build(deps): bump the test-and-lint-dependencies group across 1 directory with 4 updates by dependabot[bot] · Pull Request #234 · jku/python-tuf

dependabot · 2024-04-29T16:41:31Z

Bumps the test-and-lint-dependencies group with 4 updates in the / directory: black, isort, pylint and bandit.

Updates black from 23.11.0 to 24.4.2

Release notes

24.4.2

This is a bugfix release to fix two regressions in the new f-string parser introduced in 24.4.1.

Parser

Fix regression where certain complex f-strings failed to parse (#4332)

Performance

Fix bad performance on certain complex string literals (#4331)

24.4.1

Highlights

Add support for the new Python 3.12 f-string syntax introduced by PEP 701 (#3822)

Stable style

Fix crash involving indented dummy functions containing newlines (#4318)

Parser

Add support for type parameter defaults, a new syntactic feature added to Python 3.13 by PEP 696 (#4327)

Integrations

Github Action now works even when git archive is skipped (#4313)

24.4.0

Stable style

Fix unwanted crashes caused by AST equivalency check (#4290)

Preview style

if guards in case blocks are now wrapped in parentheses when the line is too long. (#4269)

Stop moving multiline strings to a new line unless inside brackets (#4289)

Integrations

Add a new option use_pyproject to the GitHub Action psf/black. This will read the Black version from pyproject.toml. (#4294)

24.3.0

Highlights

... (truncated)

Changelog

Sourced from black's changelog.

24.4.2

This is a bugfix release to fix two regressions in the new f-string parser introduced in 24.4.1.

Parser

Fix regression where certain complex f-strings failed to parse (#4332)

Performance

Fix bad performance on certain complex string literals (#4331)

24.4.1

Highlights

Add support for the new Python 3.12 f-string syntax introduced by PEP 701 (#3822)

Stable style

Fix crash involving indented dummy functions containing newlines (#4318)

Parser

Add support for type parameter defaults, a new syntactic feature added to Python 3.13 by PEP 696 (#4327)

Integrations

Github Action now works even when git archive is skipped (#4313)

24.4.0

Stable style

Fix unwanted crashes caused by AST equivalency check (#4290)

Preview style

if guards in case blocks are now wrapped in parentheses when the line is too long. (#4269)

Stop moving multiline strings to a new line unless inside brackets (#4289)

Integrations

Add a new option use_pyproject to the GitHub Action psf/black. This will read the Black version from pyproject.toml. (#4294)

24.3.0

... (truncated)

Commits

3702ba2 Prepare release 24.4.2 (#4335)
e4aaa8a Fix incorrect f-string tokenization (#4332)
ba88fc3 Simplify string tokenization regexes (#4331)
5683242 New release template
e7fb048 Prepare release 24.4.1 (#4328)
3f0f8f1 Support PEP 696 (#4327)
2f88085 Github Action: Directly install from repo if export-subst is skipped (#4313)
12ce3db Move changelog entry to right section (#4326)
1354be2 Add support to style function definitions with newlines before function stubs...
f4b644b Prevent wrapping of multiline fstrings in parens (#4325)
Additional commits viewable in compare view

Updates isort from 5.13.0 to 5.13.2

Release notes

Sourced from isort's releases.

5.13.2

Changes

Apply the bracket fix from issue 471 only for use_parentheses=True (#2184) @bp72

confine pre-commit to stages (#2213) @davidculley

🪲 Fixes

Fix colors extras (#2212) @staticdev

5.13.1

Changes

Fix integration tests (#2208) @bp72

Added a fix for normalizing imports from more than one level of parent modules (issue/2152) (#2191) @bp72

🪲 Fixes

Remove optional dependencies without extras (#2207) @staticdev

Changelog

Sourced from isort's changelog.

5.13.2 December 13 2023

Apply the bracket fix from issue #471 only for use_parentheses=True (#2184) @bp72

Confine pre-commit to stages (#2213) @davidculley

Fixed colors extras (#2212) @staticdev

5.13.1 December 11 2023

Fixed integration tests (#2208) @bp72

Fixed normalizing imports from more than one level of parent modules (issue/2152) (#2191) @bp72

Remove optional dependencies without extras (#2207) @staticdev

Commits

c655831 Merge pull request #2214 from PyCQA/version/5.13.2
b4335b4 Prepare version 5.13.2
c36e43c Merge pull request #2184 from bp72/issue/2154
e38702f Merge pull request #2213 from davidculley/confine-precommit-to-stages
ee8d87f Add fix for the error found by hypothesis
5849ec2 Apply the bracket fix from issue 471 only for use_parentheses=True
df0e119 confine pre-commit to stages
9255bca Merge pull request #2212 from PyCQA/bugfix/Metadata API: set default version for MetaFile() theupdateframework/python-tuf#2211-colors-extra
5336d7d Fix colors extras
643d9c4 Merge pull request #2210 from PyCQA/version/5.13.1
Additional commits viewable in compare view

Updates pylint from 3.0.2 to 3.1.0

Commits

053c2c3 Bump pylint to 3.1.0, update changelog
c954636 Upgrade release documentation, and contributors.txt
7300ed2 Discover .pyi files (#9241)
9dbf3df Merge maintenance 3.0.x into main following 3.0.4 release (#9459)
28e89b0 Remove changelog fragments pertaining to 3.0.4
4332ea1 Merge branch 'maintenance/3.0.x' into main following 3.0.4 release
8115381 Bump pylint to 3.0.4, update changelog (#9458)
4bf3524 [false-negative] Fix for consider-using-min/max-builtin (#9127)
8c24b1e [pre-commit.ci] pre-commit autoupdate (#9448)
f499686 Update astroid version to 3.1.0 (#9457)
Additional commits viewable in compare view

Updates bandit from 1.7.6 to 1.7.8

Release notes

Sourced from bandit's releases.

1.7.8

What's Changed

Incorrect tag naming in readme by @lukehinds in PyCQA/bandit#1105

Utilize PyPI's trusted publishing by @ericwb in PyCQA/bandit#1107

Bump sigstore/cosign-installer from 3.3.0 to 3.4.0 by @dependabot in PyCQA/bandit#1109

Add 1.7.7 to versions of bug template by @ericwb in PyCQA/bandit#1110

Use datetime to avoid updating copyright year by @ericwb in PyCQA/bandit#1112

filter data is safe for tarfile extractall by @etienneschalk in PyCQA/bandit#1111

Bump docker/setup-buildx-action from 3.0.0 to 3.1.0 by @dependabot in PyCQA/bandit#1115

[B605] Add functions that are vulnerable to shell injection. by @shihai1991 in PyCQA/bandit#1116

Add a SARIF output formatter by @ericwb in PyCQA/bandit#1113

New Contributors

@etienneschalk made their first contribution in PyCQA/bandit#1111

@shihai1991 made their first contribution in PyCQA/bandit#1116

Full Changelog: PyCQA/bandit@1.7.7...1.7.8

1.7.7

What's Changed

Add the new release to bandit versions of bug template by @ericwb in PyCQA/bandit#1075

Bump actions/setup-python from 4 to 5 by @dependabot in PyCQA/bandit#1076

Handle variant in how policy is passed in paramiko by @ericwb in PyCQA/bandit#1078

Flag str.replace as possible sql injection by @costaparas in PyCQA/bandit#1044

defusedxml: Show correct module name by @kajinamit in PyCQA/bandit#1081

Add tidelift to the sponsor funding list by @ericwb in PyCQA/bandit#1089

Create a security policy by @ericwb in PyCQA/bandit#1091

Fix up issues found running Bandit on itself by @ericwb in PyCQA/bandit#1093

Add random.randbytes to blacklist calls by @ericwb in PyCQA/bandit#1096

Prepend ./ for files specified as CLI args by @ericwb in PyCQA/bandit#1094

Rework GitPython dependency to be an extra for bandit-baseline by @ericwb in PyCQA/bandit#1099

Bump actions/dependency-review-action from 3 to 4 by @dependabot in PyCQA/bandit#1101

Introduce Official Bandit Images by @lukehinds in PyCQA/bandit#1088

Remove markdown formatting in reStructuredText formatted README by @ericwb in PyCQA/bandit#1103

Downsize the org:repo name by @lukehinds in PyCQA/bandit#1104

New Contributors

@kajinamit made their first contribution in PyCQA/bandit#1081

Full Changelog: PyCQA/bandit@1.7.6...1.7.7

Commits

22b4226 Add a SARIF output formatter (#1113)
b603dce [B605] Add functions that are vulnerable to shell injection. (#1116)
a682a18 Bump docker/setup-buildx-action from 3.0.0 to 3.1.0 (#1115)
c8d5f77 filter data is safe for tarfile extractall (#1111)
e041e12 Use datetime to avoid updating copyright year (#1112)
5b16b6a Add 1.7.7 to versions of bug template (#1110)
858bfd8 Bump sigstore/cosign-installer from 3.3.0 to 3.4.0 (#1109)
be5d6ac Utilize PyPI's trusted publishing (#1107)
c3a07e5 Incorrect tag naming in readme (#1105)
4c5b3c8 Downsize the org:repo name (#1104)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…tory with 4 updates Bumps the test-and-lint-dependencies group with 4 updates in the / directory: [black](https://github.com/psf/black), [isort](https://github.com/pycqa/isort), [pylint](https://github.com/pylint-dev/pylint) and [bandit](https://github.com/PyCQA/bandit). Updates `black` from 23.11.0 to 24.4.2 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](psf/black@23.11.0...24.4.2) Updates `isort` from 5.13.0 to 5.13.2 - [Release notes](https://github.com/pycqa/isort/releases) - [Changelog](https://github.com/PyCQA/isort/blob/main/CHANGELOG.md) - [Commits](PyCQA/isort@5.13.0...5.13.2) Updates `pylint` from 3.0.2 to 3.1.0 - [Release notes](https://github.com/pylint-dev/pylint/releases) - [Commits](pylint-dev/pylint@v3.0.2...v3.1.0) Updates `bandit` from 1.7.6 to 1.7.8 - [Release notes](https://github.com/PyCQA/bandit/releases) - [Commits](PyCQA/bandit@1.7.6...1.7.8) --- updated-dependencies: - dependency-name: black dependency-type: direct:production update-type: version-update:semver-major dependency-group: test-and-lint-dependencies - dependency-name: isort dependency-type: direct:production update-type: version-update:semver-patch dependency-group: test-and-lint-dependencies - dependency-name: pylint dependency-type: direct:production update-type: version-update:semver-minor dependency-group: test-and-lint-dependencies - dependency-name: bandit dependency-type: direct:production update-type: version-update:semver-patch dependency-group: test-and-lint-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2024-05-06T16:53:56Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Apr 29, 2024

dependabot bot closed this May 6, 2024

dependabot bot deleted the dependabot/pip/test-and-lint-dependencies-57fc74d7ea branch May 6, 2024 16:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the test-and-lint-dependencies group across 1 directory with 4 updates#234

build(deps): bump the test-and-lint-dependencies group across 1 directory with 4 updates#234
dependabot[bot] wants to merge 1 commit intodevelopfrom
dependabot/pip/test-and-lint-dependencies-57fc74d7ea

dependabot bot commented on behalf of github Apr 29, 2024 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github May 6, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Apr 29, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

24.4.2

Parser

Performance

24.4.1

Highlights

Stable style

Parser

Integrations

24.4.0

Stable style

Preview style

Integrations

24.3.0

Highlights

24.4.2

Parser

Performance

24.4.1

Highlights

Stable style

Parser

Integrations

24.4.0

Stable style

Preview style

Integrations

24.3.0

5.13.2

Changes

🪲 Fixes

5.13.1

Changes

🪲 Fixes

5.13.2 December 13 2023

5.13.1 December 11 2023

1.7.8

What's Changed

New Contributors

1.7.7

What's Changed

New Contributors

Uh oh!

dependabot bot commented on behalf of github May 6, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Apr 29, 2024 •

edited

Loading