Bump the pip group across 1 directory with 4 updates by dependabot[bot] · Pull Request #1 · synfinatic/stacker · GitHub
Skip to content

Bump the pip group across 1 directory with 4 updates#1

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/pip-b9ff85c01f
Open

Bump the pip group across 1 directory with 4 updates#1
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/pip-b9ff85c01f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 5, 2024

Copy link
Copy Markdown

Updates the requirements on gitpython, jinja2, rsa and python-jose to permit the latest version.
Updates gitpython to 3.1.43

Release notes

Sourced from gitpython's releases.

3.1.43

Particularly Important Changes

These are likely to affect you, please do take a careful look.

Other Changes

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.42...3.1.43

Commits
  • 5364053 bump version to 3.1.43
  • 4e626bd Merge pull request #1886 from EliahKagan/deprecation-warnings
  • f6060df Add GitMeta alias
  • 8327b45 Test GitMeta alias
  • f92f4c3 Clarify security risk in USE_SHELL doc and warnings
  • c7675d2 update security policy, to use GitHub instead of email
  • cf2576e Make/use test.deprecation.lib; abandon idea to filter by module
  • 7cd3aa9 Make test.performance.lib docstring more specific
  • b51b080 Explain the approach in test.deprecation to static checking
  • bdabb21 Expand USE_SHELL docstring; clarify a test usage
  • Additional commits viewable in compare view

Updates jinja2 to 3.1.4

Release notes

Sourced from jinja2's releases.

3.1.4

This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.

PyPI: https://pypi.org/project/Jinja2/3.1.4/ Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-4

  • The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. GHSA-h75v-3vvj-5mfj
Changelog

Sourced from jinja2's changelog.

Version 3.1.4

Released 2024-05-05

  • The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. :ghsa:h75v-3vvj-5mfj

Version 3.1.3

Released 2024-01-10

  • Fix compiler error when checking if required blocks in parent templates are empty. :pr:1858
  • xmlattr filter does not allow keys with spaces. :ghsa:h5c8-rqwp-cp95
  • Make error messages stemming from invalid nesting of {% trans %} blocks more helpful. :pr:1918

Version 3.1.2

Released 2022-04-28

  • Add parameters to Environment.overlay to match __init__. :issue:1645
  • Handle race condition in FileSystemBytecodeCache. :issue:1654

Version 3.1.1

Released 2022-03-25

  • The template filename on Windows uses the primary path separator. :issue:1637

Version 3.1.0

Released 2022-03-24

  • Drop support for Python 3.6. :pr:1534
  • Remove previously deprecated code. :pr:1544

... (truncated)

Commits

Updates rsa from 4.5 to 4.7

Changelog

Sourced from rsa's changelog.

Version 4.7 - released 2021-01-10

  • Fix #165: CVE-2020-25658 - Bleichenbacher-style timing oracle in PKCS#1 v1.5 decryption code
  • Add padding length check as described by PKCS#1 v1.5 (Fixes #164)
  • Reuse of blinding factors to speed up blinding operations. Fixes #162.
  • Declare & test support for Python 3.9

Version 4.4 & 4.6 - released 2020-06-12

Version 4.4 and 4.6 are almost a re-tagged release of version 4.2. It requires Python 3.5+. To avoid older Python installations from trying to upgrade to RSA 4.4, this is now made explicit in the python_requires argument in setup.py. There was a mistake releasing 4.4 as "3.5+ only", which made it necessary to retag 4.4 as 4.6 as well.

No functional changes compared to version 4.2.

Commits

Updates python-jose to 3.3.0

Release notes

Sourced from python-jose's releases.

3.3.0 -- 2020-06-04

News

  • Remove support for python 2.7 & 3.5
  • Add support for Python 3.9
  • Remove PyCrypto backend
  • Fix deprecation warning from cryptography backend

Housekeeping

  • Switched from Travis CI to Github Actions
  • Added iSort & Black
  • Run CI Tests under Mac OS & Windows.
  • Updated Syntax to use Python 3.6+
  • Upgrade to latest pytest, remove used dev requirements.
Changelog

Sourced from python-jose's changelog.

3.3.0 -- 2021-06-04

News

  • Remove support for python 2.7 & 3.5
  • Add support for Python 3.9
  • Remove PyCrypto backend
  • Fix deprecation warning from cryptography backend

Housekeeping

  • Switched from Travis CI to Github Actions
  • Added iSort & Black
  • Run CI Tests under Mac OS & Windows.
  • Updated Syntax to use Python 3.6+
  • Upgrade to latest pytest, remove used dev requirements.

3.2.0 -- 2020-07-29

News

  • This will be the last release supporting Python 2.7, 3.5, and the PyCrypto backend.

Bug fixes and Improvements

  • Use hmac.compare_digest instead of our own constant_time_string_compare #163
  • Fix to_dict output, which should always be JSON encodeable. #139 and #165 (fixes #127 and #137)
  • Require setuptools >= 39.2.0 #167 (fixes #161)
  • Emit a warning when verifying with a private key #168 (fixes #53 and #142)
  • Avoid loading python-ecdsa when using the cryptography backend, and pinned python-ecdsa dependency to <0.15 #178

Housekeeping

3.1.0 -- 2019-12-10

This is a greatly overdue release.

Features

  • Improve JWT.decode() #76 (fixes #75)
  • Sort headers when serializing to allow for headless JWT #136 (fixes #80)
  • Adjust dependency handling
    • Use PyCryptodome instead of PyCrypto #83
    • Update package dependencies #124 (fixes #158)
  • Avoid using deprecated methods #85

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the pip group across 1 directory with 4 updates
ded28b1 
Updates the requirements on [gitpython](https://github.com/gitpython-developers/GitPython), [jinja2](https://github.com/pallets/jinja), [rsa](https://github.com/sybrenstuvel/python-rsa) and [python-jose](https://github.com/mpdavis/python-jose) to permit the latest version.

Updates `gitpython` to 3.1.43
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@2.0.0...3.1.43)

Updates `jinja2` to 3.1.4
- [Release notes](https://github.com/pallets/jinja/releases)
- [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst)
- [Commits](pallets/jinja@2.7...3.1.4)

Updates `rsa` from 4.5 to 4.7
- [Changelog](https://github.com/sybrenstuvel/python-rsa/blob/main/CHANGELOG.md)
- [Commits](sybrenstuvel/python-rsa@version-4.5...version-4.7)

Updates `python-jose` to 3.3.0
- [Release notes](https://github.com/mpdavis/python-jose/releases)
- [Changelog](https://github.com/mpdavis/python-jose/blob/master/CHANGELOG.md)
- [Commits](mpdavis/python-jose@v0.1.5...3.3.0)

---
updated-dependencies:
- dependency-name: gitpython
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: jinja2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: rsa
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: python-jose
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Jun 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants