-
Notifications
You must be signed in to change notification settings - Fork 981
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
build(deps): bump pip-tools from 6.1.0 to 6.2.0 in /python/helpers #3974
Conversation
Bumps [pip-tools](https://github.com/jazzband/pip-tools) from 6.1.0 to 6.2.0. - [Release notes](https://github.com/jazzband/pip-tools/releases) - [Changelog](https://github.com/jazzband/pip-tools/blob/master/CHANGELOG.md) - [Commits](jazzband/pip-tools@6.1.0...6.2.0) --- updated-dependencies: - dependency-name: pip-tools dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
The new option |
@Mogost does it make sense to always enable this? Dependabot already has some support for extras so wondering if this should be configured using a |
@feelepxyz It seems to me that we need the ability in dependabot to pass the necessary parameters to pip-tools directly with some kind of configuration file. |
I do not see any issue bumping the version, the only visible change in 6.2.0 is that the header contains version of python used to run it. Regarding |
@ssbarnea thanks that's helpful context. Sounds like we can get this in as is and maybe follow up by setting this flag for files called |
Has there been any follow-up on this? I'm trying to use Dependabot (great product!) to keep a Thanks! |
(Replying to my own question) I'm not familiar with the Dependabot codebase, and not a Ruby'ist, but would supporting dependabot-core/python/lib/dependabot/python/file_updater/pip_compile_file_updater.rb Line 419 in ebe338e
|
The `--strip-extras` flag of `pip-compile` is useful to generate contstraints files (instead of the more traditional requirements files) from some `constraints.in` file. Constraints files can't have extras markers on the packages (this wouldn't make much sense indeed), hence they need to be stripped. Since `pip-tools` 6.2.0 this is supported by using the `--strip-extras` flag. This commit adds this as a 'recognized' flag: if it's found in an existing `foo.txt` file, it will be passed to `pip-compile` when some `foo.in` file is updated. See: dependabot#3974 (comment) See: dependabot#3974 (comment) See: jazzband/pip-tools#1300 (comment)
* v0.162.0 * handle support files with dir macro in umbrellas * bin/dry-run.rb exits outside a developer shell * Update README * Prefer checking user over touching a file * Support basic Kotlin apply, add tests * Escape paths passed to VendorUpdater Paths in packages could be constructed to perform command, when not properly escaped those could be executed. ``` (byebug) `file -b --mime-encoding t&&curl$IFS@0.0.0.0&&.go` % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (7) Failed to connect to 0.0.0.0 port 80: Connection refused "cannot open `t' (No such file or directory)\n" ``` ``` (byebug) `#{Dependabot::SharedHelpers.escape_command("file -b --mime-encoding t&&curl$IFS@0.0.0.0&&.go")}` "cannot open `t&&curl$IFS@0.0.0.0&&.go' (No such file or directory)\n" ``` * Bump golang from 1.17 to 1.17.1 * build(deps): bump github.com/dependabot/gomodules-extracted Bumps [github.com/dependabot/gomodules-extracted](https://github.com/dependabot/gomodules-extracted) from 1.4.1 to 1.4.2. - [Release notes](https://github.com/dependabot/gomodules-extracted/releases) - [Commits](dependabot/gomodules-extracted@v1.4.1...v1.4.2) --- updated-dependencies: - dependency-name: github.com/dependabot/gomodules-extracted dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * fix `labels': Unsupported provider bitbucket Bitbucket doesn't yet supports PR labels. dependabot throught this issue whenever I try to use it with bitbucket labeler.rb:241:in `labels': Unsupported provider bitbucket (RuntimeError) * Fix minor typos in changelog * v0.162.1 * Support Gradle files with no top level build.gradle file * Treat tokens after underscore as numeric if possible * Simplify string processing * Ignore replaced dependencies * v0.162.2 * Add support for gradlePluginPortal() * build(deps-dev): bump jest in /npm_and_yarn/helpers Bumps [jest](https://github.com/facebook/jest) from 27.0.6 to 27.2.4. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/main/CHANGELOG.md) - [Commits](jestjs/jest@v27.0.6...v27.2.4) --- updated-dependencies: - dependency-name: jest dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Handle .tar path dependency * Fix indentation * build(deps): bump composer/composer in /composer/helpers/v1 Bumps [composer/composer](https://github.com/composer/composer) from 1.10.22 to 1.10.23. - [Release notes](https://github.com/composer/composer/releases) - [Changelog](https://github.com/composer/composer/blob/master/CHANGELOG.md) - [Commits](composer/composer@1.10.22...1.10.23) --- updated-dependencies: - dependency-name: composer/composer dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump @npmcli/arborist in /npm_and_yarn/helpers Bumps [@npmcli/arborist](https://github.com/npm/arborist) from 2.8.0 to 3.0.0. - [Release notes](https://github.com/npm/arborist/releases) - [Changelog](https://github.com/npm/arborist/blob/main/CHANGELOG.md) - [Commits](npm/arborist@v2.8.0...v3.0.0) --- updated-dependencies: - dependency-name: "@npmcli/arborist" dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps-dev): bump friendsofphp/php-cs-fixer in /composer/helpers/v2 Bumps [friendsofphp/php-cs-fixer](https://github.com/FriendsOfPHP/PHP-CS-Fixer) from 3.0.0 to 3.2.1. - [Release notes](https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases) - [Changelog](https://github.com/FriendsOfPHP/PHP-CS-Fixer/blob/v3.2.1/CHANGELOG.md) - [Commits](PHP-CS-Fixer/PHP-CS-Fixer@v3.0.0...v3.2.1) --- updated-dependencies: - dependency-name: friendsofphp/php-cs-fixer dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Add issue template config with Dependabot contact links * Fix elm tests The version resolver fetches the latest version from the public registry, and since we shell out to `elm` for this, it's currently hard to stub out. Our test fixture did not have the latest version yet and would cause our tests to fail. Ideally we'd rely on both the version_checker and resolver using the same source that we stub, but unfortunately with the way our tests are set up makes that hard. Fortunately these don't change often, so I suggest we live with the pain for now. * Fix Poetry unreachable git deps error Since python-poetry/poetry-core#202 poetry now uses a slightly different (safer) git command, and this caused the regex matching we do on the error output to now fail. This fixes up the regex, and just to be safe ensures it'll keep working with the old version as well. The test that was failing was: `python/spec/dependabot/python/update_checker/poetry_version_resolver_spec.rb:179` * build(deps-dev): bump prettier in /npm_and_yarn/helpers Bumps [prettier](https://github.com/prettier/prettier) from 2.3.2 to 2.4.1. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@2.3.2...2.4.1) --- updated-dependencies: - dependency-name: prettier dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Gradle: Prefer method call over instance variable access in file fetcher * build(deps): bump poetry from 1.1.7 to 1.1.11 in /python/helpers Bumps [poetry](https://github.com/python-poetry/poetry) from 1.1.7 to 1.1.11. - [Release notes](https://github.com/python-poetry/poetry/releases) - [Changelog](https://github.com/python-poetry/poetry/blob/1.1.11/CHANGELOG.md) - [Commits](python-poetry/poetry@1.1.7...1.1.11) --- updated-dependencies: - dependency-name: poetry dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump composer/composer in /composer/helpers/v2 Bumps [composer/composer](https://github.com/composer/composer) from 2.1.3 to 2.1.9. - [Release notes](https://github.com/composer/composer/releases) - [Changelog](https://github.com/composer/composer/blob/master/CHANGELOG.md) - [Commits](composer/composer@2.1.3...2.1.9) --- updated-dependencies: - dependency-name: composer/composer dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump pip-tools from 6.2.0 to 6.3.0 in /python/helpers Bumps [pip-tools](https://github.com/jazzband/pip-tools) from 6.2.0 to 6.3.0. - [Release notes](https://github.com/jazzband/pip-tools/releases) - [Changelog](https://github.com/jazzband/pip-tools/blob/master/CHANGELOG.md) - [Commits](jazzband/pip-tools@6.2.0...6.3.0) --- updated-dependencies: - dependency-name: pip-tools dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump wheel from 0.36.2 to 0.37.0 in /python/helpers Bumps [wheel](https://github.com/pypa/wheel) from 0.36.2 to 0.37.0. - [Release notes](https://github.com/pypa/wheel/releases) - [Changelog](https://github.com/pypa/wheel/blob/master/docs/news.rst) - [Commits](pypa/wheel@0.36.2...0.37.0) --- updated-dependencies: - dependency-name: wheel dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps-dev): bump phpstan/phpstan in /composer/helpers/v1 Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan) from 0.12.93 to 0.12.99. - [Release notes](https://github.com/phpstan/phpstan/releases) - [Commits](phpstan/phpstan@0.12.93...0.12.99) --- updated-dependencies: - dependency-name: phpstan/phpstan dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps-dev): bump friendsofphp/php-cs-fixer in /composer/helpers/v1 Bumps [friendsofphp/php-cs-fixer](https://github.com/FriendsOfPHP/PHP-CS-Fixer) from 2.19.0 to 2.19.2. - [Release notes](https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases) - [Changelog](https://github.com/FriendsOfPHP/PHP-CS-Fixer/blob/3.0/CHANGELOG.md) - [Commits](PHP-CS-Fixer/PHP-CS-Fixer@v2.19.0...v2.19.2) --- updated-dependencies: - dependency-name: friendsofphp/php-cs-fixer dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * v0.163.0 * remove trailing whitespaces * Recommend `git reset` when cloning repository on Windows fails `git restore --source=HEAD :/` which is currently suggested by Git does not work, it is unable to restore the files, see git-for-windows/git#3411. * build(deps): bump pip-tools from 6.3.0 to 6.3.1 in /python/helpers Bumps [pip-tools](https://github.com/jazzband/pip-tools) from 6.3.0 to 6.3.1. - [Release notes](https://github.com/jazzband/pip-tools/releases) - [Changelog](https://github.com/jazzband/pip-tools/blob/master/CHANGELOG.md) - [Commits](jazzband/pip-tools@6.3.0...6.3.1) --- updated-dependencies: - dependency-name: pip-tools dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps-dev): bump jest in /npm_and_yarn/helpers Bumps [jest](https://github.com/facebook/jest) from 27.2.4 to 27.2.5. - [Release notes](https://github.com/facebook/jest/releases) - [Changelog](https://github.com/facebook/jest/blob/main/CHANGELOG.md) - [Commits](jestjs/jest@v27.2.4...v27.2.5) --- updated-dependencies: - dependency-name: jest dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump pip from 21.1.3 to 21.2.4 in /python/helpers Bumps [pip](https://github.com/pypa/pip) from 21.1.3 to 21.2.4. - [Release notes](https://github.com/pypa/pip/releases) - [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst) - [Commits](pypa/pip@21.1.3...21.2.4) --- updated-dependencies: - dependency-name: pip dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump flake8 from 3.9.2 to 4.0.0 in /python/helpers Bumps [flake8](https://github.com/pycqa/flake8) from 3.9.2 to 4.0.0. - [Release notes](https://github.com/pycqa/flake8/releases) - [Commits](PyCQA/flake8@3.9.2...4.0.0) --- updated-dependencies: - dependency-name: flake8 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps-dev): bump eslint in /npm_and_yarn/helpers Bumps [eslint](https://github.com/eslint/eslint) from 7.32.0 to 8.0.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/master/CHANGELOG.md) - [Commits](eslint/eslint@v7.32.0...v8.0.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump golang.org/x/mod in /go_modules/helpers Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.5.0 to 0.5.1. - [Release notes](https://github.com/golang/mod/releases) - [Commits](golang/mod@v0.5.0...v0.5.1) --- updated-dependencies: - dependency-name: golang.org/x/mod dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Upgrade OTP to latest minor: 23.3.4.5 * Python: Upgrade pyenv to 2.1.0 This also adds Python 3.10.0, 3.7.12, 3.6.15 * Bump Terraform from 1.0.6 to 1.0.8 https://github.com/hashicorp/terraform/blob/v1.0/CHANGELOG.md#108-september-29-2021 * build(deps): bump pip-tools from 6.3.1 to 6.4.0 in /python/helpers Bumps [pip-tools](https://github.com/jazzband/pip-tools) from 6.3.1 to 6.4.0. - [Release notes](https://github.com/jazzband/pip-tools/releases) - [Changelog](https://github.com/jazzband/pip-tools/blob/master/CHANGELOG.md) - [Commits](jazzband/pip-tools@6.3.1...6.4.0) --- updated-dependencies: - dependency-name: pip-tools dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump flake8 from 4.0.0 to 4.0.1 in /python/helpers Bumps [flake8](https://github.com/pycqa/flake8) from 4.0.0 to 4.0.1. - [Release notes](https://github.com/pycqa/flake8/releases) - [Commits](PyCQA/flake8@4.0.0...4.0.1) --- updated-dependencies: - dependency-name: flake8 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * update Elixir from 1.12.2 -> 1.12.3 * update erlang solutions from 1.0 to 2.0 * v0.163.1 * Add license to image and gemspec The dependabot-* gems on rubygems currently have the license set as 'nonstandard' and do not include a license file. * Add license to gem build directory * Set license back to Nonstandard Rubygems only recognizes licenses on the spdx license list, and the Prosperity Public License 2.0.0 is not one of them. * Allow passing target_project_id to Gitlab pr creator and updater * Revert "Add license to gem build directory" This reverts commit 05aa6ee. * Update specs Validate target_project_id passed correctly Fix request expectation * Move target_project_id to provider_metadata * Treat GHES hosted sources as github sources When a dependency is hosted on GHES, previously it was not treated as a GitHub source, meaning that we would not check for releases/changelogs etc when requesting Metadata for the PR. This fixes that, by first parsing the URL, and then making a request to `<host>/status`, and checking for a `X-GitHub-Request-Id` header, which we return from GitHub Enterprise Server. * Revert "v0.163.1" This reverts commit 2103fbb. * v0.164.0 * Add TagsCreationForbidden Exception to Azure Client * Make labeler optional in Azure * Add labels_required param to PR creator * Fix indentation * Ensure we cleanup tmp directories after use * Only check auth for github.com * v0.164.1 * feat: specify timeouts per spawned process * style: fix linter errors * test: update glass assertions * test: ensure the proper command is generated * feat: trap SIGHUB and flush error to stdout * refactor: collapse multi line conditional * style: fix linter errors * refactor: extract class to build shell command * style: fix linter errors * fix: ensure min of 1 minute and max of 30 minutes per op * refactor: make timeout_seconds a private method * [Gradle] add settings_file to fetched_files * [Gradle] add settings files to SUPPORTED_BUILD_FILE_NAMES * [Gradle] update tests * refactor: use Comparable#clamp * [Gradle] add tests for FileParser * [Gradle] fix implementation * v0.165.0 * Bump to go 1.17.3 There were some minor fixes to the `go` command in 1.17.2/1.17.3... I don't think any of them directly affect dependabot, but it doesn't hurt to bump this and makes it so the next person has a smaller diff to look at when they consider updating. * Move composer-not-found fixture from decommissioned dependabot.com * Ignore errors from Source enterprise check and ignore known failures We check if a potential Source is GitHub enterprise by making a request to a `/status` endpoint against the root URL and checking some headers. We've observed this check failing in some cases when the source is not enterprise, and we get rate limited, or otherwise the request fails with an error. In this case we do not want to block creating a PR, but instead we should assume the source is not Enterprise. This also adds a list of known hosts that we come across often that definitely are not GitHub Enterprise instances, and we ignore those and don't bother making a request to them. Co-Authored-By: Barry Gordon <brrygrdn@github.com> * Explicitly ignore metadata detection for fuchsia.googlesource.com We've observed some failures when trying to establish if this might be an GHES host, since we can be confident it's not, let's not bother making a request to check. * v0.166.0 * Apply suggested code tweaks * Fix variable references * Refactor code to reduce complexity This also reverts a previous incorrect change. With this, rubocop is happy and the tests still pass. * Improve error handling when `terraform init` fails We attempt to run `terraform init` once, but when this fails, we still end up with an unhandled error. Given that there is not much we can do at this point, communicate that to the user instead, and treat it as a resolvability error. At the same time, when `terraform init` fails with an error other than a private source error, there is no point trying further so we should raise a resolvability error as well. * Rescue terraform registry connection errors * v0.166.1 * Remove labels_required param * Run YarnUpdate only once for a version requirement * Fix indent * Adjust indentation to please rubocop * fix: remove fixed error message check A new version of [pandoc-ruby](https://rubygems.org/gems/pandoc-ruby/versions/2.1.5) was recently released that changes the behaviour of how the `pandoc` executable is invoked. [src](xwmx/pandoc-ruby@2.1.4...2.1.5). /cc dependabot#2849 * style: fix linter errors * Fix * build(deps-dev): bump friendsofphp/php-cs-fixer in /composer/helpers/v2 Bumps [friendsofphp/php-cs-fixer](https://github.com/FriendsOfPHP/PHP-CS-Fixer) from 3.2.1 to 3.3.2. - [Release notes](https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases) - [Changelog](https://github.com/FriendsOfPHP/PHP-CS-Fixer/blob/v3.3.2/CHANGELOG.md) - [Commits](PHP-CS-Fixer/PHP-CS-Fixer@v3.2.1...v3.3.2) --- updated-dependencies: - dependency-name: friendsofphp/php-cs-fixer dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps-dev): bump friendsofphp/php-cs-fixer in /composer/helpers/v1 Bumps [friendsofphp/php-cs-fixer](https://github.com/FriendsOfPHP/PHP-CS-Fixer) from 2.19.2 to 2.19.3. - [Release notes](https://github.com/FriendsOfPHP/PHP-CS-Fixer/releases) - [Changelog](https://github.com/FriendsOfPHP/PHP-CS-Fixer/blob/master/CHANGELOG.md) - [Commits](PHP-CS-Fixer/PHP-CS-Fixer@v2.19.2...v2.19.3) --- updated-dependencies: - dependency-name: friendsofphp/php-cs-fixer dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump pipenv from 2021.5.29 to 2021.11.15 in /python/helpers Bumps [pipenv](https://github.com/pypa/pipenv) from 2021.5.29 to 2021.11.15. - [Release notes](https://github.com/pypa/pipenv/releases) - [Changelog](https://github.com/pypa/pipenv/blob/main/CHANGELOG.rst) - [Commits](pypa/pipenv@v2021.5.29...v2021.11.15) --- updated-dependencies: - dependency-name: pipenv dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Maven: Correctly handle nested declarations We've observed errors around pom files that have a nested `plugin` section inside an outer plugin declaration. Previously we used a regex to recursively scan the XML document, which caused the inner `plugin` declarations closing tag to match the regex, resulting in an incomplete XML section. To demonstrate, given the following XML: ```xml <plugins> <plugin> <configuration> <jvmTarget>11</jvmTarget> <compilerPlugins> <plugin>spring</plugin> </compilerPlugins> </configuration> <groupId>org.jetbrains.kotlin</groupId> <artifactId>kotlin-maven-plugin</artifactId> <version>${kotlin.version}</version> </plugin> </plugin> ``` The `<plugin>spring</plugin>` declaration would cause a regex match, resulting in the required information (the `version` in this case) to be omitted from the XML snippet. This is resolved by using Nokogiri to traverse the XML instead of using regular expressions, and selecting the nodes by name. Co-authored-by: Landon Grindheim <landongrindheim@github.com> * v0.167.0 * Remove the dependabot migration issue template The Dependabot Preview service was shut down on the 3rd of August 2021, so our path to migration is now closed and the service has been wrapped up. This template format is no longer required, any issues for lapsed users returning to the integrated Dependabot service should just file a standard bug report. * Do not freeze file-based Poetry dependency version Fixes dependabot#4333 * Polish * Code formatting * Remove unnecessary quotes Co-authored-by: Jurre <jurre@github.com> * Fix typo * Special case URL dependencies, add better positive assertions for file and directory dependencies * Rename expected files in tests * Rename file back * build(deps): bump @npmcli/arborist in /npm_and_yarn/helpers Bumps [@npmcli/arborist](https://github.com/npm/arborist) from 3.0.0 to 4.0.5. - [Release notes](https://github.com/npm/arborist/releases) - [Changelog](https://github.com/npm/arborist/blob/main/CHANGELOG.md) - [Commits](npm/arborist@v3.0.0...v4.0.5) --- updated-dependencies: - dependency-name: "@npmcli/arborist" dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps-dev): bump phpstan/phpstan in /composer/helpers/v1 Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan) from 0.12.99 to 1.2.0. - [Release notes](https://github.com/phpstan/phpstan/releases) - [Changelog](https://github.com/phpstan/phpstan/blob/master/CHANGELOG.md) - [Commits](phpstan/phpstan@0.12.99...1.2.0) --- updated-dependencies: - dependency-name: phpstan/phpstan dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps-dev): bump phpstan/phpstan in /composer/helpers/v2 Bumps [phpstan/phpstan](https://github.com/phpstan/phpstan) from 0.12.93 to 1.2.0. - [Release notes](https://github.com/phpstan/phpstan/releases) - [Changelog](https://github.com/phpstan/phpstan/blob/master/CHANGELOG.md) - [Commits](phpstan/phpstan@0.12.93...1.2.0) --- updated-dependencies: - dependency-name: phpstan/phpstan dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Update some pipenv error handling to match latest version * Add support for custom commit message trailer * Pass custom git trailers as hash object * Remove reliance on `PandocRuby` PandocRuby has been used to convert RestructuredText (rst), a markdown-like format widely used in the Python ecosystem, to markdown. We recently noticed new errors surfacing around Pandoc and started to investigate. This led to the discovery that Pandoc was not installed in the Docker container GitHub is using to run Dependabot against repositories. I'm opting to remove this dependency as PandocRuby is effectively unused. Note: There is the possibility that some users rely on this functionality. As has been noted in a recent PR-review, non-Docker usage of dependabot-core is poorly supported, so this seems unlikely. * Update tests to reflect our not converting rst's We stopped relying on `PandocRuby` in a previous commit. This test may be able to go away, but first I'd like to prove that it's no longer needed. * Allow providing env to SharedHelpers.run_shell_command * Switch to go command to find available module versions * Handle new error message for bad module paths go list returns a different error message: go list -m: malformed module path "pkg-errors": missing dot in first path element * Enable retracted module test go list -m properly handles retractions so this test is now passing * Bump latest go-modules-lib to v3. v2 was invalid. Prior error: go list -m: loading module retractions for github.com/dependabot-fixtures/go-modules-lib/v2@v2.0.0: version "v2.0.0" invalid: go.mod has non-.../v2 module path "github.com/dependabot-fixtures/go-modules-lib" (and .../v2/go.mod does not exist) at revision v2.0.0 * Handle invalid major version errors * Remove unused go_modules updatechecker native helper * Fix linter error Co-authored-by: Jurre <jurre@github.com> * Verify for just message code instead of text * Fix linter issue Co-authored-by: Jurre <jurre@github.com> * build(deps-dev): bump eslint in /npm_and_yarn/helpers Bumps [eslint](https://github.com/eslint/eslint) from 8.0.0 to 8.3.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Changelog](https://github.com/eslint/eslint/blob/main/CHANGELOG.md) - [Commits](eslint/eslint@v8.0.0...v8.3.0) --- updated-dependencies: - dependency-name: eslint dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * build(deps): bump pip from 21.2.4 to 21.3.1 in /python/helpers Bumps [pip](https://github.com/pypa/pip) from 21.2.4 to 21.3.1. - [Release notes](https://github.com/pypa/pip/releases) - [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst) - [Commits](pypa/pip@21.2.4...21.3.1) --- updated-dependencies: - dependency-name: pip dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * Remove test around updating unneeded transitive dependency The behavior around this has changed in pipenv, but it does not seem documented or even expected. Essentially, this test was doing the following: - add the transitive dependency to the Pipfile - run `pipenv lock` - check the version of the transitive dependency in the lockfile Previous versions of pipenv would then remove the transitive dependency from the lockfile, but it is not clear to me why, as it is present in the Pipfile at that point. My guess is it would keep the top-level dependencies cached somehow, but I've not been able to find much. Either way, if transitive dependencies are _actually_ removed (meaning, not also present in the manifest file), this should still work just fine. The test setup is at the least confusing and at the worst wrong, let's remove it. * Clarify how env vars are passed to shell commands Co-Authored-By: Mattt Zmuda <mattt@github.com> Co-Authored-By: Landon Grindheim <landongrindheim@github.com> * Python: Honour `--strip-extras` flag of `pip-compile` The `--strip-extras` flag of `pip-compile` is useful to generate contstraints files (instead of the more traditional requirements files) from some `constraints.in` file. Constraints files can't have extras markers on the packages (this wouldn't make much sense indeed), hence they need to be stripped. Since `pip-tools` 6.2.0 this is supported by using the `--strip-extras` flag. This commit adds this as a 'recognized' flag: if it's found in an existing `foo.txt` file, it will be passed to `pip-compile` when some `foo.in` file is updated. See: dependabot#3974 (comment) See: dependabot#3974 (comment) See: jazzband/pip-tools#1300 (comment) * Use redirect.github.com for redirect service * v0.168.0 * python: Update `GIT_DEPENDENCY_UNREACHABLE_REGEX` for pip 21.3.1 * v0.169.0 * Bump minimum to 1.17 This isn't strictly necessary, but since the rest of the infra bumped to 1.17, might as well bump it here too. Esp since the `go.mod` behavior changed a bit in `1.17`... so if more libs get added ever, this makes it so `go.mod`/`go.sum` will follow the new behavior... * build(deps): bump pipenv in /python/helpers Bumps [pipenv](https://github.com/pypa/pipenv) from 2021.11.15 to 2021.11.23. - [Release notes](https://github.com/pypa/pipenv/releases) - [Changelog](https://github.com/pypa/pipenv/blob/main/CHANGELOG.rst) - [Commits](pypa/pipenv@v2021.11.15...v2021.11.23) --- updated-dependencies: - dependency-name: pipenv dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> * Dependabot config: ignore npm lib major version updates These helpers exist to support npm 6, so we require that specific major version and should not update it. * Update dependabot.yml Co-authored-by: mo khan <mo@mokhan.ca> Co-authored-by: Jurre <jurre@github.com> Co-authored-by: Nish Sinha <nishnha@github.com> Co-authored-by: nirev <nirev@taming-chaos.com> Co-authored-by: Barry Gordon <brrygrdn@github.com> Co-authored-by: Barry Gordon <896971+brrygrdn@users.noreply.github.com> Co-authored-by: Zbynek Konecny <zbynek@geogebra.org> Co-authored-by: Jurre Stender <jurrestender@gmail.com> Co-authored-by: David McIntosh <804610+mctofu@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Melad Raouf <melad.raouf@gmail.com> Co-authored-by: Zbynek Konecny <zbynek1729@gmail.com> Co-authored-by: Jeroen Bobbeldijk <jeroen@klippa.com> Co-authored-by: AlekhyaYalla <alekhyayalla@microsoft.com> Co-authored-by: Andrew Bredow <andrewbredow@github.com> Co-authored-by: Marcono1234 <Marcono1234@users.noreply.github.com> Co-authored-by: Tomás Pinho <me@tomaspinho.com> Co-authored-by: Parnassius <Parnassius@users.noreply.github.com> Co-authored-by: Philip Ross <philipr@synopsys.com> Co-authored-by: Andrejs Cunskis <andrejs.cunskis@gmail.com> Co-authored-by: anatawa12 <anatawa12@icloud.com> Co-authored-by: Jeff Widman <jeff@jeffwidman.com> Co-authored-by: Tim Van Holder <tim.vanholder@gmail.com> Co-authored-by: Landon Grindheim <landongrindheim@github.com> Co-authored-by: Landon Grindheim <landon.grindheim@gmail.com> Co-authored-by: Phillip Verheyden <pverheyden@gmail.com> Co-authored-by: Mattt Zmuda <mattt@github.com> Co-authored-by: Nicolas Trangez <ikke@nicolast.be> Co-authored-by: Lane Seppala <lseppala@github.com> Co-authored-by: Lane Seppala <lseppala@users.noreply.github.com> Co-authored-by: Andy Freeland <andy@andyfreeland.net>
Bumps pip-tools from 6.1.0 to 6.2.0.
Release notes
Sourced from pip-tools's releases.
Changelog
Sourced from pip-tools's changelog.
Commits
39f7519
Release 6.2.0 (#1423)8db87eb
Fix changelog category title template (#1424)d917eda
Make GitHub recognise license (#1426)6da1c46
Merge pull request #1428 from jazzband/pre-commit-ci-update-config95d4dc7
[pre-commit.ci] pre-commit autoupdatedb0f4a5
Prettify CHANGELOG file (#1425)608572f
Add release drafter github action (#1416)d8ac360
Add PyPy jobs to PR CI runs (#1379)295ba86
Add --emit-options/--no-emit-options flag (#1123)cb53648
Fix pip-compile package ordering (#1419)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase
will rebase this PR@dependabot recreate
will recreate this PR, overwriting any edits that have been made to it@dependabot merge
will merge this PR after your CI passes on it@dependabot squash and merge
will squash and merge this PR after your CI passes on it@dependabot cancel merge
will cancel a previously requested merge and block automerging@dependabot reopen
will reopen this PR if it is closed@dependabot close
will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major version
will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor version
will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependency
will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)