Skip to content

Bump the pip group across 5 directories with 7 updates - #1

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pyperformance/data-files/benchmarks/bm_django_template/pip-9b6cc31a49
Open

Bump the pip group across 5 directories with 7 updates#1
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pyperformance/data-files/benchmarks/bm_django_template/pip-9b6cc31a49

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Feb 5, 2025

Copy link
Copy Markdown

Bumps the pip group with 2 updates in the /pyperformance/data-files/benchmarks/bm_django_template directory: django and sqlparse.
Bumps the pip group with 2 updates in the /pyperformance/data-files/benchmarks/bm_dulwich_log directory: certifi and urllib3.
Bumps the pip group with 1 update in the /pyperformance/data-files/benchmarks/bm_mako directory: mako.
Bumps the pip group with 1 update in the /pyperformance/data-files/benchmarks/bm_sympy directory: mpmath.
Bumps the pip group with 1 update in the /pyperformance/data-files/benchmarks/bm_tornado_http directory: tornado.

Updates django from 3.2.4 to 4.2.18

Commits

Updates sqlparse from 0.4.1 to 0.5.0

Changelog

Sourced from sqlparse's changelog.

Release 0.5.0 (Apr 13, 2024)

Notable Changes

  • Drop support for Python 3.5, 3.6, and 3.7.
  • Python 3.12 is now supported (pr725, by hugovk).
  • IMPORTANT: Fixes a potential denial of service attack (DOS) due to recursion error for deeply nested statements. Instead of recursion error a generic SQLParseError is raised. See the security advisory for details: GHSA-2m57-hf25-phgg The vulnerability was discovered by @​uriyay-jfrog. Thanks for reporting!

Enhancements

  • Splitting statements now allows to remove the semicolon at the end. Some database backends love statements without semicolon (issue742).
  • Support TypedLiterals in get_parameters (pr749, by Khrol).
  • Improve splitting of Transact SQL when using GO keyword (issue762).
  • Support for some JSON operators (issue682).
  • Improve formatting of statements containing JSON operators (issue542).
  • Support for BigQuery and Snowflake keywords (pr699, by griffatrasgo).
  • Support parsing of OVER clause (issue701, pr768 by r33s3n6).

Bug Fixes

  • Ignore dunder attributes when creating Tokens (issue672).
  • Allow operators to precede dollar-quoted strings (issue763).
  • Fix parsing of nested order clauses (issue745, pr746 by john-bodley).
  • Thread-safe initialization of Lexer class (issue730).
  • Classify TRUNCATE as DDL and GRANT/REVOKE as DCL keywords (based on pr719 by josuc1, thanks for bringing this up!).
  • Fix parsing of PRIMARY KEY (issue740).

Other

  • Optimize performance of matching function (pr799, by admachainz).

Release 0.4.4 (Apr 18, 2023)

Notable Changes

  • IMPORTANT: This release fixes a security vulnerability in the parser where a regular expression vulnerable to ReDOS (Regular Expression Denial of Service) was used. See the security advisory for details: GHSA-rrm6-wvj7-cwh2 The vulnerability was discovered by @​erik-krogh from GitHub Security Lab (GHSL). Thanks for reporting!

... (truncated)

Commits
  • ddbd0ec Bump version.
  • 29f2e0a Raise recursion limit for tests.
  • b4a39d9 Raise SQLParseError instead of RecursionError.
  • f1bcf2f Update AUHTORS and Changelog.
  • e03b74e Fix Function.get_parameters(), add Funtion.get_window()
  • 617b8f6 Add OVER clause, and group it into Function (fixes #701)
  • d8f8147 Update AUHTORS and Changelog.
  • 012c9f1 Optimize sqlparse.utils.imt().
  • 46971e5 Fix parsing of PRIMARY KEY (fixes #740).
  • fc4b0be Code cleanup.
  • Additional commits viewable in compare view

Updates certifi from 2021.5.30 to 2024.7.4

Commits

Updates urllib3 from 1.26.5 to 1.26.19

Release notes

Sourced from urllib3's releases.

1.26.19

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

  • Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.

Full Changelog: urllib3/urllib3@1.26.18...1.26.19

Note that due to an issue with our release automation, no multiple.intoto.jsonl file is available for this release.

1.26.18

  • Made body stripped from HTTP requests changing the request method to GET after HTTP 303 "See Other" redirect responses. (GHSA-g4mx-q9vg-27p4)

1.26.17

  • Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect. (GHSA-v845-jxx5-vc9f)

1.26.16

  • Fixed thread-safety issue where accessing a PoolManager with many distinct origins would cause connection pools to be closed while requests are in progress (#2954)

1.26.15

1.26.14

  • Fixed parsing of port 0 (zero) returning None, instead of 0 (#2850)
  • Removed deprecated HTTPResponse.getheaders() calls in urllib3.contrib module.

1.26.13

  • Deprecated the HTTPResponse.getheaders() and HTTPResponse.getheader() methods.
  • Fixed an issue where parsing a URL with leading zeroes in the port would be rejected even when the port number after removing the zeroes was valid.
  • Fixed a deprecation warning when using cryptography v39.0.0.
  • Removed the <4 in the Requires-Python packaging metadata field.

1.26.12

  • Deprecated the urllib3[secure] extra and the urllib3.contrib.pyopenssl module. Both will be removed in v2.x. See this GitHub issue for justification and info on how to migrate.

1.26.11

If you or your organization rely on urllib3 consider supporting us via GitHub Sponsors.

⚠️ urllib3 v2.0 will drop support for Python 2: Read more in the v2.0 Roadmap

  • Fixed an issue where reading more than 2 GiB in a call to HTTPResponse.read would raise an OverflowError on Python 3.9 and earlier.

... (truncated)

Changelog

Sourced from urllib3's changelog.

1.26.19 (2024-06-17)

  • Added the Proxy-Authorization header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect.
  • Fixed handling of OpenSSL 3.2.0 new error message for misconfiguring an HTTP proxy as HTTPS. ([#3405](https://github.com/urllib3/urllib3/issues/3405) <https://github.com/urllib3/urllib3/issues/3405>__)

1.26.18 (2023-10-17)

  • Made body stripped from HTTP requests changing the request method to GET after HTTP 303 "See Other" redirect responses.

1.26.17 (2023-10-02)

  • Added the Cookie header to the list of headers to strip from requests when redirecting to a different host. As before, different headers can be set via Retry.remove_headers_on_redirect. ([#3139](https://github.com/urllib3/urllib3/issues/3139) <https://github.com/urllib3/urllib3/pull/3139>_)

1.26.16 (2023-05-23)

  • Fixed thread-safety issue where accessing a PoolManager with many distinct origins would cause connection pools to be closed while requests are in progress ([#2954](https://github.com/urllib3/urllib3/issues/2954) <https://github.com/urllib3/urllib3/pull/2954>_)

1.26.15 (2023-03-10)

  • Fix socket timeout value when HTTPConnection is reused ([#2645](https://github.com/urllib3/urllib3/issues/2645) <https://github.com/urllib3/urllib3/issues/2645>__)
  • Remove "!" character from the unreserved characters in IPv6 Zone ID parsing ([#2899](https://github.com/urllib3/urllib3/issues/2899) <https://github.com/urllib3/urllib3/issues/2899>__)
  • Fix IDNA handling of '\x80' byte ([#2901](https://github.com/urllib3/urllib3/issues/2901) <https://github.com/urllib3/urllib3/issues/2901>__)

1.26.14 (2023-01-11)

  • Fixed parsing of port 0 (zero) returning None, instead of 0. ([#2850](https://github.com/urllib3/urllib3/issues/2850) <https://github.com/urllib3/urllib3/issues/2850>__)
  • Removed deprecated getheaders() calls in contrib module. Fixed the type hint of PoolKey.key_retries by adding bool to the union. ([#2865](https://github.com/urllib3/urllib3/issues/2865) <https://github.com/urllib3/urllib3/issues/2865>__)

1.26.13 (2022-11-23)

  • Deprecated the HTTPResponse.getheaders() and HTTPResponse.getheader() methods.
  • Fixed an issue where parsing a URL with leading zeroes in the port would be rejected even when the port number after removing the zeroes was valid.
  • Fixed a deprecation warning when using cryptography v39.0.0.
  • Removed the <4 in the Requires-Python packaging metadata field.

1.26.12 (2022-08-22)

  • Deprecated the urllib3[secure] extra and the urllib3.contrib.pyopenssl module. Both will be removed in v2.x. See this GitHub issue <https://github.com/urllib3/urllib3/issues/2680>_

... (truncated)

Commits

Updates mako from 1.1.4 to 1.2.2

Release notes

Sourced from mako's releases.

1.2.2

Released: Mon Aug 29 2022

bug

  • [bug] [lexer] Fixed issue in lexer where the regexp used to match tags would not correctly interpret quoted sections individually. While this parsing issue still produced the same expected tag structure later on, the mis-handling of quoted sections was also subject to a regexp crash if a tag had a large number of quotes within its quoted sections.

    References: #366

1.2.1

Released: Thu Jun 30 2022

bug

  • [bug] [tests] Various fixes to the test suite in the area of exception message rendering to accommodate for variability in Python versions as well as Pygments.

    References: #360

misc

  • [performance] Optimized some codepaths within the lexer/Python code generation process, improving performance for generation of templates prior to their being cached. Pull request courtesy Takuto Ikuta.

    References: #361

1.2.0

Released: Thu Mar 10 2022

changed

  • [changed] [py3k] Corrected "universal wheel" directive in setup.cfg so that building a wheel does not target Python 2.

    References: #351

  • [changed] [py3k] The bytestring_passthrough template argument is removed, as this flag only applied to Python 2.

... (truncated)

Commits

Updates mpmath from 1.2.1 to 1.3.0

Release notes

Sourced from mpmath's releases.

1.3.0

Security issues:

  • Fixed ReDOS vulnerability in mpmathify() (CVE-2021-29063) (Vinzent Steinberg)

Features:

  • Added quadsubdiv() for numerical integration with adaptive path splitting (Fredrik Johansson)
  • Added the Cohen algorithm for inverse Laplace transforms (Guillermo Navas-Palencia)
  • Some speedup of matrix multiplication (Fredrik Johansson)
  • Optimizations to Carlson elliptic integrals (Paul Masson)
  • Added signal functions (squarew(), trianglew(), sawtoothw(), unit_triangle() sigmoidw()) (Nike Dattani, Deyan Mihaylov, Tina Yu)

Bug fixes:

  • Correct mpf initialization from tuple for finf and fninf (Sergey B Kirpichev)
  • Support QR decomposition for matrices of width 0 and 1 (Clemens Hofreither)
  • Fixed some cases where elliprj() gave inaccurate results (Fredrik Johansson)
  • Fixed cases where digamma() hangs for complex input (Fredrik Johansson)
  • Fixed cases of polylog() with integer-valued parameter with complex type (Fredrik Johansson)
  • Fixed fp.nsum() with Euler-Maclaurin algorithm (Fredrik Johansson)

Maintenance:

  • Dropped support for Python 3.4 (Sergey B Kirpichev)
  • Documentation cleanup (Sergey B Kirpichev)
  • Removed obsolete files (Sergey B Kirpichev)
  • Added options to runtests.py to skip tests and exit on failure (Jonathan Warner)
Changelog

Sourced from mpmath's changelog.

--1.3.0-- Released March 7, 2023

Security issues:

  • Fixed ReDOS vulnerability in mpmathify() (CVE-2021-29063) (Vinzent Steinberg)

Features:

  • Added quadsubdiv() for numerical integration with adaptive path splitting (Fredrik Johansson)
  • Added the Cohen algorithm for inverse Laplace transforms (Guillermo Navas-Palencia)
  • Some speedup of matrix multiplication (Fredrik Johansson)
  • Optimizations to Carlson elliptic integrals (Paul Masson)
  • Added signal functions (squarew(), trianglew(), sawtoothw(), unit_triangle() sigmoidw()) (Nike Dattani, Deyan Mihaylov, Tina Yu)

Bug fixes:

  • Correct mpf initialization from tuple for finf and fninf (Sergey B Kirpichev)
  • Support QR decomposition for matrices of width 0 and 1 (Clemens Hofreither)
  • Fixed some cases where elliprj() gave inaccurate results (Fredrik Johansson)
  • Fixed cases where digamma() hangs for complex input (Fredrik Johansson)
  • Fixed cases of polylog() with integer-valued parameter with complex type (Fredrik Johansson)
  • Fixed fp.nsum() with Euler-Maclaurin algorithm (Fredrik Johansson)

Maintenance:

  • Dropped support for Python 3.4 (Sergey B Kirpichev)
  • Documentation cleanup (Sergey B Kirpichev)
  • Removed obsolete files (Sergey B Kirpichev)
  • Added options to runtests.py to skip tests and exit on failure (Jonathan Warner)

--1.2.0-- Released February 1, 2021

Features and optimizations:

  • Support @ operator for matrix multiplication (Max Gaukler)
  • Add eta() implementing the Dedekind eta function
  • Optimized the python_trailing function (adhoc-king)
  • Implement unary plus for matrices (Max Gaukler)
  • Improved calculation of gram_index (p15-git-acc)

Compatibility:

... (truncated)

Commits
  • b5c0450 version 1.3.0
  • a27581c Merge pull request #656 from cclauss/patch-2
  • 9d7884b don't use .ae method in library code
  • 967de83 Downgrade to ubuntu-20.04 for Py35 and Py36
  • 6425c6a build: strategy: fail-fast: false
  • e2341c7 GitHub Actions: Test on Python 3.11 production release
  • 1258e33 fix failing doctests
  • b7c15d6 include signals documentation; remove duplicate docstrings
  • 1b476ea update doc building instructions
  • 5f57beb Merge pull request #646 from cclauss/patch-1
  • Additional commits viewable in compare view

Updates tornado from 6.2 to 6.4.2

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1 releases/v3.2.0 releases/v3.1.1 releases/v3.1.0 releases/v3.0.2 releases/v3.0.1 releases/v3.0.0 releases/v2.4.1 releases/v2.4.0

... (truncated)

Commits
  • a5ecfab Bump version to 6.4.2
  • bc7df6b Fix tests with Twisted 24.7.0
  • d5ba4a1 httputil: Fix quadratic performance of cookie parsing
  • 2a0e1d1 Merge pull request #3388 from bdarnell/release-641
  • b7af4e8 Release notes and version bump for version 6.4.1
  • d65f6e7 Merge pull request #3387 from bdarnell/chunked-parsing
  • 8d721a8 httputil: Only strip tabs and spaces from header values
  • 7786f09 Merge pull request #3386 from bdarnell/curl-crlf
  • fb119c7 http1connection: Stricter handling of transfer-encoding
  • b0ffc58 curl_httpclient,http1connection: Prohibit CR and LF in headers
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the pip group across 5 directories with 7 updates
e7c319c 
Bumps the pip group with 2 updates in the /pyperformance/data-files/benchmarks/bm_django_template directory: [django](https://github.com/django/django) and [sqlparse](https://github.com/andialbrecht/sqlparse).
Bumps the pip group with 2 updates in the /pyperformance/data-files/benchmarks/bm_dulwich_log directory: [certifi](https://github.com/certifi/python-certifi) and [urllib3](https://github.com/urllib3/urllib3).
Bumps the pip group with 1 update in the /pyperformance/data-files/benchmarks/bm_mako directory: [mako](https://github.com/sqlalchemy/mako).
Bumps the pip group with 1 update in the /pyperformance/data-files/benchmarks/bm_sympy directory: [mpmath](https://github.com/fredrik-johansson/mpmath).
Bumps the pip group with 1 update in the /pyperformance/data-files/benchmarks/bm_tornado_http directory: [tornado](https://github.com/tornadoweb/tornado).


Updates `django` from 3.2.4 to 4.2.18
- [Commits](django/django@3.2.4...4.2.18)

Updates `sqlparse` from 0.4.1 to 0.5.0
- [Changelog](https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG)
- [Commits](andialbrecht/sqlparse@0.4.1...0.5.0)

Updates `certifi` from 2021.5.30 to 2024.7.4
- [Commits](certifi/python-certifi@2021.05.30...2024.07.04)

Updates `urllib3` from 1.26.5 to 1.26.19
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@1.26.5...1.26.19)

Updates `mako` from 1.1.4 to 1.2.2
- [Release notes](https://github.com/sqlalchemy/mako/releases)
- [Changelog](https://github.com/sqlalchemy/mako/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/mako/commits)

Updates `mpmath` from 1.2.1 to 1.3.0
- [Release notes](https://github.com/fredrik-johansson/mpmath/releases)
- [Changelog](https://github.com/mpmath/mpmath/blob/master/CHANGES)
- [Commits](mpmath/mpmath@1.2.1...1.3.0)

Updates `tornado` from 6.2 to 6.4.2
- [Changelog](https://github.com/tornadoweb/tornado/blob/v6.4.2/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.2.0...v6.4.2)

---
updated-dependencies:
- dependency-name: django
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: sqlparse
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: certifi
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: urllib3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: mako
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: mpmath
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: tornado
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Feb 5, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants