chore(deps): update dependency urllib3 to v2.0.6 [security] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
urllib3 (changelog)	==2.0.5 -> ==2.0.6

GitHub Vulnerability Alerts

CVE-2023-43804

urllib3 doesn't treat the Cookie HTTP header special or provide any helpers for managing cookies over HTTP, that is the responsibility of the user. However, it is possible for a user to specify a Cookie header and unknowingly leak information via HTTP redirects to a different origin if that user doesn't disable redirects explicitly.

Users must handle redirects themselves instead of relying on urllib3's automatic redirects to achieve safe processing of the Cookie header, thus we decided to strip the header by default in order to further protect users who aren't using the correct approach.

Affected usages

We believe the number of usages affected by this advisory is low. It requires all of the following to be true to be exploited:

• Using an affected version of urllib3 (patched in v1.26.17 and v2.0.6)
• Using the Cookie header on requests, which is mostly typical for impersonating a browser.
• Not disabling HTTP redirects
• Either not using HTTPS or for the origin server to redirect to a malicious origin.

Remediation

• Upgrading to at least urllib3 v1.26.17 or v2.0.6
• Disabling HTTP redirects using redirects=False when sending requests.
• Not using the Cookie header.

---

Release Notes

urllib3/urllib3 (urllib3)

v2.0.6

Compare Source

==================

• Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[github-actions]

🦙 MegaLinter status: ⚠️ WARNING

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ ACTION	actionlint	18		0	0.44s
✅ BASH	bash-exec	4		0	0.02s
✅ BASH	shellcheck	1		0	0.02s
✅ BASH	shfmt	4		0	0.03s
⚠️ CSHARP	csharpier	1		1	0.29s
⚠️ CSHARP	dotnet-format	1		1	1.27s
✅ CSS	stylelint	1		0	1.55s
✅ DOCKERFILE	hadolint	4		0	0.16s
✅ EDITORCONFIG	editorconfig-checker	374		0	2.54s
✅ ENV	dotenv-linter	1		0	0.02s
✅ GROOVY	npm-groovy-lint	7		0	11.83s
✅ HTML	djlint	2		0	1.2s
✅ HTML	htmlhint	2		0	0.43s
✅ JAVA	checkstyle	59		0	8.33s
✅ JSON	eslint-plugin-jsonc	29		0	5.09s
✅ JSON	jsonlint	29		0	0.41s
✅ JSON	prettier	29		0	3.94s
✅ JSON	v8r	29		0	36.9s
⚠️ MARKDOWN	markdownlint	22		117	1.52s
✅ PYTHON	bandit	1		0	1.35s
✅ PYTHON	black	1		0	0.91s
✅ PYTHON	flake8	1		0	0.58s
✅ PYTHON	isort	1		0	0.24s
✅ PYTHON	mypy	1		0	6.11s
✅ PYTHON	ruff	1		0	0.07s
✅ REPOSITORY	checkov	yes		no	26.4s
✅ REPOSITORY	gitleaks	yes		no	1.31s
✅ REPOSITORY	git_diff	yes		no	0.13s
✅ REPOSITORY	grype	yes		no	13.75s
✅ REPOSITORY	kics	yes		no	65.71s
✅ REPOSITORY	secretlint	yes		no	2.12s
✅ REPOSITORY	syft	yes		no	1.26s
✅ REPOSITORY	trivy	yes		no	20.31s
✅ REPOSITORY	trivy-sbom	yes		no	1.9s
✅ REPOSITORY	trufflehog	yes		no	11.87s
✅ SQL	sql-lint	2		0	0.79s
✅ XML	xmllint	3		0	0.01s
✅ YAML	prettier	109		0	2.38s

See detailed report in MegaLinter reports

You could have same capabilities but better runtime performances if you request a new MegaLinter flavor.

• Click here to request the new flavor

MegaLinter is graciously provided by

[renovate]

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: src/query/tests/e2e/requirements.txt

installing v2 tool python v3.12.0
[12:08:02.320] INFO (10): Installing tool python v3.12.0...
linking tool python v3.12.0
Python 3.12.0
pip 23.2.1 from /opt/containerbase/tools/python/3.12.0/lib/python3.12/site-packages/pip (python 3.12)
[12:08:09.342] INFO (10): Installed tool python in 7s.
installing v2 tool hashin v0.17.0
[12:08:09.580] INFO (171): Installing tool hashin v0.17.0...
linking tool hashin v0.17.0
Traceback (most recent call last):
  File "/opt/containerbase/tools/hashin/0.17.0/3.12/bin/hashin", line 8, in <module>
    sys.exit(main())
             ^^^^^^
  File "/opt/containerbase/tools/hashin/0.17.0/3.12/lib/python3.12/site-packages/hashin.py", line 794, in main
    import pkg_resources
ModuleNotFoundError: No module named 'pkg_resources'
[12:08:12.126] FATAL (171): Command failed with exit code 1: /usr/local/containerbase/bin/install-tool hashin 0.17.0
    err: {
      "type": "Error",
      "message": "Command failed with exit code 1: /usr/local/containerbase/bin/install-tool hashin 0.17.0",
      "stack":
          Error: Command failed with exit code 1: /usr/local/containerbase/bin/install-tool hashin 0.17.0
              at makeError (/snapshot/dist/containerbase-cli.js:42922:13)
              at handlePromise (/snapshot/dist/containerbase-cli.js:43378:29)
              at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
              at async InstallLegacyToolService.execute (/snapshot/dist/containerbase-cli.js:45801:5)
              at async InstallToolService.execute (/snapshot/dist/containerbase-cli.js:45980:9)
              at async InstallToolShortCommand.execute (/snapshot/dist/containerbase-cli.js:46296:14)
              at async InstallToolShortCommand.validateAndExecute (/snapshot/dist/containerbase-cli.js:1344:26)
              at async _Cli.run (/snapshot/dist/containerbase-cli.js:2457:22)
              at async _Cli.runExit (/snapshot/dist/containerbase-cli.js:2465:28)
              at async main (/snapshot/dist/containerbase-cli.js:46439:3)
      "shortMessage": "Command failed with exit code 1: /usr/local/containerbase/bin/install-tool hashin 0.17.0",
      "command": "/usr/local/containerbase/bin/install-tool hashin 0.17.0",
      "escapedCommand": "\"/usr/local/containerbase/bin/install-tool\" hashin 0.17.0",
      "exitCode": 1,
      "cwd": "/tmp/worker/1370d6/3ea4d3/repos/github/miracum/recruit",
      "failed": true,
      "timedOut": false,
      "isCanceled": false,
      "killed": false
    }
[12:08:12.665] INFO (171): Installed tool hashin with errors in 3s.