Bump python from `d97b595` to `9ed09f7` in the docker-deps group #831

dependabot · 2025-06-12T02:19:07Z

Bumps the docker-deps group with 1 update: python.

Updates python from d97b595 to 9ed09f7

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the docker-deps group with 1 update: python. Updates `python` from `d97b595` to `9ed09f7` --- updated-dependencies: - dependency-name: python dependency-version: 3.13.4-alpine3.21 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: docker-deps ... Signed-off-by: dependabot[bot] <[email protected]>

codecov · 2025-06-12T02:20:08Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00%. Comparing base (fd0e735) to head (b11b8fc).
Report is 1 commits behind head on main.

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #831   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            8         8           
  Lines          151       151           
  Branches        11        11           
=========================================
  Hits           151       151

Flag	Coverage Δ
python-3.10	`100.00% <ø> (ø)`
python-3.11	`100.00% <ø> (ø)`
python-3.12	`100.00% <ø> (ø)`
python-3.13	`100.00% <ø> (ø)`
python-3.9	`100.00% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

github-actions · 2025-06-12T02:22:20Z

Test Results

5 files ±0 5 suites ±0 5s ⏱️ ±0s
36 tests ±0 36 ✅ ±0 0 💤 ±0 0 ❌ ±0
180 runs ±0 180 ✅ ±0 0 💤 ±0 0 ❌ ±0

Results for commit b11b8fc. ± Comparison against base commit fd0e735.

♻️ This comment has been updated with latest results.

github-actions · 2025-06-18T21:54:40Z

🔍 Vulnerabilities of `jkreileder/cf-ips-to-hcloud-fw:pr-831`

📦 Image Reference jkreileder/cf-ips-to-hcloud-fw:pr-831

digest	`sha256:5afadb21a77a3a25cadb8041151c1d3e5dd08fd8b94c6b1efcfc39436e5e466c`
vulnerabilities
platform	linux/amd64
size	26 MB
packages	59

📦 Base Image python:3-alpine3.21

also known as	`3.13-alpine3.21` `3.13.4-alpine3.21` `alpine3.21`
digest	`sha256:7a12a6fcff5e21880667bbf1ff8ac29181b6ad2a455293dd942a408753ba45ba`
vulnerabilities

h11 0.14.0 (pypi)

pkg:pypi/[email protected]

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<0.16.0`
Fixed version	`0.16.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

Description

A leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected range	`<0.16.0`
Fixed version	`0.16.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`0.052%`
EPSS Percentile	`16th percentile`

Description

Impact

A leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions.

Details

HTTP/1.1 Chunked-Encoding bodies are formatted as a sequence of "chunks", each of which consists of:

chunk length

\r\n

length bytes of content

\r\n

In versions of h11 up to 0.14.0, h11 instead parsed them as:

chunk length

\r\n

length bytes of content

any two bytes

i.e. it did not validate that the trailing \r\n bytes were correct, and if you put 2 bytes of garbage there it would be accepted, instead of correctly rejecting the body as malformed.

By itself this is harmless. However, suppose you have a proxy or reverse-proxy that tries to analyze HTTP requests, and your proxy has a different bug in parsing Chunked-Encoding, acting as if the format is:

chunk length

\r\n

length bytes of content

more bytes of content, as many as it takes until you find a \r\n

For example, pound had this bug -- it can happen if an implementer uses a generic "read until end of line" helper to consumes the trailing \r\n.

In this case, h11 and your proxy may both accept the same stream of bytes, but interpret them differently. For example, consider the following HTTP request(s) (assume all line breaks are \r\n):
GET /one HTTP/1.1
Host: localhost
Transfer-Encoding: chunked

5
AAAAAXX2
45
0

GET /two HTTP/1.1
Host: localhost
Transfer-Encoding: chunked

0
Here h11 will interpret it as two requests, one with body AAAAA45 and one with an empty body, while our hypothetical buggy proxy will interpret it as a single request, with body AAAAXX20\r\n\r\nGET /two .... And any time two HTTP processors both accept the same string of bytes but interpret them differently, you have the conditions for a "request smuggling" attack. For example, if /two is a dangerous endpoint and the job of the reverse proxy is to stop requests from getting there, then an attacker could use a bytestream like the above to circumvent this protection.

Even worse, if our buggy reverse proxy receives two requests from different users:
GET /one HTTP/1.1
Host: localhost
Transfer-Encoding: chunked

5
AAAAAXX999
0
GET /two HTTP/1.1
Host: localhost
Cookie: SESSION_KEY=abcdef...
...it will consider the first request to be complete and valid, and send both on to the h11-based web server over the same socket. The server will then see the two concatenated requests, and interpret them as one request to /one whose body includes /two's session key, potentially allowing one user to steal another's credentials.

Patches

Fixed in h11 0.15.0.

Workarounds

Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.

Credits

Reported by Jeppe Bonde Weikop on 2025-01-09.

requests 2.32.3 (pypi)

pkg:pypi/[email protected]

Insufficiently Protected Credentials

Affected range	`<2.32.4`
Fixed version	`2.32.4`
CVSS Score	`5.3`
CVSS Vector	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`
EPSS Score	`0.062%`
EPSS Percentile	`20th percentile`

Description

Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

Workarounds

For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).

References

psf/requests#6965
https://seclists.org/fulldisclosure/2025/Jun/2

github-actions · 2025-06-18T21:54:41Z

Recommended fixes for image `jkreileder/cf-ips-to-hcloud-fw:pr-831`

Base image is python:3-alpine3.21

Name	3.13.4-alpine3.21
Digest	sha256:7a12a6fcff5e21880667bbf1ff8ac29181b6ad2a455293dd942a408753ba45ba
Vulnerabilities
Pushed	2 weeks ago
Size	17 MB
Packages	43
Flavor	alpine
OS	3.21
Runtime	3.13.4

The base image is also available under the supported tag(s): 3.13-alpine3.21, alpine3.21

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

Tag	Details	Pushed	Vulnerabilities
`3-alpine3.21` Newer image for same tag Also known as: alpine3.21 3.13.5-alpine3.21 3.13-alpine3.21	Benefits: Same OS detected Minor runtime version update Newer image for same tag Image contains 5 fewer packages Tag was pushed more recently Image has similar size Image has same number of vulnerabilities Image details: Size: 17 MB Flavor: alpine OS: 3.21 Runtime: 3.13.5	1 week ago

Change base image

Tag	Details	Pushed	Vulnerabilities
`3-alpine` Tag is preferred tag Also known as: alpine alpine3.22 3.13.5-alpine 3.13.5-alpine3.22 3.13-alpine 3.13-alpine3.22 3-alpine3.22	Benefits: Same OS detected Minor runtime version update Minor OS version update Image contains 4 fewer packages Tag is preferred tag Tag was pushed more recently Image has similar size Image has same number of vulnerabilities 3-alpine was pulled 51K times last month Image details: Size: 17 MB Flavor: alpine OS: 3.22 Runtime: 3.13.5	1 week ago

github-actions · 2025-06-18T21:54:51Z

Overview

Image reference	`jkreileder/cf-ips-to-hcloud-fw:1`	`quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-831`
- digest	`dd18d18ca96b`	`5afadb21a77a`
- tag	`1`	`pr-831`
- provenance	`5387efd`	`771ec58`
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	24 MB	26 MB (+1.8 MB)
- packages	62	59 (-3)
Base Image	`python:3-alpine` also known as: • `3.13-alpine` • `alpine`	`python:3-alpine3.21` also known as: • `3.13-alpine3.21` • `alpine3.21`
- vulnerabilities

Environment Variables (2 changes)

± 2 changed

4 unchanged

 GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305
 PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 PYTHONDONTWRITEBYTECODE=1
 PYTHONFAULTHANDLER=1
-PYTHON_SHA256=9cf9427bee9e2242e3877dd0f6b641c1853ca461f39d6503ce260a59c80bf0d9
+PYTHON_SHA256=27b15a797562a2971dce3ffe31bb216042ce0b995b39d768cf15f784cc757365
-PYTHON_VERSION=3.13.1
+PYTHON_VERSION=3.13.4

Labels (3 changes)

± 3 changed

5 unchanged

-org.opencontainers.image.created=2024-12-22T13:10:48.667Z
+org.opencontainers.image.created=2025-06-18T21:53:06.256Z
 org.opencontainers.image.description=Update Hetzner Cloud firewall rules with current Cloudflare IP ranges
 org.opencontainers.image.licenses=MIT
-org.opencontainers.image.revision=5387efdaf829ded112cb2acdde1ab4916839a5ee
+org.opencontainers.image.revision=771ec58f1b441176c99d651d313325e791bfb8d2
 org.opencontainers.image.source=https://github.com/jkreileder/cf-ips-to-hcloud-fw
 org.opencontainers.image.title=cf-ips-to-hcloud-fw
 org.opencontainers.image.url=https://github.com/jkreileder/cf-ips-to-hcloud-fw
-org.opencontainers.image.version=1.0.15
+org.opencontainers.image.version=pr-831

Policies (0 improved, 2 worsened, 2 missing data)

Policy Name	`jkreileder/cf-ips-to-hcloud-fw:1`	`quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-831`	Change	Standing
Default non-root user	✅	✅		No Change
No AGPL v3 licenses	✅	✅		No Change
No fixable critical or high vulnerabilities	✅	⚠️ 2	+2	Worsened
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	❓ No data
No unapproved base images	✅	❓ No data
Supply chain attestations	✅	⚠️ 2	+2	Worsened

Packages and Vulnerabilities (49 package changes and 4 vulnerability changes)

➕ 2 packages added

➖ 5 packages removed

♾️ 42 packages changed

15 packages unchanged

✔️ 4 vulnerabilities removed

Changes for packages of type apk (33 changes)

	Package	Version `jkreileder/cf-ips-to-hcloud-fw:1`	Version `quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-831`
♾️	.python-rundeps	`20241205.142133`	`20250605.070647`
➕	alpine-base		`3.21.3-r0`
♾️	alpine-baselayout	`3.6.5-r0`	`3.6.8-r1`
♾️	alpine-baselayout-data	`3.6.5-r0`	`3.6.8-r1`
♾️	alpine-keys	`2.4-r1`	`2.5-r0`
➕	alpine-release		`3.21.3-r0`
♾️	apk-tools	`2.14.4-r0`	`2.14.6-r3`
♾️	busybox	`1.36.1-r29`	`1.37.0-r12`
♾️	busybox-binsh	`1.36.1-r29`	`1.37.0-r12`
♾️	ca-certificates	`20240705-r0`	`20241121-r1`
♾️	ca-certificates-bundle	`20240705-r0`	`20241121-r1`
♾️	libcrypto3	`3.3.2-r1`	`3.3.3-r0`
♾️	libffi	`3.4.6-r0`	`3.4.7-r0`
♾️	libncursesw	`6.4_p20240420-r2`	`6.5_p20241006-r3`
♾️	libpanelw	`6.4_p20240420-r2`	`6.5_p20241006-r3`
♾️	libssl3	`3.3.2-r1`	`3.3.3-r0`
♾️	libuuid	`2.40.1-r1`	`2.40.4-r1`
♾️	musl	`1.2.5-r0`	`1.2.5-r9`

		Removed vulnerabilities (1):
♾️	musl-utils	`1.2.5-r0`	`1.2.5-r9`
♾️	ncurses	`6.4_p20240420-r2`	`6.5_p20241006-r3`
♾️	ncurses-terminfo-base	`6.4_p20240420-r2`	`6.5_p20241006-r3`
♾️	openssl	`3.3.2-r1`	`3.3.3-r0`

		Removed vulnerabilities (2):
♾️	pax-utils	`1.3.7-r2`	`1.3.8-r1`
♾️	readline	`8.2.10-r0`	`8.2.13-r0`
♾️	scanelf	`1.3.7-r2`	`1.3.8-r1`
♾️	sqlite	`3.45.3-r1`	`3.48.0-r2`
♾️	sqlite-libs	`3.45.3-r1`	`3.48.0-r2`
♾️	ssl_client	`1.36.1-r29`	`1.37.0-r12`
♾️	tzdata	`2024b-r0`	`2025b-r0`
♾️	util-linux	`2.40.1-r1`	`2.40.4-r1`
♾️	xz	`5.6.2-r0`	`5.6.3-r1`

		Removed vulnerabilities (1):
♾️	xz-libs	`5.6.2-r0`	`5.6.3-r1`
♾️	zlib	`1.3.1-r1`	`1.3.1-r2`

Changes for packages of type generic (1 changes)

	Package	Version `jkreileder/cf-ips-to-hcloud-fw:1`	Version `quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-831`
♾️	python	`3.13.1`	`3.13.4`

Changes for packages of type nuget (5 changes)

	Package	Version `jkreileder/cf-ips-to-hcloud-fw:1`
➖	Simple Launcher	`1.1.0.14`
➖	t32.exe	`1.1.0.14`
➖	t64.exe	`1.1.0.14`
➖	w32.exe	`1.1.0.14`
➖	w64.exe	`1.1.0.14`

Changes for packages of type pypi (10 changes)

	Package	Version `jkreileder/cf-ips-to-hcloud-fw:1`	Version `quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-831`
♾️	anyio	`4.7.0`	`4.9.0`
♾️	certifi	`2024.12.14`	`2025.1.31`
♾️	cf-ips-to-hcloud-fw	`1.0.15`	`1.0.16.dev0`
♾️	charset-normalizer	`3.4.0`	`3.4.1`
♾️	cloudflare	`3.1.1`	`4.1.0`
♾️	hcloud	`2.3.0`	`2.4.0`
♾️	httpx	`0.27.2`	`0.28.1`
♾️	pip	`24.3.1`	`25.1.1`
♾️	pydantic	`2.9.2`	`2.10.6`
♾️	pydantic-core	`2.23.4`	`2.27.2`

dependabot bot added dependencies Pull requests that update a dependency file docker Pull requests that update Docker code labels Jun 12, 2025

dependabot bot requested a review from jkreileder as a code owner June 12, 2025 02:19

dependabot bot added dependencies Pull requests that update a dependency file docker Pull requests that update Docker code labels Jun 12, 2025

jkreileder approved these changes Jun 18, 2025

View reviewed changes

jkreileder enabled auto-merge (squash) June 18, 2025 21:41

Merge branch 'main' into dependabot/docker/docker-deps-6c9408c305

b11b8fc

jkreileder merged commit cfc187b into main Jun 18, 2025
58 checks passed

jkreileder deleted the dependabot/docker/docker-deps-6c9408c305 branch June 18, 2025 21:58

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump python from `d97b595` to `9ed09f7` in the docker-deps group #831

Bump python from `d97b595` to `9ed09f7` in the docker-deps group #831

Uh oh!

dependabot bot commented on behalf of github Jun 12, 2025 •

edited

Loading

Uh oh!

codecov bot commented Jun 12, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Jun 12, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Jun 18, 2025

Impact

Details

Patches

Workarounds

Credits

Impact

Workarounds

References

Uh oh!

github-actions bot commented Jun 18, 2025

Uh oh!

github-actions bot commented Jun 18, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Bump python from d97b595 to 9ed09f7 in the docker-deps group #831

Bump python from d97b595 to 9ed09f7 in the docker-deps group #831

Uh oh!

Conversation

dependabot bot commented on behalf of github Jun 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Jun 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

github-actions bot commented Jun 12, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Test Results

Uh oh!

github-actions bot commented Jun 18, 2025

🔍 Vulnerabilities of jkreileder/cf-ips-to-hcloud-fw:pr-831

Impact

Details

Patches

Workarounds

Credits

Impact

Workarounds

References

Uh oh!

github-actions bot commented Jun 18, 2025

Recommended fixes for image jkreileder/cf-ips-to-hcloud-fw:pr-831

Refresh base image

Change base image

Uh oh!

github-actions bot commented Jun 18, 2025

Overview

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Bump python from `d97b595` to `9ed09f7` in the docker-deps group #831

Bump python from `d97b595` to `9ed09f7` in the docker-deps group #831

dependabot bot commented on behalf of github Jun 12, 2025 •

edited

Loading

codecov bot commented Jun 12, 2025 •

edited

Loading

github-actions bot commented Jun 12, 2025 •

edited

Loading

🔍 Vulnerabilities of `jkreileder/cf-ips-to-hcloud-fw:pr-831`

Recommended fixes for image `jkreileder/cf-ips-to-hcloud-fw:pr-831`