Bump the pip-minor-and-patch group across 1 directory with 6 updates #890

dependabot · 2024-09-30T18:43:19Z

Bumps the pip-minor-and-patch group with 6 updates in the /src directory:

Package	From	To
bandit	`1.7.9`	`1.7.10`
importlib-metadata	`8.4.0`	`8.5.0`
pytest	`8.3.2`	`8.3.3`
ruff	`0.6.4`	`0.6.8`
urllib3	`2.2.2`	`2.2.3`
zipp	`3.20.1`	`3.20.2`

Updates bandit from 1.7.9 to 1.7.10

Release notes

Sourced from bandit's releases.

1.7.10

What's Changed

Bump docker/build-push-action from 5.4.0 to 6.0.0 by @dependabot in PyCQA/bandit#1147

Suggested small refactors in assignments by @ericwb in PyCQA/bandit#1150

Performance improvement in blacklist function by @ericwb in PyCQA/bandit#1148

Add test for usage of FTP_TLS by @ericwb in PyCQA/bandit#1149

New check: B113: TrojanSource - Bidirectional control characters by @Lucas-C in PyCQA/bandit#757

Bump docker/build-push-action from 6.0.0 to 6.1.0 by @dependabot in PyCQA/bandit#1152

feat(plugins): add support for httpx in B113 by @mkniewallner in PyCQA/bandit#1060

Nit: remove unused variable by @ericwb in PyCQA/bandit#1153

Add recent releases to version choice in bug report by @ericwb in PyCQA/bandit#1151

Bump docker/build-push-action from 6.1.0 to 6.2.0 by @dependabot in PyCQA/bandit#1155

Bump docker/build-push-action from 6.2.0 to 6.3.0 by @dependabot in PyCQA/bandit#1157

Bump docker/setup-buildx-action from 3.3.0 to 3.4.0 by @dependabot in PyCQA/bandit#1156

Bump docker/setup-buildx-action from 3.4.0 to 3.5.0 by @dependabot in PyCQA/bandit#1158

Bump docker/login-action from 3.2.0 to 3.3.0 by @dependabot in PyCQA/bandit#1159

Bump docker/build-push-action from 6.3.0 to 6.5.0 by @dependabot in PyCQA/bandit#1160

Bump docker/setup-buildx-action from 3.5.0 to 3.6.1 by @dependabot in PyCQA/bandit#1163

Bump docker/build-push-action from 6.5.0 to 6.6.1 by @dependabot in PyCQA/bandit#1166

Bump sigstore/cosign-installer from 3.5.0 to 3.6.0 by @dependabot in PyCQA/bandit#1165

Bump docker/build-push-action from 6.6.1 to 6.7.0 by @dependabot in PyCQA/bandit#1168

Use consistent file naming of docs by @ericwb in PyCQA/bandit#1170

Pytorch Load / Save Plugin by @lukehinds in PyCQA/bandit#1114

New Contributors

@Lucas-C made their first contribution in PyCQA/bandit#757

Full Changelog: PyCQA/bandit@1.7.9...1.7.10

Commits

36fd650 Pytorch Load / Save Plugin (#1114)
4ac55df Use consistent file naming of docs (#1170)
68022aa Bump docker/build-push-action from 6.6.1 to 6.7.0 (#1168)
77566a0 Bump sigstore/cosign-installer from 3.5.0 to 3.6.0 (#1165)
221ced6 Bump docker/build-push-action from 6.5.0 to 6.6.1 (#1166)
701b7d5 Bump docker/setup-buildx-action from 3.5.0 to 3.6.1 (#1163)
320495c Bump docker/build-push-action from 6.3.0 to 6.5.0 (#1160)
90490c7 Bump docker/login-action from 3.2.0 to 3.3.0 (#1159)
708ab74 Bump docker/setup-buildx-action from 3.4.0 to 3.5.0 (#1158)
89d2345 Bump docker/setup-buildx-action from 3.3.0 to 3.4.0 (#1156)
Additional commits viewable in compare view

Updates importlib-metadata from 8.4.0 to 8.5.0

Changelog

Sourced from importlib-metadata's changelog.

v8.5.0

Features

Deferred import of zipfile.Path (#502)

Deferred import of json (#503)

Rely on zipp overlay for zipfile.Path.

Commits

b34810b Finalize
8c1d1fa Merge pull request #501 from Avasam/Pass-mypy-and-link-issues
afa39e8 Back out changes to tests._path
8b909f9 Merge pull request #503 from danielhollas/defer-json
2a3f50d Add news fragment.
3f78dc1 Add comment to protect the deferred import.
18eb2da Revert "Defer platform import"
58832f2 Merge pull request #502 from danielhollas/defer-zipp
e3ce33b Add news fragment.
d11b67f Add comment to protect the deferred import.
Additional commits viewable in compare view

Updates pytest from 8.3.2 to 8.3.3

Release notes

Sourced from pytest's releases.

8.3.3

pytest 8.3.3 (2024-09-09)

Bug fixes

#12446: Avoid calling @property (and other instance descriptors) during fixture discovery -- by asottile{.interpreted-text role="user"}

#12659: Fixed the issue of not displaying assertion failure differences when using the parameter --import-mode=importlib in pytest>=8.1.

#12667: Fixed a regression where type change in [ExceptionInfo.errisinstance]{.title-ref} caused [mypy]{.title-ref} to fail.

#12744: Fixed typing compatibility with Python 3.9 or less -- replaced [typing.Self]{.title-ref} with [typing_extensions.Self]{.title-ref} -- by Avasam{.interpreted-text role="user"}

#12745: Fixed an issue with backslashes being incorrectly converted in nodeid paths on Windows, ensuring consistent path handling across environments.

#6682: Fixed bug where the verbosity levels where not being respected when printing the "msg" part of failed assertion (as in assert condition, msg).

#9422: Fix bug where disabling the terminal plugin via -p no:terminal would cause crashes related to missing the verbose option.

-- by GTowers1{.interpreted-text role="user"}

Improved documentation

#12663: Clarify that the [pytest_deselected]{.title-ref} hook should be called from [pytest_collection_modifyitems]{.title-ref} hook implementations when items are deselected.

#12678: Remove erroneous quotes from [tmp_path_retention_policy]{.title-ref} example in docs.

Miscellaneous internal changes

#12769: Fix typos discovered by codespell and add codespell to pre-commit hooks.

Commits

d0f136f build(deps): Bump pypa/gh-action-pypi-publish from 1.10.0 to 1.10.1 (#12790)
972f307 Prepare release version 8.3.3
0dabdcf Include co-authors in release announcement (#12795) (#12797)
a9910a4 Do not discover properties when iterating fixtures (#12781) (#12788)
0f10b6b Fix issue with slashes being turned into backslashes on Windows (#12760) (#12...
300d13d Merge pull request #12785 from pytest-dev/patchback/backports/8.3.x/57cccf7f4...
e5d32c7 Merge pull request #12784 from svenevs/fix/docs-example-parametrize-minor-typo
bc913d1 Streamline checks for verbose option (#12706) (#12778)
01cfcc9 Fix typos and introduce codespell pre-commit hook (#12769) (#12774)
4873394 doc: Remove past training (#12772) (#12773)
Additional commits viewable in compare view

Updates ruff from 0.6.4 to 0.6.8

Release notes

Sourced from ruff's releases.

0.6.8

Release Notes

Preview features

Remove unnecessary parentheses around match case clauses (#13510)

Parenthesize overlong if guards in match..case clauses (#13513)

Detect basic wildcard imports in ruff analyze graph (#13486)

[pylint] Implement boolean-chained-comparison (R1716) (#13435)

Rule changes

[lake8-simplify] Detect SIM910 when using variadic keyword arguments, i.e., **kwargs (#13503)

[pyupgrade] Avoid false negatives with non-reference shadowed bindings of loop variables (UP028) (#13504)

Bug fixes

Detect tuples bound to variadic positional arguments i.e. *args (#13512)

Exit gracefully on broken pipe errors (#13485)

Avoid panic when analyze graph hits broken pipe (#13484)

Performance

Reuse BTreeSets in module resolver (#13440)

Skip traversal for non-compound statements (#13441)

Contributors

@MichaReiser

@TomerBin

@charliermarsh

@diceroll123

@dylwil3

@haarisr

@renovate

@sbrugman

@vincevannoort

@zanieb

Install ruff 0.6.8

Install prebuilt binaries via shell script
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/ruff/releases/download/0.6.8/ruff-installer.sh | sh
Install prebuilt binaries via powershell script

... (truncated)

Changelog

Sourced from ruff's changelog.

0.6.8

Preview features

Remove unnecessary parentheses around match case clauses (#13510)

Parenthesize overlong if guards in match..case clauses (#13513)

Detect basic wildcard imports in ruff analyze graph (#13486)

[pylint] Implement boolean-chained-comparison (R1716) (#13435)

Rule changes

[lake8-simplify] Detect SIM910 when using variadic keyword arguments, i.e., **kwargs (#13503)

[pyupgrade] Avoid false negatives with non-reference shadowed bindings of loop variables (UP028) (#13504)

Bug fixes

Detect tuples bound to variadic positional arguments i.e. *args (#13512)

Exit gracefully on broken pipe errors (#13485)

Avoid panic when analyze graph hits broken pipe (#13484)

Performance

Reuse BTreeSets in module resolver (#13440)

Skip traversal for non-compound statements (#13441)

0.6.7

Preview features

Add Python version support to ruff analyze CLI (#13426)

Add exclude support to ruff analyze (#13425)

Fix parentheses around return type annotations (#13381)

Rule changes

[pycodestyle] Fix: Don't autofix if the first line ends in a question mark? (D400) (#13399)

Bug fixes

Respect lint.exclude in ruff check --add-noqa (#13427)

Performance

Avoid tracking module resolver files in Salsa (#13437)

Use forget for module resolver database (#13438)

0.6.6

Preview features

... (truncated)

Commits

ae39ce5 Bump version to 0.6.8 (#13522)
ff2d214 Don't skip over imports and other nodes containing nested statements in impor...
9442cd8 Parenthesize match..case if guards (#13513)
8012707 Align formatting of patterns in match-cases with expression formatting in cla...
d7ffe46 Disable the typeset plugin (#13517)
7c83af4 red-knot: Implement the not operator for all Type variants (#13432)
bbb044e Detect tuples bound to variadic positional arguments i.e. *args (#13512)
4810652 Avoid UP028 false negatives with non-reference shadowed bindings of loop vari...
11f06e0 Detect SIM910 when using variadic keyword arguments, i.e., **kwargs (#13503)
f27a8b8 [internal] ComparableExpr (f)strings and bytes made invariant under concate...
Additional commits viewable in compare view

Updates urllib3 from 2.2.2 to 2.2.3

Release notes

Sourced from urllib3's releases.

2.2.3

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Features

Added support for Python 3.13. (#3473)

Bugfixes

Fixed the default encoding of chunked request bodies to be UTF-8 instead of ISO-8859-1. All other methods of supplying a request body already use UTF-8 starting in urllib3 v2.0. (#3053)

Fixed ResourceWarning on CONNECT with Python < 3.11.4 by backporting python/cpython#103472. (`#3252)

Adjust tolerance for floating-point comparison on Windows to avoid flakiness in CI (#3413)

Fixed a crash where certain standard library hash functions were absent in restricted environments. (#3432)

Fixed mypy error when adding to HTTPConnection.default_socket_options. (#3448)

HTTP/2 (experimental)

HTTP/2 support is still in early development.

Excluded Transfer-Encoding: chunked from HTTP/2 request body (#3425)

Added version checking for h2 (https://pypi.org/project/h2/) usage. Now only accepting supported h2 major version 4.x.x. (#3290)

Added a probing mechanism for determining whether a given target origin supports HTTP/2 via ALPN. (#3301)

Add support for sending a request body with HTTP/2 (#3302)

Full Changelog: urllib3/urllib3@2.2.2...2.2.3

Changelog

Sourced from urllib3's changelog.

2.2.3 (2024-09-12)

Features

Added support for Python 3.13. ([#3473](https://github.com/urllib3/urllib3/issues/3473) <https://github.com/urllib3/urllib3/issues/3473>__)

Bugfixes

Fixed the default encoding of chunked request bodies to be UTF-8 instead of ISO-8859-1. All other methods of supplying a request body already use UTF-8 starting in urllib3 v2.0. ([#3053](https://github.com/urllib3/urllib3/issues/3053) <https://github.com/urllib3/urllib3/issues/3053>__)

Fixed ResourceWarning on CONNECT with Python `__)

Adjust tolerance for floating-point comparison on Windows to avoid flakiness in CI ([#3413](https://github.com/urllib3/urllib3/issues/3413) <https://github.com/urllib3/urllib3/issues/3413>__)

Fixed a crash where certain standard library hash functions were absent in restricted environments. ([#3432](https://github.com/urllib3/urllib3/issues/3432) <https://github.com/urllib3/urllib3/issues/3432>__)

Fixed mypy error when adding to HTTPConnection.default_socket_options. ([#3448](https://github.com/urllib3/urllib3/issues/3448) <https://github.com/urllib3/urllib3/issues/3448>__)

HTTP/2 (experimental)

HTTP/2 support is still in early development.

Excluded Transfer-Encoding: chunked from HTTP/2 request body ([#3425](https://github.com/urllib3/urllib3/issues/3425) <https://github.com/urllib3/urllib3/issues/3425>__)

Added version checking for h2 (https://pypi.org/project/h2/) usage.

Now only accepting supported h2 major version 4.x.x. ([#3290](https://github.com/urllib3/urllib3/issues/3290) <https://github.com/urllib3/urllib3/issues/3290>__)

Added a probing mechanism for determining whether a given target origin supports HTTP/2 via ALPN. ([#3301](https://github.com/urllib3/urllib3/issues/3301) <https://github.com/urllib3/urllib3/issues/3301>__)

Add support for sending a request body with HTTP/2 ([#3302](https://github.com/urllib3/urllib3/issues/3302) <https://github.com/urllib3/urllib3/issues/3302>__)

Deprecations and Removals

Note for downstream distributors: the _version.py file has been removed and is now created at build time by hatch-vcs. ([#3412](https://github.com/urllib3/urllib3/issues/3412) <https://github.com/urllib3/urllib3/issues/3412>__)

Drop support for end-of-life PyPy3.8 and PyPy3.9. ([#3475](https://github.com/urllib3/urllib3/issues/3475) <https://github.com/urllib3/urllib3/issues/3475>__)

Commits

2458bfc Release 2.2.3
9b25db6 Only attempt to publish for upstream
b9adeef Drop support for EOL PyPy3.8 and PyPy3.9
b1d4649 Add explicit support for Python 3.13
cc42860 Bump cryptography from 42.0.4 to 43.0.1 (#3470)
3dae2e9 Bump pypa/gh-action-pypi-publish from 1.9.0 to 1.10.1 (#3469)
1e94feb Revert "Add TLS settings for HTTP/2 (#3456)" (#3466)
aa73abc Bump actions/setup-python from 5.1.0 to 5.2.0 (#3468)
abbfbcb Add 1.26.20 to changelog and make the publish workflow the same (#3464)
d480615 Add TLS settings for HTTP/2 (#3456)
Additional commits viewable in compare view

Updates zipp from 3.20.1 to 3.20.2

Changelog

Sourced from zipp's changelog.

v3.20.2

Bugfixes

Make zipp.compat.overlay.zipfile hashable. (#126)

Commits

a575660 Make no assertions about the number. It could be negative.
0b3a1b9 Finalize
a4c7961 Make zipp.compat.overlay.zipfile hashable.
d66007a Merge https://github.com/jaraco/skeleton
3fe8c5bjaraco/skeleton#146
81b766c Fix an incompatibility (and source of merge conflicts) with projects using Ru...
b8a63ca Merge pull request #125 from saschanaz/patch-1
0b95ec7 Suppress F821
5d2fa66 Merge https://github.com/jaraco/skeleton
a675458 Allow the workflow to be triggered manually.
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the pip-minor-and-patch group with 6 updates in the /src directory: | Package | From | To | | --- | --- | --- | | [bandit](https://github.com/PyCQA/bandit) | `1.7.9` | `1.7.10` | | [importlib-metadata](https://github.com/python/importlib_metadata) | `8.4.0` | `8.5.0` | | [pytest](https://github.com/pytest-dev/pytest) | `8.3.2` | `8.3.3` | | [ruff](https://github.com/astral-sh/ruff) | `0.6.4` | `0.6.8` | | [urllib3](https://github.com/urllib3/urllib3) | `2.2.2` | `2.2.3` | | [zipp](https://github.com/jaraco/zipp) | `3.20.1` | `3.20.2` | Updates `bandit` from 1.7.9 to 1.7.10 - [Release notes](https://github.com/PyCQA/bandit/releases) - [Commits](PyCQA/bandit@1.7.9...1.7.10) Updates `importlib-metadata` from 8.4.0 to 8.5.0 - [Release notes](https://github.com/python/importlib_metadata/releases) - [Changelog](https://github.com/python/importlib_metadata/blob/main/NEWS.rst) - [Commits](python/importlib_metadata@v8.4.0...v8.5.0) Updates `pytest` from 8.3.2 to 8.3.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@8.3.2...8.3.3) Updates `ruff` from 0.6.4 to 0.6.8 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.6.4...0.6.8) Updates `urllib3` from 2.2.2 to 2.2.3 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.2.2...2.2.3) Updates `zipp` from 3.20.1 to 3.20.2 - [Release notes](https://github.com/jaraco/zipp/releases) - [Changelog](https://github.com/jaraco/zipp/blob/main/NEWS.rst) - [Commits](jaraco/zipp@v3.20.1...v3.20.2) --- updated-dependencies: - dependency-name: bandit dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-minor-and-patch - dependency-name: importlib-metadata dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip-minor-and-patch - dependency-name: pytest dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-minor-and-patch - dependency-name: ruff dependency-type: direct:development update-type: version-update:semver-patch dependency-group: pip-minor-and-patch - dependency-name: urllib3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-minor-and-patch - dependency-name: zipp dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip-minor-and-patch ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Sep 30, 2024

dependabot bot mentioned this pull request Sep 30, 2024

Bump the pip-minor-and-patch group across 1 directory with 6 updates #889

Closed

Yrob approved these changes Oct 2, 2024

View reviewed changes

Yrob merged commit c8814e9 into master Oct 2, 2024
4 checks passed

Yrob deleted the dependabot/pip/src/pip-minor-and-patch-4eb9a1a85f branch October 2, 2024 08:59

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the pip-minor-and-patch group across 1 directory with 6 updates #890

Bump the pip-minor-and-patch group across 1 directory with 6 updates #890

dependabot bot commented on behalf of github Sep 30, 2024 •

edited

Loading

Bump the pip-minor-and-patch group across 1 directory with 6 updates #890

Bump the pip-minor-and-patch group across 1 directory with 6 updates #890

Conversation

dependabot bot commented on behalf of github Sep 30, 2024 • edited Loading

1.7.10

What's Changed

New Contributors

v8.5.0

Features

8.3.3

pytest 8.3.3 (2024-09-09)

Bug fixes

Improved documentation

Miscellaneous internal changes

0.6.8

Release Notes

Preview features

Rule changes

Bug fixes

Performance

Contributors

Install ruff 0.6.8

Install prebuilt binaries via shell script

Install prebuilt binaries via powershell script

0.6.8

Preview features

Rule changes

Bug fixes

Performance

0.6.7

Preview features

Rule changes

Bug fixes

Performance

0.6.6

Preview features

2.2.3

🚀 urllib3 is fundraising for HTTP/2 support

Features

Bugfixes

HTTP/2 (experimental)

2.2.3 (2024-09-12)

Features

Bugfixes

HTTP/2 (experimental)

Deprecations and Removals

v3.20.2

Bugfixes

dependabot bot commented on behalf of github Sep 30, 2024 •

edited

Loading