Bump the pip group across 1 directories with 3 updates

[dependabot]

Bumps the pip group with 3 updates in the /backend/app directory: scrapy, cryptography and twisted.

Updates scrapy from 2.11.0 to 2.11.1

Release notes

Sourced from scrapy's releases.

2.11.1

• Security bug fixes.
• Support for Twisted >= 23.8.0.
• Documentation improvements.

See the full changelog.

Changelog

Sourced from scrapy's changelog.

Scrapy 2.11.1 (2024-02-14)

Highlights:

• Security bug fixes.

• Support for Twisted >= 23.8.0.

• Documentation improvements.

Security bug fixes

-   Addressed `ReDoS vulnerabilities`_:
-   ``scrapy.utils.iterators.xmliter`` is now deprecated in favor of
    :func:`~scrapy.utils.iterators.xmliter_lxml`, which
    :class:`~scrapy.spiders.XMLFeedSpider` now uses.
To minimize the impact of this change on existing code,
:func:`~scrapy.utils.iterators.xmliter_lxml` now supports indicating
the node namespace with a prefix in the node name, and big files with
highly nested trees when using libxml2 2.7+.


Fixed regular expressions in the implementation of the

:func:~scrapy.utils.response.open_in_browser function.

Please, see the cc65-xxvf-f7r9 security advisory_ for more information.
.. _ReDoS vulnerabilities: https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

.. _cc65-xxvf-f7r9 security advisory: GHSA-cc65-xxvf-f7r9




:setting:DOWNLOAD_MAXSIZE and :setting:DOWNLOAD_WARNSIZE now also apply
to the decompressed response body. Please, see the 7j7m-v7m3-jqm7 security advisory_ for more information.
.. _7j7m-v7m3-jqm7 security advisory: GHSA-7j7m-v7m3-jqm7


Also in relation with the 7j7m-v7m3-jqm7 security advisory_, the
deprecated scrapy.downloadermiddlewares.decompression module has been
removed.


The Authorization header is now dropped on redirects to a different
domain. Please, see the cw9j-q3vf-hrrv security advisory_ for more
information.
.. _cw9j-q3vf-hrrv security advisory: GHSA-cw9j-q3vf-hrrv


Modified requirements
</tr></table>

... (truncated)

Commits

• 2f1d345 Solve test issues
• 502addc Bump version: 2.11.0 → 2.11.1
• 6b88b33 Set the release date of versions 2.11.1 and 1.8.4
• 479619b Merge branch '2.11-redos' into 2.11
• 809bfac Merge branch '2.11-compression-bomb' into 2.11
• 5bcb8fd Merge branch '2.11-authorization' into 2.11
• a55e933 Release notes for 2.11.1 (#6150)
• 5e5a920 Remove slow leftovers
• 810aaa6 Undo an unintended change
• c5dad41 Speed up tests, remove comments without regexps
• Additional commits viewable in compare view

Updates cryptography from 42.0.1 to 42.0.2

Changelog

Sourced from cryptography's changelog.

42.0.2 - 2024-01-30

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.2.1.
* Fixed an issue that prevented the use of Python buffer protocol objects in
  ``sign`` and ``verify`` methods on asymmetric keys.
* Fixed an issue with incorrect keyword-argument naming with ``EllipticCurvePrivateKey``
  :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey.exchange`,
  ``X25519PrivateKey``
  :meth:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.exchange`,
  ``X448PrivateKey``
  :meth:`~cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey.exchange`,
  and ``DHPrivateKey``
  :meth:`~cryptography.hazmat.primitives.asymmetric.dh.DHPrivateKey.exchange`.
.. _v42-0-1:

Commits

• 2202123 changelog and version bump 42.0.2 (#10268)
• f7032bd bump openssl in CI (#10298) (#10299)
• 002e886 Fixes #10294 -- correct accidental change to exchange kwarg (#10295) (#10296)
• 92fa9f2 support bytes-like consistently across our asym sign/verify APIs (#10260) (#1...
• 6478f7e explicitly support bytes-like for signature/data in RSA sign/verify (#10259) ...
• 4bb8596 fix the release script (#10233) (#10254)
• See full diff in compare view

Updates twisted from 22.10.0 to 23.10.0

Release notes

Sourced from twisted's releases.

Twisted 23.10.0 (2023-10-31)

No changes since 23.10.0.rc1.

Features

• twisted.python.filepath.FilePath and related classes (twisted.python.filepath.IFilepath, twisted.python.filepath.AbstractFilePath, twisted.python.zippath.ZipPath, and twisted.python.zippath.ZipArchive) now have type annotations. Additionally, FilePath is now generic, describing its mode, so you can annotate variables as FilePath[str] or FilePath[bytes] depending on the types that you wish to get back from the 'path' attribute and related methods like 'basename'. (#11822)
• When using CPython, functions wrapped by twisted.internet.defer.inlineCallbacks can have their arguments and return values freed immediately after completion (due to there no longer being circular references). (#11885)

Bugfixes

• Fix TypeError on t.i.cfreactor due to 3.10 type annotation syntax (#11965)
• Fix the type annotations of DeferredLock.run, DeferredSemaphore.run, maybeDeferred, ensureDeferred, inlineCallbacks and fromCoroutine that used to return Deferred[Any] to return the result of the passed Coroutine/Coroutine function (#11985)
• Fixed significant performance overhead (CPU and bandwidth) when doing small writes to a TLS transport. Specifically, small writes to a TLS transport are now buffered until the next reactor iteration. (#11989)
• fix mypy due to hypothesis 6.85 (#11995)

Improved Documentation

• The search and version navigation for the documentation hosted on Read The Docs was fixed. This was a regression introduced with 23.8.0. (#12012)

Deprecations and Removals

• Drop support for Python 3.7. Remove twisted[contextvars] extra (contextvars are always available in Python 3.7+) (#11913)

Misc

• #5206, #11583, #11787, #11871, #11912, #11921, #11922, #11926, #11932, #11934, #11936, #11938, #11940, #11942, #11945, #11948, #11952, #11953, #11955, #11957, #11959, #11961, #11964, #11973, #11977, #11980, #11982, #11993, #11999, #12004, #12005, #12009

Conch

No significant changes.

Web

... (truncated)

Changelog

Sourced from twisted's changelog.

Twisted 23.10.0 (2023-10-31)

No changes since 23.10.0.rc1.

Features

• twisted.python.filepath.FilePath and related classes (twisted.python.filepath.IFilepath, twisted.python.filepath.AbstractFilePath, twisted.python.zippath.ZipPath, and twisted.python.zippath.ZipArchive) now have type annotations. Additionally, FilePath is now generic, describing its mode, so you can annotate variables as FilePath[str] or FilePath[bytes] depending on the types that you wish to get back from the 'path' attribute and related methods like 'basename'. (#11822)
• When using CPython, functions wrapped by twisted.internet.defer.inlineCallbacks can have their arguments and return values freed immediately after completion (due to there no longer being circular references). (#11885)

Bugfixes

• Fix TypeError on t.i.cfreactor due to 3.10 type annotation syntax (#11965)
• Fix the type annotations of DeferredLock.run, DeferredSemaphore.run, maybeDeferred, ensureDeferred, inlineCallbacks and fromCoroutine that used to return Deferred[Any] to return the result of the passed Coroutine/Coroutine function (#11985)
• Fixed significant performance overhead (CPU and bandwidth) when doing small writes to a TLS transport. Specifically, small writes to a TLS transport are now buffered until the next reactor iteration. (#11989)
• fix mypy due to hypothesis 6.85 (#11995)

Improved Documentation

• The search and version navigation for the documentation hosted on Read The Docs was fixed. This was a regression introduced with 23.8.0. (#12012)

Deprecations and Removals

• Drop support for Python 3.7. Remove twisted[contextvars] extra (contextvars are always available in Python 3.7+) (#11913)

Misc

• #5206, #11583, #11787, #11871, #11912, #11921, #11922, #11926, #11932, #11934, #11936, #11938, #11940, #11942, #11945, #11948, #11952, #11953, #11955, #11957, #11959, #11961, #11964, #11973, #11977, #11980, #11982, #11993, #11999, #12004, #12005, #12009

Conch

No significant changes.

Web

... (truncated)

Commits

• f3f3389 python -m incremental.update Twisted --newversion
• 2d15c00 Add CVE id to bug.
• 61c46d4 tox -e towncrier
• 650c59d python -m incremental.update Twisted --rc
• 157cd8e #11985 fix DeferredLock.run/Semaphore.run/maybeDeferred/ensureDeferred/inline...
• ed25d4a [pre-commit.ci] auto fixes from pre-commit.com hooks
• 5eb2078 Merge branch 'trunk' into fix-concurrency-primative-type
• 2df4c76 Update src/twisted/test/test_defer.py
• 105a9f5 #11989 Lots of small writes to the TLS transport use a lot of cpu (#11996)
• 524a2fa Fix lint
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.