CVE-2022-21187

Advisory

Vcspull 1.11.1 updates its dependency 'libvcs' to v0.11.1 to fix a command injection vulnerability.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

Security

- Update libvcs 0.11.0 -> 0.11.1 to patch mercurial URL injection
vulnerability with URLs ([info](https://github.com/vcs-python/libvcs/pull/306))

Development

- Run pyupgrade formatting (353)
- Tests: Move from pytest `tmp_dir` (`py.path.local`) to `tmp_path`
(`pathlib.Path`)

Documentation

- Move to furo theme
- Root: `make start_docs`, `make design_docs`
- docs/: `make start`, `make design`

Resources

• https://pypi.org/project/vcspull
• https://pyup.io/changelogs/vcspull/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21187