Prepare for v1.0.16 release #842

jkreileder · 2025-06-20T08:22:32Z

Update version to 1.0.16, enhance dependencies, and improve CI workflows in this maintenance release.

Signed-off-by: Jürgen Kreileder <[email protected]>

codecov · 2025-06-20T08:22:51Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 100.00%. Comparing base (0f96396) to head (ba4c84c).

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #842   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            8         8           
  Lines          151       151           
  Branches        11        11           
=========================================
  Hits           151       151

Flag	Coverage Δ
python-3.10	`100.00% <100.00%> (ø)`
python-3.11	`100.00% <100.00%> (ø)`
python-3.12	`100.00% <100.00%> (ø)`
python-3.13	`100.00% <100.00%> (ø)`
python-3.9	`100.00% <100.00%> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copilot

Pull Request Overview

This PR prepares the project for the v1.0.16 release by updating the version, documentation references, and adding a changelog entry.

Bump package version to 1.0.16
Update Docker image tags and issue template version placeholder
Add changelog section for v1.0.16 with maintenance notes

Reviewed Changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
src/cf_ips_to_hcloud_fw/version.py	Bumped `__VERSION__` from `1.0.16-dev` to `1.0.16`
README.md	Updated example and tag references to `1.0.16`
CHANGELOG.md	Added `[v1.0.16]` release entry with summary items
.github/ISSUE_TEMPLATE/bug_report.md	Updated version placeholder to `1.0.16`

github-actions · 2025-06-20T08:23:56Z

🔍 Vulnerabilities of `jkreileder/cf-ips-to-hcloud-fw:pr-842`

📦 Image Reference jkreileder/cf-ips-to-hcloud-fw:pr-842

digest	`sha256:8874a2227441460abeeb54520b356a94261d3e4fd69096b07f10db3aa93844fc`
vulnerabilities
platform	linux/amd64
size	26 MB
packages	60

📦 Base Image python:1b526bbd121103d964aa0fd7edce60b8cd99c79b0eddd8e3113cb3fea6386904

also known as	`3-alpine` `3-alpine3.22` `3.13-alpine` `3.13-alpine3.22` `3.13.5-alpine` `3.13.5-alpine3.22` `alpine` `alpine3.22`
digest	`sha256:1e58d36e5c24f88877f10b5fed6d0597a2ece96b3bb2236252c79b8e902e405b`
vulnerabilities

h11 0.14.0 (pypi)

pkg:pypi/[email protected]

OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Affected range	`<0.16.0`
Fixed version	`0.16.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

Description

A leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions.

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected range	`<0.16.0`
Fixed version	`0.16.0`
CVSS Score	`9.1`
CVSS Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
EPSS Score	`0.044%`
EPSS Percentile	`13th percentile`

Description

Impact

A leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions.

Details

HTTP/1.1 Chunked-Encoding bodies are formatted as a sequence of "chunks", each of which consists of:

chunk length

\r\n

length bytes of content

\r\n

In versions of h11 up to 0.14.0, h11 instead parsed them as:

chunk length

\r\n

length bytes of content

any two bytes

i.e. it did not validate that the trailing \r\n bytes were correct, and if you put 2 bytes of garbage there it would be accepted, instead of correctly rejecting the body as malformed.

By itself this is harmless. However, suppose you have a proxy or reverse-proxy that tries to analyze HTTP requests, and your proxy has a different bug in parsing Chunked-Encoding, acting as if the format is:

chunk length

\r\n

length bytes of content

more bytes of content, as many as it takes until you find a \r\n

For example, pound had this bug -- it can happen if an implementer uses a generic "read until end of line" helper to consumes the trailing \r\n.

In this case, h11 and your proxy may both accept the same stream of bytes, but interpret them differently. For example, consider the following HTTP request(s) (assume all line breaks are \r\n):
GET /one HTTP/1.1
Host: localhost
Transfer-Encoding: chunked

5
AAAAAXX2
45
0

GET /two HTTP/1.1
Host: localhost
Transfer-Encoding: chunked

0
Here h11 will interpret it as two requests, one with body AAAAA45 and one with an empty body, while our hypothetical buggy proxy will interpret it as a single request, with body AAAAXX20\r\n\r\nGET /two .... And any time two HTTP processors both accept the same string of bytes but interpret them differently, you have the conditions for a "request smuggling" attack. For example, if /two is a dangerous endpoint and the job of the reverse proxy is to stop requests from getting there, then an attacker could use a bytestream like the above to circumvent this protection.

Even worse, if our buggy reverse proxy receives two requests from different users:
GET /one HTTP/1.1
Host: localhost
Transfer-Encoding: chunked

5
AAAAAXX999
0
GET /two HTTP/1.1
Host: localhost
Cookie: SESSION_KEY=abcdef...
...it will consider the first request to be complete and valid, and send both on to the h11-based web server over the same socket. The server will then see the two concatenated requests, and interpret them as one request to /one whose body includes /two's session key, potentially allowing one user to steal another's credentials.

Patches

Fixed in h11 0.15.0.

Workarounds

Since exploitation requires the combination of buggy h11 with a buggy (reverse) proxy, fixing either component is sufficient to mitigate this issue.

Credits

Reported by Jeppe Bonde Weikop on 2025-01-09.

urllib3 2.3.0 (pypi)

pkg:pypi/[email protected]

URL Redirection to Untrusted Site ('Open Redirect')

Affected range	`<2.5.0`
Fixed version	`2.5.0`
CVSS Score	`5.3`
CVSS Vector	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N`

Description

urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects.

However, the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior.

Affected usages

Any code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime.

Impact

Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.

Remediation

If you use urllib3 in Node.js, upgrade to a patched version of urllib3.

Unfortunately, browsers provide no suitable way which urllib3 can use: XMLHttpRequest provides no control over redirects, the Fetch API returns opaqueredirect responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects.

URL Redirection to Untrusted Site ('Open Redirect')

Affected range	`<2.5.0`
Fixed version	`2.5.0`
CVSS Score	`5.3`
CVSS Vector	`CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N`

Description

urllib3 handles redirects and retries using the same mechanism, which is controlled by the Retry object. The most common way to disable redirects is at the request level, as follows:
resp = urllib3.request("GET", "https://httpbin.org/redirect/1", redirect=False)
print(resp.status)
# 302
However, it is also possible to disable redirects, for all requests, by instantiating a PoolManager and specifying retries in a way that disable redirects:
import urllib3

http = urllib3.PoolManager(retries=0)  # should raise MaxRetryError on redirect
http = urllib3.PoolManager(retries=urllib3.Retry(redirect=0))  # equivalent to the above
http = urllib3.PoolManager(retries=False)  # should return the first response

resp = http.request("GET", "https://httpbin.org/redirect/1")
However, the retries parameter is currently ignored, which means all the above examples don't disable redirects.

Affected usages

Passing retries on PoolManager instantiation to disable redirects or restrict their number.

By default, requests and botocore users are not affected.

Impact

Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.

Remediation

You can remediate this vulnerability with the following steps:

Upgrade to a patched version of urllib3. If your organization would benefit from the continued support of urllib3 1.x, please contact [email protected] to discuss sponsorship or contribution opportunities.

Disable redirects at the request() level instead of the PoolManager() level.

requests 2.32.3 (pypi)

pkg:pypi/[email protected]

Insufficiently Protected Credentials

Affected range	`<2.32.4`
Fixed version	`2.32.4`
CVSS Score	`5.3`
CVSS Vector	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N`
EPSS Score	`0.062%`
EPSS Percentile	`20th percentile`

Description

Impact

Due to a URL parsing issue, Requests releases prior to 2.32.4 may leak .netrc credentials to third parties for specific maliciously-crafted URLs.

Workarounds

For older versions of Requests, use of the .netrc file can be disabled with trust_env=False on your Requests Session (docs).

References

psf/requests#6965
https://seclists.org/fulldisclosure/2025/Jun/2

github-actions · 2025-06-20T08:23:58Z

Recommended fixes for image `jkreileder/cf-ips-to-hcloud-fw:pr-842`

Base image is python:3-alpine

Name	3.13.5-alpine3.22
Digest	sha256:1e58d36e5c24f88877f10b5fed6d0597a2ece96b3bb2236252c79b8e902e405b
Vulnerabilities
Pushed	1 week ago
Size	17 MB
Packages	39
Flavor	alpine
OS	3.22
Runtime	3.13.5

The base image is also available under the supported tag(s): 3-alpine3.22, 3.13-alpine, 3.13-alpine3.22, 3.13.5-alpine, 3.13.5-alpine3.22, alpine, alpine3.22

Refresh base image

Rebuild the image using a newer base image version. Updating this may result in breaking changes.

✅ This image version is up to date.

Change base image

✅ There are no tag recommendations at this time.

github-actions · 2025-06-20T08:24:10Z

Overview

Image reference	`jkreileder/cf-ips-to-hcloud-fw:1`	`quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-842`
- digest	`dd18d18ca96b`	`8874a2227441`
- tag	`1`	`pr-842`
- provenance	`5387efd`	`947e834`
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	24 MB	26 MB (+1.9 MB)
- packages	62	60 (-2)
Base Image	`python:3-alpine` also known as: • `3.13-alpine` • `alpine`	`python:3-alpine` also known as: • `3-alpine3.22` • `3.13-alpine` • `3.13-alpine3.22` • `3.13.5-alpine` • `3.13.5-alpine3.22` • `alpine` • `alpine3.22`
- vulnerabilities

Environment Variables (2 changes)

± 2 changed

4 unchanged

 GPG_KEY=7169605F62C751356D054A26A821E680E5FA6305
 PATH=/usr/local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 PYTHONDONTWRITEBYTECODE=1
 PYTHONFAULTHANDLER=1
-PYTHON_SHA256=9cf9427bee9e2242e3877dd0f6b641c1853ca461f39d6503ce260a59c80bf0d9
+PYTHON_SHA256=93e583f243454e6e9e4588ca2c2662206ad961659863277afcdb96801647d640
-PYTHON_VERSION=3.13.1
+PYTHON_VERSION=3.13.5

Labels (3 changes)

± 3 changed

5 unchanged

-org.opencontainers.image.created=2024-12-22T13:10:48.667Z
+org.opencontainers.image.created=2025-06-20T08:23:05.407Z
 org.opencontainers.image.description=Update Hetzner Cloud firewall rules with current Cloudflare IP ranges
 org.opencontainers.image.licenses=MIT
-org.opencontainers.image.revision=5387efdaf829ded112cb2acdde1ab4916839a5ee
+org.opencontainers.image.revision=947e8342d2bc6a3c3c7810e8e9c8f0c27bda997e
 org.opencontainers.image.source=https://github.com/jkreileder/cf-ips-to-hcloud-fw
 org.opencontainers.image.title=cf-ips-to-hcloud-fw
 org.opencontainers.image.url=https://github.com/jkreileder/cf-ips-to-hcloud-fw
-org.opencontainers.image.version=1.0.15
+org.opencontainers.image.version=pr-842

Policies (0 improved, 2 worsened, 2 missing data)

Policy Name	`jkreileder/cf-ips-to-hcloud-fw:1`	`quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-842`	Change	Standing
Default non-root user	✅	✅		No Change
No AGPL v3 licenses	✅	✅		No Change
No fixable critical or high vulnerabilities	✅	⚠️ 2	+2	Worsened
No high-profile vulnerabilities	✅	✅		No Change
No outdated base images	✅	❓ No data
No unapproved base images	✅	❓ No data
Supply chain attestations	✅	⚠️ 2	+2	Worsened

Packages and Vulnerabilities (50 package changes and 4 vulnerability changes)

➕ 3 packages added

➖ 5 packages removed

♾️ 42 packages changed

15 packages unchanged

✔️ 4 vulnerabilities removed

Changes for packages of type apk (34 changes)

	Package	Version `jkreileder/cf-ips-to-hcloud-fw:1`	Version `quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-842`
♾️	.python-rundeps	`20241205.142133`	`20250619.205442`
➕	alpine-base		`3.22.0-r0`
♾️	alpine-baselayout	`3.6.5-r0`	`3.7.0-r0`
♾️	alpine-baselayout-data	`3.6.5-r0`	`3.7.0-r0`
♾️	alpine-keys	`2.4-r1`	`2.5-r0`
➕	alpine-release		`3.22.0-r0`
♾️	apk-tools	`2.14.4-r0`	`2.14.9-r2`
♾️	busybox	`1.36.1-r29`	`1.37.0-r18`
♾️	busybox-binsh	`1.36.1-r29`	`1.37.0-r18`
♾️	ca-certificates	`20240705-r0`	`20241121-r2`
♾️	ca-certificates-bundle	`20240705-r0`	`20241121-r2`
➕	libapk2		`2.14.9-r2`
♾️	libcrypto3	`3.3.2-r1`	`3.5.0-r0`
♾️	libffi	`3.4.6-r0`	`3.4.8-r0`
♾️	libncursesw	`6.4_p20240420-r2`	`6.5_p20250503-r0`
♾️	libpanelw	`6.4_p20240420-r2`	`6.5_p20250503-r0`
♾️	libssl3	`3.3.2-r1`	`3.5.0-r0`
♾️	libuuid	`2.40.1-r1`	`2.41-r9`
♾️	musl	`1.2.5-r0`	`1.2.5-r10`

		Removed vulnerabilities (1):
♾️	musl-utils	`1.2.5-r0`	`1.2.5-r10`
♾️	ncurses	`6.4_p20240420-r2`	`6.5_p20250503-r0`
♾️	ncurses-terminfo-base	`6.4_p20240420-r2`	`6.5_p20250503-r0`
♾️	openssl	`3.3.2-r1`	`3.5.0-r0`

		Removed vulnerabilities (2):
♾️	pax-utils	`1.3.7-r2`	`1.3.8-r1`
♾️	readline	`8.2.10-r0`	`8.2.13-r1`
♾️	scanelf	`1.3.7-r2`	`1.3.8-r1`
♾️	sqlite	`3.45.3-r1`	`3.49.2-r0`
♾️	sqlite-libs	`3.45.3-r1`	`3.49.2-r0`
♾️	ssl_client	`1.36.1-r29`	`1.37.0-r18`
♾️	tzdata	`2024b-r0`	`2025b-r0`
♾️	util-linux	`2.40.1-r1`	`2.41-r9`
♾️	xz	`5.6.2-r0`	`5.8.1-r0`

		Removed vulnerabilities (1):
♾️	xz-libs	`5.6.2-r0`	`5.8.1-r0`
♾️	zlib	`1.3.1-r1`	`1.3.1-r2`

Changes for packages of type generic (1 changes)

	Package	Version `jkreileder/cf-ips-to-hcloud-fw:1`	Version `quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-842`
♾️	python	`3.13.1`	`3.13.5`

Changes for packages of type nuget (5 changes)

	Package	Version `jkreileder/cf-ips-to-hcloud-fw:1`
➖	Simple Launcher	`1.1.0.14`
➖	t32.exe	`1.1.0.14`
➖	t64.exe	`1.1.0.14`
➖	w32.exe	`1.1.0.14`
➖	w64.exe	`1.1.0.14`

Changes for packages of type pypi (10 changes)

	Package	Version `jkreileder/cf-ips-to-hcloud-fw:1`	Version `quay.io/jkreileder/cf-ips-to-hcloud-fw:pr-842`
♾️	anyio	`4.7.0`	`4.9.0`
♾️	certifi	`2024.12.14`	`2025.1.31`
♾️	cf-ips-to-hcloud-fw	`1.0.15`	`1.0.16`
♾️	charset-normalizer	`3.4.0`	`3.4.1`
♾️	cloudflare	`3.1.1`	`4.1.0`
♾️	hcloud	`2.3.0`	`2.4.0`
♾️	httpx	`0.27.2`	`0.28.1`
♾️	pip	`24.3.1`	`25.1.1`
♾️	pydantic	`2.9.2`	`2.10.6`
♾️	pydantic-core	`2.23.4`	`2.27.2`

github-actions · 2025-06-20T08:24:20Z

Test Results

5 files ±0 5 suites ±0 5s ⏱️ ±0s
36 tests ±0 36 ✅ ±0 0 💤 ±0 0 ❌ ±0
180 runs ±0 180 ✅ ±0 0 💤 ±0 0 ❌ ±0

Results for commit ba4c84c. ± Comparison against base commit 0f96396.

Prepare v1.0.16

ba4c84c

Signed-off-by: Jürgen Kreileder <[email protected]>

jkreileder requested a review from Copilot June 20, 2025 08:22

Copilot AI reviewed Jun 20, 2025

View reviewed changes

jkreileder merged commit a9f8256 into main Jun 20, 2025
66 checks passed

jkreileder deleted the prep-release branch June 20, 2025 08:29

Prepare for v1.0.16 release #842

Prepare for v1.0.16 release #842

Uh oh!

Conversation

jkreileder commented Jun 20, 2025

Uh oh!

codecov bot commented Jun 20, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

github-actions bot commented Jun 20, 2025

🔍 Vulnerabilities of jkreileder/cf-ips-to-hcloud-fw:pr-842

Impact

Details

Patches

Workarounds

Credits

Affected usages

Impact

Remediation

Affected usages

Impact

Remediation

Impact

Workarounds

References

Uh oh!

github-actions bot commented Jun 20, 2025

Recommended fixes for image jkreileder/cf-ips-to-hcloud-fw:pr-842

Refresh base image

Change base image

Uh oh!

github-actions bot commented Jun 20, 2025

Overview

Uh oh!

github-actions bot commented Jun 20, 2025

Test Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov bot commented Jun 20, 2025 •

edited

Loading

🔍 Vulnerabilities of `jkreileder/cf-ips-to-hcloud-fw:pr-842`

Recommended fixes for image `jkreileder/cf-ips-to-hcloud-fw:pr-842`