE-2021-33503. Upgrading to the latest version of urllib3 is a recommended security practice to mitigate these vulnerabilities. Apart from the urllib3 update, the rest of the changes seem to be general library version updates, which may include bug fixes and feature improvements, but do not directly address any known security issues.

From an application security perspective, the update to the urllib3 library is the most significant change, as it addresses known security vulnerabilities. Keeping dependencies up-to-date is a crucial part of maintaining the security of an application, as outdated libraries can introduce vulnerabilities that could be exploited by attackers. The update to urllib3 version 2.2.2 should be reviewed to ensure that it addresses any known security issues and does not introduce any new vulnerabilities.

Files Changed:

requirements.txt: This file has been updated to include the following change:
- The urllib3 library has been updated from version 1.26.18 to version 2.2.2. This is a security-related update, as previous versions of urllib3 had several known vulnerabilities.

Code Analysis

We ran 9 analyzers against 1 file and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

github-actions · 2024-08-07T01:13:58Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

github-actions · 2024-09-04T15:45:25Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

dependabot · 2024-09-12T12:35:21Z

Superseded by #10900.

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jun 18, 2024

dependabot bot mentioned this pull request Jun 18, 2024

Bump urllib3 from 1.26.18 to 2.2.1 #10021

Closed

dependabot bot force-pushed the dependabot/pip/dev/urllib3-2.2.2 branch from 42f61eb to 050722b Compare June 20, 2024 14:30

dependabot bot force-pushed the dependabot/pip/dev/urllib3-2.2.2 branch 2 times, most recently from 72f0b8a to e82d1b3 Compare June 29, 2024 02:50

github-actions bot added the conflicts-detected label Aug 6, 2024

dependabot bot force-pushed the dependabot/pip/dev/urllib3-2.2.2 branch from e82d1b3 to e22c86d Compare August 7, 2024 01:13

github-actions bot removed the conflicts-detected label Aug 7, 2024

github-actions bot added the conflicts-detected label Sep 4, 2024

dependabot bot closed this Sep 12, 2024

dependabot bot deleted the dependabot/pip/dev/urllib3-2.2.2 branch September 12, 2024 12:35

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump urllib3 from 1.26.18 to 2.2.2 #10424

Bump urllib3 from 1.26.18 to 2.2.2 #10424

dependabot bot commented on behalf of github Jun 18, 2024 •

edited

Loading

dryrunsecurity bot commented Jun 18, 2024 •

edited

Loading

github-actions bot commented Aug 6, 2024

mtesauro commented Aug 7, 2024

dryrunsecurity bot commented Aug 7, 2024 •

edited

Loading

github-actions bot commented Aug 7, 2024

github-actions bot commented Sep 4, 2024

dependabot bot commented on behalf of github Sep 12, 2024

Bump urllib3 from 1.26.18 to 2.2.2 #10424

Bump urllib3 from 1.26.18 to 2.2.2 #10424

Conversation

dependabot bot commented on behalf of github Jun 18, 2024 • edited Loading

2.2.2

🚀 urllib3 is fundraising for HTTP/2 support

Changes

2.2.1

🚀 urllib3 is fundraising for HTTP/2 support

Changes

2.2.0

🖥️ urllib3 now works in the browser

🚀 urllib3 is fundraising for HTTP/2 support

Changes

2.2.2 (2024-06-17)

2.2.1 (2024-02-16)

2.2.0 (2024-01-30)

2.1.0 (2023-11-13)

2.0.7 (2023-10-17)

dryrunsecurity bot commented Jun 18, 2024 • edited Loading

github-actions bot commented Aug 6, 2024

mtesauro commented Aug 7, 2024

dryrunsecurity bot commented Aug 7, 2024 • edited Loading

DryRun Security Summary

Code Analysis

Riskiness

github-actions bot commented Aug 7, 2024

github-actions bot commented Sep 4, 2024

dependabot bot commented on behalf of github Sep 12, 2024

dependabot bot commented on behalf of github Jun 18, 2024 •

edited

Loading

dryrunsecurity bot commented Jun 18, 2024 •

edited

Loading

dryrunsecurity bot commented Aug 7, 2024 •

edited

Loading