Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Deps: Bump the python-packages group with 3 updates #1214

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
greenbonebot merged 1 commit into from
Mar 31, 2025
Merged

Deps: Bump the python-packages group with 3 updates #1214

greenbonebot merged 1 commit into from
Mar 31, 2025

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 31, 2025

Bumps the python-packages group with 3 updates: coverage, pontos and rich.

Updates coverage from 7.7.1 to 7.8.0

Changelog

Sourced from coverage's changelog.

Version 7.8.0 — 2025-03-30

  • Added a new source_dirs setting for symmetry with the existing source_pkgs setting. It's preferable to the existing source setting, because you'll get a clear error when directories don't exist. Fixes issue 1942. Thanks, Jeremy Fleischman <pull 1943_>.

  • Fix: the PYTHONSAFEPATH environment variable new in Python 3.11 is properly supported, closing issue 1696. Thanks, Philipp A. <pull 1700_>. This works properly except for a detail when using the coverage command on Windows. There you can use python -m coverage instead if you need exact emulation.

.. _issue 1696: nedbat/coveragepy#1696 .. _pull 1700: nedbat/coveragepy#1700 .. _issue 1942: nedbat/coveragepy#1942 .. _pull 1943: nedbat/coveragepy#1943

.. _changes_7-7-1:

Commits
  • 6d5ced9 docs: sample HTML for 7.8.0
  • 49c194f docs: prep for 7.8.0
  • 38782cb docs: finish up source_dirs. bump to 7.8.0
  • 7aea2f3 feat: add new source_dirs option (#1943)
  • f464155 test: some simple bytecode tests
  • cf1dec0 refactor: these pypy modules are available in all our versions
  • a876052 test: a general helper for iterating over our own source files
  • 82cff3e perf: sets are better than lists
  • a66bd61 refactor: move bytecode code into bytecode.py
  • d64ce5f chore: bump the action-dependencies group with 3 updates (#1940)
  • Additional commits viewable in compare view

Updates pontos from 25.3.2 to 25.3.3

Release notes

Sourced from pontos's releases.

pontos 25.3.3

25.3.3 - 2025-03-28

Changed

  • Align CVE with specification by making fields optional 0ee11f1

Dependencies

  • Bump the python-packages group with 4 updates c3ef0d4
  • Bump the python-packages group with 4 updates 372404c
  • Bump the python-packages group with 3 updates 45f0191
Commits
  • ae4219a Automatic release to 25.3.3
  • 0ee11f1 Change: Align CVE with specification by making fields optional
  • c3ef0d4 Deps: Bump the python-packages group with 4 updates
  • 372404c Deps: Bump the python-packages group with 4 updates
  • 45f0191 Deps: Bump the python-packages group with 3 updates
  • 597f246 Automatic adjustments after release [skip ci]
  • See full diff in compare view

Updates rich from 13.9.4 to 14.0.0

Release notes

Sourced from rich's releases.

The ENVy of all other releases

Mostly updates to Traceback rendering, to add support for features introduced in Python3.11

We also have a new env var that I am proposing to become a standard. TTY_COMPATIBLE=1 tells Rich to write ansi-escape sequences even if it detects it is not writing to a terminal. This is intended for use with GitHub Actions / CI, which can interpret escape sequences, but aren't a terminal.

There is also a change to how NO_COLOR and FORCE_COLOR are interpreted, which is the reason for the major version bump.

[14.0.0] - 2025-03-30

Added

  • Added env var TTY_COMPATIBLE to override auto-detection of TTY support (See console.rst for details). Textualize/rich#3675

Changed

Changelog

Sourced from rich's changelog.

[14.0.0] - 2025-03-30

Added

  • Added env var TTY_COMPATIBLE to override auto-detection of TTY support (See console.rst for details). Textualize/rich#3675

Changed

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Deps: Bump the python-packages group with 3 updates
3228b95 
Bumps the python-packages group with 3 updates: [coverage](https://github.com/nedbat/coveragepy), [pontos](https://github.com/greenbone/pontos) and [rich](https://github.com/Textualize/rich).


Updates `coverage` from 7.7.1 to 7.8.0
- [Release notes](https://github.com/nedbat/coveragepy/releases)
- [Changelog](https://github.com/nedbat/coveragepy/blob/master/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.7.1...7.8.0)

Updates `pontos` from 25.3.2 to 25.3.3
- [Release notes](https://github.com/greenbone/pontos/releases)
- [Commits](greenbone/pontos@v25.3.2...v25.3.3)

Updates `rich` from 13.9.4 to 14.0.0
- [Release notes](https://github.com/Textualize/rich/releases)
- [Changelog](https://github.com/Textualize/rich/blob/master/CHANGELOG.md)
- [Commits](Textualize/rich@v13.9.4...v14.0.0)

---
updated-dependencies:
- dependency-name: coverage
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: pontos
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: rich
  dependency-type: indirect
  update-type: version-update:semver-major
  dependency-group: python-packages
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Mar 31, 2025
@dependabot dependabot bot requested review from a team as code owners March 31, 2025 04:46
@greenbonebot greenbonebot enabled auto-merge (rebase) March 31, 2025 04:46
@github-actions
Copy link

github-actions bot commented Mar 31, 2025

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 3228b95.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

OpenSSF Scorecard

PackageVersionScoreDetails
pip/coverage 7.8.0 🟢 8.5
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 24 issue activity found in the last 90 days -- score normalized to 10
Code-Review⚠️ 0Found 1/28 approved changesets -- score normalized to 0
Security-Policy🟢 10security policy file detected
License🟢 10license file detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices🟢 5badge detected: Passing
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Signed-Releases⚠️ -1no releases found
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
Packaging🟢 10packaging workflow detected
SAST🟢 10SAST tool is run on all commits
pip/pontos 25.3.3 🟢 7.4
Details
CheckScoreReason
Code-Review🟢 3Found 4/12 approved changesets -- score normalized to 3
Dependency-Update-Tool🟢 10update tool detected
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
License🟢 10license file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
Security-Policy🟢 10security policy file detected
Packaging🟢 10packaging workflow detected
CI-Tests🟢 108 out of 8 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 6project has 2 contributing companies or organizations -- score normalized to 6
pip/rich 14.0.0 🟢 6.9
Details
CheckScoreReason
Code-Review🟢 5Found 5/9 approved changesets -- score normalized to 5
Maintained🟢 50 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
License🟢 10license file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Fuzzing🟢 10project is fuzzed
Pinned-Dependencies⚠️ 2dependency not pinned by hash detected -- score normalized to 2
Vulnerabilities🟢 91 existing vulnerabilities detected
SAST🟢 10SAST tool is run on all commits

Scanned Files

  • poetry.lock

@github-actions
Copy link

github-actions bot commented Mar 31, 2025

Conventional Commits Report

Type Number
Dependencies 1

🚀 Conventional commits found.

@greenbonebot greenbonebot merged commit b5664ad into main Mar 31, 2025
25 checks passed
@greenbonebot greenbonebot deleted the dependabot/pip/python-packages-31b06e032e branch March 31, 2025 06:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bjoernricks bjoernricks bjoernricks approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@bjoernricks @greenbonebot