Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump boto3 from 1.34.142 to 1.34.143 #10558

Merged
merged 1 commit into from
Jul 11, 2024
Merged

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jul 11, 2024

Bumps boto3 from 1.34.142 to 1.34.143.

Commits
  • 5b7ef37 Merge branch 'release-1.34.143'
  • 5527d5b Bumping version to 1.34.143
  • 5b20752 Add changelog entries from botocore
  • f902982 Merge branch 'release-1.34.142' into develop
  • See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request
Dependency Name Ignore Conditions
boto3 [< 1.25, > 1.24.55]

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [boto3](https://github.com/boto/boto3) from 1.34.142 to 1.34.143.
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.34.142...1.34.143)

---
updated-dependencies:
- dependency-name: boto3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jul 11, 2024
Copy link

dryrunsecurity bot commented Jul 11, 2024

DryRun Security Summary

The provided code change updates the requirements.txt file for the DefectDojo application, specifically updating the boto3 library from version 1.34.142 to 1.34.143, which is an important part of maintaining the application's security posture by ensuring the use of up-to-date dependencies.

Expand for full summary

Summary:

The provided code change is an update to the requirements.txt file, which specifies the Python dependencies required for the DefectDojo application. The specific change is an update to the boto3 library, a Python SDK for the Amazon Web Services (AWS) ecosystem, from version 1.34.142 to 1.34.143.

While the change to the boto3 library itself is not particularly interesting from a security perspective, the requirements.txt file is an important part of the application's security posture, as it specifies the exact versions of the dependencies used by the application. Keeping these dependencies up-to-date is crucial for maintaining the application's security, as older versions may contain known vulnerabilities that could be exploited. Additionally, the requirements.txt file includes several other dependencies, such as argon2-cffi, vulners, and django-ratelimit, that are worth reviewing from a security perspective, as they play a role in the application's overall security.

Files Changed:

  • requirements.txt: This file has been updated to include the latest version of the boto3 library, which is a Python SDK for the Amazon Web Services (AWS) ecosystem. The specific change is an update from version 1.34.142 to 1.34.143. While this change is not particularly interesting from a security perspective, the requirements.txt file is an important part of the application's security posture, as it specifies the exact versions of the dependencies used by the application. Keeping these dependencies up-to-date is crucial for maintaining the application's security.

Code Analysis

We ran 7 analyzers against 1 file and 1 analyzer had findings. 6 analyzers had no findings.

Analyzer Findings
Sensitive Files Analyzer 1 finding

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

Copy link

Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@mtesauro mtesauro merged commit a6b8c86 into dev Jul 11, 2024
124 checks passed
@dependabot dependabot bot deleted the dependabot/pip/dev/boto3-1.34.143 branch July 11, 2024 16:24
mwager added a commit to mwager/django-DefectDojo that referenced this pull request Jul 16, 2024
… kiuwan-sca

# By dependabot[bot] (13) and others
# Via GitHub
* 'kiuwan-sca' of github.com:mwager/django-DefectDojo: (39 commits)
  Deprecate Python-jose and migrate okta to python_social_auth (DefectDojo#10117)
  fix: dockerfile warnings (DefectDojo#10505)
  Ruff: Add and fix Q000 (DefectDojo#10095)
  Fix(django): Upgrade of 4.2 (DefectDojo#10553)
  fix(deps): build python psycopg3 dependency instead of use the pre-build binary (DefectDojo#10491)
  Bump coverage from 7.5.4 to 7.6.0 (DefectDojo#10560)
  Bump asteval from 1.0.0 to 1.0.1 (DefectDojo#10561)
  Bump djangorestframework from 3.14.0 to 3.15.2 (DefectDojo#10431)
  Bump boto3 from 1.34.142 to 1.34.143 (DefectDojo#10558)
  Bump django-debug-toolbar from 4.4.5 to 4.4.6 (DefectDojo#10557)
  Bump boto3 from 1.34.141 to 1.34.142 (DefectDojo#10551)
  Bump packageurl-python from 0.15.2 to 0.15.3 (DefectDojo#10541)
  Bump boto3 from 1.34.140 to 1.34.141 (DefectDojo#10542)
  Update helm lock file
  Update versions in application files
  Update versions in application files
  API: Convert get_filterset calls to get_queryset (DefectDojo#10543)
  Bump django-debug-toolbar from 4.4.4 to 4.4.5 (DefectDojo#10527)
  Fix ruff
  Ruff fix
  ...

# Conflicts:
#	dojo/settings/.settings.dist.py.sha256sum
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants