Skip to content
This repository has been archived by the owner on Oct 16, 2024. It is now read-only.

Bump the pip group across 1 directory with 7 updates #659

Open
wants to merge 1 commit into
base: develop
Choose a base branch
from
Open

Bump the pip group across 1 directory with 7 updates #659

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link

@dependabot dependabot bot commented on behalf of github Sep 3, 2024

Bumps the pip group with 7 updates in the / directory:

Package From To
django-filter 0.15.3 2.4.0
django 1.10.2 3.2.25
djangorestframework 3.5.3 3.15.2
gunicorn 19.6.0 22.0.0
paramiko 1.17.6 2.0.9
pyyaml 3.12 5.4
ipython 2.4.1 8.10.0

Updates django-filter from 0.15.3 to 2.4.0

Release notes

Sourced from django-filter's releases.

Version 2.4.0

  • SECURITY: Added a MaxValueValidator to the form field for NumberFilter. This prevents a potential DoS attack if numbers with very large exponents were subsequently converted to integers.

    The default limit value for the validator is 1e50.

    The new NumberFilter.get_max_validator() allows customising the used validator, and may return None to disable the validation entirely.

  • Added testing against Django 3.1 and Python 3.9.

    In addition tests against Django main development branch are now required to pass.

Version 2.3.0

https://github.com/carltongibson/django-filter/blob/master/CHANGES.rst#version-230-2020-6-5

Version 2.2

Highlights:

  • Added DjangoFilterBackend.get_schema_operation_parameters() for DRF 3.10+ OpenAPI schema generation. (#1086)
  • Added lookup_expr to MultipleChoiceFilter (#1054)
  • Dropped support for EOL Python 3.4

Version 2.1.0

  • Fixed a regression in FilterView introduced in 2.0. An empty QuerySet was incorrectly used whenever the FilterSet was unbound (i.e. when there were no GET parameters). The correct, pre-2.0 behaviour is now restored.

    A workaround was to set strict=False on the FilterSet. This is no longer necessary, so you may restore strict behaviour as desired.

  • Added IsoDateTimeFromToRangeFilter. Allows From-To filtering using ISO-8601 formatted dates.

Version 2.0

2.0 introduced a number of small changes and tidy-ups. Please see the migration guide:

https://django-filter.readthedocs.io/en/master/guide/migration.html#migrating-to-2-0

  • Added testing for Python 3.7 (#944)
  • Improve exception message for invalid filter result (#943)
  • Test QueryDict against CSV filters (#937)
  • Add renderer argument to render() method of BooleanWidget (#923)
  • Fix lookups for reverse relationships (#915)
  • Refactor backend filterset instantiation (#865)
  • Improve view-related attribute name consistency (#867)

... (truncated)

Changelog

Sourced from django-filter's changelog.

Version 2.4.0 (2020-9-27)

  • SECURITY: Added a MaxValueValidator to the form field for NumberFilter. This prevents a potential DoS attack if numbers with very large exponents were subsequently converted to integers.

    The default limit value for the validator is 1e50.

    The new NumberFilter.get_max_validator() allows customising the used validator, and may return None to disable the validation entirely.

  • Added testing against Django 3.1 and Python 3.9.

    In addition tests against Django main development branch are now required to pass.

Version 2.3.0 (2020-6-5)

  • Fixed import of FieldDoesNotExist. (#1127)
  • Added testing against Django 3.0. (#1125)
  • Declared support for, and added testing against, Python 3.8. (#1138)
  • Fix filterset multiple inheritance bug (#1131)
  • Allowed customising default lookup expression. (#1129)
  • Drop Django 2.1 and below (#1180)
  • Fixed IsoDateTimeRangeFieldTests for Django 3.1
  • Require tests to pass against Django master.

Version 2.2 (2019-7-16)

  • Added DjangoFilterBackend.get_schema_operation_parameters() for DRF 3.10+ OpenAPI schema generation. (#1086)
  • Added lookup_expr to MultipleChoiceFilter (#1054)
  • Dropped support for EOL Python 3.4

Version 2.1 (2019-1-20)

  • Fixed a regression in FilterView introduced in 2.0. An empty QuerySet was incorrectly used whenever the FilterSet was unbound (i.e. when there were no GET parameters). The correct, pre-2.0 behaviour is now restored.

    A workaround was to set strict=False on the FilterSet. This is no longer necessary, so you may restore strict behaviour as desired.

... (truncated)

Commits
  • 7821072 Postpone move to CalVer.
  • fd5824e Restore version declaration in setup.py.
  • c9daa68 Version 20.9.0.
  • c045bbe Droped using bumpversion.
  • b1f56ed Use single version reference from main module.
  • 451d372 Update docs copyright year.
  • 82c9a42 Added MaxValueValidator to NumberFilter.
  • 2ebce74 Confirmed compatibility with Python 3.9. (#1270)
  • 85c9572 Run tests with GitHub Actions
  • d9f389f Update Jinja test dependency.
  • Additional commits viewable in compare view

Updates django from 1.10.2 to 3.2.25

Commits

Updates djangorestframework from 3.5.3 to 3.15.2

Release notes

Sourced from djangorestframework's releases.

Version 3.15.1

What's Changed

New Contributors

Full Changelog: encode/django-rest-framework@3.15.0...3.15.1

Version 3.14.0

  • Django 2.2 is no longer supported. #8662
  • Django 4.1 compatibility. #8591
  • Add --api-version CLI option to generateschema management command. #8663
  • Enforce is_valid(raise_exception=False) as a keyword-only argument. #7952
  • Stop calling set_context on Validators. #8589
  • Return NotImplemented from ErrorDetails.__ne__. #8538
  • Don't evaluate DateTimeField.default_timezone when a custom timezone is set. #8531
  • Make relative URLs clickable in Browseable API. #8464
  • Support ManyRelatedField falling back to the default value when the attribute specified by dot notation doesn't exist. Matches ManyRelatedField.get_attribute to Field.get_attribute. #7574
  • Make schemas.openapi.get_reference public. #7515
  • Make ReturnDict support dict union operators on Python 3.9 and later. #8302
  • Update throttling to check if request.user is set before checking if the user is authenticated. #8370

Version 3.13.1

  • Revert schema naming changes with function based @api_view. #8297

Version 3.13.0

  • Django 4.0 compatability. #8178
  • Add max_length and min_length options to ListSerializer. #8165
  • Add get_request_serializer and get_response_serializer hooks to AutoSchema. #7424
  • Fix OpenAPI representation of null-able read only fields. #8116
  • Respect UNICODE_JSON setting in API schema outputs. #7991
  • Fix for RemoteUserAuthentication. #7158
  • Make Field constructors keyword-only. #7632

3.12.4

No release notes provided.

... (truncated)

Commits
  • c7a7eae Version 3.15.2 (#9439)
  • 3b41f01 Fix potential XSS vulnerability in break_long_headers template filter (#9435)
  • fe92f0d Add __hash__ method for permissions.OperandHolder class (#9417)
  • fbdab09 docs: Correct some evaluation results and a httpie option in Tutorial1 (#9421)
  • 36d5c0e tests: Check urlpatterns after cleanups (#9400)
  • 9d4ed05 Don't use Windows line endings
  • b34bde4 Fix typo in setup.cfg setting
  • ab681f2 Update requirements in docs
  • 2237724 bump pygments (security hygiene)
  • d58b8da Update deprecation hints
  • Additional commits viewable in compare view

Updates gunicorn from 19.6.0 to 22.0.0

Release notes

Sourced from gunicorn's releases.

Gunicorn 22.0 has been released

Gunicorn 22.0.0 has been released. This version fix the numerous security vulnerabilities. You're invited to upgrade asap your own installation.

Changes:

22.0.0 - 2024-04-17
===================

    

  • use utime to notify workers liveness
    • 

  • migrate setup to pyproject.toml
    • 

  • fix numerous security vulnerabilities in HTTP parser (closing some request smuggling vectors)
    • 

  • parsing additional requests is no longer attempted past unsupported request framing
    • 

  • on HTTP versions < 1.1 support for chunked transfer is refused (only used in exploits)
    • 

  • requests conflicting configured or passed SCRIPT_NAME now produce a verbose error
    • 

  • Trailer fields are no longer inspected for headers indicating secure scheme
    • 

  • support Python 3.12
    • 



** Breaking changes **


    

  • minimum version is Python 3.7
    • 

  • the limitations on valid characters in the HTTP method have been bounded to Internet Standards
    • 

  • requests specifying unsupported transfer coding (order) are refused by default (rare)
    • 

  • HTTP methods are no longer casefolded by default (IANA method registry contains none affected)
    • 

  • HTTP methods containing the number sign (#) are no longer accepted by default (rare)
    • 

  • HTTP versions < 1.0 or >= 2.0 are no longer accepted by default (rare, only HTTP/1.1 is supported)
    • 

  • HTTP versions consisting of multiple digits or containing a prefix/suffix are no longer accepted
    • 

  • HTTP header field names Gunicorn cannot safely map to variables are silently dropped, as in other software
    • 

  • HTTP headers with empty field name are refused by default (no legitimate use cases, used in exploits)
    • 

  • requests with both Transfer-Encoding and Content-Length are refused by default (such a message might indicate an attempt to perform request smuggling)
    • 

  • empty transfer codings are no longer permitted (reportedly seen with really old & broken proxies)
    • 



** SECURITY **


    

  • fix CVE-2024-1135
  1. Documentation is available there: https://docs.gunicorn.org/en/stable/news.html
  2. Packages: https://pypi.org/project/gunicorn/

Gunicorn 21.2.0 has been released

Gunicorn 21.2.0 has been released. This version fix the issue introduced in the threaded worker.

Changes:

21.2.0 - 2023-07-19
===================
fix thread worker: revert change considering connection as idle .
</tr></table>

... (truncated)

Commits
  • f63d59e bump to 22.0
  • 4ac81e0 Merge pull request #3175 from e-kwsm/typo
  • 401cecf Merge pull request #3179 from dhdaines/exclude-eventlet-0360
  • 0243ec3 fix(deps): exclude eventlet 0.36.0
  • 628a0bc chore: fix typos
  • 88fc4a4 Merge pull request #3131 from pajod/patch-py12-rebased
  • deae2fc CI: back off the agressive timeout
  • f470382 docs: promise 3.12 compat
  • 5e30bfa add changelog to project.urls (updated for PEP621)
  • 481c3f9 remove setup.cfg - overridden by pyproject.toml
  • Additional commits viewable in compare view

Updates paramiko from 1.17.6 to 2.0.9

Commits
  • f83156a Cut 2.0.9
  • 81ba2ac Almost left the 1.17+ marker in the changelog.
  • a5ce12d Fix a Python 2.6 oops
  • e6f9842 Formatting
  • 56c96a6 Fix and changelog re #1283
  • 852176d Fix a pseudo-bug re: responding to MSG_UNIMPLEMENTED w/ itself
  • 0b2e154 Merge branch 'crypto-1.5-agnostisicm' into 2.0
  • 238a862 Missing verbose/color for 2.6/3.3 backported pytest setup
  • 35b1f57 Backport support for newer cryptography sign/verify APIs.
  • 40fde0e Try testing against different cryptography.io versions
  • Additional commits viewable in compare view

Updates pyyaml from 3.12 to 5.4

Changelog

Sourced from pyyaml's changelog.

5.4 (2021-01-19)

5.3.1 (2020-03-18)

  • yaml/pyyaml#386 -- Prevents arbitrary code execution during python/object/new constructor

5.3 (2020-01-06)

5.2 (2019-12-02)

  • Repair incompatibilities introduced with 5.1. The default Loader was changed, but several methods like add_constructor still used the old default yaml/pyyaml#279 -- A more flexible fix for custom tag constructors yaml/pyyaml#287 -- Change default loader for yaml.add_constructor yaml/pyyaml#305 -- Change default loader for add_implicit_resolver, add_path_resolver
  • Make FullLoader safer by removing python/object/apply from the default FullLoader yaml/pyyaml#347 -- Move constructor for object/apply to UnsafeConstructor
  • Fix bug introduced in 5.1 where quoting went wrong on systems with sys.maxunicode <= 0xffff yaml/pyyaml#276 -- Fix logic for quoting special characters
  • Other PRs: yaml/pyyaml#280 -- Update CHANGES for 5.1

5.1.2 (2019-07-30)

  • Re-release of 5.1 with regenerated Cython sources to build properly for Python 3.8b2+

... (truncated)

Commits
  • 58d0cb7 5.4 release
  • a60f7a1 Fix compatibility with Jython
  • ee98abd Run CI on PR base branch changes
  • ddf2033 constructor.timezone: _copy & deepcopy
  • fc914d5 Avoid repeatedly appending to yaml_implicit_resolvers
  • a001f27 Fix for CVE-2020-14343
  • fe15062 Add 3.9 to appveyor file for completeness sake
  • 1e1c7fb Add a newline character to end of pyproject.toml
  • 0b6b7d6 Start sentences and phrases for capital letters
  • c976915 Shell code improvements
  • Additional commits viewable in compare view

Updates ipython from 2.4.1 to 8.10.0

Release notes

Sourced from ipython's releases.

See https://pypi.org/project/ipython/

We do not use GitHub release anymore. Please see PyPI https://pypi.org/project/ipython/

7.9.0

No release notes provided.

7.8.0

No release notes provided.

7.7.0

No release notes provided.

7.6.1

No release notes provided.

7.6.0

No release notes provided.

7.5.0

No release notes provided.

7.4.0

No release notes provided.

7.3.0

No release notes provided.

7.2.0

No release notes provided.

7.1.1

No release notes provided.

7.1.0

No release notes provided.

7.0.1

No release notes provided.

7.0.0

No release notes provided.

7.0.0-doc

No release notes provided.

7.0.0rc1

No release notes provided.

7.0.0b1

No release notes provided.

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the pip group across 1 directory with 7 updates
ec49aae 
Bumps the pip group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [django-filter](https://github.com/carltongibson/django-filter) | `0.15.3` | `2.4.0` |
| [django](https://github.com/django/django) | `1.10.2` | `3.2.25` |
| [djangorestframework](https://github.com/encode/django-rest-framework) | `3.5.3` | `3.15.2` |
| [gunicorn](https://github.com/benoitc/gunicorn) | `19.6.0` | `22.0.0` |
| [paramiko](https://github.com/paramiko/paramiko) | `1.17.6` | `2.0.9` |
| [pyyaml](https://github.com/yaml/pyyaml) | `3.12` | `5.4` |
| [ipython](https://github.com/ipython/ipython) | `2.4.1` | `8.10.0` |



Updates `django-filter` from 0.15.3 to 2.4.0
- [Release notes](https://github.com/carltongibson/django-filter/releases)
- [Changelog](https://github.com/carltongibson/django-filter/blob/main/CHANGES.rst)
- [Commits](carltongibson/django-filter@0.15.3...2.4.0)

Updates `django` from 1.10.2 to 3.2.25
- [Commits](django/django@1.10.2...3.2.25)

Updates `djangorestframework` from 3.5.3 to 3.15.2
- [Release notes](https://github.com/encode/django-rest-framework/releases)
- [Commits](encode/django-rest-framework@3.5.3...3.15.2)

Updates `gunicorn` from 19.6.0 to 22.0.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@19.6.0...22.0.0)

Updates `paramiko` from 1.17.6 to 2.0.9
- [Commits](paramiko/paramiko@1.17.6...2.0.9)

Updates `pyyaml` from 3.12 to 5.4
- [Release notes](https://github.com/yaml/pyyaml/releases)
- [Changelog](https://github.com/yaml/pyyaml/blob/main/CHANGES)
- [Commits](yaml/pyyaml@3.12...5.4)

Updates `ipython` from 2.4.1 to 8.10.0
- [Release notes](https://github.com/ipython/ipython/releases)
- [Commits](ipython/ipython@rel-2.4.1...8.10.0)

---
updated-dependencies:
- dependency-name: django-filter
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: django
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: djangorestframework
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: gunicorn
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: paramiko
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pyyaml
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: ipython
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Sep 3, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@vi4m vi4m Awaiting requested review from vi4m vi4m is a code owner

@MarekBleschke MarekBleschke Awaiting requested review from MarekBleschke MarekBleschke is a code owner

At least 1 approving review is required to merge this pull request.

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants