Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump the pip group across 2 directories with 12 updates #4

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Jul 15, 2024

Updates the requirements on fastapi, jinja2, pydantic, requests, starlette, urllib3, setuptools, streamlit, aiohttp, tqdm, scikit-learn and onnx to permit the latest version.
Updates fastapi to 0.111.1

Release notes

Sourced from fastapi's releases.

0.111.1

Upgrades

  • ➖ Remove orjson and ujson from default dependencies. PR #11842 by @​tiangolo.
    • These dependencies are still installed when you install with pip install "fastapi[all]". But they not included in pip install fastapi.
  • 📝 Restored Swagger-UI links to use the latest version possible. PR #11459 by @​UltimateLobster.

Docs

Translations

... (truncated)

Commits

Updates jinja2 to 3.1.4

Release notes

Sourced from jinja2's releases.

3.1.4

This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.

PyPI: https://pypi.org/project/Jinja2/3.1.4/ Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-4

  • The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. GHSA-h75v-3vvj-5mfj
Changelog

Sourced from jinja2's changelog.

Version 3.1.4

Released 2024-05-05

  • The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. :ghsa:h75v-3vvj-5mfj

Version 3.1.3

Released 2024-01-10

  • Fix compiler error when checking if required blocks in parent templates are empty. :pr:1858
  • xmlattr filter does not allow keys with spaces. :ghsa:h5c8-rqwp-cp95
  • Make error messages stemming from invalid nesting of {% trans %} blocks more helpful. :pr:1918

Version 3.1.2

Released 2022-04-28

  • Add parameters to Environment.overlay to match __init__. :issue:1645
  • Handle race condition in FileSystemBytecodeCache. :issue:1654

Version 3.1.1

Released 2022-03-25

  • The template filename on Windows uses the primary path separator. :issue:1637

Version 3.1.0

Released 2022-03-24

  • Drop support for Python 3.6. :pr:1534
  • Remove previously deprecated code. :pr:1544

... (truncated)

Commits

Updates pydantic to 2.8.2

Release notes

Sourced from pydantic's releases.

v2.8.2 (2024-07-03)

What's Changed

Fixes

  • Fix issue with assertion caused by pluggable schema validator by @​dmontagu in #9838

Full Changelog: pydantic/pydantic@v2.8.1...v2.8.2

Changelog

Sourced from pydantic's changelog.

v2.8.2 (2024-07-03)

GitHub release

What's Changed

Fixes

  • Fix issue with assertion caused by pluggable schema validator by @​dmontagu in #9838

v2.8.1 (2024-07-03)

GitHub release

What's Changed

Packaging

Fixes

v2.8.0 (2024-07-01)

GitHub release

The code released in v2.8.0 is functionally identical to that of v2.8.0b1.

What's Changed

Packaging

New Features

... (truncated)

Commits
  • 4978ee2 update history
  • 0345929 v bump
  • d390a04 Fix issue with assertion caused by pluggable schema validator (#9838)
  • 040865f update history
  • 5a33e3b bump version
  • 2f9abb2 Bump pydantic-core to v2.20.1, pydantic-extra-types to v2.9.0 (#9832)
  • ce9c5f7 Remove spooky meetings file (#9824)
  • 6bdd6d1 Pedantic typo correction within explanation of Pydantic's root in 'pedantic' ...
  • 701ccde Fix list constraint json schema application (#9818)
  • 2a066a2 Bump ruff to v0.5.0 and pyright to v1.1.369 (#9801)
  • Additional commits viewable in compare view

Updates requests to 2.32.3

Release notes

Sourced from requests's releases.

v2.32.3

2.32.3 (2024-05-29)

Bugfixes

  • Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of HTTPAdapter. (#6716)
  • Fixed issue where Requests started failing to run on Python versions compiled without the ssl module. (#6724)
Changelog

Sourced from requests's changelog.

2.32.3 (2024-05-29)

Bugfixes

  • Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of HTTPAdapter. (#6716)
  • Fixed issue where Requests started failing to run on Python versions compiled without the ssl module. (#6724)

2.32.2 (2024-05-21)

Deprecations

  • To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

    A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

2.32.1 (2024-05-20)

Bugfixes

  • Add missing test certs to the sdist distributed on PyPI.

2.32.0 (2024-05-20)

Security

  • Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification, regardless of the value of verify. (GHSA-9wx4-h78v-vm56)

Improvements

  • verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems when using a Python version built with OpenSSL 3.x. (#6667)
  • Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored. This enables pip and other projects to minimize their vendoring surface area. The Response.text() and apparent_encoding APIs will default to utf-8 if neither library is present. (#6702)

... (truncated)

Commits
  • 0e322af v2.32.3
  • e188799 Don't create default SSLContext if ssl module isn't present (#6724)
  • 145b539 Merge pull request #6716 from sigmavirus24/bug/6715
  • b1d73dd Don't use default SSLContext with custom poolmanager kwargs
  • 6badbac Update HISTORY.md
  • a62a2d3 Allow for overriding of specific pool key params
  • 88dce9d v2.32.2
  • c98e4d1 Merge pull request #6710 from nateprewitt/api_rename
  • 92075b3 Add deprecation warning
  • aa1461b Move _get_connection to get_connection_with_tls_context
  • Additional commits viewable in compare view

Updates starlette to 0.37.2

Release notes

Sourced from starlette's releases.

Version 0.37.2

Added

  • Add bytes to _RequestData type #2510.

Fixed

  • Revert "Turn scope["client"] to None on TestClient (#2377)" #2525.
  • Remove deprecated app argument passed to httpx.Client on the TestClient #2526.

Full Changelog: encode/starlette@0.37.1...0.37.2

Changelog

Sourced from starlette's changelog.

0.37.2

March 5, 2024

Added

  • Add bytes to _RequestData type #2510.

Fixed

  • Revert "Turn scope["client"] to None on TestClient (#2377)" #2525.
  • Remove deprecated app argument passed to httpx.Client on the TestClient #2526.

0.37.1

February 9, 2024

Fixed

  • Warn instead of raise for missing env file on Config #2485.

0.37.0

February 5, 2024

Added

  • Support the WebSocket Denial Response ASGI extension #2041.

0.36.3

February 4, 2024

Fixed

  • Create anyio.Event on async context #2459.

0.36.2

February 3, 2024

Fixed

  • Upgrade python-multipart to 0.0.7 13e5c26.
  • Avoid duplicate charset on Content-Type #2443.

0.36.1

January 23, 2024

... (truncated)

Commits

Updates urllib3 to 2.2.2

Release notes

Sourced from urllib3's releases.

2.2.2

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

  • Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.
  • Allowed passing negative integers as amt to read methods of http.client.HTTPResponse as an alternative to None. (#3122)
  • Fixed return types representing copying actions to use typing.Self. (#3363)

Full Changelog: urllib3/urllib3@2.2.1...2.2.2

Changelog

Sourced from urllib3's changelog.

2.2.2 (2024-06-17)

  • Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.
  • Allowed passing negative integers as amt to read methods of http.client.HTTPResponse as an alternative to None. ([#3122](https://github.com/urllib3/urllib3/issues/3122) <https://github.com/urllib3/urllib3/issues/3122>__)
  • Fixed return types representing copying actions to use typing.Self. ([#3363](https://github.com/urllib3/urllib3/issues/3363) <https://github.com/urllib3/urllib3/issues/3363>__)

2.2.1 (2024-02-16)

  • Fixed issue where InsecureRequestWarning was emitted for HTTPS connections when using Emscripten. ([#3331](https://github.com/urllib3/urllib3/issues/3331) <https://github.com/urllib3/urllib3/issues/3331>__)
  • Fixed HTTPConnectionPool.urlopen to stop automatically casting non-proxy headers to HTTPHeaderDict. This change was premature as it did not apply to proxy headers and HTTPHeaderDict does not handle byte header values correctly yet. ([#3343](https://github.com/urllib3/urllib3/issues/3343) <https://github.com/urllib3/urllib3/issues/3343>__)
  • Changed InvalidChunkLength to ProtocolError when response terminates before the chunk length is sent. ([#2860](https://github.com/urllib3/urllib3/issues/2860) <https://github.com/urllib3/urllib3/issues/2860>__)
  • Changed ProtocolError to be more verbose on incomplete reads with excess content. ([#3261](https://github.com/urllib3/urllib3/issues/3261) <https://github.com/urllib3/urllib3/issues/3261>__)

2.2.0 (2024-01-30)

  • Added support for Emscripten and Pyodide <https://urllib3.readthedocs.io/en/latest/reference/contrib/emscripten.html>, including streaming support in cross-origin isolated browser environments where threading is enabled. ([#2951](https://github.com/urllib3/urllib3/issues/2951) <https://github.com/urllib3/urllib3/issues/2951>)
  • Added support for HTTPResponse.read1() method. ([#3186](https://github.com/urllib3/urllib3/issues/3186) <https://github.com/urllib3/urllib3/issues/3186>__)
  • Added rudimentary support for HTTP/2. ([#3284](https://github.com/urllib3/urllib3/issues/3284) <https://github.com/urllib3/urllib3/issues/3284>__)
  • Fixed issue where requests against urls with trailing dots were failing due to SSL errors when using proxy. ([#2244](https://github.com/urllib3/urllib3/issues/2244) <https://github.com/urllib3/urllib3/issues/2244>__)
  • Fixed HTTPConnection.proxy_is_verified and HTTPSConnection.proxy_is_verified to be always set to a boolean after connecting to a proxy. It could be None in some cases previously. ([#3130](https://github.com/urllib3/urllib3/issues/3130) <https://github.com/urllib3/urllib3/issues/3130>__)
  • Fixed an issue where headers passed in a request with json= would be mutated ([#3203](https://github.com/urllib3/urllib3/issues/3203) <https://github.com/urllib3/urllib3/issues/3203>__)
  • Fixed HTTPSConnection.is_verified to be set to False when connecting from a HTTPS proxy to an HTTP target. It was set to True previously. ([#3267](https://github.com/urllib3/urllib3/issues/3267) <https://github.com/urllib3/urllib3/issues/3267>__)
  • Fixed handling of new error message from OpenSSL 3.2.0 when configuring an HTTP proxy as HTTPS ([#3268](https://github.com/urllib3/urllib3/issues/3268) <https://github.com/urllib3/urllib3/issues/3268>__)
  • Fixed TLS 1.3 post-handshake auth when the server certificate validation is disabled ([#3325](https://github.com/urllib3/urllib3/issues/3325) <https://github.com/urllib3/urllib3/issues/3325>__)
  • Note for downstream distributors: To run integration tests, you now need to run the tests a second time with the --integration pytest flag. ([#3181](https://github.com/urllib3/urllib3/issues/3181) <https://github.com/urllib3/urllib3/issues/3181>__)

2.1.0 (2023-11-13)

  • Removed support for the deprecated urllib3[secure] extra. ([#2680](https://github.com/urllib3/urllib3/issues/2680) <https://github.com/urllib3/urllib3/issues/2680>__)
  • Removed support for the deprecated SecureTransport TLS implementation. ([#2681](https://github.com/urllib3/urllib3/issues/2681) <https://github.com/urllib3/urllib3/issues/2681>__)
  • Removed support for the end-of-life Python 3.7. ([#3143](https://github.com/urllib3/urllib3/issues/3143) <https://github.com/urllib3/urllib3/issues/3143>__)
  • Allowed loading CA certificates from memory for proxies. ([#3065](https://github.com/urllib3/urllib3/issues/3065) <https://github.com/urllib3/urllib3/issues/3065>__)
  • Fixed decoding Gzip-encoded responses which specified x-gzip content-encoding. ([#3174](https://github.com/urllib3/urllib3/issues/3174) <https://github.com/urllib3/urllib3/issues/3174>__)

2.0.7 (2023-10-17)

  • Made body stripped from HTTP requests changing the request method to GET after HTTP 303 "See Other" redirect responses.

... (truncated)

Commits

Updates setuptools to 70.3.0

Changelog

Sourced from setuptools's changelog.

v70.3.0

Features

  • Support for loading distutils from the standard library is now deprecated, including use of SETUPTOOLS_USE_DISTUTILS=stdlib and importing distutils before importing setuptools. (#4137)

Bugfixes

  • pypa/distutils#268

v70.2.0

Features

  • Updated distutils including significant changes to support Cygwin and mingw compilers. (#4444)

Bugfixes

  • Fix distribution name normalisation (:pep:625) for valid versions that are not canonical (e.g. 1.0-2). (#4434)

v70.1.1

Misc

v70.1.0

Features

  • Adopted the bdist_wheel command from the wheel project -- by :user:agronholm (#1386)

  • Improve error message when pkg_resources.ZipProvider tries to extract resources with a missing Egg -- by :user:Avasam

    Added variables and parameter type annotations to pkg_resources to be nearly on par with typeshed.* -- by :user:Avasam

... (truncated)

Commits

Updates streamlit to 1.36.0

Release notes

Sourced from streamlit's releases.

1.36.0

What's Changed

Breaking Changes 🛠

New Features 🎉

Bug Fixes 🐛

Other Changes

New Contributors

Full Changelog: streamlit/streamlit@1.35.0...1.36.0

Commits

Updates aiohttp to 3.9.5

Release notes

Sourced from aiohttp's releases.

3.9.5

Bug fixes

  • Fixed "Unclosed client session" when initialization of :py:class:~aiohttp.ClientSession fails -- by :user:NewGlad.

    Related issues and pull requests on GitHub: #8253.

  • Fixed regression (from :pr:8280) with adding Content-Disposition to the form-data part after appending to writer -- by :user:Dreamsorcerer/:user:Olegt0rr.

    Related issues and pull requests on GitHub: #8332.

  • Added default Content-Disposition in multipart/form-data responses to avoid broken form-data responses -- by :user:Dreamsorcerer.

    Related issues and pull requests on GitHub: #8335.


Changelog

Sourced from aiohttp's changelog.

3.9.5 (2024-04-16)

Bug fixes

  • Fixed "Unclosed client session" when initialization of :py:class:~aiohttp.ClientSession fails -- by :user:NewGlad.

    Related issues and pull requests on GitHub: :issue:8253.

  • Fixed regression (from :pr:8280) with adding Content-Disposition to the form-data part after appending to writer -- by :user:Dreamsorcerer/:user:Olegt0rr.

    Related issues and pull requests on GitHub: :issue:8332.

  • Added default Content-Disposition in multipart/form-data responses to avoid broken form-data responses -- by :user:Dreamsorcerer.

    Related issues and pull requests on GitHub: :issue:8335.


3.9.4 (2024-04-11)

Bug fixes

  • The asynchronous internals now set the underlying causes when assigning exceptions to the future objects -- by :user:webknjaz.

    Related issues and pull requests on GitHub: :issue:8089.

... (truncated)

Commits

Updates the requirements on [fastapi](https://github.com/tiangolo/fastapi), [jinja2](https://github.com/pallets/jinja), [pydantic](https://github.com/pydantic/pydantic), [requests](https://github.com/psf/requests), [starlette](https://github.com/encode/starlette), [urllib3](https://github.com/urllib3/urllib3), [setuptools](https://github.com/pypa/setuptools), [streamlit](https://github.com/streamlit/streamlit), [aiohttp](https://github.com/aio-libs/aiohttp), [tqdm](https://github.com/tqdm/tqdm), [scikit-learn](https://github.com/scikit-learn/scikit-learn) and [onnx](https://github.com/onnx/onnx) to permit the latest version.

Updates `fastapi` to 0.111.1
- [Release notes](https://github.com/tiangolo/fastapi/releases)
- [Commits](fastapi/fastapi@0.1.11...0.111.1)

Updates `jinja2` to 3.1.4
- [Release notes](https://github.com/pallets/jinja/releases)
- [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst)
- [Commits](pallets/jinja@3.0.0...3.1.4)

Updates `pydantic` to 2.8.2
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v0.0.2...v2.8.2)

Updates `requests` to 2.32.3
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v0.2.0...v2.32.3)

Updates `starlette` to 0.37.2
- [Release notes](https://github.com/encode/starlette/releases)
- [Changelog](https://github.com/encode/starlette/blob/master/docs/release-notes.md)
- [Commits](encode/starlette@0.1.0...0.37.2)

Updates `urllib3` to 2.2.2
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@0.3...2.2.2)

Updates `setuptools` to 70.3.0
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@0.6...v70.3.0)

Updates `streamlit` to 1.36.0
- [Release notes](https://github.com/streamlit/streamlit/releases)
- [Commits](streamlit/streamlit@1.13.0...1.36.0)

Updates `aiohttp` to 3.9.5
- [Release notes](https://github.com/aio-libs/aiohttp/releases)
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.8.0...v3.9.5)

Updates `fastapi` to 0.111.1
- [Release notes](https://github.com/tiangolo/fastapi/releases)
- [Commits](fastapi/fastapi@0.1.11...0.111.1)

Updates `tqdm` to 4.66.4
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.57.0...v4.66.4)

Updates `scikit-learn` to 1.5.1
- [Release notes](https://github.com/scikit-learn/scikit-learn/releases)
- [Commits](scikit-learn/scikit-learn@0.22.2...1.5.1)

Updates `onnx` to 1.16.1
- [Release notes](https://github.com/onnx/onnx/releases)
- [Changelog](https://github.com/onnx/onnx/blob/main/docs/Changelog-ml.md)
- [Commits](onnx/onnx@v0.1...v1.16.1)

---
updated-dependencies:
- dependency-name: fastapi
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: jinja2
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pydantic
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: requests
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: starlette
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: urllib3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: setuptools
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: streamlit
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: aiohttp
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: fastapi
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: tqdm
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: scikit-learn
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: onnx
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jul 15, 2024
Copy link

dryrunsecurity bot commented Jul 15, 2024

DryRun Security Summary

The pull request updates the application's dependencies across several requirement files, including version updates for libraries like Streamlit, Panel, FastAPI, Jinja2, Pydantic, Requests, and urllib3, as well as the addition of a new dependency on the protobuf library, to ensure compatibility and security improvements.

Expand for full summary

Summary:

The changes in this pull request involve updates to the application's dependencies across several requirement files. The key changes include:

  1. Updating the version constraints for various libraries, such as Streamlit, Panel, FastAPI, Jinja2, Pydantic, Requests, and urllib3. These updates generally aim to allow the use of newer versions of the libraries, which can bring bug fixes and security improvements.

  2. Adding a new dependency on the protobuf library with a version constraint of <=3.20.1. This is likely to ensure compatibility with the TensorBoardLogger dependency.

  3. Maintaining version constraints for other dependencies, such as aiohttp, scikit-learn, and onnx, to keep the application compatible with the required versions.

From an application security perspective, these changes do not introduce any obvious security vulnerabilities. However, it is important to thoroughly review the release notes and changelogs of the updated dependencies to ensure that there are no known security issues or breaking changes that could impact the application's security posture.

Additionally, it is recommended to have a comprehensive testing strategy and security scanning tools in place to validate the application's behavior and catch any potential security issues introduced by these dependency updates.

Files Changed:

  • requirements/app/ui.txt: The version range for the Streamlit library has been updated from <1.16.1 to <1.36.1, allowing the use of newer versions of Streamlit.
  • requirements/app/test.txt: The version constraint for the setuptools dependency has been updated from <67.7.0 to <70.4.0.
  • requirements/app/components.txt: The version constraint for the aiohttp library has been updated from <=3.8.3 to <=3.9.5.
  • requirements/app/base.txt: The versions of several critical dependencies, such as FastAPI, Jinja2, Pydantic, Requests, and urllib3, have been updated to newer versions.
  • requirements/pytorch/base.txt: The version range for the tqdm library has been updated from <4.65.0 to <4.67.0.
  • requirements/pytorch/test.txt: The version ranges for scikit-learn, onnx, fastapi, and uvicorn have been updated, and a new dependency on protobuf<=3.20.1 has been added.

Code Analysis

We ran 7 analyzers against 6 files and 0 analyzers had findings. 7 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
app dependencies Pull requests that update a dependency file pl
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants