Bump the python-packages group with 5 updates #507

dependabot · 2024-09-02T04:17:25Z

Bumps the python-packages group with 5 updates:

Package	From	To
certifi	`2024.7.4`	`2024.8.30`
starlette	`0.38.2`	`0.38.4`
watchfiles	`0.23.0`	`0.24.0`
websockets	`13.0`	`13.0.1`
zipp	`3.20.0`	`3.20.1`

Updates certifi from 2024.7.4 to 2024.8.30

Commits

325c2fd 2024.08.30 (#304)
d66bf5f Bump actions/upload-artifact from 4.3.5 to 4.3.6 (#302)
2150f23 Bump actions/upload-artifact from 4.3.4 to 4.3.5 (#301)
fc9b771 Bump actions/setup-python from 5.1.0 to 5.1.1 (#300)
965b239 Bump actions/download-artifact from 4.1.7 to 4.1.8 (#297)
c1f50cc Bump actions/upload-artifact from 4.3.3 to 4.3.4 (#296)
See full diff in compare view

Updates starlette from 0.38.2 to 0.38.4

Release notes

Sourced from starlette's releases.

Version 0.38.4

Fixed

Ensure accurate root_path removal in get_route_path function #2600

Full Changelog: encode/starlette@0.38.3...0.38.4

Version 0.38.3

Added

Support for Python 3.13 #2662.

Fixed

Don't poll for disconnects in BaseHTTPMiddleware via StreamingResponse #2620.

Full Changelog: encode/starlette@0.38.2...0.38.3

Changelog

Sourced from starlette's changelog.

0.38.4 (September 1, 2024)

Fixed

Ensure accurate root_path removal in get_route_path function #2600.

0.38.3 (September 1, 2024)

Added

Support for Python 3.13 #2662.

Fixed

Don't poll for disconnects in BaseHTTPMiddleware via StreamingResponse #2620.

Commits

831418a Version 0.38.4 (#2681)
1131b3c Ensure accurate root_path removal in get_route_path function (#2600)
1eb4036 Change documentation layout (#2680)
b9db010 Set line-length to 120 on Ruff (#2679)
72c2334 Version 0.38.3 (#2678)
d771bb7 Don't poll for disconnects in BaseHTTPMiddleware via StreamingResponse (#2620)
c78c9aa Fix typo in README.md (#2666)
3c7de99 Fix typo in docs/index.md (#2665)
55cbba9 Support Python 3.13 (#2662)
e46165a Add tests to test_responses (#2656)
Additional commits viewable in compare view

Updates watchfiles from 0.23.0 to 0.24.0

Release notes

Sourced from watchfiles's releases.

v0.24.0 2024-08-28

What's Changed

drop PyPy 3.8 by @samuelcolvin in samuelcolvin/watchfiles#293

Update Python version in index.md by @kjaymiller in samuelcolvin/watchfiles#296

return "file deleted" instead of raising an exception, fix samuelcolvin/watchfiles#282 by @samuelcolvin in samuelcolvin/watchfiles#301

New Contributors

@kjaymiller made their first contribution in samuelcolvin/watchfiles#296

Full Changelog: samuelcolvin/watchfiles@v0.23.0...v0.24.0

Commits

6e3c2c8 return "file deleted" instead of raising an exception (#301)
4314094 Update Python version in index.md (#296)
e7ecc00 drop PyPy 3.8 (#293)
See full diff in compare view

Updates websockets from 13.0 to 13.0.1

Release notes

Sourced from websockets's releases.

13.0.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

Commits

157f790 Add provenance attestations.
62d70f4 Restore speedups.c in source distribution.
16456e2 Restore id-token permission.
ed2f21e Attempt to fix automatic creation of GitHub release.
See full diff in compare view

Updates zipp from 3.20.0 to 3.20.1

Changelog

Sourced from zipp's changelog.

v3.20.1

Bugfixes

python/cpython#123270

Commits

c23e549 Finalize
c2b9015 Merge pull request #124 from jaraco/bugfix/gh-123270-supported-names
774a3ac Add TODO to consolidate this behavior in CPython.
cc61e61 Prefer simpler path.rstrip to consolidate checks for empty or only paths.
bec712f Mark unused code as uncovered.
fde82dc Add news fragment.
a421f7e Invent DirtyZipInfo to create an unsanitized zipfile with backslashes.
0a3a7b4 Refine expectation that paths with leading slashes are simply not visible.
f89b93f Address infinite loop when zipfile begins with more than one leading slash.
3cb5609 Removed SanitizedNames.
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

github-actions · 2024-09-02T04:17:42Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
❌ 1 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
✅ 0 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 5c169a4.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

poetry.lock

Package	Version	License	Issue Type
starlette	0.38.4	BSD-2-Clause AND BSD-3-Clause	Incompatible License

Allowed Licenses: 0BSD, AGPL-3.0-or-later, Apache-2.0, BlueOak-1.0.0, BSD-2-Clause, BSD-3-Clause-Clear, BSD-3-Clause, BSL-1.0, CAL-1.0, CC-BY-3.0, CC-BY-4.0, CC-BY-SA-4.0, CC0-1.0, EPL-2.0, GPL-2.0-only, GPL-2.0-or-later, GPL-2.0, GPL-3.0-or-later, ISC, LGPL-2.0-only, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-2.1, LGPL-3.0-only, LGPL-3.0, MIT, MPL-2.0, OFL-1.1, PSF-2.0, Python-2.0, Python-2.0.1, Unicode-DFS-2016, Unlicense

OpenSSF Scorecard

Package

Version

Score

Details

pip/certifi

2024.8.30

🟢 7

Details

Check	Score	Reason
Code-Review	🟢 3	Found 1/3 approved changesets -- score normalized to 3
Maintained	🟢 10	15 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Branch-Protection	🟢 3	branch protection is not maximal on development and all release branches
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Packaging	🟢 10	packaging workflow detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

pip/starlette

0.38.4

🟢 6.1

Details

Check	Score	Reason
Code-Review	🟢 6	Found 17/27 approved changesets -- score normalized to 6
Maintained	🟢 10	28 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Security-Policy	🟢 10	security policy file detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

pip/watchfiles

0.24.0

🟢 5.2

Details

Check	Score	Reason
Code-Review	🟢 4	Found 11/26 approved changesets -- score normalized to 4
Maintained	🟢 10	14 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Security-Policy	⚠️ 0	security policy file not detected
Fuzzing	⚠️ 0	project is not fuzzed
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

pip/websockets

13.0.1

🟢 5.9

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/17 approved changesets -- score normalized to 0
Maintained	🟢 10	30 commit(s) and 27 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Security-Policy	🟢 10	security policy file detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	🟢 10	project is fuzzed
Packaging	🟢 10	packaging workflow detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

pip/zipp

3.20.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/20 approved changesets -- score normalized to 0
Maintained	🟢 10	30 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 10	license file detected
Signed-Releases	⚠️ -1	no releases found
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Security-Policy	🟢 10	security policy file detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Binary-Artifacts	🟢 10	no binaries found in the repo
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Fuzzing	🟢 10	project is fuzzed
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

Scanned Manifest Files

poetry.lock

Bumps the python-packages group with 5 updates: | Package | From | To | | --- | --- | --- | | [certifi](https://github.com/certifi/python-certifi) | `2024.7.4` | `2024.8.30` | | [starlette](https://github.com/encode/starlette) | `0.38.2` | `0.38.4` | | [watchfiles](https://github.com/samuelcolvin/watchfiles) | `0.23.0` | `0.24.0` | | [websockets](https://github.com/python-websockets/websockets) | `13.0` | `13.0.1` | | [zipp](https://github.com/jaraco/zipp) | `3.20.0` | `3.20.1` | Updates `certifi` from 2024.7.4 to 2024.8.30 - [Commits](certifi/python-certifi@2024.07.04...2024.08.30) Updates `starlette` from 0.38.2 to 0.38.4 - [Release notes](https://github.com/encode/starlette/releases) - [Changelog](https://github.com/encode/starlette/blob/master/docs/release-notes.md) - [Commits](encode/starlette@0.38.2...0.38.4) Updates `watchfiles` from 0.23.0 to 0.24.0 - [Release notes](https://github.com/samuelcolvin/watchfiles/releases) - [Commits](samuelcolvin/watchfiles@v0.23.0...v0.24.0) Updates `websockets` from 13.0 to 13.0.1 - [Release notes](https://github.com/python-websockets/websockets/releases) - [Commits](python-websockets/websockets@13.0...13.0.1) Updates `zipp` from 3.20.0 to 3.20.1 - [Release notes](https://github.com/jaraco/zipp/releases) - [Changelog](https://github.com/jaraco/zipp/blob/main/NEWS.rst) - [Commits](jaraco/zipp@v3.20.0...v3.20.1) --- updated-dependencies: - dependency-name: certifi dependency-type: indirect update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: starlette dependency-type: indirect update-type: version-update:semver-patch dependency-group: python-packages - dependency-name: watchfiles dependency-type: indirect update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: websockets dependency-type: indirect update-type: version-update:semver-patch dependency-group: python-packages - dependency-name: zipp dependency-type: indirect update-type: version-update:semver-patch dependency-group: python-packages ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot requested review from a team as code owners September 2, 2024 04:17

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Sep 2, 2024

greenbonebot enabled auto-merge (rebase) September 2, 2024 04:17

dependabot bot temporarily deployed to github-pages September 2, 2024 04:18 Inactive

y0urself force-pushed the dependabot/pip/python-packages-68b1cf7ab5 branch from 7d74e9d to 5c169a4 Compare September 6, 2024 12:39

y0urself approved these changes Sep 6, 2024

View reviewed changes

y0urself temporarily deployed to github-pages September 6, 2024 12:39 — with GitHub Actions Inactive

greenbonebot merged commit 36e739c into main Sep 6, 2024
2 of 3 checks passed

greenbonebot deleted the dependabot/pip/python-packages-68b1cf7ab5 branch September 6, 2024 12:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the python-packages group with 5 updates #507

Bump the python-packages group with 5 updates #507

dependabot bot commented on behalf of github Sep 2, 2024

github-actions bot commented Sep 2, 2024 •

edited

Loading

Bump the python-packages group with 5 updates #507

Bump the python-packages group with 5 updates #507

Conversation

dependabot bot commented on behalf of github Sep 2, 2024

Version 0.38.4

Fixed

Version 0.38.3

Added

Fixed

0.38.4 (September 1, 2024)

Fixed

0.38.3 (September 1, 2024)

Added

Fixed

v0.24.0 2024-08-28

What's Changed

New Contributors

13.0.1

v3.20.1

Bugfixes

github-actions bot commented Sep 2, 2024 • edited Loading

Dependency Review

Snapshot Warnings

License Issues

poetry.lock

OpenSSF Scorecard

Scanned Manifest Files

github-actions bot commented Sep 2, 2024 •

edited

Loading