Deps: Bump the python-packages group with 3 updates

[dependabot]

Bumps the python-packages group with 3 updates: pontos, certifi and ruff.

Updates pontos from 24.12.0 to 24.12.3

Release notes

Sourced from pontos's releases.

pontos 24.12.3

24.12.3 - 2024-12-13

Added

• Tests for CPE match string API ae1dc66

Bug Fixes

• Make cpe_last_modified of CPE matches optional a215412
• Convert matchCriteriaId to string for HTTP requests 31e47e8

pontos 24.12.2

24.12.2 - 2024-12-13

Added

• Retrying for NVDApi (#1070) 1fc864f

pontos 24.12.1

24.12.1 - 2024-12-12

Changed

• Fix endless loop in NVDApi (#1073) 7631819

Dependencies

• Bump the python-packages group with 5 updates 54d814c

Commits

• 4ae86b3 Automatic release to 24.12.3
• a215412 Fix: Make cpe_last_modified of CPE matches optional
• b2fa245 Remove duplicate test_cpe_matches_request_results, sort imports
• 9e64235 Fix formatting for new CPE match API tests
• ae1dc66 Add: Tests for CPE match string API
• 31e47e8 Fix: Convert matchCriteriaId to string for HTTP requests
• 1e5103c Automatic adjustments after release [skip ci]
• 721a24b Automatic release to 24.12.2
• 1fc864f Add: Retrying for NVDApi (#1070)
• 01eeea2 Automatic adjustments after release [skip ci]
• Additional commits viewable in compare view

Updates certifi from 2024.8.30 to 2024.12.14

Commits

• 4ba3900 2024.12.14 (#329)
• 9164660 Bump pypa/gh-action-pypi-publish from 1.12.2 to 1.12.3 (#331)
• 3dc3651 Bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.2 (#328)
• c5bf18d Bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0 (#327)
• b908391 Bump actions/setup-python from 5.2.0 to 5.3.0 (#326)
• bc26b41 Bump actions/checkout from 4.2.1 to 4.2.2 (#325)
• 57afc22 Bump actions/upload-artifact from 4.4.1 to 4.4.3 (#323)
• a495091 test against 3.13 final
• 62f8144 Added 3.13 classifier (#322)
• 94d23a0 Bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3 (#321)
• Additional commits viewable in compare view

Updates ruff from 0.8.2 to 0.8.3

Release notes

Sourced from ruff's releases.

0.8.3

Release Notes

Preview features

• Fix fstring formatting removing overlong implicit concatenated string in expression part (#14811)
• [airflow] Add fix to remove deprecated keyword arguments (AIR302) (#14887)
• [airflow]: Extend rule to include deprecated names for Airflow 3.0 (AIR302) (#14765 and #14804)
• [flake8-bugbear] Improve error messages for except* (B025, B029, B030, B904) (#14815)
• [flake8-bugbear] itertools.batched() without explicit strict (B911) (#14408)
• [flake8-use-pathlib] Dotless suffix passed to Path.with_suffix() (PTH210) (#14779)
• [pylint] Include parentheses and multiple comparators in check for boolean-chained-comparison (PLR1716) (#14781)
• [ruff] Do not simplify round() calls (RUF046) (#14832)
• [ruff] Don't emit used-dummy-variable on function parameters (RUF052) (#14818)
• [ruff] Implement if-key-in-dict-del (RUF051) (#14553)
• [ruff] Mark autofix for RUF052 as always unsafe (#14824)
• [ruff] Teach autofix for used-dummy-variable about TypeVars etc. (RUF052) (#14819)

Rule changes

• [flake8-bugbear] Offer unsafe autofix for no-explicit-stacklevel (B028) (#14829)
• [flake8-pyi] Skip all type definitions in string-or-bytes-too-long (PYI053) (#14797)
• [pyupgrade] Do not report when a UTF-8 comment is followed by a non-UTF-8 one (UP009) (#14728)
• [pyupgrade] Mark fixes for convert-typed-dict-functional-to-class and convert-named-tuple-functional-to-class as unsafe if they will remove comments (UP013, UP014) (#14842)

Bug fixes

• Raise syntax error for mixing except and except* (#14895)
• [flake8-bugbear] Fix B028 to allow stacklevel to be explicitly assigned as a positional argument (#14868)
• [flake8-bugbear] Skip B028 if warnings.warn is called with *args or **kwargs (#14870)
• [flake8-comprehensions] Skip iterables with named expressions in unnecessary-map (C417) (#14827)
• [flake8-pyi] Also remove self and cls's annotation (PYI034) (#14801)
• [flake8-pytest-style] Fix pytest-parametrize-names-wrong-type (PT006) to edit both argnames and argvalues if both of them are single-element tuples/lists (#14699)
• [perflint] Improve autofix for PERF401 (#14369)
• [pylint] Fix PLW1508 false positive for default string created via a mult operation (#14841)

Contributors

• @​AlexWaygood
• @​BurntSushi
• @​DimitriPapadopoulos
• @​Glyphack
• @​InSyncWithFoo
• @​Lee-W
• @​MichaReiser
• @​UnknownPlatypus
• @​carljm
• @​cclauss
• @​dcreager
• @​dhruvmanila
• @​dylwil3

... (truncated)

Changelog

Sourced from ruff's changelog.

0.8.3

Preview features

• Fix fstring formatting removing overlong implicit concatenated string in expression part (#14811)
• [airflow] Add fix to remove deprecated keyword arguments (AIR302) (#14887)
• [airflow]: Extend rule to include deprecated names for Airflow 3.0 (AIR302) (#14765 and #14804)
• [flake8-bugbear] Improve error messages for except* (B025, B029, B030, B904) (#14815)
• [flake8-bugbear] itertools.batched() without explicit strict (B911) (#14408)
• [flake8-use-pathlib] Dotless suffix passed to Path.with_suffix() (PTH210) (#14779)
• [pylint] Include parentheses and multiple comparators in check for boolean-chained-comparison (PLR1716) (#14781)
• [ruff] Do not simplify round() calls (RUF046) (#14832)
• [ruff] Don't emit used-dummy-variable on function parameters (RUF052) (#14818)
• [ruff] Implement if-key-in-dict-del (RUF051) (#14553)
• [ruff] Mark autofix for RUF052 as always unsafe (#14824)
• [ruff] Teach autofix for used-dummy-variable about TypeVars etc. (RUF052) (#14819)

Rule changes

• [flake8-bugbear] Offer unsafe autofix for no-explicit-stacklevel (B028) (#14829)
• [flake8-pyi] Skip all type definitions in string-or-bytes-too-long (PYI053) (#14797)
• [pyupgrade] Do not report when a UTF-8 comment is followed by a non-UTF-8 one (UP009) (#14728)
• [pyupgrade] Mark fixes for convert-typed-dict-functional-to-class and convert-named-tuple-functional-to-class as unsafe if they will remove comments (UP013, UP014) (#14842)

Bug fixes

• Raise syntax error for mixing except and except* (#14895)
• [flake8-bugbear] Fix B028 to allow stacklevel to be explicitly assigned as a positional argument (#14868)
• [flake8-bugbear] Skip B028 if warnings.warn is called with *args or **kwargs (#14870)
• [flake8-comprehensions] Skip iterables with named expressions in unnecessary-map (C417) (#14827)
• [flake8-pyi] Also remove self and cls's annotation (PYI034) (#14801)
• [flake8-pytest-style] Fix pytest-parametrize-names-wrong-type (PT006) to edit both argnames and argvalues if both of them are single-element tuples/lists (#14699)
• [perflint] Improve autofix for PERF401 (#14369)
• [pylint] Fix PLW1508 false positive for default string created via a mult operation (#14841)

Commits

• 53f2d72 Revert certain double quotes from workflow shell script (#14939)
• 3629cbf Use double quotes consistently for shell scripts (#14938)
• 37f4338 Bump version to 0.8.3 (#14937)
• 45b565c [red-knot] Any cannot be parameterized (#14933)
• 82faa9b Add tests demonstrating f-strings with debug expressions in replacements that...
• 2eac00c [perflint] fix invalid hoist in perf401 (#14369)
• 033ecf5 Also have zizmor check for low-severity security issues (#14893)
• 5509a3d Add LSP settings example for Zed editor (#14894)
• e4885a2 [red-knot] Understand typing.Tuple (#14927)
• a7e5e42 [red-knot] Make attributes.md test future-proof (#14923)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 1 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 1 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA a7a2e83.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

poetry.lock

Package	Version	License	Issue Type
pontos	24.12.3	GPL-3.0 AND GPL-3.0-only AND GPL-3.0-or-later	Incompatible License
certifi	2024.12.14	Null	Unknown License

Allowed Licenses: 0BSD, AGPL-3.0-or-later, Apache-2.0, BlueOak-1.0.0, BSD-2-Clause, BSD-3-Clause-Clear, BSD-3-Clause, BSL-1.0, CAL-1.0, CC-BY-3.0, CC-BY-4.0, CC-BY-SA-4.0, CC0-1.0, EPL-2.0, GPL-2.0-only, GPL-2.0-or-later, GPL-2.0, GPL-3.0-or-later, ISC, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-2.1, LGPL-3.0-only, LGPL-3.0, LGPL-3.0-or-later, MIT, MIT-CMU, MPL-1.1, MPL-2.0, OFL-1.1, PSF-2.0, Python-2.0, Python-2.0.1, Unicode-DFS-2016, Unlicense

OpenSSF Scorecard

Package	Version	Score	Details
pip/certifi	2024.12.14	🟢 7.2	Details Check Score Reason Code-Review 🟢 6 Found 2/3 approved changesets -- score normalized to 6 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 15 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities 🟢 10 0 existing vulnerabilities detected Signed-Releases ⚠️ -1 no releases found License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Packaging 🟢 10 packaging workflow detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/pontos	24.12.3	🟢 7.1	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection 🟢 8 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 16 out of 16 merged PRs checked by a CI test -- score normalized to 10 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Code-Review 🟢 3 Found 5/13 approved changesets -- score normalized to 3 Contributors 🟢 6 project has 2 contributing companies or organizations -- score normalized to 6 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Maintained 🟢 10 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Packaging 🟢 10 packaging workflow detected Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 SAST 🟢 10 SAST tool is run on all commits Security-Policy ⚠️ 0 security policy file not detected Signed-Releases 🟢 8 5 out of the last 5 releases have a total of 5 signed artifacts. Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Vulnerabilities 🟢 10 0 existing vulnerabilities detected
pip/ruff	0.8.3	Unknown	Unknown

Scanned Files

• poetry.lock

[github-actions]

Conventional Commits Report

Type	Number
Dependencies	1

🚀 Conventional commits found.