Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

⬆ Bump the pip group group with 10 updates #193

Closed
wants to merge 1 commit into from
Closed

⬆ Bump the pip group group with 10 updates #193

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Mar 20, 2024

Bumps the pip group group with 10 updates:

Package From To
black 23.3.0 24.3.0
pillow 9.5.0 10.2.0
aiohttp 3.8.4 3.9.2
certifi 2023.5.7 2023.7.22
fastapi 0.97.0 0.109.1
hnswlib 0.7.0 0.8.0
jinja2 3.1.2 3.1.3
pyarrow 12.0.1 14.0.1
starlette 0.27.0 0.35.1
urllib3 2.0.3 2.0.7

Updates black from 23.3.0 to 24.3.0

Release notes

Sourced from black's releases.

24.3.0

Highlights

This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.

This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

Stable style

  • Don't move comments along with delimiters, which could cause crashes (#4248)
  • Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)
  • Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)

Performance

  • Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)

Documentation

  • Note what happens when --check is used with --quiet (#4236)

24.2.0

Stable style

  • Fixed a bug where comments where mistakenly removed along with redundant parentheses (#4218)

Preview style

  • Move the hug_parens_with_braces_and_square_brackets feature to the unstable style due to an outstanding crash and proposed formatting tweaks (#4198)
  • Fixed a bug where base expressions caused inconsistent formatting of ** in tenary expression (#4154)
  • Checking for newline before adding one on docstring that is almost at the line limit (#4185)
  • Remove redundant parentheses in case statement if guards (#4214).

Configuration

... (truncated)

Changelog

Sourced from black's changelog.

24.3.0

Highlights

This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.

This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

Stable style

  • Don't move comments along with delimiters, which could cause crashes (#4248)
  • Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)
  • Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)

Performance

  • Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)

Documentation

  • Note what happens when --check is used with --quiet (#4236)

24.2.0

Stable style

  • Fixed a bug where comments where mistakenly removed along with redundant parentheses (#4218)

Preview style

  • Move the hug_parens_with_braces_and_square_brackets feature to the unstable style due to an outstanding crash and proposed formatting tweaks (#4198)
  • Fixed a bug where base expressions caused inconsistent formatting of ** in tenary expression (#4154)
  • Checking for newline before adding one on docstring that is almost at the line limit (#4185)
  • Remove redundant parentheses in case statement if guards (#4214).

... (truncated)

Commits

Updates pillow from 9.5.0 to 10.2.0

Release notes

Sourced from pillow's releases.

10.2.0

https://pillow.readthedocs.io/en/stable/releasenotes/10.2.0.html

Changes

... (truncated)

Changelog

Sourced from pillow's changelog.

10.2.0 (2024-01-02)

  • Add keep_rgb option when saving JPEG to prevent conversion of RGB colorspace #7553 [bgilbert, radarhere]

  • Trim glyph size in ImageFont.getmask() #7669, #7672 [radarhere, nulano]

  • Deprecate IptcImagePlugin helpers #7664 [nulano, hugovk, radarhere]

  • Allow uncompressed TIFF images to be saved in chunks #7650 [radarhere]

  • Concatenate multiple JPEG EXIF markers #7496 [radarhere]

  • Changed IPTC tile tuple to match other plugins #7661 [radarhere]

  • Do not assign new fp attribute when exiting context manager #7566 [radarhere]

  • Support arbitrary masks for uncompressed RGB DDS images #7589 [radarhere, akx]

  • Support setting ROWSPERSTRIP tag #7654 [radarhere]

  • Apply ImageFont.MAX_STRING_LENGTH to ImageFont.getmask() #7662 [radarhere]

  • Optimise ImageColor using functools.lru_cache #7657 [hugovk]

  • Restricted environment keys for ImageMath.eval() #7655 [wiredfool, radarhere]

  • Optimise ImageMode.getmode using functools.lru_cache #7641 [hugovk, radarhere]

  • Fix incorrect color blending for overlapping glyphs #7497 [ZachNagengast, nulano, radarhere]

  • Attempt memory mapping when tile args is a string #7565 [radarhere]

  • Fill identical pixels with transparency in subsequent frames when saving GIF #7568 [radarhere]

... (truncated)

Commits
  • 6956d0b 10.2.0 version bump
  • 31c8dac Merge pull request #7675 from python-pillow/pre-commit-ci-update-config
  • 40a3f91 Merge pull request #7674 from nulano/url-example
  • cb41b0c [pre-commit.ci] pre-commit autoupdate
  • de62b25 fix image url in "Reading from URL" example
  • 7c526a6 Update CHANGES.rst [ci skip]
  • d93a5ad Merge pull request #7553 from bgilbert/jpeg-rgb
  • aed764f Update CHANGES.rst [ci skip]
  • f8df530 Merge pull request #7672 from nulano/imagefont-negative-crop
  • 24e9485 Merge pull request #7671 from radarhere/imagetransform
  • Additional commits viewable in compare view

Updates aiohttp from 3.8.4 to 3.9.2

Release notes

Sourced from aiohttp's releases.

3.9.2

Bug fixes

  • Fixed server-side websocket connection leak.

    Related issues and pull requests on GitHub: #7978.

  • Fixed web.FileResponse doing blocking I/O in the event loop.

    Related issues and pull requests on GitHub: #8012.

  • Fixed double compress when compression enabled and compressed file exists in server file responses.

    Related issues and pull requests on GitHub: #8014.

  • Added runtime type check for ClientSession timeout parameter.

    Related issues and pull requests on GitHub: #8021.

  • Fixed an unhandled exception in the Python HTTP parser on header lines starting with a colon -- by :user:pajod.

    Invalid request lines with anything but a dot between the HTTP major and minor version are now rejected. Invalid header field names containing question mark or slash are now rejected. Such requests are incompatible with :rfc:9110#section-5.6.2 and are not known to be of any legitimate use.

    Related issues and pull requests on GitHub: #8074.

  • Improved validation of paths for static resources requests to the server -- by :user:bdraco.

... (truncated)

Changelog

Sourced from aiohttp's changelog.

3.9.2 (2024-01-28)

Bug fixes

  • Fixed server-side websocket connection leak.

    Related issues and pull requests on GitHub: :issue:7978.

  • Fixed web.FileResponse doing blocking I/O in the event loop.

    Related issues and pull requests on GitHub: :issue:8012.

  • Fixed double compress when compression enabled and compressed file exists in server file responses.

    Related issues and pull requests on GitHub: :issue:8014.

  • Added runtime type check for ClientSession timeout parameter.

    Related issues and pull requests on GitHub: :issue:8021.

  • Fixed an unhandled exception in the Python HTTP parser on header lines starting with a colon -- by :user:pajod.

    Invalid request lines with anything but a dot between the HTTP major and minor version are now rejected. Invalid header field names containing question mark or slash are now rejected. Such requests are incompatible with :rfc:9110#section-5.6.2 and are not known to be of any legitimate use.

    Related issues and pull requests on GitHub: :issue:8074.

... (truncated)

Commits
  • 24a6d64 Release v3.9.2 (#8082)
  • 9118a58 [PR #8079/1c335944 backport][3.9] Validate static paths (#8080)
  • 435ad46 [PR #3955/8960063e backport][3.9] Replace all tmpdir fixtures with tmp_path (...
  • d33bc21 Improve validation in HTTP parser (#8074) (#8078)
  • 0d945d1 [PR #7916/822fbc74 backport][3.9] Add more information to contributing page (...
  • 3ec4fa1 [PR #8069/69bbe874 backport][3.9] 📝 Only show changelog draft for non-release...
  • 419d715 [PR #8066/cba34699 backport][3.9] 💅📝 Restructure the changelog for clarity (#...
  • a54dab3 [PR #8049/a379e634 backport][3.9] Set cause for ClientPayloadError (#8050)
  • 437ac47 [PR #7995/43a5bc50 backport][3.9] Fix examples of fallback_charset_resolver...
  • 034e5e3 [PR #8042/4b91b530 backport][3.9] Tightening the runtime type check for ssl (...
  • Additional commits viewable in compare view

Updates certifi from 2023.5.7 to 2023.7.22

Commits

Updates fastapi from 0.97.0 to 0.109.1

Release notes

Sourced from fastapi's releases.

0.109.1

Security fixes

  • ⬆️ Upgrade minimum version of python-multipart to >=0.0.7 to fix a vulnerability when using form data with a ReDos attack. You can also simply upgrade python-multipart.

Read more in the advisory: Content-Type Header ReDoS.

Features

Refactors

  • ✅ Refactor tests for duplicate operation ID generation for compatibility with other tools running the FastAPI test suite. PR #10876 by @​emmettbutler.
  • ♻️ Simplify string format with f-strings in fastapi/utils.py. PR #10576 by @​eukub.
  • 🔧 Fix Ruff configuration unintentionally enabling and re-disabling mccabe complexity check. PR #10893 by @​jiridanek.
  • ✅ Re-enable test in tests/test_tutorial/test_header_params/test_tutorial003.py after fix in Starlette. PR #10904 by @​ooknimm.

Docs

Translations

  • 🌐 Add Spanish translation for docs/es/docs/external-links.md. PR #10933 by @​pablocm83.
  • 🌐 Update Korean translation for docs/ko/docs/tutorial/first-steps.md, docs/ko/docs/tutorial/index.md, docs/ko/docs/tutorial/path-params.md, and docs/ko/docs/tutorial/query-params.md. PR #4218 by @​SnowSuno.

... (truncated)

Commits

Updates hnswlib from 0.7.0 to 0.8.0

Release notes

Sourced from hnswlib's releases.

v0.8.0

Highlights:

  • Multi-vector document search and epsilon search (for now, only in C++)
  • By default, there is no statistic aggregation, which speeds up the multi-threaded search (it does not seem like people are using it anyway: [Issue #495](nmslib/hnswlib#495)).
  • Various bugfixes and improvements
  • get_items now have return_type parameter, which can be either 'numpy' or 'list'

Huge thanks to the contributors:

  1. Dmitry Yashunin (dyashuni) - Led the addition of a custom stop condition, multivector and epsilon search functionalities, and various code refinements and bug fixes.
  2. Alexander Vieth (alxvth) - Contributed to resolving global linkage issues and improving Mac setup in the CI environment.
  3. Taras Tsugrii (ttsugriy) - Focused on fixing build warnings, enhancing bruteforce removePoint functionality, and improving memory management.
  4. aurora327 - Implemented more efficient AVX512 instruction sets in functions.
  5. Étienne Mollier (emollier) - added a cap on the 'M' parameter and a typo.
  6. Johan Rade (jrade) - Addressed a linking error when compiling with Visual Studio.
  7. James Melville (jlmelville) - Addressed reordering warning, sign mismatch in loops, and standardized error handling using macros (#508 has the details)
  8. stephematician - Resolved initialization order warning in GNU compilers.
  9. moritz-h - Added CMake install targets and set CMake version range.
  10. drons - Implemented functions for precise memory footprint control and fixed memory leak issues.
  11. Atsushi Tatsuma (yoshoku) - Added a missing virtual destructor to BaseFilterFunctor.
Commits

Updates jinja2 from 3.1.2 to 3.1.3

Release notes

Sourced from jinja2's releases.

3.1.3

This is a fix release for the 3.1.x feature branch.

Changelog

Sourced from jinja2's changelog.

Version 3.1.3

Released 2024-01-10

  • Fix compiler error when checking if required blocks in parent templates are empty. :pr:1858
  • xmlattr filter does not allow keys with spaces. GHSA-h5c8-rqwp-cp95
  • Make error messages stemming from invalid nesting of {% trans %} blocks more helpful. :pr:1918
Commits

Updates pyarrow from 12.0.1 to 14.0.1

Commits

Updates starlette from 0.27.0 to 0.35.1

Release notes

Sourced from starlette's releases.

Version 0.35.1

Fixed

  • Stop using the deprecated "method" parameter in FileResponse inside of StaticFiles #2406.
  • Make typing-extensions optional again #2409.

Full Changelog: encode/starlette@0.35.0...0.35.1

Version 0.35.0

Added

  • Add *args to Middleware and improve its type hints #2381.

Fixed

  • Use Iterable instead Iterator on iterate_in_threadpool #2362.

Changes

  • Handle root_path to keep compatibility with mounted ASGI applications and WSGI #2400.
  • Turn scope["client"] to None on TestClient #2377.

Full Changelog: encode/starlette@0.34.0...0.35.0

Version 0.34.0

Added

  • Use ParamSpec for run_in_threadpool #2375.
  • Add UploadFile.__repr__ #2360.

Fixed

  • Merge URLs properly on TestClient #2376.
  • Take weak ETags in consideration on StaticFiles #2334.

Deprecated

  • Deprecate FileResponse(method=...) parameter #2366.

Full Changelog: encode/starlette@0.33.0...0.34.0

Version 0.33.0

Added

... (truncated)

Changelog

Sourced from starlette's changelog.

0.35.1

January 11, 2024

Fixed

  • Stop using the deprecated "method" parameter in FileResponse inside of StaticFiles #2406.
  • Make typing-extensions optional again #2409.

0.35.0

January 11, 2024

Added

  • Add *args to Middleware and improve its type hints #2381.

Fixed

  • Use Iterable instead Iterator on iterate_in_threadpool #2362.

Changes

  • Handle root_path to keep compatibility with mounted ASGI applications and WSGI #2400.
  • Turn scope["client"] to None on TestClient #2377.

0.34.0

December 16, 2023

Added

  • Use ParamSpec for run_in_threadpool #2375.
  • Add UploadFile.__repr__ #2360.

Fixed

  • Merge URLs properly on TestClient #2376.
  • Take weak ETags in consideration on StaticFiles #2334.

Deprecated

  • Deprecate FileResponse(method=...) parameter #2366.

0.33.0

December 1, 2023

Added

... (truncated)

Commits

Updates urllib3 from 2.0.3 to 2.0.7

Release notes

Sourced from urllib3's releases.

2.0.7

  • Made body stripped from HTTP requests changing the request method to GET after HTTP 303 "See Other" redirect responses. (GHSA-g4mx-q9vg-27p4)

2.0.6

  • Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect. (GHSA-v845-jxx5-vc9f)

2.0.5

  • Allowed pyOpenSSL third-party module without any deprecation warning. #3126
  • Fixed default blocksize of HTTPConnection classes to match high-level classes. Previously was 8KiB, now 16KiB. #3066

2.0.4

  • Added support for union operators to HTTPHeaderDict (#2254)
  • Added BaseHTTPResponse to urllib3.__all__ (#3078)
  • Fixed urllib3.connection.HTTPConnection to raise the http.client.connect audit event to have the same behavior as the standard library HTTP client (#2757)
  • Relied on the standard library for checking hostnames in supported PyPy releases (#3087)
Changelog

Sourced from urllib3's changelog.

2.0.7 (2023-10-17)

  • Made body stripped from HTTP requests changing the request method to GET after HTTP 303 "See Other" redirect responses.

2.0.6 (2023-10-02)

  • Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.

2.0.5 (2023-09-20)

  • Allowed pyOpenSSL third-party module without any deprecation warning. ([#3126](https://github.com/urllib3/urllib3/issues/3126) <https://github.com/urllib3/urllib3/issues/3126>__)
  • Fixed default blocksize of HTTPConnection classes to match high-level classes. Previously was 8KiB, now 16KiB. ([#3066](https://github.com/urllib3/urllib3/issues/3066) <https://github.com/urllib3/urllib3/issues/3066>__)

2.0.4 (2023-07-19)

  • Added support for union operators to HTTPHeaderDict ([#2254](https://github.com/urllib3/urllib3/issues/2254) <https://github.com/urllib3/urllib3/issues/2254>__)
  • Added BaseHTTPResponse to urllib3.__all__ ([#3078](https://github.com/urllib3/urllib3/issues/3078) <https://github.com/urllib3/urllib3/issues/3078>__)
  • Fixed urllib3.connection.HTTPConnection to raise the http.client.connect audit event to have the same behavior as the standard library HTTP client ([#2757](https://github.com/urllib3/urllib3/issues/2757) <https://github.com/urllib3/urllib3/issues/2757>__)
  • Relied on the standard library for checking hostnames in supported PyPy releases ([#3087](https://github.com/urllib3/urllib3/issues/3087) <https://github.com/urllib3/urllib3/issues/3087>__)
Commits
  • 56f01e0 Relea...

    Description has been truncated

@dependabot
⬆ Bump the pip group group with 10 updates
aec07f7 
Bumps the pip group group with 10 updates:

| Package | From | To |
| --- | --- | --- |
| [black](https://github.com/psf/black) | `23.3.0` | `24.3.0` |
| [pillow](https://github.com/python-pillow/Pillow) | `9.5.0` | `10.2.0` |
| [aiohttp](https://github.com/aio-libs/aiohttp) | `3.8.4` | `3.9.2` |
| [certifi](https://github.com/certifi/python-certifi) | `2023.5.7` | `2023.7.22` |
| [fastapi](https://github.com/tiangolo/fastapi) | `0.97.0` | `0.109.1` |
| [hnswlib](https://github.com/yurymalkov/hnsw) | `0.7.0` | `0.8.0` |
| [jinja2](https://github.com/pallets/jinja) | `3.1.2` | `3.1.3` |
| [pyarrow](https://github.com/apache/arrow) | `12.0.1` | `14.0.1` |
| [starlette](https://github.com/encode/starlette) | `0.27.0` | `0.35.1` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.0.3` | `2.0.7` |


Updates `black` from 23.3.0 to 24.3.0
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@23.3.0...24.3.0)

Updates `pillow` from 9.5.0 to 10.2.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@9.5.0...10.2.0)

Updates `aiohttp` from 3.8.4 to 3.9.2
- [Release notes](https://github.com/aio-libs/aiohttp/releases)
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.8.4...v3.9.2)

Updates `certifi` from 2023.5.7 to 2023.7.22
- [Commits](certifi/python-certifi@2023.05.07...2023.07.22)

Updates `fastapi` from 0.97.0 to 0.109.1
- [Release notes](https://github.com/tiangolo/fastapi/releases)
- [Commits](fastapi/fastapi@0.97.0...0.109.1)

Updates `hnswlib` from 0.7.0 to 0.8.0
- [Release notes](https://github.com/yurymalkov/hnsw/releases)
- [Commits](nmslib/hnswlib@v0.7.0...v0.8.0)

Updates `jinja2` from 3.1.2 to 3.1.3
- [Release notes](https://github.com/pallets/jinja/releases)
- [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst)
- [Commits](pallets/jinja@3.1.2...3.1.3)

Updates `pyarrow` from 12.0.1 to 14.0.1
- [Commits](apache/arrow@r-12.0.1...go/v14.0.1)

Updates `starlette` from 0.27.0 to 0.35.1
- [Release notes](https://github.com/encode/starlette/releases)
- [Changelog](https://github.com/encode/starlette/blob/master/docs/release-notes.md)
- [Commits](encode/starlette@0.27.0...0.35.1)

Updates `urllib3` from 2.0.3 to 2.0.7
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.0.3...2.0.7)

---
updated-dependencies:
- dependency-name: black
  dependency-type: direct:development
  dependency-group: pip-security-group
- dependency-name: pillow
  dependency-type: direct:development
  dependency-group: pip-security-group
- dependency-name: aiohttp
  dependency-type: indirect
  dependency-group: pip-security-group
- dependency-name: certifi
  dependency-type: indirect
  dependency-group: pip-security-group
- dependency-name: fastapi
  dependency-type: indirect
  dependency-group: pip-security-group
- dependency-name: hnswlib
  dependency-type: indirect
  dependency-group: pip-security-group
- dependency-name: jinja2
  dependency-type: indirect
  dependency-group: pip-security-group
- dependency-name: pyarrow
  dependency-type: indirect
  dependency-group: pip-security-group
- dependency-name: starlette
  dependency-type: indirect
  dependency-group: pip-security-group
- dependency-name: urllib3
  dependency-type: indirect
  dependency-group: pip-security-group
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Mar 20, 2024
This was referenced Mar 20, 2024
Closed
Closed
Closed
Closed
@dependabot Dependabot
Copy link
Author

dependabot bot commented on behalf of github Apr 3, 2024

Superseded by #203.

@dependabot dependabot bot closed this Apr 3, 2024
@dependabot dependabot bot deleted the dependabot/pip/pip-security-group-dbd13f364c branch April 3, 2024 21:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants