Update dependency dparse to v0.5.2 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
dparse	==0.5.1 -> ==0.5.2

---

⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.

GitHub Vulnerability Alerts

CVE-2022-39280

Impact

dparse versions prior to 0.5.1 contain a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service).

All users parsing index server URLs with dparse are impacted by this vulnerability.

Patches

The Patch is applied in the 0.5.2 version, all users are recommended to upgrade as soon as possible.

Workarounds

Avoid passing index server URLs in the source file to be parsed.

References

https://github.com/pyupio/dparse/tree/security/remove-intensive-regex

For more information

If you have any questions or comments about this advisory:

• Email us at [email protected]

---

Release Notes

pyupio/dparse

v0.5.2

Compare Source

• Install pyyaml only when asked for with extras (conda extra)
• Add support for piptools requirements.in
• Use ConfigParser directly
• Removed a regex used in the index server validation, fixing a possible ReDos security issue

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[guardrails]

⚠️ We detected 1 security issue in this pull request:

Vulnerable Libraries (1)

Severity	Details
Medium	pkg:pypi/[email protected]@0.5.2 - no patch available

More info on how to fix Vulnerable Libraries in Python.

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

[github-actions]

Stale pull request message

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (==0.5.2). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.