Deps: Bump the python-packages group with 3 updates #1226

dependabot · 2025-05-05T05:03:21Z

Bumps the python-packages group with 3 updates: charset-normalizer, cryptography and ruff.

Updates charset-normalizer from 3.4.1 to 3.4.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.4.2

3.4.2 (2025-05-02)

Fixed

Addressed the DeprecationWarning in our CLI regarding argparse.FileType by backporting the target class into the package. (#591)

Improved the overall reliability of the detector with CJK Ideographs. (#605) (#587)

Changed

Optional mypyc compilation upgraded to version 1.15 for Python >= 3.9

Changelog

Sourced from charset-normalizer's changelog.

3.4.2 (2025-05-02)

Fixed

Addressed the DeprecationWarning in our CLI regarding argparse.FileType by backporting the target class into the package. (#591)

Improved the overall reliability of the detector with CJK Ideographs. (#605) (#587)

Changed

Optional mypyc compilation upgraded to version 1.15 for Python >= 3.8

Commits

6422af1 📝 update release date
0e60ec1 🔖 Release 3.4.2 (#614)
f6630ce ⬆️ Bump pypa/cibuildwheel from 2.23.2 to 2.23.3 (#617)
677c999 ⬆️ Bump actions/download-artifact from 4.2.1 to 4.3.0 (#618)
960ab1e ⬆️ Bump actions/setup-python from 5.5.0 to 5.6.0 (#619)
6eb6325 ⬆️ Bump github/codeql-action from 3.28.10 to 3.28.16 (#620)
c99c0f2 ⬆️ Update coverage requirement from <7.7,>=7.2.7 to >=7.2.7,<7.9 (#606)
270f28e ⬆️ Bump actions/setup-python from 5.4.0 to 5.5.0 (#607)
d4d89a0 ⬆️ Bump pypa/cibuildwheel from 2.22.0 to 2.23.2 (#608)
905fcf5 ⬆️ Bump slsa-framework/slsa-github-generator from 2.0.0 to 2.1.0 (#609)
Additional commits viewable in compare view

Updates cryptography from 44.0.2 to 44.0.3

Changelog

Sourced from cryptography's changelog.

44.0.3 - 2025-05-02

* Fixed compilation when using LibreSSL 4.1.0.

.. _v44-0-2:

Commits

b92c841 [44.0.x] backports for libressl 4.1.0 support release (#12848)
387ca00 Hopefully add Window / MacOS PyPy 3.10 / 3.11 support (#12559)
See full diff in compare view

Updates ruff from 0.11.7 to 0.11.8

Release notes

Sourced from ruff's releases.

0.11.8

Release Notes

Preview features

[airflow] Apply auto fixes to cases where the names have changed in Airflow 3 (AIR302, AIR311) (#17553, #17570, #17571)

[airflow] Extend AIR301 rule (#17598)

[airflow] Update existing AIR302 rules with better suggestions (#17542)

[refurb] Mark fix as safe for readlines-in-for (FURB129) (#17644)

[syntax-errors] nonlocal declaration at module level (#17559)

[syntax-errors] Detect single starred expression assignment x = *y (#17624)

Bug fixes

[flake8-pyi] Ensure Literal[None,] | Literal[None,] is not autofixed to None | None (PYI061) (#17659)

[flake8-use-pathlib] Avoid suggesting Path.iterdir() for os.listdir with file descriptor (PTH208) (#17715)

[flake8-use-pathlib] Fix PTH104 false positive when rename is passed a file descriptor (#17712)

[flake8-use-pathlib] Fix PTH116 false positive when stat is passed a file descriptor (#17709)

[flake8-use-pathlib] Fix PTH123 false positive when open is passed a file descriptor from a function call (#17705)

[pycodestyle] Fix duplicated diagnostic in E712 (#17651)

[pylint] Detect global declarations in module scope (PLE0118) (#17411)

[syntax-errors] Make async-comprehension-in-sync-comprehension more specific (#17460)

Configuration

Add option to disable typing_extensions imports (#17611)

Documentation

Fix example syntax for the lint.pydocstyle.ignore-var-parameters option (#17740)

Add fix safety sections (ASYNC116, FLY002, D200, RUF005, RUF017, RUF027, RUF028, RUF057) (#17497, #17496, #17502, #17484, #17480, #17485, #17722, #17483)

Other changes

Add Python 3.14 to configuration options (#17647)

Make syntax error for unparenthesized except tuples version specific to before 3.14 (#17660)

Contributors

@AlexWaygood

@BurntSushi

@Jie211

@Kalmaegi

@LaBatata101

@Lee-W

@MichaReiser

@VascoSch92

@abhijeetbodas2001

@brendancooley

@carljm

... (truncated)

Changelog

Sourced from ruff's changelog.

0.11.8

Preview features

[airflow] Apply auto fixes to cases where the names have changed in Airflow 3 (AIR302, AIR311) (#17553, #17570, #17571)

[airflow] Extend AIR301 rule (#17598)

[airflow] Update existing AIR302 rules with better suggestions (#17542)

[refurb] Mark fix as safe for readlines-in-for (FURB129) (#17644)

[syntax-errors] nonlocal declaration at module level (#17559)

[syntax-errors] Detect single starred expression assignment x = *y (#17624)

Bug fixes

[flake8-pyi] Ensure Literal[None,] | Literal[None,] is not autofixed to None | None (PYI061) (#17659)

[flake8-use-pathlib] Avoid suggesting Path.iterdir() for os.listdir with file descriptor (PTH208) (#17715)

[flake8-use-pathlib] Fix PTH104 false positive when rename is passed a file descriptor (#17712)

[flake8-use-pathlib] Fix PTH116 false positive when stat is passed a file descriptor (#17709)

[flake8-use-pathlib] Fix PTH123 false positive when open is passed a file descriptor from a function call (#17705)

[pycodestyle] Fix duplicated diagnostic in E712 (#17651)

[pylint] Detect global declarations in module scope (PLE0118) (#17411)

[syntax-errors] Make async-comprehension-in-sync-comprehension more specific (#17460)

Configuration

Add option to disable typing_extensions imports (#17611)

Documentation

Fix example syntax for the lint.pydocstyle.ignore-var-parameters option (#17740)

Add fix safety sections (ASYNC116, FLY002, D200, RUF005, RUF017, RUF027, RUF028, RUF057) (#17497, #17496, #17502, #17484, #17480, #17485, #17722, #17483)

Other changes

Add Python 3.14 to configuration options (#17647)

Make syntax error for unparenthesized except tuples version specific to before 3.14 (#17660)

Commits

75effb8 Bump 0.11.8 (#17766)
3353d07 [flake8-use-pathlib] Fix PTH104false positive when rename is passed a f...
41f3f21 Improve messages outputted by py-fuzzer (#17764)
76ec64d [red-knot] Allow subclasses of Any to be assignable to Callable types (#17717)
b7e69ec [red-knot] Increase durability of read-only File fields (#17757)
9c57862 [red-knot] Cache source type during semanic index building (#17756)
67ef370 [flake8-use-pathlib] Fix PTH116 false positive when stat is passed a fi...
e17e1e8 Sync vendored typeshed stubs (#17753)
03d8679 [red-knot] Preliminary NamedTuple support (#17738)
d33a503 [red-knot] Add tests for classes that have incompatible __new__ and `__init...
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python-packages group with 3 updates: [charset-normalizer](https://github.com/jawah/charset_normalizer), [cryptography](https://github.com/pyca/cryptography) and [ruff](https://github.com/astral-sh/ruff). Updates `charset-normalizer` from 3.4.1 to 3.4.2 - [Release notes](https://github.com/jawah/charset_normalizer/releases) - [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md) - [Commits](jawah/charset_normalizer@3.4.1...3.4.2) Updates `cryptography` from 44.0.2 to 44.0.3 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@44.0.2...44.0.3) Updates `ruff` from 0.11.7 to 0.11.8 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.11.7...0.11.8) --- updated-dependencies: - dependency-name: charset-normalizer dependency-version: 3.4.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: python-packages - dependency-name: cryptography dependency-version: 44.0.3 dependency-type: indirect update-type: version-update:semver-patch dependency-group: python-packages - dependency-name: ruff dependency-version: 0.11.8 dependency-type: indirect update-type: version-update:semver-patch dependency-group: python-packages ... Signed-off-by: dependabot[bot] <[email protected]>

github-actions · 2025-05-05T05:03:34Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
❌ 2 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
✅ 0 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 556a0c6.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

poetry.lock

Package	Version	License	Issue Type
charset-normalizer	3.4.2	LGPL-2.1-only AND MIT AND MPL-1.1	Incompatible License
ruff	0.11.8	0BSD AND Apache-2.0 AND BSD-3-Clause AND MIT	Incompatible License

Allowed Licenses: 0BSD, AGPL-3.0-or-later, Apache-2.0, BlueOak-1.0.0, BSD-2-Clause, BSD-3-Clause-Clear, BSD-3-Clause, BSL-1.0, CAL-1.0, CC-BY-3.0, CC-BY-4.0, CC-BY-SA-4.0, CC0-1.0, EPL-2.0, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-2.0, GPL-3.0-only, GPL-3.0-or-later, GPL-3.0, ISC, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-2.1, LGPL-3.0-only, LGPL-3.0, LGPL-3.0-or-later, MIT, MIT-CMU, MPL-1.1, MPL-2.0, OFL-1.1, PSF-2.0, Python-2.0, Python-2.0.1, Unicode-DFS-2016, Unlicense, Zlib, ZPL-2.1

OpenSSF Scorecard

Package

Version

Score

Details

pip/charset-normalizer

3.4.2

🟢 8.1

Details

Check	Score	Reason
Code-Review	⚠️ 0	Found 0/4 approved changesets -- score normalized to 0
Dependency-Update-Tool	🟢 10	update tool detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Maintained	🟢 10	21 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts	🟢 10	no binaries found in the repo
Security-Policy	🟢 10	security policy file detected
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
CII-Best-Practices	⚠️ 2	badge detected: InProgress
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	🟢 10	5 out of the last 5 releases have a total of 5 signed artifacts.
License	🟢 10	license file detected
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits
Branch-Protection	🟢 8	branch protection is not maximal on development and all release branches
CI-Tests	🟢 10	23 out of 23 merged PRs checked by a CI test -- score normalized to 10
Contributors	🟢 3	project has 1 contributing companies or organizations -- score normalized to 3

pip/cryptography

44.0.3

🟢 8.2

Details

Check	Score	Reason
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Security-Policy	🟢 10	security policy file detected
Code-Review	🟢 10	all changesets reviewed
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases	⚠️ -1	no releases found
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Fuzzing	🟢 10	project is fuzzed
Packaging	🟢 10	packaging workflow detected
Binary-Artifacts	🟢 10	no binaries found in the repo
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities	🟢 7	3 existing vulnerabilities detected
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4

pip/ruff

0.11.8

Unknown

Scanned Files

poetry.lock

github-actions · 2025-05-05T05:03:49Z

Conventional Commits Report

Type	Number
Dependencies	1

🚀 Conventional commits found.

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels May 5, 2025

dependabot bot requested review from a team as code owners May 5, 2025 05:03

greenbonebot enabled auto-merge (rebase) May 5, 2025 05:03

bjoernricks approved these changes May 5, 2025

View reviewed changes

greenbonebot merged commit c95213f into main May 5, 2025
24 of 25 checks passed

greenbonebot deleted the dependabot/pip/python-packages-b21a530c8f branch May 5, 2025 06:24

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Deps: Bump the python-packages group with 3 updates #1226

Deps: Bump the python-packages group with 3 updates #1226

Uh oh!

dependabot bot commented on behalf of github May 5, 2025 •

edited

Loading

Uh oh!

github-actions bot commented May 5, 2025

Uh oh!

github-actions bot commented May 5, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Deps: Bump the python-packages group with 3 updates #1226

Deps: Bump the python-packages group with 3 updates #1226

Uh oh!

Conversation

dependabot bot commented on behalf of github May 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Version 3.4.2

3.4.2 (2025-05-02)

Fixed

Changed

3.4.2 (2025-05-02)

Fixed

Changed

0.11.8

Release Notes

Preview features

Bug fixes

Configuration

Documentation

Other changes

Contributors

0.11.8

Preview features

Bug fixes

Configuration

Documentation

Other changes

Uh oh!

github-actions bot commented May 5, 2025

Dependency Review

Snapshot Warnings

License Issues

poetry.lock

OpenSSF Scorecard

Scanned Files

Uh oh!

github-actions bot commented May 5, 2025

Conventional Commits Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dependabot bot commented on behalf of github May 5, 2025 •

edited

Loading