repos/roboluke
5
0
Fork 0
Code Issues 1 Pull Requests 1 Actions 1 Packages Releases 77 Activity
477 Commits 2 Branches 77 Tags
e4f753c9a1748ecdd9c59548b81610fca5a9929e
Go to file
Clone
Open with VS Code Open with VSCodium Open with Intellij IDEA
Download ZIP Download TAR.GZ Download BUNDLE
renovate[bot] e4f753c9a1
All checks were successful
Release / Tag release (push) Successful in 11s
Details
Release / Create Release (push) Successful in 32s
Details
Release / Publish Docker Images (push) Successful in 1m51s
Details
feat(deps): Update dependency requests to v2.33.0 [SECURITY] (#436) 
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [requests](https://github.com/psf/requests) ([changelog](https://github.com/psf/requests/blob/master/HISTORY.md)) | `2.32.5` → `2.33.0` | ![age](https://developer.mend.io/api/mc/badges/age/pypi/requests/2.33.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/pypi/requests/2.32.5/2.33.0?slim=true) |

---

### Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function
[CVE-2026-25645](https://nvd.nist.gov/vuln/detail/CVE-2026-25645) / [GHSA-gc5v-m9x4-r6x2](https://github.com/advisories/GHSA-gc5v-m9x4-r6x2)

<details>
<summary>More information</summary>

#### Details
##### Impact
The `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one.

##### Affected usages
**Standard usage of the Requests library is not affected by this vulnerability.** Only applications that call `extract_zipped_paths()` directly are impacted.

##### Remediation
Upgrade to at least Requests 2.33.0, where the library now extracts files to a non-deterministic location.

If developers are unable to upgrade, they can set `TMPDIR` in their environment to a directory with restricted write access.

#### Severity
- CVSS Score: 4.4 / 10 (Medium)
- Vector String: `CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N`

#### References
- [https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2](https://github.com/psf/requests/security/advisories/GHSA-gc5v-m9x4-r6x2)
- [66d21cb07b)
- [https://github.com/psf/requests](https://github.com/psf/requests)
- [https://github.com/psf/requests/releases/tag/v2.33.0](https://github.com/psf/requests/releases/tag/v2.33.0)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-gc5v-m9x4-r6x2) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>psf/requests (requests)</summary>

### [`v2.33.0`](https://github.com/psf/requests/blob/HEAD/HISTORY.md#2330-2026-03-25)

[Compare Source](https://github.com/psf/requests/compare/v2.32.5...v2.33.0)

**Announcements**

- 📣 Requests is adding inline types. If you have a typed code base that
  uses Requests, please take a look at [#&#8203;7271](https://github.com/psf/requests/issues/7271). Give it a try, and report
  any gaps or feedback you may have in the issue. 📣

**Security**

- CVE-2026-25645 `requests.utils.extract_zipped_paths` now extracts
  contents to a non-deterministic location to prevent malicious file
  replacement. This does not affect default usage of Requests, only
  applications calling the utility function directly.

**Improvements**

- Migrated to a PEP 517 build system using setuptools. ([#&#8203;7012](https://github.com/psf/requests/issues/7012))

**Bugfixes**

- Fixed an issue where an empty netrc entry could cause
  malformed authentication to be applied to Requests on
  Python 3.11+. ([#&#8203;7205](https://github.com/psf/requests/issues/7205))

**Deprecations**

- Dropped support for Python 3.9 following its end of support. ([#&#8203;7196](https://github.com/psf/requests/issues/7196))

**Documentation**

- Various typo fixes and doc improvements.

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45MS4xIiwidXBkYXRlZEluVmVyIjoiNDMuOTEuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsic2VjdXJpdHkiXX0=-->

Reviewed-on: https://git.tainton.uk/repos/roboluke/pulls/436
Reviewed-by: Luke Tainton <luke@tainton.uk>
Co-authored-by: renovate[bot] <renovate-bot@git.tainton.uk>
Co-committed-by: renovate[bot] <renovate-bot@git.tainton.uk>
2026-03-27 18:06:12 +00:00
.archive
feat(config): update n8n webhook handling (#366)
2025-08-04 09:59:52 +02:00
.gitea
chore(deps): update docker/setup-buildx-action action to v4 (#427)
2026-03-06 20:11:13 +00:00
app
feat(config): update n8n webhook handling (#366)
2025-08-04 09:59:52 +02:00
tests
fix(test): fix assertion error in timestamp_to_date invalid test (#421)
2026-02-28 14:16:30 +00:00
.coveragerc
Initial
2023-04-05 20:57:31 +01:00
.env.default
feat(config): update n8n webhook handling (#366)
2025-08-04 09:59:52 +02:00
.gitignore
chore(ci): remove Sonar (#355)
2025-05-31 13:08:47 +02:00
.pre-commit-config.yaml
fix(python): update to latest Python 3.13 (#389)
2025-11-02 17:26:17 +00:00
compose.yaml
feat(deps): update uv dependency to version 0.9.21 (#406)
2026-01-04 10:34:31 +00:00
Dockerfile
fix(build): Update to Python 3.13.12 (#422)
2026-02-28 14:28:52 +00:00
pyproject.toml
chore(deps): update dependency black to <26.3.2,>=26.3.1 (#434)
2026-03-13 17:10:08 +00:00
README.md
feat(sentry): remove Sentry
2024-11-24 10:20:04 +00:00
renovate.json
chore(ci): remove Snyk workflow for security monitoring (#411)
2026-01-21 20:36:36 +00:00
sonar-project.properties
feat(ci): fix CI, switch to SonarQube self-hosted (#337)
2025-02-09 21:29:47 +01:00
test.sh
feat(sentry): remove Sentry
2024-11-24 10:20:04 +00:00
uv.lock
feat(deps): Update dependency requests to v2.33.0 [SECURITY] (#436)
2026-03-27 18:06:12 +00:00

README.md

RoboLuke - Tasks

Description

Add tasks to a Wekan to do list via Webex and n8n.

How to install

  1. Clone the repository
  2. Copy .env.default to .env
  3. Edit .env as required:
    • ADMIN_EMAIL - comma-separated list of admin (who owns the to-do list) email addresses
    • ADMIN_FIRST_NAME - admin first name
    • APP_LIFECYCLE - set the name of the environment
    • APPROVED_DOMAINS - comma-separated list of domains that users are allowed to message the bot from
    • APPROVED_ROOMS - comma-separated list of room IDs that users are allowed to message the bot from
    • APPROVED_USERS - comma-separated list of email addresses of approved users
    • BOT_NAME - Webex bot name
    • N8N_WEBHOOK_URL - n8n webhook URL
    • WEBEX_API_KEY - Webex API key

How to use

  1. Install Docker and Docker Compose
  2. Run docker-compose up -d
Reference in New Issue View Git Blame Copy Permalink
Description
Add tasks to a Wekan to do list via Webex and n8n.
Readme 2.1 MiB
Releases 77
v1.51.0 Latest
2026-03-29 09:00:37 +00:00
Languages
Python 95.6%
Dockerfile 3.3%
Shell 1.1%