Bump the pip group across 1 directory with 12 updates #1

dependabot · 2025-02-12T03:49:41Z

Bumps the pip group with 12 updates in the / directory:

Package	From	To
certifi	`2023.7.22`	`2024.7.4`
cryptography	`41.0.4`	`44.0.1`
idna	`3.4`	`3.7`
jinja2	`3.1.2`	`3.1.5`
jupyter-lsp	`2.2.0`	`2.2.2`
jupyterlab	`4.0.6`	`4.2.5`
pillow	`10.0.1`	`10.3.0`
requests	`2.31.0`	`2.32.2`
scikit-learn	`1.3.1`	`1.5.0`
torch	`2.1.0`	`2.2.0`
tornado	`6.3.3`	`6.4.2`
urllib3	`2.0.6`	`2.2.2`

Updates certifi from 2023.7.22 to 2024.7.4

Commits

bd81538 2024.07.04 (#295)
06a2cbf Bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (#294)
13bba02 Bump actions/checkout from 4.1.6 to 4.1.7 (#293)
e8abcd0 Bump pypa/gh-action-pypi-publish from 1.8.14 to 1.9.0 (#292)
124f4ad 2024.06.02 (#291)
c2196ce --- (#290)
fefdeec Bump actions/checkout from 4.1.4 to 4.1.5 (#289)
3c5fb15 Bump actions/download-artifact from 4.1.6 to 4.1.7 (#286)
4a9569a Bump actions/checkout from 4.1.2 to 4.1.4 (#287)
1fc8086 Bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 (#288)
Additional commits viewable in compare view

Updates cryptography from 41.0.4 to 44.0.1

Changelog

Sourced from cryptography's changelog.

44.0.1 - 2025-02-11
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.1.
* We now build ``armv7l`` ``manylinux`` wheels and publish them to PyPI.
* We now build ``manylinux_2_34`` wheels and publish them to PyPI.
.. _v44-0-0:
44.0.0 - 2024-11-27
BACKWARDS INCOMPATIBLE: Dropped support for LibreSSL < 3.9.

Deprecated Python 3.7 support. Python 3.7 is no longer supported by the Python core team. Support for Python 3.7 will be removed in a future cryptography release.

Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0.

macOS wheels are now built against the macOS 10.13 SDK. Users on older versions of macOS should upgrade, or they will need to build cryptography themselves.

Enforce the :rfc:5280 requirement that extended key usage extensions must not be empty.

Added support for timestamp extraction to the :class:~cryptography.fernet.MultiFernet class.

Relax the Authority Key Identifier requirements on root CA certificates during X.509 verification to allow fields permitted by :rfc:5280 but forbidden by the CA/Browser BRs.

Added support for :class:~cryptography.hazmat.primitives.kdf.argon2.Argon2id when using OpenSSL 3.2.0+.

Added support for the :class:~cryptography.x509.Admissions certificate extension.

Added basic support for PKCS7 decryption (including S/MIME 3.2) via :func:~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der, :func:~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem, and :func:~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime.

.. _v43-0-3:

43.0.3 - 2024-10-18
* Fixed release metadata for ``cryptography-vectors``
.. _v43-0-2:
43.0.2 - 2024-10-18
Fixed compilation when using LibreSSL 4.0.0.

.. _v43-0-1:

... (truncated)

Commits

adaaaed Bump for 44.0.1 release (#12441)
ccc61da [backport] test and build on armv7l (#12420) (#12431)
f299a48 remove deprecated call (#12052)
439eb05 Bump version for 44.0.0 (#12051)
2c5ad4d chore(deps): bump maturin from 1.7.4 to 1.7.5 in /.github/requirements (#12050)
d23968a chore(deps): bump libc from 0.2.165 to 0.2.166 (#12049)
133c0e0 Bump x509-limbo and/or wycheproof in CI (#12047)
f2259d7 Bump BoringSSL and/or OpenSSL in CI (#12046)
e201c87 fixed metadata in changelog (#12044)
c6104cc Prohibit Python 3.9.0, 3.9.1 -- they have a bug that causes errors (#12045)
Additional commits viewable in compare view

Updates idna from 3.4 to 3.7

Release notes

Sourced from idna's releases.

v3.7

What's Changed

Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

Full Changelog: kjd/idna@v3.6...v3.7

Changelog

Sourced from idna's changelog.

3.7 (2024-04-11) ++++++++++++++++

Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

3.6 (2023-11-25) ++++++++++++++++

Fix regression to include tests in source distribution.

3.5 (2023-11-24) ++++++++++++++++

Update to Unicode 15.1.0

String codec name is now "idna2008" as overriding the system codec "idna" was not working.

Fix typing error for codec encoding

"setup.cfg" has been added for this release due to some downstream lack of adherence to PEP 517. Should be removed in a future release so please prepare accordingly.

Removed reliance on a symlink for the "idna-data" tool to comport with PEP 517 and the Python Packaging User Guide for sdist archives.

Added security reporting protocol for project

Thanks Jon Ribbens, Diogo Teles Sant'Anna, Wu Tingfeng for contributions to this release.

Commits

1d365e1 Release v3.7
c1b3154 Merge pull request #172 from kjd/optimize-contextj
0394ec7 Merge branch 'master' into optimize-contextj
cd58a23 Merge pull request #152 from elliotwutingfeng/dev
5beb28b More efficient resolution of joiner contexts
1b12148 Update ossf/scorecard-action to v2.3.1
d516b87 Update Github actions/checkout to v4
c095c75 Merge branch 'master' into dev
60a0a4c Fix typo in GitHub Actions workflow key
5918a0e Merge branch 'master' into dev
Additional commits viewable in compare view

Updates jinja2 from 3.1.2 to 3.1.5

Release notes

Sourced from jinja2's releases.

3.1.5

This is the Jinja 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Jinja2/3.1.5/ Changes: https://jinja.palletsprojects.com/changes/#version-3-1-5 Milestone: https://github.com/pallets/jinja/milestone/16?closed=1

The sandboxed environment handles indirect calls to str.format, such as by passing a stored reference to a filter that calls its argument. GHSA-q2x7-8rv6-6q7h

Escape template name before formatting it into error messages, to avoid issues with names that contain f-string syntax. #1792, GHSA-gmj6-6f8f-6699

Sandbox does not allow clear and pop on known mutable sequence types. #2032

Calling sync render for an async template uses asyncio.run. #1952

Avoid unclosed auto_aiter warnings. #1960

Return an aclose-able AsyncGenerator from Template.generate_async. #1960

Avoid leaving root_render_func() unclosed in Template.generate_async. #1960

Avoid leaving async generators unclosed in blocks, includes and extends. #1960

The runtime uses the correct concat function for the current environment when calling block references. #1701

Make |unique async-aware, allowing it to be used after another async-aware filter. #1781

|int filter handles OverflowError from scientific notation. #1921

Make compiling deterministic for tuple unpacking in a {% set ... %} call. #2021

Fix dunder protocol (copy/pickle/etc) interaction with Undefined objects. #2025

Fix copy/pickle support for the internal missing object. #2027

Environment.overlay(enable_async) is applied correctly. #2061

The error message from FileSystemLoader includes the paths that were searched. #1661

PackageLoader shows a clearer error message when the package does not contain the templates directory. #1705

Improve annotations for methods returning copies. #1880

urlize does not add mailto: to values like @a@b. #1870

Tests decorated with @pass_context can be used with the |select filter. #1624

Using set for multiple assignment (a, b = 1, 2) does not fail when the target is a namespace attribute. #1413

Using set in all branches of {% if %}{% elif %}{% else %} blocks does not cause the variable to be considered initially undefined. #1253

3.1.4

This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.

PyPI: https://pypi.org/project/Jinja2/3.1.4/ Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-4

The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. GHSA-h75v-3vvj-5mfj

3.1.3

This is a fix release for the 3.1.x feature branch.

Fix for GHSA-h5c8-rqwp-cp95. You are affected if you are using xmlattr and passing user input as attribute keys.

Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-3

Milestone: https://github.com/pallets/jinja/milestone/15?closed=1

Changelog

Sourced from jinja2's changelog.

Version 3.1.5

Released 2024-12-21

The sandboxed environment handles indirect calls to str.format, such as by passing a stored reference to a filter that calls its argument. :ghsa:q2x7-8rv6-6q7h

Escape template name before formatting it into error messages, to avoid issues with names that contain f-string syntax. :issue:1792, :ghsa:gmj6-6f8f-6699

Sandbox does not allow clear and pop on known mutable sequence types. :issue:2032

Calling sync render for an async template uses asyncio.run. :pr:1952

Avoid unclosed auto_aiter warnings. :pr:1960

Return an aclose-able AsyncGenerator from Template.generate_async. :pr:1960

Avoid leaving root_render_func() unclosed in Template.generate_async. :pr:1960

Avoid leaving async generators unclosed in blocks, includes and extends. :pr:1960

The runtime uses the correct concat function for the current environment when calling block references. :issue:1701

Make |unique async-aware, allowing it to be used after another async-aware filter. :issue:1781

|int filter handles OverflowError from scientific notation. :issue:1921

Make compiling deterministic for tuple unpacking in a {% set ... %} call. :issue:2021

Fix dunder protocol (copy/pickle/etc) interaction with Undefined objects. :issue:2025

Fix copy/pickle support for the internal missing object. :issue:2027

Environment.overlay(enable_async) is applied correctly. :pr:2061

The error message from FileSystemLoader includes the paths that were searched. :issue:1661

PackageLoader shows a clearer error message when the package does not contain the templates directory. :issue:1705

Improve annotations for methods returning copies. :pr:1880

urlize does not add mailto: to values like @a@b. :pr:1870

Tests decorated with @pass_context`` can be used with the ``|select`` filter. :issue:1624`

Using set for multiple assignment (a, b = 1, 2) does not fail when the target is a namespace attribute. :issue:1413

Using set in all branches of {% if %}{% elif %}{% else %} blocks does not cause the variable to be considered initially undefined. :issue:1253

... (truncated)

Commits

877f6e5 release version 3.1.5
8d58859 remove test pypi
eda8fe8 update dev dependencies
c8fdce1 Fix bug involving calling set on a template parameter within all branches of ...
66587ce Fix bug where set would sometimes fail within if
fbc3a69 Add support for namespaces in tuple parsing (#1664)
b8f4831 more comments about nsref assignment
ee83219 Add support for namespaces in tuple assignment
1d55cdd Triple quotes in docs (#2064)
8a8eafc edit block assignment section
Additional commits viewable in compare view

Updates jupyter-lsp from 2.2.0 to 2.2.2

Changelog

Sourced from jupyter-lsp's changelog.

jupyter-lsp 2.2.2

bug fixes:

address warning about renamed extension_points (#1035)

fix compatibility with jupyter server 1.x

fix an authentication-related security vulnerability (see the advisory for details)

enhancements:

add authorization support (lsp resource, jupyter-server v2+ only) - this allows server operators for fine grained access control, e.g. in case if specific users (such as guest or read-only users) should not be allowed to access LSP; this is in addition to authentication fixes

@jupyter-lsp/jupyterlab-lsp 5.0.1

bug fixes:

fix false “undefined name” in %%time and %%capture magics #1007 (thanks @i-aki-y!)

fix completion items for paths and other long items being cut off #1025

workaround issue with markdown lost on edit #1016

fix latex/Greek letters insertion and other completions which do not match prefix (do not pre-filter completions from kernel) #1022

fix completions in Console #1023

fix customising priority after pre-setting it with overrides.json #1027

fix jump to definitions in a file inside root in Pyright on Windows #1024

fix typos in setting title and help message #999 and #1010

maintenance:

fix bootstrap script #1021

bump axios from 1.2.1 to 1.6.2 #1019

bump @babel/traverse from 7.22.5 to 7.23.4 #1020

jupyter-lsp 2.2.1

bug fixes:

use APIHandler over JupyterHandler to get CORS OPTIONS #952 (thanks @zhanba!)

use shutil.which to discover npm executable on Windows (thanks @jameshurst!)

maintenance:

resolve traitlets type warnings, lint, remove six #1015

use sys.executable in stdio tests #998

@jupyter-lsp/jupyterlab-lsp 5.0.0

enhancements:

uses toast notifications instead of messages on status bar

diagnostics panel will be re-opened on reload

maintenance:

support JupyterLab 4

use upstream @jupyterlab/lsp package

use camelCase convention in TypeScript/JavaScript code

use @codemirror/linter to show diagnostics

this comes with a different style of underlines and custom tooltips

known issues/limitations:

configuration of language servers via JSON Settings Editor may result in a spurious warning due to a transitive clash with settings from the UI editor when using nested pattern (e.g. {pylsp: {flake8: {enabled: true}}}); the dotted pattern (e.g. {"pylsp.flake8.enabled": true}) does not lead to such problem.

... (truncated)

Commits

See full diff in compare view

Updates jupyterlab from 4.0.6 to 4.2.5

Release notes

Sourced from jupyterlab's releases.

v4.2.5

4.2.5

(Full Changelog)

Bugs fixed

Use locale name instead of display/native name to toggle language #16710 (@maitreya2954)

Prevent replacing code with find and replace in read-only cells #16682 (@itsmevichu)

Do not block shift-click mouse up handler on active cell #16647 (@EdsterG)

Maintenance and upkeep improvements

Bump braces from 3.0.2 to 3.0.3 #16486 (@dependabot[bot])

Documentation improvements

Fix JupyterLab install instructions in the debugger docs #16683 (@jtpio)

Contributors to this release

(GitHub contributors page for this release)

@davidbrochart | @fcollonval | @github-actions | @HaudinFlorence | @JasonWeill | @jtpio | @jupyterlab-probot | @krassowski | @meeseeksmachine | @Mehak261124 | @Rob-P-Smith | @tonyfast | @welcome | @williamstein

v4.2.4

4.2.4

(Full Changelog)

Bugs fixed

Fix the identifier to download licenses in JSON format #16584 (@joaopalmeiro)

Update JupyterLab wordmark color #16567 (@joaopalmeiro)

Add customisation options to prevent inline completer resizing aggressively #16507 (@krassowski)

Fix license table CSS selector to apply the selected row styles #16547 (@joaopalmeiro)

Maintenance and upkeep improvements

Bump ws from 8.12.0 to 8.17.1 #16495 (@dependabot[bot])

Documentation improvements

Fix galata docs on overriding tmpPath #16587 (@krassowski)

Align extension migration docs with the latest extension template #16450 (@jtpio)

... (truncated)

Changelog

Sourced from jupyterlab's changelog.

4.2.5

(Full Changelog)

Bugs fixed

Use locale name instead of display/native name to toggle language #16710 (@maitreya2954)

Prevent replacing code with find and replace in read-only cells #16682 (@itsmevichu)

Do not block shift-click mouse up handler on active cell #16647 (@EdsterG)

Maintenance and upkeep improvements

Bump braces from 3.0.2 to 3.0.3 #16486 (@dependabot[bot])

Documentation improvements

Fix JupyterLab install instructions in the debugger docs #16683 (@jtpio)

Contributors to this release

(GitHub contributors page for this release)

@davidbrochart | @fcollonval | @github-actions | @HaudinFlorence | @JasonWeill | @jtpio | @jupyterlab-probot | @krassowski | @meeseeksmachine | @Mehak261124 | @Rob-P-Smith | @tonyfast | @welcome | @williamstein

4.2.4

(Full Changelog)

Bugs fixed

Fix the identifier to download licenses in JSON format #16584 (@joaopalmeiro)

Update JupyterLab wordmark color #16567 (@joaopalmeiro)

Add customisation options to prevent inline completer resizing aggressively #16507 (@krassowski)

Fix license table CSS selector to apply the selected row styles #16547 (@joaopalmeiro)

Maintenance and upkeep improvements

Bump ws from 8.12.0 to 8.17.1 #16495 (@dependabot[bot])

Documentation improvements

Fix galata docs on overriding tmpPath #16587 (@krassowski)

Align extension migration docs with the latest extension template #16450 (@jtpio)

Contributors to this release

(GitHub contributors page for this release)

... (truncated)

Commits

a046125 [ci skip] Publish 4.2.5
88e24ba Merge commit from fork
58d7535 Backport PR #16710: Use locale name instead of display/native name to toggle ...
524f71d Backport PR #16486: Bump braces from 3.0.2 to 3.0.3 (#16699)
7bf7ec5 Backport PR #16682: Prevent replacing code with find and replace in read-only...
355cbd5 Backport PR #16683: Fix JupyterLab install instructions in the debugger docs ...
1fa4474 Backport PR #16647: Do not block shift-click mouse up handler on active cell ...
c639643 [ci skip] Publish 4.2.4
8f78e27 Backport PR #16450 on branch 4.2.x (Align extension migration docs with the l...
9223530 Backport PR #16507: Add customisation options to prevent inline completer res...
Additional commits viewable in compare view

Updates pillow from 10.0.1 to 10.3.0

Release notes

Sourced from pillow's releases.

10.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html

Deprecations

Deprecate eval(), replacing it with lambda_eval() and unsafe_eval() #7927 [@hugovk]

Deprecate ImageCms constants and versions() function #7702 [@nulano]

Changes

CVE-2024-28219: Use strncpy to avoid buffer overflow #7928 [@hugovk]

Use functools.lru_cache for hopper() #7912 [@hugovk]

Raise ValueError if seeking to greater than offset-sized integer in TIFF #7883 [@radarhere]

Improve speed of loading QOI images #7925 [@radarhere]

Added RGB to I;16N conversion #7920 [@radarhere]

Add --report argument to main.py to omit supported formats #7818 [@nulano]

Added RGB to I;16, I;16L and I;16B conversion #7918 [@radarhere]

Fix editable installation with custom build backend and configuration options #7658 [@nulano]

Fix putdata() for I;16N on big-endian #7209 [@Yay295]

Determine MPO size from markers, not EXIF data #7884 [@radarhere]

Improved conversion from RGB to RGBa, LA and La #7888 [@radarhere]

Support FITS images with GZIP_1 compression #7894 [@radarhere]

Use I;16 mode for 9-bit JPEG 2000 images #7900 [@scaramallion]

Raise ValueError if kmeans is negative #7891 [@radarhere]

Remove TIFF tag OSUBFILETYPE when saving using libtiff #7893 [@radarhere]

Raise ValueError for negative values when loading P1-P3 PPM images #7882 [@radarhere]

Added reading of JPEG2000 palettes #7870 [@radarhere]

Added alpha_quality argument when saving WebP images #7872 [@radarhere]

Fixed joined corners for ImageDraw rounded_rectangle() non-integer dimensions #7881 [@radarhere]

Removed Python and NumPy pinning on Cygwin #7880 [@radarhere]

Update UnidentifiedImageError and version imports #7644 [@radarhere]

Stop reading EPS image at EOF marker #7753 [@radarhere]

PSD layer co-ordinates may be negative #7706 [@radarhere]

Use subprocess with CREATE_NO_WINDOW flag in ImageShow WindowsViewer #7791 [@radarhere]

When saving GIF frame that restores to background color, do not fill identical pixels #7788 [@radarhere]

Fixed reading PNG iCCP compression method #7823 [@radarhere]

Allow writing IFDRational to UNDEFINED tag #7840 [@radarhere]

Fix logged tag name when loading Exif data #7842 [@radarhere]

Use maximum frame size in IHDR chunk when saving APNG images #7821 [@radarhere]

Prevent opening P TGA images without a palette #7797 [@radarhere]

Use palette when loading ICO images #7798 [@radarhere]

Use consistent arguments for load_read and load_seek #7713 [@radarhere]

Turn off nullability warnings for macOS SDK #7827 [@radarhere]

Fix shift-sign issue in Convert.c #7838 [@r-barnes]

winbuild: Refactor dependency versions into constants #7843 [@hugovk]

Build macOS arm64 wheels natively #7852 [@radarhere]

Fixed typo #7855 [@radarhere]

Open 16-bit grayscale PNGs as I;16 #7849 [@radarhere]

Handle truncated chunks at the end of PNG images #7709 [@lajiyuan]

Match mask size to pasted image size in GifImagePlugin #7779 [@radarhere]

... (truncated)

Changelog

Sourced from pillow's changelog.

10.3.0 (2024-04-01)

CVE-2024-28219: Use strncpy to avoid buffer overflow #7928 [radarhere, hugovk]

Deprecate eval(), replacing it with lambda_eval() and unsafe_eval() #7927 [radarhere, hugovk]

Raise ValueError if seeking to greater than offset-sized integer in TIFF #7883 [radarhere]

Add --report argument to __main__.py to omit supported formats #7818 [nulano, radarhere, hugovk]

Added RGB to I;16, I;16L, I;16B and I;16N conversion #7918, #7920 [radarhere]

Fix editable installation with custom build backend and configuration options #7658 [nulano, radarhere]

Fix putdata() for I;16N on big-endian #7209 [Yay295, hugovk, radarhere]

Determine MPO size from markers, not EXIF data #7884 [radarhere]

Improved conversion from RGB to RGBa, LA and La #7888 [radarhere]

Support FITS images with GZIP_1 compression #7894 [radarhere]

Use I;16 mode for 9-bit JPEG 2000 images #7900 [scaramallion, radarhere]

Raise ValueError if kmeans is negative #7891 [radarhere]

Remove TIFF tag OSUBFILETYPE when saving using libtiff #7893 [radarhere]

Raise ValueError for negative values when loading P1-P3 PPM images #7882 [radarhere]

Added reading of JPEG2000 palettes #7870 [radarhere]

Added alpha_quality argument when saving WebP images #7872 [radarhere]

... (truncated)

Commits

5c89d88 10.3.0 version bump
63cbfcf Update CHANGES.rst [ci skip]
2776126 Merge pull request #7928 from python-pillow/lcms
aeb51cb Merge branch 'main' into lcms
5beb0b6 Update CHANGES.rst [ci skip]
cac6ffa Merge pull request #7927 from python-pillow/imagemath
f5eeeac Name as 'options' in lambda_eval and unsafe_eval, but '_dict' in deprecated eval
facf3af Added release notes
2a93aba Use strncpy to avoid buffer overflow
a670597 Update CHANGES.rst [ci skip]
Additional commits viewable in compare view

Updates requests from 2.31.0 to 2.32.2

Release notes

Sourced from requests's releases.

v2.32.2

2.32.2 (2024-05-21)

Deprecations

To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

v2.32.1

2.32.1 (2024-05-20)

Bugfixes

Add missing test certs to the sdist distributed on PyPI.

v2.32.0

2.32.0 (2024-05-20)

🐍 PYCON US 2024 EDITION 🐍

Security

Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification, regardless of the value of verify. (GHSA-9wx4-h78v-vm56)

Improvements

verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems when using a Python version built with OpenSSL 3.x. (#6667)

Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored. This enables pip and other projects to minimize their vendoring surface area. The Response.text() and apparent_encoding APIs will default to utf-8 if neither library is present. (#6702)

Bugfixes

Fixed bug in length detection where emoji length was incorrectly calculated in the request content-length. (#6589)

Fixed deserialization bug in JSONDecodeError. (#6629)

Fixed bug where an extra leading / (path separator) could lead urllib3 to unnecessarily reparse the request URI. (#6644)

... (truncated)

Changelog

Sourced from requests's changelog.

2.32.2 (2024-05-21)

Deprecations

To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

2.32.1 (2024-05-20)

Bugfixes

Add missing test certs to the sdist distributed on PyPI.

2.32.0 (2024-05-20)

Security

Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification, regardless of the value of verify. (GHSA-9wx4-h78v-vm56)

Improvements

verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems when using a Python version built with OpenSSL 3.x. (#6667)

Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored. This enables pip and other projects to minimize their vendoring surface area. The Response.text() and apparent_encoding APIs will default to utf-8 if neither library is present. (#6702)

Bugfixes

Fixed bug in length detection where emoji length was incorrectly calculated in the request content-length. (#6589)

Fixed deserialization bug in JSONDecodeError. (#6629)

Fixed bug where an extra leading / (path separator) could lead urllib3 to unnecessarily reparse the request URI. (#6644)

Deprecations

... (truncated)

...

Description has been truncated

Bumps the pip group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [certifi](https://github.com/certifi/python-certifi) | `2023.7.22` | `2024.7.4` | | [cryptography](https://github.com/pyca/cryptography) | `41.0.4` | `44.0.1` | | [idna](https://github.com/kjd/idna) | `3.4` | `3.7` | | [jinja2](https://github.com/pallets/jinja) | `3.1.2` | `3.1.5` | | [jupyter-lsp](https://github.com/jupyter-lsp/jupyterlab-lsp) | `2.2.0` | `2.2.2` | | [jupyterlab](https://github.com/jupyterlab/jupyterlab) | `4.0.6` | `4.2.5` | | [pillow](https://github.com/python-pillow/Pillow) | `10.0.1` | `10.3.0` | | [requests](https://github.com/psf/requests) | `2.31.0` | `2.32.2` | | [scikit-learn](https://github.com/scikit-learn/scikit-learn) | `1.3.1` | `1.5.0` | | [torch](https://github.com/pytorch/pytorch) | `2.1.0` | `2.2.0` | | [tornado](https://github.com/tornadoweb/tornado) | `6.3.3` | `6.4.2` | | [urllib3](https://github.com/urllib3/urllib3) | `2.0.6` | `2.2.2` | Updates `certifi` from 2023.7.22 to 2024.7.4 - [Commits](certifi/python-certifi@2023.07.22...2024.07.04) Updates `cryptography` from 41.0.4 to 44.0.1 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@41.0.4...44.0.1) Updates `idna` from 3.4 to 3.7 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst) - [Commits](kjd/idna@v3.4...v3.7) Updates `jinja2` from 3.1.2 to 3.1.5 - [Release notes](https://github.com/pallets/jinja/releases) - [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst) - [Commits](pallets/jinja@3.1.2...3.1.5) Updates `jupyter-lsp` from 2.2.0 to 2.2.2 - [Release notes](https://github.com/jupyter-lsp/jupyterlab-lsp/releases) - [Changelog](https://github.com/jupyter-lsp/jupyterlab-lsp/blob/main/CHANGELOG.md) - [Commits](https://github.com/jupyter-lsp/jupyterlab-lsp/commits) Updates `jupyterlab` from 4.0.6 to 4.2.5 - [Release notes](https://github.com/jupyterlab/jupyterlab/releases) - [Changelog](https://github.com/jupyterlab/jupyterlab/blob/@jupyterlab/lsp@4.2.5/CHANGELOG.md) - [Commits](https://github.com/jupyterlab/jupyterlab/compare/@jupyterlab/lsp@4.0.6...@jupyterlab/lsp@4.2.5) Updates `pillow` from 10.0.1 to 10.3.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@10.0.1...10.3.0) Updates `requests` from 2.31.0 to 2.32.2 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.31.0...v2.32.2) Updates `scikit-learn` from 1.3.1 to 1.5.0 - [Release notes](https://github.com/scikit-learn/scikit-learn/releases) - [Commits](scikit-learn/scikit-learn@1.3.1...1.5.0) Updates `torch` from 2.1.0 to 2.2.0 - [Release notes](https://github.com/pytorch/pytorch/releases) - [Changelog](https://github.com/pytorch/pytorch/blob/main/RELEASE.md) - [Commits](pytorch/pytorch@v2.1.0...v2.2.0) Updates `tornado` from 6.3.3 to 6.4.2 - [Changelog](https://github.com/tornadoweb/tornado/blob/v6.4.2/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.3.3...v6.4.2) Updates `urllib3` from 2.0.6 to 2.2.2 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.0.6...2.2.2) --- updated-dependencies: - dependency-name: certifi dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-type: direct:production dependency-group: pip - dependency-name: idna dependency-type: direct:production dependency-group: pip - dependency-name: jinja2 dependency-type: direct:production dependency-group: pip - dependency-name: jupyter-lsp dependency-type: direct:production dependency-group: pip - dependency-name: jupyterlab dependency-type: direct:production dependency-group: pip - dependency-name: pillow dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-type: direct:production dependency-group: pip - dependency-name: scikit-learn dependency-type: direct:production dependency-group: pip - dependency-name: torch dependency-type: direct:production dependency-group: pip - dependency-name: tornado dependency-type: direct:production dependency-group: pip - dependency-name: urllib3 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added the dependencies Pull requests that update a dependency file label Feb 12, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the pip group across 1 directory with 12 updates #1

Bump the pip group across 1 directory with 12 updates #1

dependabot bot commented on behalf of github Feb 12, 2025

Bump the pip group across 1 directory with 12 updates #1

Are you sure you want to change the base?

Bump the pip group across 1 directory with 12 updates #1

Conversation

dependabot bot commented on behalf of github Feb 12, 2025

v3.7

What's Changed

3.1.5

3.1.4

3.1.3

Version 3.1.5

jupyter-lsp 2.2.2

@jupyter-lsp/jupyterlab-lsp 5.0.1

jupyter-lsp 2.2.1

@jupyter-lsp/jupyterlab-lsp 5.0.0

v4.2.5

4.2.5

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

v4.2.4

4.2.4

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

4.2.5

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

4.2.4

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

10.3.0

Deprecations

Changes

10.3.0 (2024-04-01)

v2.32.2

2.32.2 (2024-05-21)

v2.32.1

2.32.1 (2024-05-20)

v2.32.0

2.32.0 (2024-05-20)

🐍 PYCON US 2024 EDITION 🐍

2.32.2 (2024-05-21)

2.32.1 (2024-05-20)

2.32.0 (2024-05-20)

`jupyter-lsp 2.2.2`

`@jupyter-lsp/jupyterlab-lsp 5.0.1`

`jupyter-lsp 2.2.1`

`@jupyter-lsp/jupyterlab-lsp 5.0.0`