chore(deps)(deps): bump the pip group across 1 directory with 13 updates #32

dependabot · 2025-10-13T13:29:59Z

Bumps the pip group with 13 updates in the / directory:

Package	From	To
certifi	`2024.2.2`	`2024.7.4`
django	`5.0.4`	`5.1.13`
djangorestframework	`3.14.0`	`3.15.2`
idna	`3.6`	`3.7`
protobuf	`4.25.3`	`4.25.8`
requests	`2.31.0`	`2.32.4`
sqlparse	`0.4.4`	`0.5.0`
strawberry-graphql	`0.225.1`	`0.257.0`
urllib3	`2.2.1`	`2.5.0`
zipp	`3.18.1`	`3.19.1`
black	`24.2.0`	`24.3.0`
deepdiff	`6.7.1`	`8.6.1`
djangorestframework-simplejwt	`5.3.1`	`5.5.1`

Updates certifi from 2024.2.2 to 2024.7.4

Commits

bd81538 2024.07.04 (#295)
06a2cbf Bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (#294)
13bba02 Bump actions/checkout from 4.1.6 to 4.1.7 (#293)
e8abcd0 Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (#292)
124f4ad 2024.06.02 (#291)
c2196ce --- (#290)
fefdeec Bump actions/checkout from 4.1.4 to 4.1.5 (#289)
3c5fb15 Bump actions/download-artifact from 4.1.6 to 4.1.7 (#286)
4a9569a Bump actions/checkout from 4.1.2 to 4.1.4 (#287)
1fc8086 Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (#288)
Additional commits viewable in compare view

Updates django from 5.0.4 to 5.1.13

Commits

467aeeb [5.1.x] Bumped version for 5.1.13 release.
74fa85c [5.1.x] Fixed CVE-2025-59682 -- Fixed potential partial directory-traversal v...
01d2d77 [5.1.x] Fixed CVE-2025-59681 -- Protected QuerySet.annotate(), alias(), aggre...
cbe5042 [5.1.x] Added stub release notes and release date for 5.1.13 and 4.2.25.
27e230f [5.1.x] Added missing backticks in docs/releases/security.txt.
26fc643 [5.1.x] Added CVE-2025-57833 to security archive.
dc002e5 [5.1.x] Post-release version bump.
f71d9c3 [5.1.x] Bumped version for 5.1.12 release.
102965e [5.1.x] Fixed CVE-2025-57833 -- Protected FilteredRelation against SQL inject...
44cd014 [5.1.x] Added stub release notes and release date for 5.1.12 and 4.2.24.
Additional commits viewable in compare view

Updates djangorestframework from 3.14.0 to 3.15.2

Release notes

Sourced from djangorestframework's releases.

3.15.2

What's Changed

Add @api_view example to caching documentation by @BradWells in encode/django-rest-framework#9131

Update docstring by @jthevos in encode/django-rest-framework#9340

Apply black formatting to caching markdown by @jthevos in encode/django-rest-framework#9341

Update renderers documentation example by @mgaligniana in encode/django-rest-framework#9362

Removing live examples of tutorial code that are no longer hosted by @TGoddessana in encode/django-rest-framework#9363

Docs: Remove an unnecessary step from quickstart.md by @gogowitsch in encode/django-rest-framework#9387

Documentation: Add Python 3.12 to the requirements by @Szaroslav in encode/django-rest-framework#9382

Tweak README.md links. by @tomchristie in encode/django-rest-framework#9375

Revert "Ensure CursorPagination respects nulls in the ordering field" by @max-muoto in encode/django-rest-framework#9381

use warnings rather than logging a warning for DecimalField warnings by @terencehonles in encode/django-rest-framework#9367

20240426 docs by @peterthomassen in encode/django-rest-framework#9392

Cleanup by @peterthomassen in encode/django-rest-framework#9393

tests: Check urlpatterns after cleanups by @stanislavlevin in encode/django-rest-framework#9400

docs: Correct some evaluation results and a httpie option in Tutorial1 by @wkwkhautbois in encode/django-rest-framework#9421

Add __hash__ method for permissions.OperandHolder class by @vanya909 in encode/django-rest-framework#9417

Fix potential XSS vulnerability in break_long_headers template filter by @ch4n3-yoon in encode/django-rest-framework#9435

Version 3.15.2. by @tomchristie in encode/django-rest-framework#9439

New Contributors

@BradWells made their first contribution in encode/django-rest-framework#9131

@jthevos made their first contribution in encode/django-rest-framework#9340

@gogowitsch made their first contribution in encode/django-rest-framework#9387

@Szaroslav made their first contribution in encode/django-rest-framework#9382

@wkwkhautbois made their first contribution in encode/django-rest-framework#9421

@ch4n3-yoon made their first contribution in encode/django-rest-framework#9435

Full Changelog: encode/django-rest-framework@3.15.1...3.15.2

Version 3.15.1

What's Changed

Update the message to be consistent with the Django `HttpResponseBa… by @maycuatroi in encode/django-rest-framework#9287

Make inflection package truly optional by @browniebroke in encode/django-rest-framework#9303

Fix broken links in release notes for 3.15 by @browniebroke in encode/django-rest-framework#9305

TokenAdmin.autocomplete_fields Breaks Some Use Cases, Revert by @alexdlaird in encode/django-rest-framework#9301

Add drf-sendables to third-party-packages.md by @amikrop in encode/django-rest-framework#9261

Revert "feat: Add some changes to ValidationError to support django style vad…" by @auvipy in encode/django-rest-framework#9326

Revert "Re-prefetch related objects after updating" by @auvipy in encode/django-rest-framework#9327

Revert #8863 by @tomchristie in encode/django-rest-framework#9330

Revert #8009 by @tomchristie in encode/django-rest-framework#9332

Revert #9030 by @tomchristie in encode/django-rest-framework#9333

Revert "Fix NamespaceVersioning ignoring DEFAULT_VERSION on non-None namespaces" by @auvipy in encode/django-rest-framework#9335

SearchFilter.get_search_terms returns list. by @tomchristie in encode/django-rest-framework#9338

Version 3.15.1 by @tomchristie in encode/django-rest-framework#9339

New Contributors

@maycuatroi made their first contribution in encode/django-rest-framework#9287

@alexdlaird made their first contribution in encode/django-rest-framework#9301

... (truncated)

Commits

c7a7eae Version 3.15.2 (#9439)
3b41f01 Fix potential XSS vulnerability in break_long_headers template filter (#9435)
fe92f0d Add __hash__ method for permissions.OperandHolder class (#9417)
fbdab09 docs: Correct some evaluation results and a httpie option in Tutorial1 (#9421)
36d5c0e tests: Check urlpatterns after cleanups (#9400)
9d4ed05 Don't use Windows line endings
b34bde4 Fix typo in setup.cfg setting
ab681f2 Update requirements in docs
2237724 bump pygments (security hygiene)
d58b8da Update deprecation hints
Additional commits viewable in compare view

Updates idna from 3.6 to 3.7

Release notes

Sourced from idna's releases.

v3.7

What's Changed

Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

Full Changelog: kjd/idna@v3.6...v3.7

Changelog

Sourced from idna's changelog.

3.7 (2024-04-11) ++++++++++++++++

Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

Commits

1d365e1 Release v3.7
c1b3154 Merge pull request #172 from kjd/optimize-contextj
0394ec7 Merge branch 'master' into optimize-contextj
cd58a23 Merge pull request #152 from elliotwutingfeng/dev
5beb28b More efficient resolution of joiner contexts
1b12148 Update ossf/scorecard-action to v2.3.1
d516b87 Update Github actions/checkout to v4
c095c75 Merge branch 'master' into dev
60a0a4c Fix typo in GitHub Actions workflow key
5918a0e Merge branch 'master' into dev
Additional commits viewable in compare view

Updates protobuf from 4.25.3 to 4.25.8

Commits

a4cbdd3 Updating version.json and repo version numbers to: 25.8
29445be Merge pull request #21880 from shaod2/py-25
cc13b69 Remove debugging code and add EOLs
d31100c Manually backport recursion limit enforcement to 25.x
88a3b90 Change pre-22 poison pill to only log once per affected message type. (#21754)
320eafa Weaken vulnerable gencode poison pills to warning by default.
f584fe3 Merge branch 'protocolbuffers:25.x' into 25.x
c710036 Update test_upb.yml to use ubuntu-22
9721758 Fix missing trailing newline.
cca7b28 Update test_upb.yml to use ubuntu-22
Additional commits viewable in compare view

Updates requests from 2.31.0 to 2.32.4

Release notes

Sourced from requests's releases.

v2.32.4

2.32.4 (2025-06-10)

Security

CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file. (#6965)

Improvements

Numerous documentation improvements

Deprecations

Added support for pypy 3.11 for Linux and macOS. (#6926)

Dropped support for pypy 3.9 following its end of support. (#6926)

v2.32.3

2.32.3 (2024-05-29)

Bugfixes

Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of HTTPAdapter. (#6716)

Fixed issue where Requests started failing to run on Python versions compiled without the ssl module. (#6724)

v2.32.2

2.32.2 (2024-05-21)

Deprecations

To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

v2.32.1

2.32.1 (2024-05-20)

Bugfixes

Add missing test certs to the sdist distributed on PyPI.

v2.32.0

2.32.0 (2024-05-20)

... (truncated)

Changelog

Sourced from requests's changelog.

2.32.4 (2025-06-10)

Security

CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file.

Improvements

Numerous documentation improvements

Deprecations

Added support for pypy 3.11 for Linux and macOS.

Dropped support for pypy 3.9 following its end of support.

2.32.3 (2024-05-29)

Bugfixes

Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of HTTPAdapter. (#6716)

Fixed issue where Requests started failing to run on Python versions compiled without the ssl module. (#6724)

2.32.2 (2024-05-21)

Deprecations

To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

2.32.1 (2024-05-20)

Bugfixes

Add missing test certs to the sdist distributed on PyPI.

2.32.0 (2024-05-20)

Security

... (truncated)

Commits

021dc72 Polish up release tooling for last manual release
821770e Bump version and add release notes for v2.32.4
59f8aa2 Add netrc file search information to authentication documentation (#6876)
5b4b64c Add more tests to prevent regression of CVE 2024 47081
7bc4587 Add new test to check netrc auth leak (#6962)
96ba401 Only use hostname to do netrc lookup instead of netloc
7341690 Merge pull request #6951 from tswast/patch-1
6716d7c remove links
a7e1c74 Update docs/conf.py
c799b81 docs: fix dead links to kenreitz.org
Additional commits viewable in compare view

Updates sqlparse from 0.4.4 to 0.5.0

Changelog

Sourced from sqlparse's changelog.

Release 0.5.0 (Apr 13, 2024)

Notable Changes

Drop support for Python 3.5, 3.6, and 3.7.

Python 3.12 is now supported (pr725, by hugovk).

IMPORTANT: Fixes a potential denial of service attack (DOS) due to recursion error for deeply nested statements. Instead of recursion error a generic SQLParseError is raised. See the security advisory for details: GHSA-2m57-hf25-phgg The vulnerability was discovered by @uriyay-jfrog. Thanks for reporting!

Enhancements

Splitting statements now allows to remove the semicolon at the end. Some database backends love statements without semicolon (issue742).

Support TypedLiterals in get_parameters (pr749, by Khrol).

Improve splitting of Transact SQL when using GO keyword (issue762).

Support for some JSON operators (issue682).

Improve formatting of statements containing JSON operators (issue542).

Support for BigQuery and Snowflake keywords (pr699, by griffatrasgo).

Support parsing of OVER clause (issue701, pr768 by r33s3n6).

Bug Fixes

Ignore dunder attributes when creating Tokens (issue672).

Allow operators to precede dollar-quoted strings (issue763).

Fix parsing of nested order clauses (issue745, pr746 by john-bodley).

Thread-safe initialization of Lexer class (issue730).

Classify TRUNCATE as DDL and GRANT/REVOKE as DCL keywords (based on pr719 by josuc1, thanks for bringing this up!).

Fix parsing of PRIMARY KEY (issue740).

Other

Optimize performance of matching function (pr799, by admachainz).

Commits

ddbd0ec Bump version.
29f2e0a Raise recursion limit for tests.
b4a39d9 Raise SQLParseError instead of RecursionError.
f1bcf2f Update AUHTORS and Changelog.
e03b74e Fix Function.get_parameters(), add Funtion.get_window()
617b8f6 Add OVER clause, and group it into Function (fixes #701)
d8f8147 Update AUHTORS and Changelog.
012c9f1 Optimize sqlparse.utils.imt().
46971e5 Fix parsing of PRIMARY KEY (fixes #740).
fc4b0be Code cleanup.
Additional commits viewable in compare view

Updates strawberry-graphql from 0.225.1 to 0.257.0

Release notes

Sourced from strawberry-graphql's releases.

🍓 0.257.0

The common node: Node used to resolve relay nodes means we will be relying on is_type_of to check if the returned object is in fact a subclass of the Node interface.

However, integrations such as Django, SQLAlchemy and Pydantic will not return the type itself, but instead an alike object that is later resolved to the expected type.

In case there are more than one possible type defined for that model that is being returned, the first one that replies True to is_type_of check would be used in the resolution, meaning that when asking for "PublicUser:123", strawberry could end up returning "User:123", which can lead to security issues (such as data leakage).

In here we are introducing a new strawberry.cast, which will be used to mark an object with the already known type by us, and when asking for is_type_of that mark will be used to check instead, ensuring we will return the correct type.

That cast is already in place for the relay node resolution and pydantic.

Releases contributed by @bellini666 via #3749

🍓 0.256.1

This release updates Strawberry internally to no longer pass keywords arguments to pathlib.PurePath. Support for supplying keyword arguments to pathlib.PurePath is deprecated and scheduled for removal in Python 3.14

Releases contributed by @DoctorJohn via #3738

🍓 0.256.0

This release drops support for Python 3.8, which reached its end-of-life (EOL) in October 2024. The minimum supported Python version is now 3.9.

We strongly recommend upgrading to Python 3.9 or a newer version, as older versions are no longer maintained and may contain security vulnerabilities.

Releases contributed by @bellini666 via #3730

🍓 0.255.0

This release adds support for making Relay connection optional, this is useful when you want to add permission classes to the connection and not fail the whole query if the user doesn't have permission to access the connection.

Example:
import strawberry
from strawberry import relay
from strawberry.permission import BasePermission
</tr></table> 

... (truncated)

Changelog

Sourced from strawberry-graphql's changelog.

0.257.0 - 2025-01-09

The common node: Node used to resolve relay nodes means we will be relying on is_type_of to check if the returned object is in fact a subclass of the Node interface.

However, integrations such as Django, SQLAlchemy and Pydantic will not return the type itself, but instead an alike object that is later resolved to the expected type.

In case there are more than one possible type defined for that model that is being returned, the first one that replies True to is_type_of check would be used in the resolution, meaning that when asking for "PublicUser:123", strawberry could end up returning "User:123", which can lead to security issues (such as data leakage).

In here we are introducing a new strawberry.cast, which will be used to mark an object with the already known type by us, and when asking for is_type_of that mark will be used to check instead, ensuring we will return the correct type.

That cast is already in place for the relay node resolution and pydantic.

Contributed by Thiago Bellini Ribeiro via [PR #3749](strawberry-graphql/strawberry#3749)

0.256.1 - 2024-12-23

This release updates Strawberry internally to no longer pass keywords arguments to pathlib.PurePath. Support for supplying keyword arguments to pathlib.PurePath is deprecated and scheduled for removal in Python 3.14

Contributed by Jonathan Ehwald via [PR #3738](strawberry-graphql/strawberry#3738)

0.256.0 - 2024-12-21

This release drops support for Python 3.8, which reached its end-of-life (EOL) in October 2024. The minimum supported Python version is now 3.9.

We strongly recommend upgrading to Python 3.9 or a newer version, as older versions are no longer maintained and may contain security vulnerabilities.

Contributed by Thiago Bellini Ribeiro via [PR #3730](strawberry-graphql/strawberry#3730)

0.255.0 - 2024-12-20

... (truncated)

Commits

1e0e1ef Release 🍓 0.257.0
526eb82 fix: Prevent a possible security issue when resolving a relay node with multi...
fc854f1 [pre-commit.ci] pre-commit autoupdate (#3748)
bf386fa Typo fix (#3747)
6bc7332 chore(ruff): Enable and fix all ruff rules that we can (#3742)
15044cd Type internal test clients stricter (#3745)
e78f8c6 Remove unused chalice test code (#3739)
85789d5 Clean up python 3.8 leftovers (#3740)
bd29cff [pre-commit.ci] pre-commit autoupdate (#3675)
ddfc084 Fix warnings directly caused by test code (#3737)
Additional commits viewable in compare view

Updates urllib3 from 2.2.1 to 2.5.0

Release notes

Sourced from urllib3's releases.

2.5.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security issues

urllib3 2.5.0 fixes two moderate security issues:

Pool managers now properly control redirects when retries is passed — CVE-2025-50181 reported by @sandumjacob (5.3 Medium, GHSA-pq67-6m6q-mj2v)

Redirects are now controlled by urllib3 in the Node.js runtime — CVE-2025-50182 (5.3 Medium, GHSA-48p4-8xcf-vxj5)

Features

Added support for the compression.zstd module that is new in Python 3.14. See PEP 784 for more information. (#3610)

Added support for version 0.5 of hatch-vcs (#3612)

Bugfixes

Raised exception for HTTPResponse.shutdown on a connection already released to the pool. (#3581)

Fixed incorrect CONNECT statement when using an IPv6 proxy with connection_from_host. Previously would not be wrapped in []. (#3615)

2.4.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Features

Applied PEP 639 by specifying the license fields in pyproject.toml. (#3522)

Updated exceptions to save and restore more properties during the pickle/serialization process. (#3567)

Added verify_flags option to create_urllib3_context with a default of VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT for Python 3.13+. (#3571)

Bugfixes

Fixed a bug with partial reads of streaming data in Emscripten. (#3555)

Misc

Switched to uv for installing development dependecies. (#3550)

Removed the multiple.intoto.jsonl asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. (#3566)

2.3.0

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.5.0 (2025-06-18)

Features

Added support for the compression.zstd module that is new in Python 3.14. See PEP 784 <https://peps.python.org/pep-0784/>_ for more information. ([#3610](https://github.com/urllib3/urllib3/issues/3610) <https://github.com/urllib3/urllib3/issues/3610>__)

Added support for version 0.5 of hatch-vcs ([#3612](https://github.com/urllib3/urllib3/issues/3612) <https://github.com/urllib3/urllib3/issues/3612>__)

Bugfixes

Fixed a security issue where restricting the maximum number of followed redirects at the urllib3.PoolManager level via the retries parameter did not work.

Made the Node.js runtime respect redirect parameters such as retries and redirects.

Raised exception for HTTPResponse.shutdown on a connection already released to the pool. ([#3581](https://github.com/urllib3/urllib3/issues/3581) <https://github.com/urllib3/urllib3/issues/3581>__)

Fixed incorrect CONNECT statement when using an IPv6 proxy with connection_from_host. Previously would not be wrapped in []. ([#3615](https://github.com/urllib3/urllib3/issues/3615) <https://github.com/urllib3/urllib3/issues/3615>__)

2.4.0 (2025-04-10)

Features

Applied PEP 639 by specifying the license fields in pyproject.toml. ([#3522](https://github.com/urllib3/urllib3/issues/3522) <https://github.com/urllib3/urllib3/issues/3522>__)

Updated exceptions to save and restore more properties during the pickle/serialization process. ([#3567](https://github.com/urllib3/urllib3/issues/3567) <https://github.com/urllib3/urllib3/issues/3567>__)

Added verify_flags option to create_urllib3_context with a default of VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT for Python 3.13+. ([#3571](https://github.com/urllib3/urllib3/issues/3571) <https://github.com/urllib3/urllib3/issues/3571>__)

Bugfixes

Fixed a bug with partial reads of streaming data in Emscripten. ([#3555](https://github.com/urllib3/urllib3/issues/3555) <https://github.com/urllib3/urllib3/issues/3555>__)

Misc

Switched to uv for installing development dependecies. ([#3550](https://github.com/urllib3/urllib3/issues/3550) <https://github.com/urllib3/urllib3/issues/3550>__)

Removed the multiple.intoto.jsonl asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. ([#3566](https://github.com/urllib3/urllib3/issues/3566) <https://github.com/urllib3/urllib3/issues/3566>__)

2.3.0 (2024-12-22)

... (truncated)

Commits

aaab4ec Release 2.5.0
7eb4a2a Merge commit from fork
f05b132 Merge commit from fork
d03fe32 Fix HTTP tunneling with IPv6 in older Python versions
11661e9 Bump github/codeql-action from 3.28.0 to 3.29.0 (#3624)
6a0ecc6 Update v2 migration guide to 2.4.0 (#3621)
8e32e60 Raise exception for shutdown on a connection already released to the pool (#3...
9996e0f Fix emscripten CI for Chrome 137+ (#3599)
4fd1a99 Bump RECENT_DATE (#3617)
c4b5917 Add support for the new compression.zstd module in Python 3.14 (#3611)
Additional commits viewable in compare view

Updates zipp from 3.18.1 to 3.19.1

Changelog

Sourced from zipp's changelog.

v3.19.1

Bugfixes

Improved handling of malformed zip files. (#119)

v3.19.0

Features

Implement is_symlink. (#117)

v3.18.2

No significant changes.

Commits

6d1cb72 Finalize
fd604bd Merge pull request #120 from jaraco/bugfix/119-malformed-paths
c18417e Add news fragment.
58115d2 Employ SanitizedNames in CompleteDirs. Fixes broken test.
564fcc1 Add SanitizedNames mixin.
79a309f Add some assertions about malformed paths.
2d015c2 Merge https://github.com/jaraco/skeleton
a595a0f Rename extras to align with core metadata spec.
608f90a Finalize
3a22d72 Merge pull request #118 from jaraco/feature/is-symlink
Additional commits viewable in compare view

Updates black from 24.2.0 to 24.3.0

Release notes

Sourced from black's releases.

24.3.0

Highlights

This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.

This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

Stable style

Don't move comments along with delimiters, which could cause crashes (#4248)

Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)

Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)

Performance

Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)

Documentation

Note what happens when --check is used with --quiet (#4236)

Changelog

Sourced from black's changelog.

24.3.0

Highlights

This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.

This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

Stable style

Don't move comments along with delimiters, which could cause crashes (#4248)

Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)

Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)

Performance

Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)

Documentation

Note what happens when --check is used with --quiet (#4236)

Commits

552baf8 Prepare release 24.3.0 (#4279)
f000936 Fix catastrophic performance in lines_with_leading_tabs_expanded() (#4278)
7b5a657 Fix --line-ranges behavior when ranges are at EOF (#4273)
1abcffc Use regex where we ignore case on windows (#4252)
719e674 Fix 4227: Improve documentation for --quiet --check (#4236)
e5510af update plugin url for Thonny (#4259)
6af7d11 Fix AST safety check false negative (#4270)
f03ee11 Ensure blib2to3.pygram is initialized before use (#4224)
e4bfedb fix: Don't move comments while splitting delimiters (#4248)
d0287e1 Make trailing comma logic more concise (#4202)
Additional commits viewable in compare view

Updates deepdiff from 6.7.1 to 8.6.1

Release notes

Sourced from deepdiff's releases.

8.6.1

DeepDiff 8-6-1

Patched security vulnerability in the Delta class which was vulnerable to class pollution via its constructor, and when combined with a gadget available in DeltaDiff itself, it could lead to Denial of Service and Remote Code Execution (via insecure Pickle deserialization).

8.5.0

Updating deprecated pydantic calls

Switching to pyproject.toml

Fix for moving nested tables when using iterable_compare_func. by

Fix recursion depth limit when hashing numpy.datetime64

Moving from legacy setuptools use to pyproject.toml

8.4.1

pytz is not required.

8.4.0

Adding BaseOperatorPlus base class for custom operators

default_timezone can be passed now to set your default timezone to something other than UTC.

New summarization algorithm that produces valid json

Better type hint support

8.1.1

Adding Python 3.13 to setup.py

8.1.0

Removing deprecated lines from setup.py

Added prefix option to pretty()

Fixes hashing of numpy boolean values.

Fixes slots comparison when the attribute doesn't exist.

Relaxing orderly-set reqs

Added Python 3.13 support

Only lower if clean_key is instance of str #504

Fixes issue where the key deep_distance is not returned when both compared items are equal #510

Fixes exclude_paths fails to work in certain cases

exclude_paths fails to work #509

Fixes to_json() method chokes on standard json.dumps() kwargs such as sort_keys

to_dict() method chokes on standard json.dumps() kwargs #490

Fixes accessing the affected_root_keys property on the diff object returned by DeepDiff fails when one of the dicts is empty

Fixes accessing the affected_root_keys property on the diff object returned by DeepDiff fails when one of the dicts is empty #508

8.0.1 - extra import of numpy is removed

8.0.0

With the introduction of threshold_to_diff_deeper, the values returned are different than in previous versions of DeepDiff. You can still get the older values by setting threshold_to_diff_deeper=0. However to signify that enough has changed in this release that the users need to update the parameters passed to DeepDiff, we will b...
Description has been truncated

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps the pip group with 13 updates in the / directory: | Package | From | To | | --- | --- | --- | | [certifi](https://github.com/certifi/python-certifi) | `2024.2.2` | `2024.7.4` | | [django](https://github.com/django/django) | `5.0.4` | `5.1.13` | | [djangorestframework](https://github.com/encode/django-rest-framework) | `3.14.0` | `3.15.2` | | [idna](https://github.com/kjd/idna) | `3.6` | `3.7` | | [protobuf](https://github.com/protocolbuffers/protobuf) | `4.25.3` | `4.25.8` | | [requests](https://github.com/psf/requests) | `2.31.0` | `2.32.4` | | [sqlparse](https://github.com/andialbrecht/sqlparse) | `0.4.4` | `0.5.0` | | [strawberry-graphql](https://github.com/strawberry-graphql/strawberry) | `0.225.1` | `0.257.0` | | [urllib3](https://github.com/urllib3/urllib3) | `2.2.1` | `2.5.0` | | [zipp](https://github.com/jaraco/zipp) | `3.18.1` | `3.19.1` | | [black](https://github.com/psf/black) | `24.2.0` | `24.3.0` | | [deepdiff](https://github.com/seperman/deepdiff) | `6.7.1` | `8.6.1` | | [djangorestframework-simplejwt](https://github.com/jazzband/djangorestframework-simplejwt) | `5.3.1` | `5.5.1` | Updates `certifi` from 2024.2.2 to 2024.7.4 - [Commits](certifi/python-certifi@2024.02.02...2024.07.04) Updates `django` from 5.0.4 to 5.1.13 - [Commits](django/django@5.0.4...5.1.13) Updates `djangorestframework` from 3.14.0 to 3.15.2 - [Release notes](https://github.com/encode/django-rest-framework/releases) - [Commits](encode/django-rest-framework@3.14.0...3.15.2) Updates `idna` from 3.6 to 3.7 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst) - [Commits](kjd/idna@v3.6...v3.7) Updates `protobuf` from 4.25.3 to 4.25.8 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Changelog](https://github.com/protocolbuffers/protobuf/blob/main/protobuf_release.bzl) - [Commits](protocolbuffers/protobuf@v4.25.3...v4.25.8) Updates `requests` from 2.31.0 to 2.32.4 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.31.0...v2.32.4) Updates `sqlparse` from 0.4.4 to 0.5.0 - [Changelog](https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG) - [Commits](andialbrecht/sqlparse@0.4.4...0.5.0) Updates `strawberry-graphql` from 0.225.1 to 0.257.0 - [Release notes](https://github.com/strawberry-graphql/strawberry/releases) - [Changelog](https://github.com/strawberry-graphql/strawberry/blob/main/CHANGELOG.md) - [Commits](strawberry-graphql/strawberry@0.225.1...0.257.0) Updates `urllib3` from 2.2.1 to 2.5.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.2.1...2.5.0) Updates `zipp` from 3.18.1 to 3.19.1 - [Release notes](https://github.com/jaraco/zipp/releases) - [Changelog](https://github.com/jaraco/zipp/blob/main/NEWS.rst) - [Commits](jaraco/zipp@v3.18.1...v3.19.1) Updates `black` from 24.2.0 to 24.3.0 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](psf/black@24.2.0...24.3.0) Updates `deepdiff` from 6.7.1 to 8.6.1 - [Release notes](https://github.com/seperman/deepdiff/releases) - [Changelog](https://github.com/seperman/deepdiff/blob/master/docs/changelog.rst) - [Commits](seperman/deepdiff@6.7.1...8.6.1) Updates `djangorestframework-simplejwt` from 5.3.1 to 5.5.1 - [Release notes](https://github.com/jazzband/djangorestframework-simplejwt/releases) - [Changelog](https://github.com/jazzband/djangorestframework-simplejwt/blob/master/CHANGELOG.md) - [Commits](jazzband/djangorestframework-simplejwt@v5.3.1...v5.5.1) --- updated-dependencies: - dependency-name: certifi dependency-version: 2024.7.4 dependency-type: direct:production dependency-group: pip - dependency-name: django dependency-version: 5.1.13 dependency-type: direct:production dependency-group: pip - dependency-name: djangorestframework dependency-version: 3.15.2 dependency-type: direct:production dependency-group: pip - dependency-name: idna dependency-version: '3.7' dependency-type: direct:production dependency-group: pip - dependency-name: protobuf dependency-version: 4.25.8 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.32.4 dependency-type: direct:production dependency-group: pip - dependency-name: sqlparse dependency-version: 0.5.0 dependency-type: direct:production dependency-group: pip - dependency-name: strawberry-graphql dependency-version: 0.257.0 dependency-type: direct:production dependency-group: pip - dependency-name: urllib3 dependency-version: 2.5.0 dependency-type: direct:production dependency-group: pip - dependency-name: zipp dependency-version: 3.19.1 dependency-type: direct:production dependency-group: pip - dependency-name: black dependency-version: 24.3.0 dependency-type: direct:production dependency-group: pip - dependency-name: deepdiff dependency-version: 8.6.1 dependency-type: direct:production dependency-group: pip - dependency-name: djangorestframework-simplejwt dependency-version: 5.5.1 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2025-10-13T13:30:01Z

Labels

The following labels could not be found: dependencies, python, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Deepthi-Chand added dependencies python security labels Oct 14, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps)(deps): bump the pip group across 1 directory with 13 updates #32

chore(deps)(deps): bump the pip group across 1 directory with 13 updates #32

Uh oh!

dependabot bot commented on behalf of github Oct 13, 2025 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Oct 13, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chore(deps)(deps): bump the pip group across 1 directory with 13 updates #32

Are you sure you want to change the base?

chore(deps)(deps): bump the pip group across 1 directory with 13 updates #32

Uh oh!

Conversation

dependabot bot commented on behalf of github Oct 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

3.15.2

What's Changed

New Contributors

Version 3.15.1

What's Changed

New Contributors

v3.7

What's Changed

v2.32.4

2.32.4 (2025-06-10)

v2.32.3

2.32.3 (2024-05-29)

v2.32.2

2.32.2 (2024-05-21)

v2.32.1

2.32.1 (2024-05-20)

v2.32.0

2.32.4 (2025-06-10)

2.32.3 (2024-05-29)

2.32.2 (2024-05-21)

2.32.1 (2024-05-20)

2.32.0 (2024-05-20)

Release 0.5.0 (Apr 13, 2024)

🍓 0.257.0

🍓 0.256.1

🍓 0.256.0

🍓 0.255.0

0.257.0 - 2025-01-09

0.256.1 - 2024-12-23

0.256.0 - 2024-12-21

0.255.0 - 2024-12-20

2.5.0

🚀 urllib3 is fundraising for HTTP/2 support

Security issues

Features

Bugfixes

2.4.0

🚀 urllib3 is fundraising for HTTP/2 support

Features

Bugfixes

Misc

2.3.0

2.5.0 (2025-06-18)

Features

Bugfixes

2.4.0 (2025-04-10)

Features

Bugfixes

Misc

2.3.0 (2024-12-22)

v3.19.1

Bugfixes

v3.19.0

Features

v3.18.2

24.3.0

Highlights

Stable style

Performance

Documentation

24.3.0

Highlights

Stable style

Performance

Documentation

8.6.1

8.5.0

8.4.1

8.4.0

8.1.1

8.1.0

8.0.0

Uh oh!

dependabot bot commented on behalf of github Oct 13, 2025 •

edited

Loading