chore(deps): update dependency pyinstaller to v5 [security]
Metadata
Current evaluation
PyInstaller 5.13.1 update was closed unmerged as superseded by #4494, merged as a763c5433 to fix AppVeyor's PyInstaller setup and address CVE-2023-49797.
Resolution: closed superseded
Reason: Maintainer @lengau explicitly marked #4489 as superseded by #4494. PR #4494 was merged as commit a763c5433.
Evaluated by: mr-cal-bot
No scores available.
Issue body
[](https://renovatebot.com)
This PR contains the following updates:
| Package | Change | Age | Adoption | Passing | Confidence |
|---|---|---|---|---|---|
| [pyinstaller](https://www.pyinstaller.org/) ([source](https://togithub.com/pyinstaller/pyinstaller)) | `==4.10` -> `==5.13.1` | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) | [](https://docs.renovatebot.com/merge-confidence/) |
### GitHub Vulnerability Alerts
#### [CVE-2023-49797](https://togithub.com/pyinstaller/pyinstaller/security/advisories/GHSA-9w2p-rh8c-v9g5)
### Impact
A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to.
A user is affected if **all** the following are satisfied:
* The user runs an application containing either `matplotlib` or `win32com`.
* The application is ran as administrator (or at least a user with higher privileges than the attacker).
* The user's temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP` environment variables pointing to an unprotected, arbitrary, non default location).
* Either:
- The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between [`shutil.rmtree()`'s builtin symlink check](https://togithub.com/python/cpython/blob/0fb18b02c8ad56299d6a2910be0bab8ad601ef24/Lib/shutil.py#L623) and the deletion itself
- The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links
### Patches
The vulnerability has been addressed in [https://github.com/pyinstaller/pyinstaller/pull/7827](https://togithub.com/pyinstaller/pyinstaller/pull/7827) which corresponds to `pyinstaller >= 5.13.1`
### Workarounds
_Is there a way for users to fix or remediate the vulnerability without upgrading?_
No workaround, although the attack complexity becomes much higher if the application is built with Python >= 3.8.0.
---
### Release Notes
<details>
<summary>pyinstaller/pyinstaller (pyinstaller)</summary>
### [`v5.13.1`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.13.1)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.13.0...v5.13.1)
Please see the [v5.13.1 section of the changelog](https://pyinstaller.org/en/v5.13.1/CHANGES.html#id1) for a list of the changes since v5.13.0. Note that this is a bugfix only release. It's primary purpose is to publish [https://github.com/pyinstaller/pyinstaller/pull/7827](https://togithub.com/pyinstaller/pyinstaller/pull/7827).
### [`v5.13.0`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.13.0)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.12.0...v5.13.0)
Please see the [v5.13.0 section of the changelog](https://pyinstaller.org/en/v5.13.0/CHANGES.html#id1) for a list of the changes since v5.12.0.
Note that this is intended to be the last `v5.x` release. `v6.0` will contain breaking changes from [#​7619](https://togithub.com/pyinstaller/pyinstaller/issues/7619), [#​7713](https://togithub.com/pyinstaller/pyinstaller/issues/7713) and [#​6999](https://togithub.com/pyinstaller/pyinstaller/issues/6999). If you want to avoid unexpected disruption, you may wish to pin pyinstaller (e.g. `pip install "pyinstaller<6"`).
### [`v5.12.0`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.12.0)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.11.0...v5.12.0)
Please see the [v5.12.0 section of the changelog](https://pyinstaller.org/en/v5.12.0/CHANGES.html#id1) for a list of the changes since v5.11.0.
### [`v5.11.0`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.11.0)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.10.1...v5.11.0)
Please see the [v5.11.0 section of the changelog](https://pyinstaller.org/en/v5.11.0/CHANGES.html#id1) for a list of the changes since v5.10.1.
### [`v5.10.1`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.10.1)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.10.0...v5.10.1)
Please see the [v5.10.1 section of the changelog](https://pyinstaller.org/en/v5.10.1/CHANGES.html#id1) for a list of the changes since v5.10.0.
### [`v5.10.0`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.10.0)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.9.0...v5.10.0)
Please see the [v5.10.0 section of the changelog](https://pyinstaller.org/en/v5.10.0/CHANGES.html#id1) for a list of the changes since v5.9.0.
### [`v5.9.0`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.9.0)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.8.0...v5.9.0)
Please see the [v5.9.0 section of the changelog](https://pyinstaller.org/en/v5.9.0/CHANGES.html#id1) for a list of the changes since v5.8.0.
### [`v5.8.0`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.8.0)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.7.0...v5.8.0)
Please see the [v5.8.0 section of the changelog](https://pyinstaller.org/en/v5.8.0/CHANGES.html#id1) for a list of the changes since v5.7.0.
### [`v5.7.0`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.7.0)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.6.2...v5.7.0)
Please see the [v5.7.0 section of the changelog](https://pyinstaller.org/en/v5.7.0/CHANGES.html#id1) for a list of the changes since v5.6.2.
### [`v5.6.2`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.6.2)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.6.1...v5.6.2)
Please see the [v5.6.2 section of the changelog](https://pyinstaller.org/en/v5.6.2/CHANGES.html#id1) for a list of the changes since v5.6.1.
### [`v5.6.1`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.6.1)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.6...v5.6.1)
Please see the [v5.6.1 section of the changelog](https://pyinstaller.org/en/v5.6.1/CHANGES.html#id1) for a list of the changes since v5.6.
### [`v5.6`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.6)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.5...v5.6)
Please see the [v5.6 section of the changelog](https://pyinstaller.org/en/v5.6/CHANGES.html#id1) for a list of the changes since v5.5.
### [`v5.5`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.5)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.4.1...v5.5)
Please see the [v5.5 section of the changelog](https://pyinstaller.org/en/v5.5/CHANGES.html#id1) for a list of the changes since v5.4.1.
### [`v5.4.1`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.4.1)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.4...v5.4.1)
Please see the [v5.4.1 section of the changelog](https://pyinstaller.org/en/v5.4.1/CHANGES.html#id1) for a list of the changes since v5.4.
### [`v5.4`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.4)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.3...v5.4)
Please see the [v5.4 section of the changelog](https://pyinstaller.org/en/v5.4/CHANGES.html#id1) for a list of the changes since v5.3.
### [`v5.3`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.3)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.2...v5.3)
Please see the [v5.3 section of the changelog](https://pyinstaller.org/en/v5.3/CHANGES.html#id1) for a list of the changes since v5.2.
### [`v5.2`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.2)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.1...v5.2)
Please see the [v5.2 section of the changelog](https://pyinstaller.org/en/v5.2/CHANGES.html#id1) for a list of the changes since v5.1.
### [`v5.1`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.1)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.0.1...v5.1)
Please see the [v5.1 section of the changelog](https://pyinstaller.readthedocs.io/en/v5.1/CHANGES.html#id1) for a list of the changes.
### [`v5.0.1`](https://togithub.com/pyinstaller/pyinstaller/compare/v5.0...v5.0.1)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v5.0...v5.0.1)
### [`v5.0`](https://togithub.com/pyinstaller/pyinstaller/releases/tag/v5.0)
[Compare Source](https://togithub.com/pyinstaller/pyinstaller/compare/v4.10...v5.0)
Please see the [v5.0 section of the changelog](https://pyinstaller.readthedocs.io/en/v5.0/CHANGES.html#id1) for a list of the changes since v4.10.
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" in timezone Etc/UTC, Automerge - "every weekend" in timezone Etc/UTC.
🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box
---
This PR has been generated by [Mend Renovate](https://www.mend.io/free-developer-tools/renovate/). View repository job log [here](https://developer.mend.io/github/snapcore/snapcraft).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy44Ny4yIiwidXBkYXRlZEluVmVyIjoiMzcuODcuMiIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed superseded | PyInstaller 5.13.1 update was closed unmerged as superseded by #4494, merged as a763c5433 to fix AppVeyor's PyInstaller setup and address CVE-2023-49797. | |
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged as superseded by #4494, which was merged as a763c5433 to fix the PyInstaller configuration and address CVE-2023-49797. | |
| stealth/space-bunny-alpha | — | closed superseded | Closed unmerged after a maintainer marked it superseded by canonical/snapcraft#4494; that PyInstaller security/build fix later merged as a763c5433. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without merging and superseded by PR #4494. The security update addressed CVE-2023-49797 by upgrading pyinstaller to v5.13.1. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed without merging. The pyinstaller v5.13.1 security update was superseded by pull request #4494. |
Update history
No update history recorded yet.
Related work
-
Superseded By:
canonical/snapcraft#4494
(confidence 100%)
Merged replacement that fixed AppVeyor's PyInstaller setup and addressed CVE-2023-49797 in commit a763c5433.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #4774 chore(deps): update dependency setuptools to v65 [security] - autoclosed | snapcraft | closed | Renovate's setuptools 65.5.1 security update was autoclosed without merge after inactivity. Dependabot merged the same docs dependency bump in #4775 via d83f1ddb8. | |
| #1345 chore(deps): update dependency pyfakefs to v5.3.0 | charmcraft | closed | Renovate’s pyfakefs 5.3.0 update was approved but closed unmerged; the version was ignored until a newer release. | |
| #559 chore(deps): update dependency setuptools to v69.5.1 | craft-providers | merged | Renovate PR #559 was merged, updating setuptools from 69.5.0 to 69.5.1 in commit 623c34e. | |
| #1726 chore(deps): update dependency setuptools to v70 [security] | charmcraft | merged | Merged PR #1726 upgraded setuptools from 69.5.1 to 70.0.0 in commit 1ef1b2a6, addressing CVE-2024-6345. | |
| #173 chore(deps): update dependency setuptools to v69.5.1 | craft-store | closed | Renovate PR #173 (setuptools ==69.2.0 -> ==69.5.1) was closed unmerged on 2024-05-26, superseded by #182, which merged as commit 7cf37e7 bumping setuptools straight to ==70.0.0. | |
| #247 chore(deps): update dependency setuptools to v69.5.1 | craft-cli | merged | Renovate dependency bump merged into main as commit 67904ef, raising the setuptools build pin in pyproject.toml from ==69.1.1 to ==69.5.1 (+1/-1,2 approvals). Later superseded by v70 (#248) and later bumps up to v84 (#475). | |
| #538 chore(deps): update dependency setuptools to v69.2.0 | craft-providers | merged | Renovate update merged via #538, raising setuptools from 69.1.1 to 69.2.0; landed as commit 105bff8. |