build(deps): bump the minor-and-patch group with 9 updates #668

dependabot · 2025-06-16T13:10:34Z

Bumps the minor-and-patch group with 9 updates:

Package	From	To
certifi	`2025.4.26`	`2025.6.15`
requests	`2.32.3`	`2.32.4`
stac-check	`1.7.0`	`1.8.0`
stac-validator	`3.8.1`	`3.9.1`
coverage	`7.8.2`	`7.9.1`
safety	`3.3.0`	`3.5.0`
cryptography	`45.0.3`	`45.0.4`
safety-schemas	`0.0.10`	`0.0.14`
watchfiles	`1.0.5`	`1.1.0`

Updates certifi from 2025.4.26 to 2025.6.15

Commits

e767d59 2025.06.15 (#357)
3e70765 Bump actions/setup-python from 5.5.0 to 5.6.0
9afd2ff Bump actions/download-artifact from 4.2.1 to 4.3.0
d7c816c remove code that's no longer required that 3.7 is our minimum (#351)
1899613 Declare setuptools as the build backend in pyproject.toml (#350)
c874142 update CI for ubuntu 20.04 deprecation (#348)
See full diff in compare view

Updates requests from 2.32.3 to 2.32.4

Release notes

Sourced from requests's releases.

v2.32.4

2.32.4 (2025-06-10)

Security

CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file. (#6965)

Improvements

Numerous documentation improvements

Deprecations

Added support for pypy 3.11 for Linux and macOS. (#6926)

Dropped support for pypy 3.9 following its end of support. (#6926)

Changelog

Sourced from requests's changelog.

2.32.4 (2025-06-10)

Security

CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file.

Improvements

Numerous documentation improvements

Deprecations

Added support for pypy 3.11 for Linux and macOS.

Dropped support for pypy 3.9 following its end of support.

Commits

021dc72 Polish up release tooling for last manual release
821770e Bump version and add release notes for v2.32.4
59f8aa2 Add netrc file search information to authentication documentation (#6876)
5b4b64c Add more tests to prevent regression of CVE 2024 47081
7bc4587 Add new test to check netrc auth leak (#6962)
96ba401 Only use hostname to do netrc lookup instead of netloc
7341690 Merge pull request #6951 from tswast/patch-1
6716d7c remove links
a7e1c74 Update docs/conf.py
c799b81 docs: fix dead links to kenreitz.org
Additional commits viewable in compare view

Updates stac-check from 1.7.0 to 1.8.0

Release notes

Sourced from stac-check's releases.

v1.8.0

What's Changed

Update docs to github pages with sphinx by @jonhealy1 in stac-utils/stac-check#128

Make stac-pydantic optional by @jonhealy1 in stac-utils/stac-check#129

release v1.8.0 by @jonhealy1 in stac-utils/stac-check#130

Full Changelog: stac-utils/stac-check@v1.7.0...v1.8.0

Changelog

Sourced from stac-check's changelog.

[v1.8.0] - 2025-06-11

Changed

Made stac-pydantic an optional dependency (#129)

stac-validator is now installed without the [pydantic] extra by default

Added stac-check[pydantic] extra for users who need pydantic validation

Added graceful fallback to JSONSchema validation when pydantic is not available

Updated tests to handle both scenarios (with and without pydantic installed)

Added helpful warning messages when pydantic is requested but not installed

Migrated documentation from Read the Docs to GitHub Pages (#128)

Updated documentation build system to use Sphinx with sphinx_rtd_theme

Added support for Markdown content in documentation using myst-parser

Updated README with instructions for building documentation locally

Added GitHub Actions workflow for automatic documentation deployment

Commits

941d7cc Merge pull request #130 from stac-utils/release-v1.8.0
0a3b150 release-v1.8.0
e8a8ec0 Merge pull request #129 from stac-utils/optional-pydantic
fbdbf94 add pr number
c0bb06e stac-pydantic optional
7111c1c Merge pull request #128 from stac-utils/github-pages-docs
110b0ea changelog/ python version
a2de0ca update docs to github.io
See full diff in compare view

Updates stac-validator from 3.8.1 to 3.9.1

Release notes

Sourced from stac-validator's releases.

v3.9.1

What's Changed

Improved error messaging by @jonhealy1 in stac-utils/stac-validator#260

failed_schema field to error messages for easier error handling

recommendation field to --verbose mode

Full Changelog: stac-utils/stac-validator@v3.9.0...v3.9.1

v3.9.0

What's Changed

Create universal verbose mode for better error messaging by @jonhealy1 in stac-utils/stac-validator#257

v3.9.0 release by @jonhealy1 in stac-utils/stac-validator#259

Full Changelog: stac-utils/stac-validator@v3.8.1...v3.9.0

Changelog

Sourced from stac-validator's changelog.

[v3.9.1] - 2025-06-13

Added

failed_schema field to error messages for easier error handling #260

recommendation field to --verbose mode #260

[v3.9.0] - 2025-06-13

Added

Added separate recommendation field in error messages when running in non-verbose mode #257

Verbose error messages for JSONSchemaValidationErrors #257

Changed

Changed --verbose for recursive mode to --trace-recursive to make way for more comprehensive error messaging #257

Commits

acef147 Improved error messaging (#260)
cd6225e v3.9.0 (#259)
d58ead2 Create universal verbose mode for better error messaging (#257)
See full diff in compare view

Updates coverage from 7.8.2 to 7.9.1

Changelog

Sourced from coverage's changelog.

Version 7.9.1 — 2025-06-13

The "no-ctracer" warning is not issued for Python pre-release versions. Coverage doesn't ship compiled wheels for those versions, so this was far too noisy.

On Python 3.14+, the "sysmon" core is now the default if it's supported for your configuration. Plugins and dynamic contexts are still not supported with it.

.. _changes_7-9-0:

Version 7.9.0 — 2025-06-11

Added a [run] core configuration setting to specify the measurement core, which was previously only available through the COVERAGE_CORE environment variable. Finishes issue 1746_.

Fixed incorrect rendering of f-strings with doubled braces, closing issue 1980_.

If the C tracer core can't be imported, a warning ("no-ctracer") is issued with the reason.

The C tracer core extension module now conforms to PEP 489, closing issue 1977. Thanks, Adam Turner <pull 1978_>_.

Fixed a "ValueError: min() arg is an empty sequence" error caused by strange empty modules, found by oss-fuzz_.

.. _issue 1746: nedbat/coveragepy#1746 .. _issue 1977: nedbat/coveragepy#1977 .. _pull 1978: nedbat/coveragepy#1978 .. _issue 1980: nedbat/coveragepy#1980 .. _PEP 489: https://peps.python.org/pep-0489 .. _oss-fuzz: https://google.github.io/oss-fuzz/

.. _changes_7-8-2:

Commits

4fa1b71 docs: sample HTML for 7.9.1
5cf757b docs: prep for 7.9.1
bea6204 fix: better defaulting of core
7795441 fix: fewer warnings, default to sys.monitoring on 3.14+
18aa074 fix: some custom builds don't have file
8c5bf65 chore: make upgrade
128c4f4 build: bump version to 7.9.1
452d86f docs: sample HTML for 7.9.0
a670927 docs: prep for 7.9.0
3b0cb87 build: windows 3.14 is fixed
Additional commits viewable in compare view

Updates safety from 3.3.0 to 3.5.0

Release notes

Sourced from safety's releases.

Version 3.5.0

What's Changed

bump: version 3.5.0b2 → 3.5.0 (e6bcb19)

fix: poetry error on source and parsing pyproject.toml (#739) (7be73c0)

Version 3.5.0b2

What's Changed

bump: version 3.5.0b1 → 3.5.0b2 (d9350f2)

feat: included project id in project specific files (#736) (9328620)

fix: source error copy for Poetry (#738) (6e71f63)

feat: add 'SAFETY_REQUEST_TIMEOUT_EVENTS' so users can use a custom timeout (#737) (ce226d9)

Version 3.5.0b1

What's Changed

bump: version 3.5.0b0 → 3.5.0b1 (fedf2f0)

fix: fix the version information passing (#735) (5a2b0e7)

Version 3.5.0b0

What's Changed

bump: version 3.4.1b0 → 3.5.0b0 (ad88bd2)

fix: missing uninstall option when feature flag is disabled (#734) (4f335ec)

fix: usage of aot instead of tables for uv project (#733) (13183f0)

feat: improved rendering of the warning messages (#732) (62a8525)

fix: suppress event loop errors during subprocess transport cleanup (#731) (1e3519a)

feat: added resolution of installed packages (#730) (5165c35)

fix: uv index out of range issue (#729) (c08c62a)

Version 3.4.1b0

What's Changed

bump: version 3.4.0 → 3.4.1b0 (2eee880)

fix: the unix-like alias interceptors (#728) (49c4d34)

fix: tool parsing and tool exit codes (#727) (2e0e5a5)

fix: tool issues on uv and poetry setup (#726) (8eb5a8a)

fix: add missing instructions for terminal activation after safety init (#724) (b1cffbb)

fix: instantaneous init output (#723) (6b33eee)

fix: codebase verification flow (#722) (5a026d2)

Version 3.4.0

What's Changed

bump: version 3.4.0b9 → 3.4.0 (c1deefa)

chore: update dependencies licenses list (#720) (f1e1678)

Version 3.4.0b9

What's Changed

bump: version 3.4.0b8 → 3.4.0b9 (de8a486)

feat: add meta client headers to all requests (#719) (ece702b)

feat: include other category in the init scan (#718) (e04a4e2)

Version 3.4.0b8

What's Changed

... (truncated)

Changelog

Sourced from safety's changelog.

3.5.0 (2025-05-07)

Fix

poetry error on source and parsing pyproject.toml (#739)

3.5.0b2 (2025-05-06)

Feat

included project id in project specific files (#736)

add 'SAFETY_REQUEST_TIMEOUT_EVENTS' so users can use a custom timeout (#737)

Fix

source error copy for Poetry (#738)

3.5.0b1 (2025-05-06)

Fix

fix the version information passing (#735)

3.5.0b0 (2025-05-05)

Feat

improved rendering of the warning messages (#732)

added resolution of installed packages (#730)

Fix

missing uninstall option when feature flag is disabled (#734)

usage of aot instead of tables for uv project (#733)

suppress event loop errors during subprocess transport cleanup (#731)

uv index out of range issue (#729)

3.4.1b0 (2025-04-29)

Fix

the unix-like alias interceptors (#728)

tool parsing and tool exit codes (#727)

tool issues on uv and poetry setup (#726)

add missing instructions for terminal activation after safety init (#724)

instantaneous init output (#723)

codebase verification flow (#722)

3.4.0 (2025-04-23)

... (truncated)

Commits

e6bcb19 bump: version 3.5.0b2 → 3.5.0
7be73c0 fix: poetry error on source and parsing pyproject.toml (#739)
d9350f2 bump: version 3.5.0b1 → 3.5.0b2
9328620 feat: included project id in project specific files (#736)
6e71f63 fix: source error copy for Poetry (#738)
ce226d9 feat: add 'SAFETY_REQUEST_TIMEOUT_EVENTS' so users can use a custom timeout (...
fedf2f0 bump: version 3.5.0b0 → 3.5.0b1
5a2b0e7 fix: fix the version information passing (#735)
ad88bd2 bump: version 3.4.1b0 → 3.5.0b0
4f335ec fix: missing uninstall option when feature flag is disabled (#734)
Additional commits viewable in compare view

Updates cryptography from 45.0.3 to 45.0.4

Changelog

Sourced from cryptography's changelog.

45.0.4 - 2025-06-09

* Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This is not considered secure, and is supported only for backwards compatibility.)

.. _v45-0-3:

Commits

678c0c5 prepare for 45.0.4 release (#13058)
See full diff in compare view

Updates safety-schemas from 0.0.10 to 0.0.14

Commits

See full diff in compare view

Updates watchfiles from 1.0.5 to 1.1.0

Release notes

Sourced from watchfiles's releases.

v1.1.0 2025-06-15

What's Changed

Bump crossbeam-channel from 0.5.12 to 0.5.15 by @dependabot in samuelcolvin/watchfiles#336

skip flakey test on windows by @samuelcolvin in samuelcolvin/watchfiles#342

Update notify dependency to 8.0.0, bumping MSRV to 1.77 by @musicinmybrain in samuelcolvin/watchfiles#327

Update PyO3 to 0.25.1 by @musicinmybrain in samuelcolvin/watchfiles#340

test and build with 3.14 & 3.14t by @samuelcolvin in samuelcolvin/watchfiles#343

uprev to 1.1.0 by @samuelcolvin in samuelcolvin/watchfiles#344

Full Changelog: samuelcolvin/watchfiles@v1.0.5...v1.1.0

Commits

dbdfd11 uprev to 1.1.0 (#344)
b27bd3a test and build with 3.14 & 3.14t (#343)
4f3b2d0 Update PyO3 to 0.25.1 (#340)
cd5b129 Update notify dependency to 8.0.0, bumping MSRV to 1.77 (#327)
79f8e73 skip flakey test on windows (#342)
927522a Bump crossbeam-channel from 0.5.12 to 0.5.15 (#336)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the minor-and-patch group with 9 updates: | Package | From | To | | --- | --- | --- | | [certifi](https://github.com/certifi/python-certifi) | `2025.4.26` | `2025.6.15` | | [requests](https://github.com/psf/requests) | `2.32.3` | `2.32.4` | | [stac-check](https://github.com/stac-utils/stac-check) | `1.7.0` | `1.8.0` | | [stac-validator](https://github.com/stac-utils/stac-validator) | `3.8.1` | `3.9.1` | | [coverage](https://github.com/nedbat/coveragepy) | `7.8.2` | `7.9.1` | | [safety](https://github.com/pyupio/safety) | `3.3.0` | `3.5.0` | | [cryptography](https://github.com/pyca/cryptography) | `45.0.3` | `45.0.4` | | [safety-schemas](https://github.com/pyupio/safety_schemas) | `0.0.10` | `0.0.14` | | [watchfiles](https://github.com/samuelcolvin/watchfiles) | `1.0.5` | `1.1.0` | Updates `certifi` from 2025.4.26 to 2025.6.15 - [Commits](certifi/python-certifi@2025.04.26...2025.06.15) Updates `requests` from 2.32.3 to 2.32.4 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.3...v2.32.4) Updates `stac-check` from 1.7.0 to 1.8.0 - [Release notes](https://github.com/stac-utils/stac-check/releases) - [Changelog](https://github.com/stac-utils/stac-check/blob/main/CHANGELOG.md) - [Commits](stac-utils/stac-check@v1.7.0...v1.8.0) Updates `stac-validator` from 3.8.1 to 3.9.1 - [Release notes](https://github.com/stac-utils/stac-validator/releases) - [Changelog](https://github.com/stac-utils/stac-validator/blob/main/CHANGELOG.md) - [Commits](stac-utils/stac-validator@v3.8.1...v3.9.1) Updates `coverage` from 7.8.2 to 7.9.1 - [Release notes](https://github.com/nedbat/coveragepy/releases) - [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst) - [Commits](nedbat/coveragepy@7.8.2...7.9.1) Updates `safety` from 3.3.0 to 3.5.0 - [Release notes](https://github.com/pyupio/safety/releases) - [Changelog](https://github.com/pyupio/safety/blob/main/CHANGELOG.md) - [Commits](pyupio/safety@3.3.0...3.5.0) Updates `cryptography` from 45.0.3 to 45.0.4 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@45.0.3...45.0.4) Updates `safety-schemas` from 0.0.10 to 0.0.14 - [Commits](https://github.com/pyupio/safety_schemas/commits) Updates `watchfiles` from 1.0.5 to 1.1.0 - [Release notes](https://github.com/samuelcolvin/watchfiles/releases) - [Commits](samuelcolvin/watchfiles@v1.0.5...v1.1.0) --- updated-dependencies: - dependency-name: certifi dependency-version: 2025.6.15 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: requests dependency-version: 2.32.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: stac-check dependency-version: 1.8.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: stac-validator dependency-version: 3.9.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: coverage dependency-version: 7.9.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: safety dependency-version: 3.5.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: cryptography dependency-version: 45.0.4 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: safety-schemas dependency-version: 0.0.14 dependency-type: indirect update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: watchfiles dependency-version: 1.1.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jun 16, 2025

github-actions bot approved these changes Jun 16, 2025

View reviewed changes

gadomski merged commit c4bb557 into main Jun 16, 2025
8 checks passed

gadomski deleted the dependabot/pip/minor-and-patch-bca5c751ae branch June 16, 2025 14:14

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the minor-and-patch group with 9 updates #668

build(deps): bump the minor-and-patch group with 9 updates #668

Uh oh!

dependabot bot commented on behalf of github Jun 16, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

build(deps): bump the minor-and-patch group with 9 updates #668

build(deps): bump the minor-and-patch group with 9 updates #668

Uh oh!

Conversation

dependabot bot commented on behalf of github Jun 16, 2025

v2.32.4

2.32.4 (2025-06-10)

2.32.4 (2025-06-10)

v1.8.0

What's Changed

[v1.8.0] - 2025-06-11

Changed

v3.9.1

What's Changed

v3.9.0

What's Changed

[v3.9.1] - 2025-06-13

Added

[v3.9.0] - 2025-06-13

Added

Changed

Version 7.9.1 — 2025-06-13

Version 7.9.0 — 2025-06-11

Version 3.5.0

What's Changed

Version 3.5.0b2

What's Changed

Version 3.5.0b1

What's Changed

Version 3.5.0b0

What's Changed

Version 3.4.1b0

What's Changed

Version 3.4.0

What's Changed

Version 3.4.0b9

What's Changed

Version 3.4.0b8

What's Changed

3.5.0 (2025-05-07)

Fix

3.5.0b2 (2025-05-06)

Feat

Fix

3.5.0b1 (2025-05-06)

Fix

3.5.0b0 (2025-05-05)

Feat

Fix

3.4.1b0 (2025-04-29)

Fix

3.4.0 (2025-04-23)

v1.1.0 2025-06-15

What's Changed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant