A fast tool to scan prototype pollution vulnerability written in Rust. 🦀

Dwi Siswanto

Last update: Dec 27, 2022

Related tags

Cryptography bugbounty vulnerability-scanners rust-tools bugbountytips bugbounty-tool prototype-pollution

Overview

ppfuzz

Prototype Pollution Fuzzer

A fast tool to scan prototype pollution vulnerability written in Rust. 🦀

Installation
Usage
- Basic
- Options
Usage
Supporting Materials
Contributing
Attribution
Acknowledments
License

Installation

Binary

Simply, download a pre-built binary from releases page and run!

Source

NOTE: Rust should be installed!

Using cargo:

▶ cargo install ppfuzz

— or

Manual building executable from source code:

▶ git clone https://github.com/dwisiswant0/ppfuzz
▶ cd ppfuzz && cargo build --release

Dependencies

ppfuzz uses chromiumoxide, which requires the Chrome or Chromium browser to be installed. If the CHROME environment variable is set, then it'll use it as the default executable. Otherwise, the filenames google-chrome-stable, chromium, chromium-browser, chrome and chrome-browser are searched for in standard places. If that fails, /Applications/Google Chrome.app/... (on MacOS) or the registry (on Windows) is consulted.

Usage

It's fairly simple to use ppfuzz!

▶ ppfuzz -l FILE [OPTIONS]

Basic

Use -l/--list to provide input list:

▶ ppfuzz -l FILE

You can also provide the list using I/O redirection:

▶ ppfuzz < FILE

— or chain it from another command output:

▶ cat FILE | ppfuzz

Only show vulnerable targets/suppress an errors:

▶ ppfuzz -l FILE 2>/dev/null

Options

Here are all the options it supports:

▶ ppfuzz -h

Flag	Description	Default value
-l, --list	List of target URLs
-c, --concurrency	Set the concurrency level	5
-t, --timeout	Max. time allowed for connection (s)	30
-h, --help	Prints help information
-V, --version	Prints version information

Supporting Materials

Contributing

When I started out ppfuzz, I had very little or no knowledge on Rust and I believe there may be a lot of drawbacks/security vulnerabilities. So all contributions are welcome, of course — any bug reports & suggestions are appreciated, some environment have not been tested yet.

Attribution

Besides being my learning medium, this tool was created because it was inspired by a tip shared by @R0X4R on how to automate prototype pollution checking using page-fetch.

Cross-compile GitHub workflow inspired by crodjer's sysit.

Acknowledments

Since this tool includes some contributions, I'll publically thank the following users for their helps and resources:

@mattsse - for his awesome chromiumoxide & mentoring me which helped a lot to quickly adapt Rust!
Fourty2#4842 (Discord) - for helpful workaround.
All contributors.

License

ppfuzz is distributed under MIT license. See LICENSE.

Comments

Using futures iteration

Your input is very useful for me as a beginner, @mattsse! I'm here using the 2nd option, with the addition that I immediately close the page when I get the results of the evaluate. Somehow, when I run from a list of about thousands, the executions stop at a sequence of less than 20's, in other words - not until the list ends. What doesn't look ideal here?

opened by dwisiswant0 9

Error on building

There is an error when building from source code and from cargo. Different one from this other issue Here is the error:

Compiling ppfuzz v1.0.1
error[E0658]: binding by-move and by-ref in the same pattern is unstable
--> /home/jusepe/.cargo/registry/src/github.com-1ecc6299db9ec823/ppfuzz-1.0.1/src/fuzzer.rs:53:37
|
53 |         if let Ok((ref url, vuln, is_err, detail, gadgets)) = res {
|                    -------                ^^^^^^  ^^^^^^^ by-move pattern here
|                    |                      |
|                    |                      by-move pattern here
|                    by-ref pattern here
|
= note: see issue #68354 <https://github.com/rust-lang/rust/issues/68354> for more information

error: aborting due to previous error

For more information about this error, try `rustc --explain E0658`.
error: could not compile `ppfuzz`.

To learn more, run the command again with --verbose.
warning: build failed, waiting for other jobs to finish...
error: failed to compile `ppfuzz v1.0.1`, intermediate artifacts can be found at `/tmp/cargo-installRpiuBb`

Caused by:
build failed

Cargo version:

cargo 1.46.0

opened by itasahobby 7

Can not Execute Binary File

I am using preinstalled version. I have chrome installed too but when i try to execute ppfuzz from /usr/local/bin it says binary not executable and when it is placed somewhere else it says command not found. I have also tried chmod +x ppfuzz command but still same error.

opened by awais922609 6
unresolved imports

unresolved imports clap::crate_authors, clap::crate_description, clap::crate_name, clap::crate_version --> src/parser.rs:5:3 | 5 | crate_authors, | ^^^^^^^^^^^^^ no crate_authors in the root 6 | crate_description, | ^^^^^^^^^^^^^^^^^ no crate_description in the root 7 | crate_name, | ^^^^^^^^^^ no crate_name in the root 8 | crate_version, | ^^^^^^^^^^^^^ no crate_version in the root

error: cannot determine resolution for the macro crate_name --> src/parser.rs:30:4 | 30 | crate_name!(), "FILE", "[OPTIONS]" | ^^^^^^^^^^ | = note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_authors --> src/parser.rs:33:12 | 33 | .author(crate_authors!()) | ^^^^^^^^^^^^^ | = note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_description --> src/parser.rs:34:11 | 34 | .about(crate_description!()) | ^^^^^^^^^^^^^^^^^ | = note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_name --> src/parser.rs:35:10 | 35 | .name(crate_name!()) | ^^^^^^^^^^ | = note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_version --> src/parser.rs:36:13 | 36 | .version(crate_version!()) | ^^^^^^^^^^^^^ | = note: import resolution is stuck, try simplifying macro imports

warning: use of deprecated macro load_yaml: Deprecated in Issue #3087, maybe clap::Parser would fit your use case? --> src/parser.rs:27:14 | 27 | let yaml = load_yaml!("cli.yaml"); | ^^^^^^^^^ | = note: #[warn(deprecated)] on by default

warning: use of deprecated macro clap::load_yaml: Deprecated in Issue #3087, maybe clap::Parser would fit your use case? --> src/parser.rs:9:3 | 9 | load_yaml, | ^^^^^^^^^

error[E0308]: mismatched types --> src/parser.rs:32:23 | 32 | let app = App::from(yaml) | ^^^^ expected struct App, found &yaml_rust::yaml::Yaml

Some errors have detailed explanations: E0308, E0432. For more information about an error, try rustc --explain E0308. warning: ppfuzz (lib) generated 2 warnings error: could not compile ppfuzz due to 7 previous errors; 2 warnings emitted

opened by Fawadkhanfk 4
problem install on macbookpro m1

`cargo build --release

Compiling ppfuzz v1.0.1 (/Users/azhariramadhan/Documents/pentest-tools/reconftw/ppfuzz) error[E0432]: unresolved imports clap::crate_authors, clap::crate_description, clap::crate_name, clap::crate_version --> src/parser.rs:5:3 | 5 | crate_authors, | ^^^^^^^^^^^^^ no crate_authors in the root 6 | crate_description, | ^^^^^^^^^^^^^^^^^ no crate_description in the root 7 | crate_name, | ^^^^^^^^^^ no crate_name in the root 8 | crate_version, | ^^^^^^^^^^^^^ no crate_version in the root

error: cannot determine resolution for the macro crate_name --> src/parser.rs:30:4 | 30 | crate_name!(), "FILE", "[OPTIONS]" | ^^^^^^^^^^ | = note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_authors --> src/parser.rs:33:12 | 33 | .author(crate_authors!()) | ^^^^^^^^^^^^^ | = note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_description --> src/parser.rs:34:11 | 34 | .about(crate_description!()) | ^^^^^^^^^^^^^^^^^ | = note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_name --> src/parser.rs:35:10 | 35 | .name(crate_name!()) | ^^^^^^^^^^ | = note: import resolution is stuck, try simplifying macro imports

error: cannot determine resolution for the macro crate_version --> src/parser.rs:36:13 | 36 | .version(crate_version!()) | ^^^^^^^^^^^^^ | = note: import resolution is stuck, try simplifying macro imports

error[E0308]: mismatched types --> src/parser.rs:32:23 | 32 | let app = App::from(yaml) | --------- ^^^^ expected struct App, found &yaml_rust::yaml::Yaml | | | arguments to this function are incorrect | note: associated function defined here

Some errors have detailed explanations: E0308, E0432. For more information about an error, try rustc --explain E0308. error: could not compile ppfuzz due to 7 previous errors `

opened by AzhariRamadhan 3
Error while building the resources

Hello. I used the command cargo build --release for building the resources after cloning it in my directory. Everything went fine till nearly 175 resources, later I am getting the following error

opened by TridevReddy 3
Add escalation to XSS using script gadgets
Proposed of Changes

See #15 15

TODOs

[x] Fingerprinting script gadgets (and show potential XSS payloads)

[x] Check the target if (it) has been escalated

[x] Remove ppfuzz additional queries
opened by dwisiswant0 2

value: Timeout

Can you help me to fix this error Thanks

thread 'main' panicked at 'called `Result::unwrap()` on an `Err` value: Timeout', /root/.cargo/registry/src/github.com-1ecc6299db9ec823/ppfuzz-0.0.1/src/browser.rs:23:10
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Capture

opened by remonsec 2

[ci skip]: Bump clap from v3.0.0-beta.2 to v4.0.30
Bumps clap from v3.0.0-beta.2 to v4.0.30.

Release notes

Sourced from clap's releases.

v4.0.30

[4.0.30] - 2022-12-21

Fixes

(error) Improve error for args_conflicts_with_subcommand

Changelog

Sourced from clap's changelog.

[4.0.30] - 2022-12-21

Fixes

(error) Improve error for args_conflicts_with_subcommand

[4.0.29] - 2022-11-29

[4.0.28] - 2022-11-29

Fixes

Fix wasm support which was broken in 4.0.27

[4.0.27] - 2022-11-24

Features

Have Arg::value_parser accept Vec<impl Into<PossibleValue>>

Implement Display and FromStr for ColorChoice

Fixes

Remove soundness issue by switching from atty to is-terminal

[4.0.26] - 2022-11-16

Fixes

(error) Fix typos in ContextKind::as_str

[4.0.25] - 2022-11-15

Features

(error) Report available subcommands when required subcommand is missing

[4.0.24] - 2022-11-14

Fixes

Avoid panic when printing an argument that isn't built

[4.0.23] - 2022-11-11

Fixes

Don't panic on reporting invalid-long errors when followed by invalid UTF8

(help) Clarified argument to help subcommand

... (truncated)

Commits

d2d0222 chore: Release

56a0bb6 docs: Update changelog

b941a3e Merge pull request #4567 from epage/error

453ac0b fix(parser): Be less confusing with args/subcommand conflicts

2a374db test(parser): Show bad behavior

f632424 test(parser): Consolidate args_conflicts_with tests

a72f962 docs(builder): Escape non-tags

ac48e2d docs: Make less brittle for rust versions

a3381a2 docs(readme): Fix build status badge (#4559)

aa54204 Merge pull request #4555 from epage/reset

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependency
opened by dependabot[bot] 1
[ci skip]: Bump clap from v3.0.0-beta.2 to v4.0.29
Bumps clap from v3.0.0-beta.2 to v4.0.29.

Release notes

Sourced from clap's releases.

v4.0.29

[4.0.29] - 2022-11-29

Changelog

Sourced from clap's changelog.

[4.0.29] - 2022-11-29

[4.0.28] - 2022-11-29

Fixes

Fix wasm support which was broken in 4.0.27

[4.0.27] - 2022-11-24

Features

Have Arg::value_parser accept Vec<impl Into<PossibleValue>>

Implement Display and FromStr for ColorChoice

Fixes

Remove soundness issue by switching from atty to is-terminal

[4.0.26] - 2022-11-16

Fixes

(error) Fix typos in ContextKind::as_str

[4.0.25] - 2022-11-15

Features

(error) Report available subcommands when required subcommand is missing

[4.0.24] - 2022-11-14

Fixes

Avoid panic when printing an argument that isn't built

[4.0.23] - 2022-11-11

Fixes

Don't panic on reporting invalid-long errors when followed by invalid UTF8

(help) Clarified argument to help subcommand

[4.0.22] - 2022-11-07

Fixes

(help) Don't overflow into next-line-help early due to stale (pre-v4) padding calculations

... (truncated)

Commits

ad47263 chore: Release

6e31743 docs: Fix docs.rs builds

c3c9099 chore: Release

6812761 docs: Update changelog

2ad0eff fix: wasm32 targets with is-terminal (#4518)

bf39b8d docs(ref): Move flatten/subcommand to be under command attr

3262016 chore: Release

757f95b docs: Update changelog

20e02eb Merge pull request #4509 from epage/possible

fb1d960 Merge pull request #4249 from jcgruenhage/replace-atty

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependency
opened by dependabot[bot] 1
[ci skip]: Update clap requirement from 3.0.0-beta.2 to 4.0.22
Updates the requirements on clap to permit the latest version.

Release notes

Sourced from clap's releases.

v3.2.23

[3.2.23] - 2022-10-24

Fixes

Upgrade to textwrap 0.16

Changelog

Sourced from clap's changelog.

[3.2.23] - 2022-10-24

Fixes

Upgrade to textwrap 0.16

[3.2.22] - 2022-09-16

Fixes

Unify dependencies on terminal_size to the 0.2 release

[3.2.21] - 2022-09-12

Features

TypedValueParser::map to allow reusing existing value parsers for other purposes

[3.2.20] - 2022-09-02

Features

ArgMatches::get_count help for ArgAction::Count

ArgMatches::get_flag help for ArgAction::SetTrue / ArgAction::SetFalse

[3.2.19] - 2022-08-30

Fixes

(help) Ensure required arguments for parent commands aren't shown in their subcommands when using args_conflicts_with_subcommand

[3.2.18] - 2022-08-29

Fixes

(help) Command::print_help now respects Command::colored_help

(derive) Improved error messages

[3.2.17] - 2022-08-12

Fixes

(derive) Expose #[clap(id = ...)] attribute to match Arg's latest API

[3.2.16] - 2022-07-30

Fixes

Ensure required arguments appear in errors when they are also members of a group (#4004)

... (truncated)

Commits

08f8d6c chore: Release

aa7ef19 docs: Update changelog

c262fb7 chore: Update release process

b93f917 Merge pull request #4422 from crepererum/crepererum/issue4418b

4b0a892 fix: Require textwrap 0.16

9e3fa67 chore: Release

d188de0 docs: Update changelog

48b2373 Merge pull request #4221 from niyaznigmatullin/bump_terminal_size

2fd5507 chore(deps): Bump terminal_size and textwrap

7de2f36 chore: Release

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependency
opened by dependabot[bot] 1
[ci skip]: Bump clap from v3.0.0-beta.2 to v4.0.32
Bumps clap from v3.0.0-beta.2 to v4.0.32.

Release notes

Sourced from clap's releases.

v4.0.32

[4.0.32] - 2022-12-22

Fixes

(parser) When overriding required(true), consider args that conflict with its group

Changelog

Sourced from clap's changelog.

[4.0.32] - 2022-12-22

Fixes

(parser) When overriding required(true), consider args that conflict with its group

[4.0.31] - 2022-12-22

Performance

Speed up parsing when a lot of different flags are present (100 unique flags)

[4.0.30] - 2022-12-21

Fixes

(error) Improve error for args_conflicts_with_subcommand

[4.0.29] - 2022-11-29

[4.0.28] - 2022-11-29

Fixes

Fix wasm support which was broken in 4.0.27

[4.0.27] - 2022-11-24

Features

Have Arg::value_parser accept Vec<impl Into<PossibleValue>>

Implement Display and FromStr for ColorChoice

Fixes

Remove soundness issue by switching from atty to is-terminal

[4.0.26] - 2022-11-16

Fixes

(error) Fix typos in ContextKind::as_str

[4.0.25] - 2022-11-15

Features

(error) Report available subcommands when required subcommand is missing

[4.0.24] - 2022-11-14

... (truncated)

Commits

ec4ccf0 chore: Release

13fdb83 docs: Update changelog

b877345 Merge pull request #4573 from epage/conflict

85ecb3e fix(parser): Override required when parent group has conflict

d145b8b test(parser): Demonstrate required-overload bug

0eccd55 chore: Release

1e37c25 docs: Update changelog

dcd5fec Merge pull request #4572 from epage/group

dde22e7 style: Update for latest clippy

dd8435d perf(parser): Reduce duplicate lookups

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependency
opened by dependabot[bot] 0
[ci skip]: Update chromiumoxide requirement from 0.3.1 to 0.4.0
Updates the requirements on chromiumoxide to permit the latest version.

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependency
opened by dependabot[bot] 0
[ci skip]: Bump dorny/paths-filter from 2.10.2 to 2.11.1
Bumps dorny/paths-filter from 2.10.2 to 2.11.1.

Release notes

Sourced from dorny/paths-filter's releases.

v2.11.1

Update @actions/core to v1.10.0 - Fixes warning about deprecated set-output

Document need for pull-requests: read permission

Updating to actions/checkout@v3

v2.11.0

Set list-files input parameter as not required

Update Node.js

Fix incorrect handling of Unicode characters in exec()

Use Octokit pagination

Updates real world links

Changelog

Sourced from dorny/paths-filter's changelog.

v2.11.1

Update @actions/core to v1.10.0 - Fixes warning about deprecated set-output

Document need for pull-requests: read permission

Updating to actions/checkout@v3

v2.11.0

Set list-files input parameter as not required

Update Node.js

Fix incorrect handling of Unicode characters in exec()

Use Octokit pagination

Updates real world links

Commits

4512585 Update dist/index.js and CHANGELOG for v2.11.1

5f5fe18 Merge pull request #168 from dorny/job-permissions

e12ca0e Revert "Modify ts file to trigger CI"

ffe0943 Modify ts file to trigger CI

c763b52 Document need for pull-requests: read permission

9e7258b Specify job permissions in the pull request workflow

baa26e3 Merge pull request #167 from dorny/update-actions-core-package

513ea69 Update @actions/core to v1.10.0

027a82c Merge pull request #164 from IdanYaffe/idanyaffe-master

e0f036e updating to actions/checkout@v3 in order to avoid the set-output deprecation ...

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

dependency
opened by dependabot[bot] 0