fix(deps): vuln minor: requests · patch: flask, pytest [pkg/extractor]

[gh-worker-campaigns-3e9aa4]

Summary: High-severity security update — 7 packages upgraded (MINOR changes included)

Manifests changed:

• pkg/extractor (pep621)

---

✅ Action Required: Please review the changes below. If they look good, approve and merge this PR.

---

Updates

Package	From	To	Type	Dep Type	Vulnerabilities Fixed
flask	2.3	2.3.3	patch	Direct	3 HIGH, 3 LOW
requests	2.28.0	2.34.2	minor	Direct	12 MEDIUM
requests	2.28	2.34.2	minor	Direct	12 MEDIUM
requests	2.28.0	2.34.2	minor	Direct	12 MEDIUM
requests	2.28.0	2.34.2	minor	Direct	12 MEDIUM
pytest	7.4.0	7.4.4	patch	Direct	3 MEDIUM
flask	2.3.2	2.3.3	patch	Direct	3 LOW

---

Security Details

🚨 Critical & High Severity (3 fixed)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
flask	PYSEC-2023-62	HIGH	-	2.3	70f906c51ce49c485f1d355703e9cc3386b1cc2b	-
flask	GHSA-m2qf-hxjv-5gpq	HIGH	Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header	2.3	2.3.2	-
flask	CVE-2023-30861	HIGH	Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header	2.3	-	-

ℹ️ Other Vulnerabilities (57)

Package	CVE	Severity	Summary	Unsafe Version	Fixed In	Case
requests	PYSEC-2023-74	medium	-	2.28.0	74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5	-
requests	CVE-2024-47081	medium	Requests vulnerable to .netrc credentials leak via malicious URLs	2.28.0	-	-
requests	CVE-2023-32681	medium	Unintended leak of Proxy-Authorization header in requests	2.28.0	-	-
requests	PYSEC-2026-1872	medium	Requests vulnerable to .netrc credentials leak via malicious URLs	2.28.0	2.32.4	-
requests	PYSEC-2023-74	medium	-	2.28	74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5	-
requests	PYSEC-2026-1872	medium	Requests vulnerable to .netrc credentials leak via malicious URLs	2.28	2.32.4	-
requests	CVE-2024-47081	medium	Requests vulnerable to .netrc credentials leak via malicious URLs	2.28	-	-
requests	CVE-2023-32681	medium	Unintended leak of Proxy-Authorization header in requests	2.28	-	-
requests	CVE-2023-32681	medium	Unintended leak of Proxy-Authorization header in requests	2.28.0	-	-
requests	CVE-2024-47081	medium	Requests vulnerable to .netrc credentials leak via malicious URLs	2.28.0	-	-
requests	PYSEC-2026-1872	medium	Requests vulnerable to .netrc credentials leak via malicious URLs	2.28.0	2.32.4	-
requests	PYSEC-2023-74	medium	-	2.28.0	74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5	-
requests	CVE-2024-47081	medium	Requests vulnerable to .netrc credentials leak via malicious URLs	2.28.0	-	-
requests	PYSEC-2023-74	medium	-	2.28.0	74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5	-
requests	CVE-2023-32681	medium	Unintended leak of Proxy-Authorization header in requests	2.28.0	-	-
requests	PYSEC-2026-1872	medium	Requests vulnerable to .netrc credentials leak via malicious URLs	2.28.0	2.32.4	-
pytest	PYSEC-2026-1845	MODERATE	pytest has vulnerable tmpdir handling	7.4.0	9.0.3	-
pytest	CVE-2025-71176	MODERATE	-	7.4.0	-	-
pytest	GHSA-6w46-j5rx-g56g	MODERATE	pytest has vulnerable tmpdir handling	7.4.0	9.0.3	-
requests	CVE-2026-25645	MODERATE	Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function	2.28.0	-	-
requests	CVE-2024-35195	MODERATE	Requests Session object does not verify requests after making first request with verify=False	2.28.0	-	-
requests	GHSA-j8r2-6x86-q33q	MODERATE	Unintended leak of Proxy-Authorization header in requests	2.28.0	2.31.0	-
requests	GHSA-gc5v-m9x4-r6x2	MODERATE	Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function	2.28.0	2.33.0	-
requests	GHSA-9hjg-9r4m-mvj7	MODERATE	Requests vulnerable to .netrc credentials leak via malicious URLs	2.28.0	2.32.4	-
requests	GHSA-9wx4-h78v-vm56	MODERATE	Requests Session object does not verify requests after making first request with verify=False	2.28.0	2.32.0	-
requests	PYSEC-2026-1873	MODERATE	Requests Session object does not verify requests after making first request with verify=False	2.28.0	2.32.0	-
requests	PYSEC-2026-2275	MODERATE	-	2.28.0	2.33.0	-
requests	GHSA-j8r2-6x86-q33q	MODERATE	Unintended leak of Proxy-Authorization header in requests	2.28	2.31.0	-
requests	GHSA-9wx4-h78v-vm56	MODERATE	Requests Session object does not verify requests after making first request with verify=False	2.28	2.32.0	-
requests	PYSEC-2026-1873	MODERATE	Requests Session object does not verify requests after making first request with verify=False	2.28	2.32.0	-
requests	GHSA-gc5v-m9x4-r6x2	MODERATE	Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function	2.28	2.33.0	-
requests	CVE-2026-25645	MODERATE	Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function	2.28	-	-
requests	PYSEC-2026-2275	MODERATE	-	2.28	2.33.0	-
requests	CVE-2024-35195	MODERATE	Requests Session object does not verify requests after making first request with verify=False	2.28	-	-
requests	GHSA-9hjg-9r4m-mvj7	MODERATE	Requests vulnerable to .netrc credentials leak via malicious URLs	2.28	2.32.4	-
requests	CVE-2024-35195	MODERATE	Requests Session object does not verify requests after making first request with verify=False	2.28.0	-	-
requests	GHSA-9wx4-h78v-vm56	MODERATE	Requests Session object does not verify requests after making first request with verify=False	2.28.0	2.32.0	-
requests	PYSEC-2026-1873	MODERATE	Requests Session object does not verify requests after making first request with verify=False	2.28.0	2.32.0	-
requests	GHSA-9hjg-9r4m-mvj7	MODERATE	Requests vulnerable to .netrc credentials leak via malicious URLs	2.28.0	2.32.4	-
requests	PYSEC-2026-2275	MODERATE	-	2.28.0	2.33.0	-
requests	CVE-2026-25645	MODERATE	Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function	2.28.0	-	-
requests	GHSA-gc5v-m9x4-r6x2	MODERATE	Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function	2.28.0	2.33.0	-
requests	GHSA-j8r2-6x86-q33q	MODERATE	Unintended leak of Proxy-Authorization header in requests	2.28.0	2.31.0	-
requests	CVE-2026-25645	MODERATE	Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function	2.28.0	-	-
requests	CVE-2024-35195	MODERATE	Requests Session object does not verify requests after making first request with verify=False	2.28.0	-	-
requests	GHSA-gc5v-m9x4-r6x2	MODERATE	Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function	2.28.0	2.33.0	-
requests	GHSA-j8r2-6x86-q33q	MODERATE	Unintended leak of Proxy-Authorization header in requests	2.28.0	2.31.0	-
requests	PYSEC-2026-2275	MODERATE	-	2.28.0	2.33.0	-
requests	PYSEC-2026-1873	MODERATE	Requests Session object does not verify requests after making first request with verify=False	2.28.0	2.32.0	-
requests	GHSA-9hjg-9r4m-mvj7	MODERATE	Requests vulnerable to .netrc credentials leak via malicious URLs	2.28.0	2.32.4	-
requests	GHSA-9wx4-h78v-vm56	MODERATE	Requests Session object does not verify requests after making first request with verify=False	2.28.0	2.32.0	-
flask	PYSEC-2026-2151	low	-	2.3	3.1.3	-
flask	CVE-2026-27205	low	Flask session does not add Vary: Cookie header when accessed in some ways	2.3	-	-
flask	GHSA-68rp-wp8r-4726	LOW	Flask session does not add Vary: Cookie header when accessed in some ways	2.3	3.1.3	-
flask	PYSEC-2026-2151	low	-	2.3.2	3.1.3	-
flask	CVE-2026-27205	low	Flask session does not add Vary: Cookie header when accessed in some ways	2.3.2	-	-
flask	GHSA-68rp-wp8r-4726	LOW	Flask session does not add Vary: Cookie header when accessed in some ways	2.3.2	3.1.3	-

⚠️ Dependencies that have Reached EOL (3)

Dependency	Unsafe Version	EOL Date	New Version	Path	Case
requests	2.28.0	-	2.34.2	pkg/extractor/fixtures/pyproject-toml-extractor/duplicate-groups/pyproject.toml	-
requests	2.28.0	-	2.34.2	pkg/extractor/fixtures/pyproject-toml-extractor/pep621-optional/pyproject.toml	-
requests	2.28.0	-	2.34.2	pkg/extractor/fixtures/pyproject-toml-extractor/pep621-pinned/pyproject.toml	-

---

Review Checklist

Standard review:

• Review changes for compatibility with your code
• Check for breaking changes in release notes
• Run tests locally or wait for CI
• Approve and merge this PR

---

Update Mode: all_vulns

🤖 Generated by DataDog Automated Dependency Management System