Deps: Bump the python-packages group with 5 updates #1231

dependabot · 2025-07-07T05:27:37Z

Bumps the python-packages group with 5 updates:

Package	From	To
coverage	`7.9.1`	`7.9.2`
colorful	`0.5.6`	`0.5.7`
cryptography	`45.0.4`	`45.0.5`
ruff	`0.12.1`	`0.12.2`
typing-extensions	`4.14.0`	`4.14.1`

Updates coverage from 7.9.1 to 7.9.2

Changelog

Sourced from coverage's changelog.

Version 7.9.2 — 2025-07-03

Fix: complex conditionals within a line might cause a KeyError when using sys.monitoring, as reported in issue 1991_. This is now fixed.

Fix: we can now measure coverage for code in Python archive (.par) files. Thanks, Itamer Oren <pull 1984_>_.

.. _pull 1984: nedbat/coveragepy#1984 .. _issue 1991: nedbat/coveragepy#1991

.. _changes_7-9-1:

Commits

6e77492 docs: oops, beta 3
b24cf7e docs: sample HTML for 7.9.2
35305c3 docs: prep for 7.9.2
9a8d9b6 docs: add pull request link
88dcaa2 fix: assume a missing line number is intra-line. #1991
678ec80 build: use pyenv for nightly builds. Thanks, Paul Timmins
a3d00d5 build: workflow jobs should have names
279310a chore: bump the action-dependencies group with 2 updates (#1988)
614dfbf fix: enable measuring test coverage for Python archive (.par) files (#1984)
42bf82c chore: bump the action-dependencies group with 2 updates (#1985)
Additional commits viewable in compare view

Updates colorful from 0.5.6 to 0.5.7

Release notes

Sourced from colorful's releases.

v0.5.7

What's Changed

Read version from ast.Constant instead of ast.Str by @carlwgeorge in timofurrer/colorful#56

fix: DualOutput object has no attribute isatty by @HollowMan6 in timofurrer/colorful#57

Update CI by @fliiiix in timofurrer/colorful#58

New Contributors

@HollowMan6 made their first contribution in timofurrer/colorful#57

Full Changelog: timofurrer/colorful@v0.5.6...v0.5.7

Changelog

Sourced from colorful's changelog.

[v0.5.7]

Fixed

Read version from ast.Constant instead of ast.Str thanks @carlwgeorge

fix: DualOutput object has no attribute isatty thanks @HollowMan6

Test Python 3.13 support

Unsupported Python versions 3.4, 3.5, 3.6 are not tested anymore

Commits

b9cff30 release: v0.5.7
22a1723 Merge pull request #58 from timofurrer/chore/maintanace
9130b2d Update codecov action
4fa49d2 Update test matrix and add 3.13
caccb89 Merge pull request #57 from HollowMan6/master
1648dd5 fix: DualOutput object has no attribute isatty
1430ec3 Merge pull request #56 from carlwgeorge/py314
2613391 Read version from ast.Constant instead of ast.Str
See full diff in compare view

Updates cryptography from 45.0.4 to 45.0.5

Changelog

Sourced from cryptography's changelog.

45.0.5 - 2025-07-02

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.1.

.. _v45-0-4:

Commits

3e53a23 Bump for 45.0.5 release (#13135)
See full diff in compare view

Updates ruff from 0.12.1 to 0.12.2

Release notes

Sourced from ruff's releases.

0.12.2

Release Notes

Preview features

[flake8-pyi] Expand Optional[A] to A | None (PYI016) (#18572)

[pyupgrade] Mark UP008 fix safe if no comments are in range (#18683)

Bug fixes

[flake8-comprehensions] Fix C420 to prepend whitespace when needed (#18616)

[perflint] Fix PERF403 panic on attribute or subscription loop variable (#19042)

[pydocstyle] Fix D413 infinite loop for parenthesized docstring (#18930)

[pylint] Fix PLW0108 autofix introducing a syntax error when the lambda's body contains an assignment expression (#18678)

[refurb] Fix false positive on empty tuples (FURB168) (#19058)

[ruff] Allow more field calls from attrs (RUF009) (#19021)

[ruff] Fix syntax error introduced for an empty string followed by a u-prefixed string (UP025) (#18899)

Rule changes

[flake8-executable] Allow uvx in shebang line (EXE003) (#18967)

[pandas] Avoid flagging PD002 if pandas is not imported (#18963)

[pyupgrade] Avoid PEP-604 unions with typing.NamedTuple (UP007, UP045) (#18682)

Documentation

Document link between import-outside-top-level (PLC0415) and lint.flake8-tidy-imports.banned-module-level-imports (#18733)

Fix description of the format.skip-magic-trailing-comma example (#19095)

[airflow] Make AIR302 example error out-of-the-box (#18988)

[airflow] Make AIR312 example error out-of-the-box (#18989)

[flake8-annotations] Make ANN401 example error out-of-the-box (#18974)

[flake8-async] Make ASYNC100 example error out-of-the-box (#18993)

[flake8-async] Make ASYNC105 example error out-of-the-box (#19002)

[flake8-async] Make ASYNC110 example error out-of-the-box (#18975)

[flake8-async] Make ASYNC210 example error out-of-the-box (#18977)

[flake8-async] Make ASYNC220, ASYNC221, and ASYNC222 examples error out-of-the-box (#18978)

[flake8-async] Make ASYNC251 example error out-of-the-box (#18990)

[flake8-bandit] Make S201 example error out-of-the-box (#19017)

[flake8-bandit] Make S604 and S609 examples error out-of-the-box (#19049)

[flake8-bugbear] Make B028 example error out-of-the-box (#19054)

[flake8-bugbear] Make B911 example error out-of-the-box (#19051)

[flake8-datetimez] Make DTZ011 example error out-of-the-box (#19055)

[flake8-datetimez] Make DTZ901 example error out-of-the-box (#19056)

[flake8-pyi] Make PYI032 example error out-of-the-box (#19061)

[flake8-pyi] Make example error out-of-the-box (PYI014, PYI015) (#19097)

[flake8-pyi] Make example error out-of-the-box (PYI042) (#19101)

[flake8-pyi] Make example error out-of-the-box (PYI059) (#19080)

[flake8-pyi] Make example error out-of-the-box (PYI062) (#19079)

[flake8-pytest-style] Make example error out-of-the-box (PT023) (#19104)

[flake8-pytest-style] Make example error out-of-the-box (PT030) (#19105)

... (truncated)

Changelog

Sourced from ruff's changelog.

0.12.2

Preview features

[flake8-pyi] Expand Optional[A] to A | None (PYI016) (#18572)

[pyupgrade] Mark UP008 fix safe if no comments are in range (#18683)

Bug fixes

[flake8-comprehensions] Fix C420 to prepend whitespace when needed (#18616)

[perflint] Fix PERF403 panic on attribute or subscription loop variable (#19042)

[pydocstyle] Fix D413 infinite loop for parenthesized docstring (#18930)

[pylint] Fix PLW0108 autofix introducing a syntax error when the lambda's body contains an assignment expression (#18678)

[refurb] Fix false positive on empty tuples (FURB168) (#19058)

[ruff] Allow more field calls from attrs (RUF009) (#19021)

[ruff] Fix syntax error introduced for an empty string followed by a u-prefixed string (UP025) (#18899)

Rule changes

[flake8-executable] Allow uvx in shebang line (EXE003) (#18967)

[pandas] Avoid flagging PD002 if pandas is not imported (#18963)

[pyupgrade] Avoid PEP-604 unions with typing.NamedTuple (UP007, UP045) (#18682)

Documentation

Document link between import-outside-top-level (PLC0415) and lint.flake8-tidy-imports.banned-module-level-imports (#18733)

Fix description of the format.skip-magic-trailing-comma example (#19095)

[airflow] Make AIR302 example error out-of-the-box (#18988)

[airflow] Make AIR312 example error out-of-the-box (#18989)

[flake8-annotations] Make ANN401 example error out-of-the-box (#18974)

[flake8-async] Make ASYNC100 example error out-of-the-box (#18993)

[flake8-async] Make ASYNC105 example error out-of-the-box (#19002)

[flake8-async] Make ASYNC110 example error out-of-the-box (#18975)

[flake8-async] Make ASYNC210 example error out-of-the-box (#18977)

[flake8-async] Make ASYNC220, ASYNC221, and ASYNC222 examples error out-of-the-box (#18978)

[flake8-async] Make ASYNC251 example error out-of-the-box (#18990)

[flake8-bandit] Make S201 example error out-of-the-box (#19017)

[flake8-bandit] Make S604 and S609 examples error out-of-the-box (#19049)

[flake8-bugbear] Make B028 example error out-of-the-box (#19054)

[flake8-bugbear] Make B911 example error out-of-the-box (#19051)

[flake8-datetimez] Make DTZ011 example error out-of-the-box (#19055)

[flake8-datetimez] Make DTZ901 example error out-of-the-box (#19056)

[flake8-pyi] Make PYI032 example error out-of-the-box (#19061)

[flake8-pyi] Make example error out-of-the-box (PYI014, PYI015) (#19097)

[flake8-pyi] Make example error out-of-the-box (PYI042) (#19101)

[flake8-pyi] Make example error out-of-the-box (PYI059) (#19080)

[flake8-pyi] Make example error out-of-the-box (PYI062) (#19079)

[flake8-pytest-style] Make example error out-of-the-box (PT023) (#19104)

[flake8-pytest-style] Make example error out-of-the-box (PT030) (#19105)

[flake8-quotes] Make example error out-of-the-box (Q003) (#19106)

... (truncated)

Commits

9bee837 Bump 0.12.2 (#19126)
1c6717b Filter private symbols from stubs if they are internal types (#19121)
1b813cd Fix description of the format.skip-magic-trailing-comma example (#19095)
b00f68a [ruff] Allow more field calls from attrs (RUF009) (#19021)
710c60f [flake8-pytest-style] Make example error out-of-the-box (PT023) (#19104)
811e25d [flake8-pytest-style] Make example error out-of-the-box (PT030) (#19105)
b78af2d [flake8-quotes] Make example error out-of-the-box (Q003) (#19106)
4f36f06 Document link between import-outside-top-level (PLC0415) and `lint.flake8-t...
2589a29 [flake8-simplify] Make example error out-of-the-box (SIM113) (#19109)
26bb8f7 [flake8-simplify] Make example error out-of-the-box (SIM401) (#19110)
Additional commits viewable in compare view

Updates typing-extensions from 4.14.0 to 4.14.1

Release notes

Sourced from typing-extensions's releases.

4.14.1

Release 4.14.1 (July 4, 2025)

Fix usage of typing_extensions.TypedDict nested inside other types (e.g., typing.Type[typing_extensions.TypedDict]). This is not allowed by the type system but worked on older versions, so we maintain support.

Changelog

Sourced from typing-extensions's changelog.

Release 4.14.1 (July 4, 2025)

Fix usage of typing_extensions.TypedDict nested inside other types (e.g., typing.Type[typing_extensions.TypedDict]). This is not allowed by the type system but worked on older versions, so we maintain support.

Commits

42027ab Prepare release 4.14.1 (#620)
59d2c20 Fix off by one in pickle protocol tests (#618)
40e22eb Do not use slots for _TypedDictSpecialForm (#616)
d17c456 allow TypedDict as a type argument (#614)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python-packages group with 5 updates: | Package | From | To | | --- | --- | --- | | [coverage](https://github.com/nedbat/coveragepy) | `7.9.1` | `7.9.2` | | [colorful](https://github.com/timofurrer/colorful) | `0.5.6` | `0.5.7` | | [cryptography](https://github.com/pyca/cryptography) | `45.0.4` | `45.0.5` | | [ruff](https://github.com/astral-sh/ruff) | `0.12.1` | `0.12.2` | | [typing-extensions](https://github.com/python/typing_extensions) | `4.14.0` | `4.14.1` | Updates `coverage` from 7.9.1 to 7.9.2 - [Release notes](https://github.com/nedbat/coveragepy/releases) - [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst) - [Commits](coveragepy/coveragepy@7.9.1...7.9.2) Updates `colorful` from 0.5.6 to 0.5.7 - [Release notes](https://github.com/timofurrer/colorful/releases) - [Changelog](https://github.com/timofurrer/colorful/blob/master/CHANGELOG.md) - [Commits](timofurrer/colorful@v0.5.6...v0.5.7) Updates `cryptography` from 45.0.4 to 45.0.5 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@45.0.4...45.0.5) Updates `ruff` from 0.12.1 to 0.12.2 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.12.1...0.12.2) Updates `typing-extensions` from 4.14.0 to 4.14.1 - [Release notes](https://github.com/python/typing_extensions/releases) - [Changelog](https://github.com/python/typing_extensions/blob/main/CHANGELOG.md) - [Commits](python/typing_extensions@4.14.0...4.14.1) --- updated-dependencies: - dependency-name: coverage dependency-version: 7.9.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: python-packages - dependency-name: colorful dependency-version: 0.5.7 dependency-type: indirect update-type: version-update:semver-patch dependency-group: python-packages - dependency-name: cryptography dependency-version: 45.0.5 dependency-type: indirect update-type: version-update:semver-patch dependency-group: python-packages - dependency-name: ruff dependency-version: 0.12.2 dependency-type: indirect update-type: version-update:semver-patch dependency-group: python-packages - dependency-name: typing-extensions dependency-version: 4.14.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: python-packages ... Signed-off-by: dependabot[bot] <[email protected]>

github-actions · 2025-07-07T05:27:47Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 1 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 81bed22.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

poetry.lock

Package	Version	License	Issue Type
typing-extensions	4.14.1	Null	Unknown License

Allowed Licenses: 0BSD, AGPL-3.0-or-later, Apache-2.0, BlueOak-1.0.0, BSD-2-Clause, BSD-3-Clause-Clear, BSD-3-Clause, BSL-1.0, CAL-1.0, CC-BY-3.0, CC-BY-4.0, CC-BY-SA-4.0, CC0-1.0, EPL-2.0, GPL-1.0-or-later, GPL-2.0-only, GPL-2.0-or-later, GPL-2.0, GPL-3.0-only, GPL-3.0-or-later, GPL-3.0, ISC, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-2.1, LGPL-3.0-only, LGPL-3.0, LGPL-3.0-or-later, MIT, MIT-CMU, MPL-1.1, MPL-2.0, OFL-1.1, PSF-2.0, Python-2.0, Python-2.0.1, Unicode-DFS-2016, Unlicense, Zlib, ZPL-2.1

OpenSSF Scorecard

Package

Version

Score

Details

pip/colorful

0.5.7

🟢 4.7

Details

Check	Score	Reason
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Binary-Artifacts	🟢 10	no binaries found in the repo
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Code-Review	🟢 4	Found 6/14 approved changesets -- score normalized to 4
Maintained	🟢 6	8 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 6
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Fuzzing	⚠️ 0	project is not fuzzed
License	🟢 10	license file detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Packaging	🟢 10	packaging workflow detected
Security-Policy	⚠️ 0	security policy file not detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

pip/coverage

7.9.2

🟢 8.5

Details

Check	Score	Reason
Security-Policy	🟢 10	security policy file detected
Code-Review	⚠️ 0	Found 1/28 approved changesets -- score normalized to 0
Maintained	🟢 10	30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
CII-Best-Practices	🟢 5	badge detected: Passing
Pinned-Dependencies	🟢 5	dependency not pinned by hash detected -- score normalized to 5
License	🟢 10	license file detected
Fuzzing	🟢 10	project is fuzzed
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging	🟢 10	packaging workflow detected
SAST	🟢 10	SAST tool is run on all commits

pip/cryptography

45.0.5

🟢 8.3

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
License	🟢 9	license file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases	⚠️ -1	no releases found
Packaging	🟢 10	packaging workflow detected
Token-Permissions	🟢 9	detected GitHub workflow tokens with excessive permissions
Fuzzing	🟢 10	project is fuzzed
Binary-Artifacts	🟢 10	no binaries found in the repo
Vulnerabilities	🟢 8	2 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies	🟢 4	dependency not pinned by hash detected -- score normalized to 4

pip/ruff

0.12.2

Unknown

pip/typing-extensions

4.14.1

🟢 6.6

Details

Check	Score	Reason
Code-Review	🟢 8	Found 25/30 approved changesets -- score normalized to 8
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
Maintained	🟢 10	25 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
License	🟢 9	license file detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Vulnerabilities	🟢 3	7 existing vulnerabilities detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

Scanned Files

poetry.lock

github-actions · 2025-07-07T05:28:03Z

Conventional Commits Report

Type	Number
Dependencies	1

🚀 Conventional commits found.

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jul 7, 2025

dependabot bot requested a review from a team as a code owner July 7, 2025 05:27

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jul 7, 2025

greenbonebot enabled auto-merge (rebase) July 7, 2025 05:27

bjoernricks approved these changes Jul 7, 2025

View reviewed changes

greenbonebot merged commit 6a108dc into main Jul 7, 2025
27 of 28 checks passed

greenbonebot deleted the dependabot/pip/python-packages-f19d2e3777 branch July 7, 2025 06:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Deps: Bump the python-packages group with 5 updates #1231

Deps: Bump the python-packages group with 5 updates #1231

Uh oh!

dependabot bot commented on behalf of github Jul 7, 2025

Uh oh!

github-actions bot commented Jul 7, 2025

Uh oh!

github-actions bot commented Jul 7, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Deps: Bump the python-packages group with 5 updates #1231

Deps: Bump the python-packages group with 5 updates #1231

Uh oh!

Conversation

dependabot bot commented on behalf of github Jul 7, 2025

Version 7.9.2 — 2025-07-03

v0.5.7

What's Changed

New Contributors

[v0.5.7]

Fixed

0.12.2

Release Notes

Preview features

Bug fixes

Rule changes

Documentation

0.12.2

Preview features

Bug fixes

Rule changes

Documentation

4.14.1

Release 4.14.1 (July 4, 2025)

Release 4.14.1 (July 4, 2025)

Uh oh!

github-actions bot commented Jul 7, 2025

Dependency Review

Snapshot Warnings

License Issues

poetry.lock

OpenSSF Scorecard

Scanned Files

Uh oh!

github-actions bot commented Jul 7, 2025

Conventional Commits Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants