UNCLASSIFIED - NO CUI

Skip to content

chore(deps): update all dependencies

renovate requested to merge renovate/all into development

This MR contains the following updates:

Package Type Update Change
quay.io/kiali/kiali-operator ironbank-docker minor v1.72.0 -> v1.73.0
quay.io/kiali/kiali-operator minor v1.72.0 -> v1.73.0
quay.io/kiali/kiali-operator stage minor v1.72.0 -> v1.73.0
quay.io/operator-framework/ansible-operator ironbank-docker minor v1.28.0 -> v1.31.0
quay.io/operator-framework/ansible-operator stage minor v1.28.0 -> v1.31.0
requests (source, changelog) minor ==2.28.2 -> ==2.31.0
urllib3 (changelog) patch ==1.26.14 -> ==1.26.16

⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the logs for more information.

Release Notes

psf/requests

v2.31.0

Compare Source

Security

  • Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential forwarding of Proxy-Authorization headers to destination servers when following HTTPS redirects.

    When proxies are defined with user info (https://user:pass@proxy:8080), Requests will construct a Proxy-Authorization header that is attached to the request to authenticate with the proxy.

    In cases where Requests receives a redirect response, it previously reattached the Proxy-Authorization header incorrectly, resulting in the value being sent through the tunneled connection to the destination server. Users who rely on defining their proxy credentials in the URL are strongly encouraged to upgrade to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy credentials once the change has been fully deployed.

    Users who do not use a proxy or do not supply their proxy credentials through the user information portion of their proxy URL are not subject to this vulnerability.

    Full details can be read in our Github Security Advisory and CVE-2023-32681.

v2.30.0

Compare Source

Dependencies

v2.29.0

Compare Source

Improvements

  • Requests now defers chunked requests to the urllib3 implementation to improve standardization. (#​6226)
  • Requests relaxes header component requirements to support bytes/str subclasses. (#​6356)
urllib3/urllib3

v1.26.16

Compare Source

====================

  • Fixed thread-safety issue where accessing a PoolManager with many distinct origins would cause connection pools to be closed while requests are in progress (#&#8203;2954 <https://github.com/urllib3/urllib3/pull/2954>_)

v1.26.15

Compare Source

====================

  • Fix socket timeout value when HTTPConnection is reused (#&#8203;2645 <https://github.com/urllib3/urllib3/issues/2645>__)
  • Remove "!" character from the unreserved characters in IPv6 Zone ID parsing (#&#8203;2899 <https://github.com/urllib3/urllib3/issues/2899>__)
  • Fix IDNA handling of '\x80' byte (#&#8203;2901 <https://github.com/urllib3/urllib3/issues/2901>__)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This MR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Merge request reports

UNCLASSIFIED - NO CUI