Skip to content

build(deps): bump the dependencies group across 1 directory with 6 updates #1009

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

build(deps): bump the dependencies group across 1 directory with 6 updates #1009

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jun 16, 2025

Updates the requirements on cryptography, sigstore, coverage, mypy, boto3 and botocore to permit the latest version.
Updates cryptography from 44.0.3 to 45.0.4

Changelog

Sourced from cryptography's changelog.

45.0.4 - 2025-06-09


* Fixed decrypting PKCS#8 files encrypted with SHA1-RC4. (This is not
  considered secure, and is supported only for backwards compatibility.)

.. _v45-0-3:


45.0.3 - 2025-05-25

  • Fixed decrypting PKCS#8 files encrypted with long salts (this impacts keys encrypted by Bouncy Castle).
  • Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5. While wildly insecure, this remains prevalent.

.. _v45-0-2:

45.0.2 - 2025-05-17


* Fixed using ``mypy`` with ``cryptography`` on older versions of Python.

.. _v45-0-1:


45.0.1 - 2025-05-17

  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.0.

.. _v45-0-0:

45.0.0 - 2025-05-17 (YANKED)


* Support for Python 3.7 is deprecated and will be removed in the next
  ``cryptography`` release.
* Updated the minimum supported Rust version (MSRV) to 1.74.0, from 1.65.0.
* Added support for serialization of PKCS#12 Java truststores in
  :func:`~cryptography.hazmat.primitives.serialization.pkcs12.serialize_java_truststore`
* Added :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id.derive_phc_encoded` and
  :meth:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id.verify_phc_encoded` methods
  to support password hashing in the PHC string format
* Added support for PKCS7 decryption and encryption using AES-256 as the
  content algorithm, in addition to AES-128.
* **BACKWARDS INCOMPATIBLE:** Made SSH private key loading more consistent with
  other private key loading:
  :func:`~cryptography.hazmat.primitives.serialization.load_ssh_private_key`
  now raises a ``TypeError`` if the key is unencrypted but a password is
  provided (previously no exception was raised), and raises a ``TypeError`` if
</tr></table>

... (truncated)

Commits

Updates sigstore from 3.6.2 to 3.6.3

Release notes

Sourced from sigstore's releases.

v3.6.3

A small bug fix release.

Fixed

  • Verify: Avoid hard failure if trusted root contains unsupported keytypes (as verification may succeed without that key). #1425
Changelog

Sourced from sigstore's changelog.

[3.6.3]

Fixed

  • Verify: Avoid hard failure if trusted root contains unsupported keytypes (as verification may succeed without that key). #1425
Commits

Updates coverage from 7.8.2 to 7.9.1

Changelog

Sourced from coverage's changelog.

Version 7.9.1 — 2025-06-13

  • The "no-ctracer" warning is not issued for Python pre-release versions. Coverage doesn't ship compiled wheels for those versions, so this was far too noisy.

  • On Python 3.14+, the "sysmon" core is now the default if it's supported for your configuration. Plugins and dynamic contexts are still not supported with it.

.. _changes_7-9-0:

Version 7.9.0 — 2025-06-11

  • Added a [run] core configuration setting to specify the measurement core, which was previously only available through the COVERAGE_CORE environment variable. Finishes issue 1746_.

  • Fixed incorrect rendering of f-strings with doubled braces, closing issue 1980_.

  • If the C tracer core can't be imported, a warning ("no-ctracer") is issued with the reason.

  • The C tracer core extension module now conforms to PEP 489, closing issue 1977. Thanks, Adam Turner <pull 1978_>_.

  • Fixed a "ValueError: min() arg is an empty sequence" error caused by strange empty modules, found by oss-fuzz_.

.. _issue 1746: nedbat/coveragepy#1746 .. _issue 1977: nedbat/coveragepy#1977 .. _pull 1978: nedbat/coveragepy#1978 .. _issue 1980: nedbat/coveragepy#1980 .. _PEP 489: https://peps.python.org/pep-0489 .. _oss-fuzz: https://google.github.io/oss-fuzz/

.. _changes_7-8-2:

Commits
  • 4fa1b71 docs: sample HTML for 7.9.1
  • 5cf757b docs: prep for 7.9.1
  • bea6204 fix: better defaulting of core
  • 7795441 fix: fewer warnings, default to sys.monitoring on 3.14+
  • 18aa074 fix: some custom builds don't have file
  • 8c5bf65 chore: make upgrade
  • 128c4f4 build: bump version to 7.9.1
  • 452d86f docs: sample HTML for 7.9.0
  • a670927 docs: prep for 7.9.0
  • 3b0cb87 build: windows 3.14 is fixed
  • Additional commits viewable in compare view

Updates mypy from 1.16.0 to 1.16.1

Commits

Updates boto3 to 1.38.37

Commits
  • 510b972 Merge branch 'release-1.38.37'
  • e178571 Bumping version to 1.38.37
  • 6768b0e Add changelog entries from botocore
  • a562bd2 Merge pull request #4557 from boto/dependabot/github_actions/github/codeql-ac...
  • 4c698b4 Bump github/codeql-action from 3.28.1 to 3.29.0
  • a1b372e Merge pull request #4546 from shepazon/privatelink-fix
  • a659848 Merge branch 'release-1.38.36'
  • e3bdb3c Merge branch 'release-1.38.36' into develop
  • 75dd118 Bumping version to 1.38.36
  • 9ae1055 Add changelog entries from botocore
  • Additional commits viewable in compare view

Updates botocore to 1.38.37

Commits
  • 1c572cd Merge branch 'release-1.38.37'
  • 1890950 Bumping version to 1.38.37
  • 044704d Update to latest models
  • b1f5b19 Merge pull request #3492 from boto/dependabot/github_actions/github/codeql-ac...
  • 3bc6ee1 Bump github/codeql-action from 3.28.1 to 3.29.0
  • 3e3d9b8 Merge branch 'release-1.38.36'
  • 472a72b Merge branch 'release-1.38.36' into develop
  • cb30150 Bumping version to 1.38.36
  • ad8469f Update to latest models
  • 3a15ff5 Merge branch 'release-1.38.35'
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
build(deps): bump the dependencies group across 1 directory with 6 up…
092feca 
…dates

Updates the requirements on [cryptography](https://github.com/pyca/cryptography), [sigstore](https://github.com/sigstore/sigstore-python), [coverage](https://github.com/nedbat/coveragepy), [mypy](https://github.com/python/mypy), [boto3](https://github.com/boto/boto3) and [botocore](https://github.com/boto/botocore) to permit the latest version.

Updates `cryptography` from 44.0.3 to 45.0.4
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@44.0.3...45.0.4)

Updates `sigstore` from 3.6.2 to 3.6.3
- [Release notes](https://github.com/sigstore/sigstore-python/releases)
- [Changelog](https://github.com/sigstore/sigstore-python/blob/main/CHANGELOG.md)
- [Commits](sigstore/sigstore-python@v3.6.2...v3.6.3)

Updates `coverage` from 7.8.2 to 7.9.1
- [Release notes](https://github.com/nedbat/coveragepy/releases)
- [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst)
- [Commits](nedbat/coveragepy@7.8.2...7.9.1)

Updates `mypy` from 1.16.0 to 1.16.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.16.0...v1.16.1)

Updates `boto3` to 1.38.37
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.38.28...1.38.37)

Updates `botocore` to 1.38.37
- [Commits](boto/botocore@1.38.28...1.38.37)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 45.0.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: sigstore
  dependency-version: 3.6.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: coverage
  dependency-version: 7.9.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: mypy
  dependency-version: 1.16.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: boto3
  dependency-version: 1.38.37
  dependency-type: direct:production
  dependency-group: dependencies
- dependency-name: botocore
  dependency-version: 1.38.37
  dependency-type: direct:production
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jun 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants