chore(deps): update dependency geopy to v2.5.0 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
geopy	==2.4.1 → ==2.5.0

---

geopy: Regular Expression Denial of Service (ReDoS) in geopy.Point

CVE-2026-77387 / GHSA-mhvh-fq92-pfmr

More information

Details

Impact

geopy.Point and Point.from_string() may take excessive CPU time when parsing long, malformed coordinate strings due to inefficient regular-expression behavior. The numeric Point constructor is not affected.

Geocoders' reverse methods called with string inputs exercise the vulnerable path.

Applications are affected when they pass attacker-controlled strings to these APIs without an appropriate length limit. Repeated requests may cause denial of service.

Patches

Fixed in geopy 2.5.0 by rejecting overly long (over 256 characters) coordinate strings before parsing.

Workarounds

Limit coordinate strings to a reasonable maximum length, such as 256 characters, before passing them to geopy.

Severity

• CVSS Score: 4.0 / 10 (Medium)
• Vector String: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/geopy/geopy/security/advisories/GHSA-mhvh-fq92-pfmr
• https://nvd.nist.gov/vuln/detail/CVE-2026-77387
• https://github.com/geopy/geopy/issues/608
• https://github.com/geopy/geopy/pull/610
• https://github.com/geopy/geopy/commit/5d09fa843f90ec80788b61552539c9fd3ae6c528
• https://github.com/geopy/geopy/releases/tag/2.5.0
• https://github.com/advisories/GHSA-mhvh-fq92-pfmr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

geopy/geopy (geopy)

v2.5.0

Compare Source

Security Advisory

GitHub Security advisory: GHSA-mhvh-fq92-pfmr.

Regular Expression Denial of Service (ReDoS) in geopy.Point:
geopy.Point.from_string may take excessive CPU time when parsing long,
malformed coordinate strings due to inefficient regular-expression behavior.

The numeric geopy.Point constructor is not affected.

Geocoders' reverse methods called with string inputs exercise the vulnerable path.

Reported by Younghun Lee in #​608,
fix contributed by Apoorv Darshan in #​610.

The fix rejects any inputs longer than 256 chars unconditionally,
which may start falsely rejecting previously valid Point strings
with long irrelevant prefixes.

Bugfixes

• .Geocodio: fix GeocoderQueryError being raised for empty results.
• .GoogleV3: fix utcnow deprecation warnings.

Packaging Changes

• Drop support for Python 3.7.
• Add support for Python 3.13, 3.14, and 3.15.
• Migrate build metadata from setup.py to setup.cfg.
  Remove download_url from the metadata.
  Contributed by Mike Taves. #​535
• Replace distutils with packaging in tests (fixes Python 3.12+).

Code Improvements

• Remove Python 2 relics.
  Contributed by Miroslav Šedivý. #​552

Test Improvements

• Fix applying pytest marks to fixtures (pytest >= 9.1 compatibility).
  Contributed by Tomáš Hrnčiar. #​609
• Fix unclosed event loop warning in tests.
• Fix pytest classmethod warning.
• .Nominatim: fix test_reverse_near_zero which was failing due to
  locale-specific response formatting.
  Contributed by Alfredo Tupone. #​606

Docs Improvements

• .TomTom: update documentation links.
  Contributed by Przemek Malolepszy. #​602
• Improve English grammar in docs.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.