Bump the pip group across 2 directories with 7 updates #2
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=80&v=4){kind=small}
Bumps the pip group with 7 updates in the / directory: | Package | From | To | | --- | --- | --- | | [black](https://github.com/psf/black) | `23.3.0` | `24.3.0` | | [jinja2](https://github.com/pallets/jinja) | `3.1.3` | `3.1.4` | | [tornado](https://github.com/tornadoweb/tornado) | `6.3.3` | `6.4` | | [cryptography](https://github.com/pyca/cryptography) | `41.0.6` | `42.0.4` | | [jupyter-server](https://github.com/jupyter-server/jupyter_server) | `1.23.5` | `2.11.2` | | [pymongo](https://github.com/mongodb/mongo-python-driver) | `4.3.3` | `4.6.3` | | [dbt-core](https://github.com/dbt-labs/dbt-core) | `1.7.4` | `1.7.13` | Bumps the pip group with 1 update in the /mage_integrations directory: [pymongo](https://github.com/mongodb/mongo-python-driver). Updates `black` from 23.3.0 to 24.3.0 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](psf/black@23.3.0...24.3.0) Updates `jinja2` from 3.1.3 to 3.1.4 - [Release notes](https://github.com/pallets/jinja/releases) - [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst) - [Commits](pallets/jinja@3.1.3...3.1.4) Updates `tornado` from 6.3.3 to 6.4 - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.3.3...v6.4.0) Updates `cryptography` from 41.0.6 to 42.0.4 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@41.0.6...42.0.4) Updates `jupyter-server` from 1.23.5 to 2.11.2 - [Release notes](https://github.com/jupyter-server/jupyter_server/releases) - [Changelog](https://github.com/jupyter-server/jupyter_server/blob/main/CHANGELOG.md) - [Commits](jupyter-server/jupyter_server@v1.23.5...v2.11.2) Updates `pymongo` from 4.3.3 to 4.6.3 - [Release notes](https://github.com/mongodb/mongo-python-driver/releases) - [Changelog](https://github.com/mongodb/mongo-python-driver/blob/master/doc/changelog.rst) - [Commits](mongodb/mongo-python-driver@4.3.3...4.6.3) Updates `dbt-core` from 1.7.4 to 1.7.13 - [Release notes](https://github.com/dbt-labs/dbt-core/releases) - [Changelog](https://github.com/dbt-labs/dbt-core/blob/v1.7.13/CHANGELOG.md) - [Commits](dbt-labs/dbt-core@v1.7.4...v1.7.13) Updates `pymongo` from 4.3.3 to 4.6.3 - [Release notes](https://github.com/mongodb/mongo-python-driver/releases) - [Changelog](https://github.com/mongodb/mongo-python-driver/blob/master/doc/changelog.rst) - [Commits](mongodb/mongo-python-driver@4.3.3...4.6.3) --- updated-dependencies: - dependency-name: black dependency-type: direct:development dependency-group: pip - dependency-name: jinja2 dependency-type: direct:production dependency-group: pip - dependency-name: tornado dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-type: direct:production dependency-group: pip - dependency-name: jupyter-server dependency-type: direct:production dependency-group: pip - dependency-name: pymongo dependency-type: direct:production dependency-group: pip - dependency-name: dbt-core dependency-type: direct:production dependency-group: pip - dependency-name: pymongo dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <[email protected]>
|
Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.
Note 🟢 Risk threshold not exceeded. Change Summary (click to expand)The following is a summary of changes in this pull request made by me, your security buddy 🤖. Summary: The changes in this pull request primarily focus on updating the versions of various Python dependencies used in the project. These updates include libraries such as From an application security perspective, these updates are generally positive as they likely address known security vulnerabilities and improve the overall security of the dependencies used in the application. Keeping dependencies up-to-date is an important practice for maintaining a secure application. However, it's crucial to thoroughly test the application after these updates to ensure that no regressions or unexpected behavior have been introduced. Additionally, it's recommended to review the changelogs for the updated dependencies to understand any significant changes or security-related fixes that have been made. The addition of Azure-related and data processing/streaming dependencies suggests that the application may be integrating with or utilizing these services and technologies. It's important to ensure that the integration and usage of these components are implemented securely, following best practices and recommendations from the respective vendors or industry standards. Files Changed:
Powered by DryRun Security |
Bumps the pip group with 7 updates in the / directory:
23.3.024.3.03.1.33.1.46.3.36.441.0.642.0.41.23.52.11.24.3.34.6.31.7.41.7.13Bumps the pip group with 1 update in the /mage_integrations directory: pymongo.
Updates
blackfrom 23.3.0 to 24.3.0Release notes
Sourced from black's releases.
... (truncated)
Changelog
Sourced from black's changelog.
... (truncated)
Commits
552baf8Prepare release 24.3.0 (#4279)f000936Fix catastrophic performance in lines_with_leading_tabs_expanded() (#4278)7b5a657Fix --line-ranges behavior when ranges are at EOF (#4273)1abcffcUse regex where we ignore case on windows (#4252)719e674Fix 4227: Improve documentation for --quiet --check (#4236)e5510afupdate plugin url for Thonny (#4259)6af7d11Fix AST safety check false negative (#4270)f03ee11Ensureblib2to3.pygramis initialized before use (#4224)e4bfedbfix: Don't move comments while splitting delimiters (#4248)d0287e1Make trailing comma logic more concise (#4202)Updates
jinja2from 3.1.3 to 3.1.4Release notes
Sourced from jinja2's releases.
Changelog
Sourced from jinja2's changelog.
Commits
dd4a8b5release version 3.1.40668239Merge pull request from GHSA-h75v-3vvj-5mfjd655030disallow invalid characters in keys to xmlattr filtera7863baadd ghsa linksb5c98e7start version 3.1.4da3a9f0update project files (#1968)0ee5eb4satisfy formatter, linter, and strict mypy20477c6update project files (#5457)e491223update pyyaml dev dependency36f9885fix pr linkUpdates
tornadofrom 6.3.3 to 6.4Changelog
Sourced from tornado's changelog.
... (truncated)
Commits
b3f2a4bMerge pull request #3352 from bdarnell/master451419cSet version to 6.4 final5a87723Merge pull request #3348 from bdarnell/iostream-hostname-test2da0a99iostream_test: Don't require server-side log on windows06e1a65iostream_test: Test check_hostname functionality.a6dfd70Merge pull request #3341 from bdarnell/more-utcnowc60d80cweb,demos: Remove more uses of deprecated datetime utc methods55db80eMerge pull request #3339 from tornadoweb/dependabot/pip/urllib3-1.26.18ec59fa0Merge pull request #3332 from bdarnell/selector-thread-atexitdcc6e59build(deps): bump urllib3 from 1.26.17 to 1.26.18Updates
cryptographyfrom 41.0.6 to 42.0.4Changelog
Sourced from cryptography's changelog.
... (truncated)
Commits
fe18470Bump for 42.0.4 release (#10445)aaa2dd0Fix ASN.1 issues in PKCS#7 and S/MIME signing (#10373) (#10442)7a4d012Fixes #10422 -- don't crash when a PKCS#12 key and cert don't match (#10423) ...df314bbbackport actions m1 switch to 42.0.x (#10415)c49a7a5changelog and version bump for 42.0.3 (#10396)396bcf6fix provider loading take two (#10390) (#10395)0e0e46fbackport: initialize openssl's legacy provider in rust (#10323) (#10333)2202123changelog and version bump 42.0.2 (#10268)f7032bdbump openssl in CI (#10298) (#10299)002e886Fixes #10294 -- correct accidental change to exchange kwarg (#10295) (#10296)Updates
jupyter-serverfrom 1.23.5 to 2.11.2Release notes
Sourced from jupyter-server's releases.
... (truncated)
Changelog
Sourced from jupyter-server's changelog.
... (truncated)
Commits
9bd9657Publish 2.11.20056c3aMerge pull request from GHSA-h56g-gq9v-vc8r88eca99Bump to 2.12.0.dev03755794Publish 2.11.140a95e5avoid unhandled error on some invalid paths (#1369)ecd5b1fChange md5 to hash and hash_algorithm, fix incompatibility (#1367)8e5d766Bump to 2.12.0.dev0cc74bb6Publish 2.11.0e7c0f33Update api docs with md5 param (#1364)0983b71Update ruff and typings (#1365)Updates
pymongofrom 4.3.3 to 4.6.3Release notes
Sourced from pymongo's releases.
Changelog
Sourced from pymongo's changelog.
... (truncated)
Commits
8da192fBUMP 4.6.356b6b6dPYTHON-4305 Fix bson size check (#1564)449d0f3BUMP to 4.6.3.dev0e04576dDEVPROD-3871 Use teardown_task when there is one function/command (#1533)cf1c6a1PYTHON-4219 Prep for 4.6.2 Release (#1530)d29b2b7PYTHON-4147 [v4.6]: Silence noisy thread.start() RuntimeError at shutdown (#1...0477b9bPYTHON-4077 [v4.6]: Ensure there is a MacOS wheel for Python 3.7 (#1527)ecad17dBUMP 4.6.2.dev0485e0a5BUMP 4.6.1995365cPYTHON-4038 [v4.6]: Ensure retryable readOperationFailures re-raise except...Updates
dbt-corefrom 1.7.4 to 1.7.13Release notes
Sourced from dbt-core's releases.
... (truncated)
Changelog
Sourced from dbt-core's changelog.
... (truncated)
Commits
6095b02Bumping version to 1.7.13 and generate changelog483a4e8[BACKPORT 1.7] bump sqlparse (#9965)f9cff92[Automated] Merged prep-release/1.7.12_8708637173 into target 1.7.latest duri...ef37e62Bumping version to 1.7.12 and generate changelog227877ebe less explicit (#9936) (#9937)ffa1a38update to wrk for all versions (#9916) (#9919)2c24aa7[1.7] Fix Workflow Deprecations (#9799)947f397[BACKPORT 1.7] Exclude password-like fields for considering reparse (#9844) ...b8681a3[Backport to 1.7.latest] Fix assorted source freshness edgecases so check is ...dd070b9[Automated] Merged prep-release/1.7.11_8461692987 into target 1.7.latest duri...Updates
pymongofrom 4.3.3 to 4.6.3Release notes
Sourced from pymongo's releases.
Changelog
Sourced from pymongo's changelog.
... (truncated)
Commits
8da192fBUMP 4.6.356b6b6dPYTHON-4305 Fix bson size check (#1564)449d0f3BUMP to 4.6.3.dev0e04576dDEVPROD-3871 Use teardown_task when there is one function/command (#1533)cf1c6a1PYTHON-4219 Prep for 4.6.2 Release (#1530)d29b2b7PYTHON-4147 [v4.6]: Silence noisy thread.start() RuntimeError at shutdown (#1...0477b9bPYTHON-4077 [v4.6]: Ensure there is a MacOS wheel for Python 3.7 (#1527)ecad17dBUMP 4.6.2.dev0485e0a5BUMP 4.6.1995365cPYTHON-4038 [v4.6]: Ensure retryable readOperationFailures re-raise except...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.