Skip to content

Bump pyzipper from 0.3.6 to 0.4.0 in /docker/py3-native - #45706

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/docker/py3-native/pyzipper-0.4.0
Open

Bump pyzipper from 0.3.6 to 0.4.0 in /docker/py3-native#45706
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/docker/py3-native/pyzipper-0.4.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 28, 2026

Copy link
Copy Markdown
Contributor

Bumps pyzipper from 0.3.6 to 0.4.0.

Changelog

Sourced from pyzipper's changelog.

0.4.0 (2026-05-13)

  • Update package to use pyproject.toml
  • Fix bug where CRC32 values were not removed for small files (CVE-2026-44722). pyzipper no longer writes any CRC32 values by default, regardless of file size. The CRC32 value could be used to brute-force candidate plaintexts by computing CRC32(candidate) and comparing against the stored value. In practice, this attack is feasible today only against small or low-entropy files, as CRC32 exhaustion across a large plaintext space is computationally prohibitive on current hardware.
Commits
  • a814388 Merge commit from fork
  • 6836583 Update test to loop through all compression methods
  • 4c23f26 Update README to include information about the CRC bug
  • 9d2a95c Fix README.rst block quote
  • 43b001b Update HISTORY.rst and version
  • bf7a6bd Add SECURITY.rst
  • 85ce9a5 Update README.rst with CRC information
  • 93ce88e Remove CRC32 values from file entries for small files (CVE-2026-44722)
  • 919e199 Merge pull request #42 from danifus/update202605
  • 61d3529 Quote python versions in github workflow to fix 3.10
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jul 28, 2026
@github-actions
github-actions Bot enabled auto-merge (squash) July 28, 2026 15:15
@content-bot

This comment has been minimized.

@BEAdi

BEAdi commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

@dependabot rebase

@dependabot
dependabot Bot force-pushed the dependabot/pip/docker/py3-native/pyzipper-0.4.0 branch from 8585b6f to b387c02 Compare July 29, 2026 20:55
@content-bot

This comment has been minimized.

Bumps [pyzipper](https://github.com/danifus/pyzipper) from 0.3.6 to 0.4.0.
- [Changelog](https://github.com/danifus/pyzipper/blob/master/HISTORY.rst)
- [Commits](danifus/pyzipper@v0.3.6...v0.4.0)

---
updated-dependencies:
- dependency-name: pyzipper
  dependency-version: 0.4.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/docker/py3-native/pyzipper-0.4.0 branch from b387c02 to ec47bcf Compare August 4, 2026 15:32
@content-bot

Copy link
Copy Markdown
Contributor

🔍 AI Triage Report Available

An automated triage report has been generated for this pipeline.

Status: failed
Report ID: f93d0aeaf35b5cf2

📋 Triage Report
💡 Resolutions are available in the full report.

⚠️ AI-generated triage. Validate before acting.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants