Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Deps: Bump the python-packages group with 7 updates #1161

Merged
merged 1 commit into from
Jul 22, 2024
Merged

Deps: Bump the python-packages group with 7 updates #1161

merged 1 commit into from
Jul 22, 2024

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jul 22, 2024

Bumps the python-packages group with 7 updates:

Package From To
sphinx 7.3.7 7.4.7
furo 2024.5.6 2024.7.18
cryptography 42.0.8 43.0.0
mypy 1.10.1 1.11.0
ruff 0.5.2 0.5.4
sphinxcontrib-htmlhelp 2.0.5 2.0.6
sphinxcontrib-qthelp 1.0.7 1.0.8

Updates sphinx from 7.3.7 to 7.4.7

Release notes

Sourced from sphinx's releases.

Sphinx 7.4.7

Changelog: https://www.sphinx-doc.org/en/master/changes.html

Sphinx 7.4.6

Changelog: https://www.sphinx-doc.org/en/master/changes.html

Sphinx 7.4.5

Changelog: https://www.sphinx-doc.org/en/master/changes.html

Sphinx 7.4.4

Changelog: https://www.sphinx-doc.org/en/master/changes.html

Sphinx 7.4.3

Changelog: https://www.sphinx-doc.org/en/master/changes.html

Sphinx 7.4.2

Changelog: https://www.sphinx-doc.org/en/master/changes.html

Sphinx 7.4.1

Changelog: https://www.sphinx-doc.org/en/master/changes.html

Sphinx 7.4.0

Changelog: https://www.sphinx-doc.org/en/master/changes.html

Changelog

Sourced from sphinx's changelog.

Release 7.4.7 (released Jul 20, 2024)

Bugs fixed

  • #12096: Warn when files are overwritten in the build directory. Patch by Adam Turner and Bénédikt Tran.
  • #12620: Ensure that old-style object description options are respected. Patch by Adam Turner.
  • #12601, #12625: Support callable objects in :py:class:~typing.Annotated type metadata in the Python domain. Patch by Adam Turner.
  • #12601, #12622: Resolve :py:class:~typing.Annotated warnings with sphinx.ext.autodoc, especially when using :mod:dataclasses as type metadata. Patch by Adam Turner.
  • #12589, #12626: autosummary: Fix warnings with :rst:role:!autolink. Patch by Adam Turner.

Release 7.4.6 (released Jul 18, 2024)

Bugs fixed

  • #12589, #9743, #12609: autosummary: Do not add the package prefix when generating autosummary directives for modules within a package. Patch by Adam Turner.
  • #12613: Reduce log severity for ambiguity detection during inventory loading. Patch by James Addison.

Release 7.4.5 (released Jul 16, 2024)

Bugs fixed

  • #12593, #12600: Revert coercing the type of selected :confval:html_sidebars values to a list. Log an error message when string values are detected. Patch by Adam Turner.
  • #12594: LaTeX: since 7.4.0, :rst:dir:seealso and other "light" admonitions now break PDF builds if they contain a :dudir:figure directive; and also if they are contained in a table cell (rendered by tabulary). Patch by Jean-François B.

Release 7.4.4 (released Jul 15, 2024)

... (truncated)

Commits
  • 0d912c8 Bump to 7.4.7 final
  • bbc97e0 autosummary: Filter invalid import prefixes in autolink (#12626)
  • 6c486a5 Fix detecting file changes for the overwritten file warning (#12627)
  • 2bd973e autodoc: Fix warnings with dataclasses in Annotated metadata (#12622)
  • dd77f85 Support callables in Annotated types (#12625)
  • 1ed4ca7 Mark test_build_manpage as XFAIL following changes in Docutils master
  • cd8ce07 Update message catalogues following reverted commits
  • c6cd25f Partially revert "Update message catalogues (#11626)"
  • fa2ba7d Partially Revert "[bot]: Update message catalogues (#12563)"
  • e439c6f Ensure that old-style object description options are respected (#12620)
  • Additional commits viewable in compare view

Updates furo from 2024.5.6 to 2024.7.18

Changelog

Sourced from furo's changelog.

Changelog

2024.07.18 -- Dull Denim

  • Improve how icons are handled and aligned.
  • Improve scroll event handler.
  • Hide the copybutton by default.
  • Fix source_view_link configuration handling.
  • Fix close tag on pencil icon.

2024.05.06 -- Cheerful Cerulean

  • ✨ Add new custom icons for auto mode, reflecting the currently active theme.
  • ✨ Add a view this page button.
  • ✨ Add colours and highlighting to "version modified" API helpers.
  • ✨ Add release information to various customisation knobs.
  • Make all icons bigger and use a thinner stroke with them.

2024.04.27 -- Bold Burgundy

  • Add a skip to content link.
  • Add --font-stack--headings.
  • Add :visited colour and enforce uniform contrast between light/dark.
  • Add an offset of :target to reduce back-to-top overlap.
  • Improve dark mode colours.
  • Fix outstanding colour contrast warnings on Firefox.
  • Fix bad indent in footnotes.
  • Tweak handling of default configuration options in a more resilient manner.
  • Tweak length and sizing of API source links.
  • Stop search engine indexing on search page.

2024.01.29 -- Amazing Amethyst

  • Fix canonical url when building with dirhtml.
  • Relicense the demo module.

2023.09.10 -- Zesty Zaffre

  • Make asset hash injection idempotent, fixing Sphinx 6 compatibility.

... (truncated)

Commits

Updates cryptography from 42.0.8 to 43.0.0

Changelog

Sourced from cryptography's changelog.

43.0.0 - 2024-07-20


* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL less than 1.1.1e has been
  removed.  Users on older version of OpenSSL will need to upgrade.
* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 3.8.
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.3.1.
* Updated the minimum supported Rust version (MSRV) to 1.65.0, from 1.63.0.
* :func:`~cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key`
  now enforces a minimum RSA key size of 1024-bit. Note that 1024-bit is still
  considered insecure, users should generally use a key size of 2048-bits.
* :func:`~cryptography.hazmat.primitives.serialization.pkcs7.serialize_certificates`
  now emits ASN.1 that more closely follows the recommendations in :rfc:`2315`.
* Added new :doc:`/hazmat/decrepit/index` module which contains outdated and
  insecure cryptographic primitives.
  :class:`~cryptography.hazmat.primitives.ciphers.algorithms.CAST5`,
  :class:`~cryptography.hazmat.primitives.ciphers.algorithms.SEED`,
  :class:`~cryptography.hazmat.primitives.ciphers.algorithms.IDEA`, and
  :class:`~cryptography.hazmat.primitives.ciphers.algorithms.Blowfish`, which were
  deprecated in 37.0.0, have been added to this module. They will be removed
  from the ``cipher`` module in 45.0.0.
* Moved :class:`~cryptography.hazmat.primitives.ciphers.algorithms.TripleDES`
  and :class:`~cryptography.hazmat.primitives.ciphers.algorithms.ARC4` into
  :doc:`/hazmat/decrepit/index` and deprecated them in the ``cipher`` module.
  They will be removed from the ``cipher`` module in 48.0.0.
* Added support for deterministic
  :class:`~cryptography.hazmat.primitives.asymmetric.ec.ECDSA` (:rfc:`6979`)
* Added support for client certificate verification to the
  :mod:`X.509 path validation <cryptography.x509.verification>` APIs in the
  form of :class:`~cryptography.x509.verification.ClientVerifier`,
  :class:`~cryptography.x509.verification.VerifiedClient`, and
  ``PolicyBuilder``
  :meth:`~cryptography.x509.verification.PolicyBuilder.build_client_verifier`.
* Added Certificate
  :attr:`~cryptography.x509.Certificate.public_key_algorithm_oid`
  and Certificate Signing Request
  :attr:`~cryptography.x509.CertificateSigningRequest.public_key_algorithm_oid`
  to determine the :class:`~cryptography.hazmat._oid.PublicKeyAlgorithmOID`
  Object Identifier of the public key found inside the certificate.
* Added :attr:`~cryptography.x509.InvalidityDate.invalidity_date_utc`, a
  timezone-aware alternative to the naïve ``datetime`` attribute
  :attr:`~cryptography.x509.InvalidityDate.invalidity_date`.
* Added support for parsing empty DN string in
  :meth:`~cryptography.x509.Name.from_rfc4514_string`.
* Added the following properties that return timezone-aware ``datetime`` objects:
  :meth:`~cryptography.x509.ocsp.OCSPResponse.produced_at_utc`,
  :meth:`~cryptography.x509.ocsp.OCSPResponse.revocation_time_utc`,
  :meth:`~cryptography.x509.ocsp.OCSPResponse.this_update_utc`,
  :meth:`~cryptography.x509.ocsp.OCSPResponse.next_update_utc`,
  :meth:`~cryptography.x509.ocsp.OCSPSingleResponse.revocation_time_utc`,
</tr></table>

... (truncated)

Commits

Updates mypy from 1.10.1 to 1.11.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next release

Mypy 1.11

We’ve just uploaded mypy 1.11 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

Support Python 3.12 Syntax for Generics (PEP 695)

Mypy now supports the new type parameter syntax introduced in Python 3.12 (PEP 695). This feature is still experimental and must be enabled with the --enable-incomplete-feature=NewGenericSyntax flag, or with enable_incomplete_feature = NewGenericSyntax in the mypy configuration file. We plan to enable this by default in the next mypy feature release.

This example demonstrates the new syntax:

# Generic function
def f[T](https://github.com/python/mypy/blob/master/x: T) -> T: ...
reveal_type(f(1))  # Revealed type is 'int'
Generic class
class C[T]:
def init(self, x: T) -> None:
self.x = x
c = C('a')
reveal_type(c.x)  # Revealed type is 'str'
Type alias
type A[T] = C[list[T]]

This feature was contributed by Jukka Lehtosalo.

Support for functools.partial

Mypy now type checks uses of functools.partial. Previously mypy would accept arbitrary arguments.

This example will now produce an error:

from functools import partial
</tr></table>

... (truncated)

Commits

Updates ruff from 0.5.2 to 0.5.4

Release notes

Sourced from ruff's releases.

0.5.4

Release Notes

Rule changes

  • [ruff] Rename RUF007 to zip-instead-of-pairwise (#12399)

Bug fixes

  • [flake8-builtins] Avoid shadowing diagnostics for @override methods (#12415)
  • [flake8-comprehensions] Insert parentheses for multi-argument generators (#12422)
  • [pydocstyle] Handle escaped docstrings within docstring (D301) (#12192)

Documentation

  • Fix GitHub link to Neovim setup (#12410)
  • Fix output-format default in settings reference (#12409)

Install ruff 0.5.4

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/astral-sh/ruff/releases/download/0.5.4/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -c "irm https://github.com/astral-sh/ruff/releases/download/0.5.4/ruff-installer.ps1 | iex"

Download ruff 0.5.4

File Platform Checksum
ruff-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
ruff-x86_64-apple-darwin.tar.gz Intel macOS checksum
ruff-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
ruff-i686-pc-windows-msvc.zip x86 Windows checksum
ruff-x86_64-pc-windows-msvc.zip x64 Windows checksum
ruff-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
ruff-i686-unknown-linux-gnu.tar.gz x86 Linux checksum
ruff-powerpc64-unknown-linux-gnu.tar.gz PPC64 Linux checksum
ruff-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
ruff-s390x-unknown-linux-gnu.tar.gz S390x Linux checksum
ruff-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
ruff-armv7-unknown-linux-gnueabihf.tar.gz ARMv7 Linux checksum
ruff-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
ruff-i686-unknown-linux-musl.tar.gz x86 MUSL Linux checksum

... (truncated)

Changelog

Sourced from ruff's changelog.

0.5.4

Rule changes

  • [ruff] Rename RUF007 to zip-instead-of-pairwise (#12399)

Bug fixes

  • [flake8-builtins] Avoid shadowing diagnostics for @override methods (#12415)
  • [flake8-comprehensions] Insert parentheses for multi-argument generators (#12422)
  • [pydocstyle] Handle escaped docstrings within docstring (D301) (#12192)

Documentation

  • Fix GitHub link to Neovim setup (#12410)
  • Fix output-format default in settings reference (#12409)

0.5.3

Ruff 0.5.3 marks the stable release of the Ruff language server and introduces revamped documentation, including setup guides for your editor of choice and the language server itself.

Preview features

  • Formatter: Insert empty line between suite and alternative branch after function/class definition (#12294)
  • [pyupgrade] Implement unnecessary-default-type-args (UP043) (#12371)

Rule changes

  • [flake8-bugbear] Detect enumerate iterations in loop-iterator-mutation (B909) (#12366)
  • [flake8-bugbear] Remove discard, remove, and pop allowance for loop-iterator-mutation (B909) (#12365)
  • [pylint] Allow repeated-equality-comparison for mixed operations (PLR1714) (#12369)
  • [pylint] Ignore self and cls when counting arguments (PLR0913) (#12367)
  • [pylint] Use UTF-8 as default encoding in unspecified-encoding fix (PLW1514) (#12370)

Server

  • Build settings index in parallel for the native server (#12299)
  • Use fallback settings when indexing the project (#12362)
  • Consider --preview flag for server subcommand for the linter and formatter (#12208)

Bug fixes

  • [flake8-comprehensions] Allow additional arguments for sum and max comprehensions (C419) (#12364)
  • [pylint] Avoid dropping extra boolean operations in repeated-equality-comparison (PLR1714) (#12368)
  • [pylint] Consider expression before statement when determining binding kind (PLR1704) (#12346)

Documentation

... (truncated)

Commits
  • 53b84ab Cleanup redundant spaces from changelog (#12424)
  • 3664f85 Bump version to v0.5.4 (#12423)
  • 2c1926b Insert parentheses for multi-argument generators (#12422)
  • 4bcc96a Avoid shadowing diagnostics for @override methods (#12415)
  • c0a2b49 Fix the Github link error for Neovim in the setup for editors in the docs. (#...
  • ca22248 Update docs Settings output-format default (#12409)
  • d8cf8ac [red-knot] Resolve symbols from builtins.pyi in the stdlib if they cannot b...
  • 1c7b840 [red-knot] fix incremental benchmark (#12400)
  • f82bb67 [red-knot] trace file when inferring types (#12401)
  • 5f96f69 [red-knot] Fix bug where module resolution would not be invalidated if an ent...
  • Additional commits viewable in compare view

Updates sphinxcontrib-htmlhelp from 2.0.5 to 2.0.6

Release notes

Sourced from sphinxcontrib-htmlhelp's releases.

sphinxcontrib-htmlhelp 2.0.6

Changelog: https://www.sphinx-doc.org/en/master/changes.html

Changelog

Sourced from sphinxcontrib-htmlhelp's changelog.

Release 2.0.6 (2024-07-20)

  • Fix tests for Sphinx 7.4 and later.
Commits

Updates sphinxcontrib-qthelp from 1.0.7 to 1.0.8

Release notes

Sourced from sphinxcontrib-qthelp's releases.

sphinxcontrib-qthelp 1.0.8

Changelog: https://www.sphinx-doc.org/en/master/changes.html

Changelog

Sourced from sphinxcontrib-qthelp's changelog.

Release 1.0.8 (2024-07-20)

  • Fix tests for Sphinx 7.4 and later.
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Deps: Bump the python-packages group with 7 updates
585d8db 
Bumps the python-packages group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [sphinx](https://github.com/sphinx-doc/sphinx) | `7.3.7` | `7.4.7` |
| [furo](https://github.com/pradyunsg/furo) | `2024.5.6` | `2024.7.18` |
| [cryptography](https://github.com/pyca/cryptography) | `42.0.8` | `43.0.0` |
| [mypy](https://github.com/python/mypy) | `1.10.1` | `1.11.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.5.2` | `0.5.4` |
| [sphinxcontrib-htmlhelp](https://github.com/sphinx-doc/sphinxcontrib-htmlhelp) | `2.0.5` | `2.0.6` |
| [sphinxcontrib-qthelp](https://github.com/sphinx-doc/sphinxcontrib-qthelp) | `1.0.7` | `1.0.8` |


Updates `sphinx` from 7.3.7 to 7.4.7
- [Release notes](https://github.com/sphinx-doc/sphinx/releases)
- [Changelog](https://github.com/sphinx-doc/sphinx/blob/master/CHANGES.rst)
- [Commits](sphinx-doc/sphinx@v7.3.7...v7.4.7)

Updates `furo` from 2024.5.6 to 2024.7.18
- [Release notes](https://github.com/pradyunsg/furo/releases)
- [Changelog](https://github.com/pradyunsg/furo/blob/main/docs/changelog.md)
- [Commits](pradyunsg/furo@2024.05.06...2024.07.18)

Updates `cryptography` from 42.0.8 to 43.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@42.0.8...43.0.0)

Updates `mypy` from 1.10.1 to 1.11.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.10.1...v1.11)

Updates `ruff` from 0.5.2 to 0.5.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.5.2...0.5.4)

Updates `sphinxcontrib-htmlhelp` from 2.0.5 to 2.0.6
- [Release notes](https://github.com/sphinx-doc/sphinxcontrib-htmlhelp/releases)
- [Changelog](https://github.com/sphinx-doc/sphinxcontrib-htmlhelp/blob/master/CHANGES)
- [Commits](sphinx-doc/sphinxcontrib-htmlhelp@2.0.5...2.0.6)

Updates `sphinxcontrib-qthelp` from 1.0.7 to 1.0.8
- [Release notes](https://github.com/sphinx-doc/sphinxcontrib-qthelp/releases)
- [Changelog](https://github.com/sphinx-doc/sphinxcontrib-qthelp/blob/master/CHANGES)
- [Commits](sphinx-doc/sphinxcontrib-qthelp@1.0.7...1.0.8)

---
updated-dependencies:
- dependency-name: sphinx
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: furo
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: cryptography
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: python-packages
- dependency-name: mypy
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: ruff
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: sphinxcontrib-htmlhelp
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: sphinxcontrib-qthelp
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-packages
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested a review from a team as a code owner July 22, 2024 04:34
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jul 22, 2024
@dependabot dependabot bot requested a review from a team as a code owner July 22, 2024 04:34
@dependabot dependabot bot added the python Pull requests that update Python code label Jul 22, 2024
@greenbonebot greenbonebot enabled auto-merge (rebase) July 22, 2024 04:34
@github-actions GitHub Actions
Copy link

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ❌ 6 package(s) with incompatible licenses
  • ❌ 1 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 585d8db.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

poetry.lock

PackageVersionLicenseIssue Type
cryptography43.0.0Apache-2.0 OR (Apache-2.0 AND BSD-3-Clause)Incompatible License
furo2024.7.18MITIncompatible License
ruff0.5.4MITIncompatible License
sphinx7.4.7BSD-2-Clause AND BSD-3-ClauseIncompatible License
sphinxcontrib-htmlhelp2.0.6BSD-2-Clause AND BSD-3-ClauseIncompatible License
sphinxcontrib-qthelp1.0.8BSD-2-Clause AND BSD-3-ClauseIncompatible License
mypy1.11.0MIT AND NOASSERTION AND Python-2.0Invalid SPDX License
Allowed Licenses: 0BSD, AGPL-3.0-or-later, GPL-3.0-or-later, LGPL-2.1, EPL-2.0, Python-2.0, GPL-2.0-or-later, GPL-2.0-only, GPL-3.0-or-later AND LGPL-2.1-only, GPL-3.0-or-later AND LGPL-3.0 AND LGPL-3.0-only, GPL-2.0 AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later, MIT, ISC, Unlicense, Apache-2.0, BSD-3-Clause, BSD-2-Clause, BSD-2-Clause AND MIT, MPL-2.0, CC-BY-4.0, CC-BY-3.0, CC-BY-SA-4.0, CC0-1.0, BSD-2-Clause AND BSD-3-Clause, BSD-3-Clause AND BSD-3-Clause-Clear, MIT OR Apache-2.0, MIT AND Python-2.0, (Apache-2.0 AND BSD-3-Clause) OR (Apache-2.0 AND MIT), (MIT OR Apache-2.0) AND Unicode-DFS-2016, OFL-1.1, Apache-2.0 AND BSD-3-Clause AND MIT AND OFL-1.1, BlueOak-1.0.0, BSL-1.0, Python-2.0.1, MIT AND PSF-2.0, LGPL-2.0-only AND LGPL-2.1-or-later, CAL-1.0

OpenSSF Scorecard

PackageVersionScoreDetails
pip/cryptography 43.0.0 🟢 8.5
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Maintained🟢 1030 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Fuzzing🟢 10project is fuzzed
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Vulnerabilities🟢 100 existing vulnerabilities detected
Pinned-Dependencies🟢 4dependency not pinned by hash detected -- score normalized to 4
pip/furo 2024.7.18 🟢 4.7
Details
CheckScoreReason
Code-Review⚠️ 1Found 4/24 approved changesets -- score normalized to 1
Maintained🟢 1030 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ 0Project has not signed or included provenance with any releases.
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Packaging🟢 10packaging workflow detected
Vulnerabilities🟢 91 existing vulnerabilities detected
pip/mypy 1.11.0 🟢 5.4
Details
CheckScoreReason
Code-Review🟢 6Found 20/30 approved changesets -- score normalized to 6
Maintained🟢 1030 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
pip/ruff 0.5.4 UnknownUnknown
pip/sphinx 7.4.7 🟢 5.9
Details
CheckScoreReason
Code-Review🟢 3Found 9/30 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy⚠️ 0security policy file not detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing⚠️ 0project is not fuzzed
Vulnerabilities🟢 82 existing vulnerabilities detected
pip/sphinxcontrib-htmlhelp 2.0.6 🟢 4.4
Details
CheckScoreReason
Maintained⚠️ 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
Code-Review⚠️ 0Found 0/30 approved changesets -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/sphinxcontrib-qthelp 1.0.8 🟢 4.4
Details
CheckScoreReason
Maintained⚠️ 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
Code-Review⚠️ 0Found 1/30 approved changesets -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Manifest Files

poetry.lock

@github-actions GitHub Actions
Copy link

Conventional Commits Report

Type Number
Dependencies 1

🚀 Conventional commits found.

@greenbonebot greenbonebot merged commit 8fa790a into main Jul 22, 2024
21 of 22 checks passed
@greenbonebot greenbonebot deleted the dependabot/pip/python-packages-d88b5b692d branch July 22, 2024 06:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Balou9 Balou9 Balou9 approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@Balou9 @greenbonebot