Bump the pip group across 1 directory with 9 updates #64

dependabot · 2024-04-25T06:33:43Z

Bumps the pip group with 9 updates in the /loc.gov JSON API/Chronicling_America_Title_Essay_Datasets directory:

Package	From	To
certifi	`2022.12.7`	`2023.7.22`
fonttools	`4.32.0`	`4.43.0`
idna	`3.3`	`3.7`
jinja2	`3.0.1`	`3.1.3`
pillow	`9.3.0`	`10.3.0`
pydantic	`1.9.2`	`1.10.13`
requests	`2.28.1`	`2.31.0`
tornado	`6.1`	`6.3.3`
urllib3	`1.26.10`	`1.26.18`

Updates certifi from 2022.12.7 to 2023.7.22

Commits

8fb96ed 2023.07.22
afe7722 Bump actions/setup-python from 4.6.1 to 4.7.0 (#230)
2038739 Bump dessant/lock-threads from 3.0.0 to 4.0.1 (#229)
44df761 Hash pin Actions and enable dependabot (#228)
8b3d7ba 2023.05.07
53da240 ci: Add Python 3.12-dev to the testing (#224)
c2fc3b1 Create a Security Policy (#222)
c211ef4 Set up permissions to github workflows (#218)
2087de5 Don't let deprecation warning fail CI (#219)
e0b9fc5 remove paragraphs about 1024-bit roots from README
Additional commits viewable in compare view

Updates fonttools from 4.32.0 to 4.43.0

Release notes

Sourced from fonttools's releases.

4.43.0

[subset] Set up lxml XMLParser(resolve_entities=False) when parsing OT-SVG documents to prevent XML External Entity (XXE) attacks (9f61271dc): https://codeql.github.com/codeql-query-help/python/py-xxe/

[varLib.iup] Added workaround for a Cython bug in iup_delta_optimize that was leading to IUP tolerance being incorrectly initialised, resulting in sub-optimal deltas (60126435d, cython/cython#5732).

[varLib] Added new command-line entry point fonttools varLib.avar to add an avar table to an existing VF from axes mappings in a .designspace file (0a3360e52).

[instancer] Fixed bug whereby no longer used variation regions were not correctly pruned after VarData optimization (#3268).

Added support for Python 3.12 (#3283).

4.42.1

[t1Lib] Fixed several Type 1 issues (#3238, #3240).

[otBase/packer] Allow sharing tables reached by different offset sizes (#3241, #3236, 457f11c2).

[varLib/merger] Fix Cursive attachment merging error when all anchors are NULL (#3248, #3247).

[ttLib] Fixed warning when calling addMultilingualName and ttFont parameter was not passed on to findMultilingualName (#3253).

4.42.0

[varLib] Use sentinel value 0xFFFF to mark a glyph advance in hmtx/vmtx as non participating, allowing sparse masters to contain glyphs for variation purposes other than {H,V}VAR (#3235).

[varLib/cff] Treat empty glyphs in non-default masters as missing, thus not participating in CFF2 delta computation, similarly to how varLib already treats them for gvar (#3234).

Added varLib.avarPlanner script to deduce 'correct' avar v1 axis mappings based on glyph average weights (#3223).

4.41.1

[subset] Fixed perf regression in v4.41.0 by making NameRecordVisitor only visit tables that do contain nameID references (#3213, #3214).

[varLib.instancer] Support instancing fonts containing null ConditionSet offsets in FeatureVariationRecords (#3211, #3212).

[statisticsPen] Report font glyph-average weight/width and font-wide slant.

[fontBuilder] Fixed head.created date incorrectly set to 0 instead of the current timestamp, regression introduced in v4.40.0 (#3210).

[varLib.merger] Support sparse CursivePos masters (#3209).

4.41.0

[fontBuilder] Fixed bug in setupOS2 with default panose attribute incorrectly being set to a dict instead of a Panose object (#3201).

[name] Added method to removeUnusedNameRecords in the user range (#3185).

[varLib.instancer] Fixed issue with L4 instancing (moving default) (#3179).

[cffLib] Use latin1 so we can roundtrip non-ASCII in {Full,Font,Family}Name (#3202).

[designspaceLib] Mark as optional in docs (as it is in the code).

[glyf-1] Fixed drawPoints() bug whereby last cubic segment becomes quadratic (#3189, #3190).

[fontBuilder] Propagate the 'hidden' flag to the fvar Axis instance (#3184).

[fontBuilder] Update setupAvar() to also support avar 2, fixing _add_avar() call site (#3183).

Added new voltLib.voltToFea submodule (originally Tiro Typeworks' "Volto") for converting VOLT OpenType Layout sources to FEA format (#3164).

4.40.0

Published native binary wheels to PyPI for all the python minor versions and platform and architectures currently supported that would benefit from this. They will include precompiled Cython-accelerated modules (e.g. cu2qu) without requiring to compile them from source. The pure-python wheel and source distribution will continue to be published as always (pip will automatically chose them when no binary wheel is available for the given platform, e.g. pypy). Use pip install --no-binary=fonttools fonttools to expliclity request pip to install from the pure-python source.

[designspaceLib|varLib] Add initial support for specifying axis mappings and build avar2 table from those (#3123).

[feaLib] Support variable ligature caret position (#3130).

[varLib|glyf] Added option to --drop-implied-oncurves; test for impliable oncurve points either before or after rounding (#3146, #3147, #3155, #3156).

[TTGlyphPointPen] Don't error with empty contours, simply ignore them (#3145).

[sfnt] Fixed str vs bytes remnant of py3 transition in code dealing with de/compiling WOFF metadata (#3129).

[instancer-solver] Fixed bug when moving default instance with sparse masters (#3139, #3140).

[feaLib] Simplify variable scalars that don’t vary (#3132).

[pens] Added filter pen that explicitly emits closing line when lastPt != movePt (#3100).

[varStore] Improve optimize algorithm and better document the algorithm (#3124, #3127).
Added quantization option (#3126).

Added CI workflow config file for building native binary wheels (#3121).

[fontBuilder] Added glyphDataFormat=0 option; raise error when glyphs contain cubic outlines but glyphDataFormat was not explicitly set to 1 (#3113, #3119).

... (truncated)

Changelog

Sourced from fonttools's changelog.

4.43.0 (released 2023-09-29)

[subset] Set up lxml XMLParser(resolve_entities=False) when parsing OT-SVG documents to prevent XML External Entity (XXE) attacks (9f61271dc): https://codeql.github.com/codeql-query-help/python/py-xxe/

[varLib.iup] Added workaround for a Cython bug in iup_delta_optimize that was leading to IUP tolerance being incorrectly initialised, resulting in sub-optimal deltas (60126435d, cython/cython#5732).

[varLib] Added new command-line entry point fonttools varLib.avar to add an avar table to an existing VF from axes mappings in a .designspace file (0a3360e52).

[instancer] Fixed bug whereby no longer used variation regions were not correctly pruned after VarData optimization (#3268).

Added support for Python 3.12 (#3283).

4.42.1 (released 2023-08-20)

[t1Lib] Fixed several Type 1 issues (#3238, #3240).

[otBase/packer] Allow sharing tables reached by different offset sizes (#3241, #3236).

[varLib/merger] Fix Cursive attachment merging error when all anchors are NULL (#3248, #3247).

[ttLib] Fixed warning when calling addMultilingualName and ttFont parameter was not passed on to findMultilingualName (#3253).

4.42.0 (released 2023-08-02)

[varLib] Use sentinel value 0xFFFF to mark a glyph advance in hmtx/vmtx as non participating, allowing sparse masters to contain glyphs for variation purposes other than {H,V}VAR (#3235).

[varLib/cff] Treat empty glyphs in non-default masters as missing, thus not participating in CFF2 delta computation, similarly to how varLib already treats them for gvar (#3234).

Added varLib.avarPlanner script to deduce 'correct' avar v1 axis mappings based on glyph average weights (#3223).

4.41.1 (released 2023-07-21)

[subset] Fixed perf regression in v4.41.0 by making NameRecordVisitor only visit tables that do contain nameID references (#3213, #3214).

[varLib.instancer] Support instancing fonts containing null ConditionSet offsets in FeatureVariationRecords (#3211, #3212).

[statisticsPen] Report font glyph-average weight/width and font-wide slant.

[fontBuilder] Fixed head.created date incorrectly set to 0 instead of the current timestamp, regression introduced in v4.40.0 (#3210).

[varLib.merger] Support sparse CursivePos masters (#3209).

4.41.0 (released 2023-07-12)

... (truncated)

Commits

145460e Release 4.43.0
64f3fd8 Update changelog [skip ci]
7aea49e Merge pull request #3283 from hugovk/main
4470c44 Bump requirements.txt to support Python 3.12
0c87cba Bump scipy for Python 3.12 support
eda6fa5 Add support for Python 3.12
0e033b0 Bump reportlab from 3.6.12 to 3.6.13 in /Doc
6012643 [iup] Work around cython bug
b14268a [iup] Remove copy/pasta
0a3360e [varLib.avar] New module to compile avar from .designspace file
Additional commits viewable in compare view

Updates idna from 3.3 to 3.7

Release notes

Sourced from idna's releases.

v3.7

What's Changed

Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

Full Changelog: kjd/idna@v3.6...v3.7

Changelog

Sourced from idna's changelog.

3.7 (2024-04-11) ++++++++++++++++

Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

3.6 (2023-11-25) ++++++++++++++++

Fix regression to include tests in source distribution.

3.5 (2023-11-24) ++++++++++++++++

Update to Unicode 15.1.0

String codec name is now "idna2008" as overriding the system codec "idna" was not working.

Fix typing error for codec encoding

"setup.cfg" has been added for this release due to some downstream lack of adherence to PEP 517. Should be removed in a future release so please prepare accordingly.

Removed reliance on a symlink for the "idna-data" tool to comport with PEP 517 and the Python Packaging User Guide for sdist archives.

Added security reporting protocol for project

Thanks Jon Ribbens, Diogo Teles Sant'Anna, Wu Tingfeng for contributions to this release.

3.4 (2022-09-14) ++++++++++++++++

Update to Unicode 15.0.0

Migrate to pyproject.toml for build information (PEP 621)

Correct another instance where generic exception was raised instead of IDNAError for malformed input

Source distribution uses zeroized file ownership for improved reproducibility

Thanks to Seth Michael Larson for contributions to this release.

Commits

1d365e1 Release v3.7
c1b3154 Merge pull request #172 from kjd/optimize-contextj
0394ec7 Merge branch 'master' into optimize-contextj
cd58a23 Merge pull request #152 from elliotwutingfeng/dev
5beb28b More efficient resolution of joiner contexts
1b12148 Update ossf/scorecard-action to v2.3.1
d516b87 Update Github actions/checkout to v4
c095c75 Merge branch 'master' into dev
60a0a4c Fix typo in GitHub Actions workflow key
5918a0e Merge branch 'master' into dev
Additional commits viewable in compare view

Updates jinja2 from 3.0.1 to 3.1.3

Release notes

Sourced from jinja2's releases.

3.1.3

This is a fix release for the 3.1.x feature branch.

Fix for GHSA-h5c8-rqwp-cp95. You are affected if you are using xmlattr and passing user input as attribute keys.

Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-3

Milestone: https://github.com/pallets/jinja/milestone/15?closed=1

3.1.2

This is a fix release for the 3.1.0 feature release.

Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-2

Milestone: https://github.com/pallets/jinja/milestone/13?closed=1

3.1.1

Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-1

Milestone: https://github.com/pallets/jinja/milestone/12?closed=1

3.1.0

This is a feature release, which includes new features and removes previously deprecated features. The 3.1.x branch is now the supported bugfix branch, the 3.0.x branch has become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. We also encourage upgrading to MarkupSafe 2.1.1, the latest version at this time.

Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-0

Milestone: https://github.com/pallets/jinja/milestone/8?closed=1

MarkupSafe changes: https://markupsafe.palletsprojects.com/en/2.1.x/changes/#version-2-1-1

3.0.3

Changes: https://jinja.palletsprojects.com/en/3.0.x/changes/#version-3-0-3

3.0.2

Changes: https://jinja.palletsprojects.com/en/3.0.x/changes/#version-3-0-2

Changelog

Sourced from jinja2's changelog.

Version 3.1.3

Released 2024-01-10

Fix compiler error when checking if required blocks in parent templates are empty. :pr:1858

xmlattr filter does not allow keys with spaces. GHSA-h5c8-rqwp-cp95

Make error messages stemming from invalid nesting of {% trans %} blocks more helpful. :pr:1918

Version 3.1.2

Released 2022-04-28

Add parameters to Environment.overlay to match __init__. :issue:1645

Handle race condition in FileSystemBytecodeCache. :issue:1654

Version 3.1.1

Released 2022-03-25

The template filename on Windows uses the primary path separator. :issue:1637

Version 3.1.0

Released 2022-03-24

Drop support for Python 3.6. :pr:1534

Remove previously deprecated code. :pr:1544

WithExtension and AutoEscapeExtension are built-in now.

contextfilter and contextfunction are replaced by pass_context. evalcontextfilter and evalcontextfunction are replaced by pass_eval_context. environmentfilter and environmentfunction are replaced by pass_environment.

Markup and escape should be imported from MarkupSafe.

Compiled templates from very old Jinja versions may need to be recompiled.

Legacy resolve mode for Context subclasses is no longer supported. Override resolve_or_missing instead of

... (truncated)

Commits

d9de4bb release version 3.1.3
50124e1 skip test pypi
9ea7222 use trusted publishing
da703f7 use trusted publishing
bce1746 use trusted publishing
7277d80 update pre-commit hooks
5c8a105 Make nested-trans-block exceptions nicer (#1918)
19a55db Make nested-trans-block exceptions nicer
7167953 Merge pull request from GHSA-h5c8-rqwp-cp95
7dd3680 xmlattr filter disallows keys with spaces
Additional commits viewable in compare view

Updates pillow from 9.3.0 to 10.3.0

Release notes

Sourced from pillow's releases.

10.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/10.3.0.html

Changes

CVE-2024-28219: Use strncpy to avoid buffer overflow #7928 [@hugovk]

Use functools.lru_cache for hopper() #7912 [@hugovk]

Raise ValueError if seeking to greater than offset-sized integer in TIFF #7883 [@radarhere]

Improve speed of loading QOI images #7925 [@radarhere]

Added RGB to I;16N conversion #7920 [@radarhere]

Add --report argument to main.py to omit supported formats #7818 [@nulano]

Added RGB to I;16, I;16L and I;16B conversion #7918 [@radarhere]

Fix editable installation with custom build backend and configuration options #7658 [@nulano]

Fix putdata() for I;16N on big-endian #7209 [@Yay295]

Determine MPO size from markers, not EXIF data #7884 [@radarhere]

Improved conversion from RGB to RGBa, LA and La #7888 [@radarhere]

Support FITS images with GZIP_1 compression #7894 [@radarhere]

Use I;16 mode for 9-bit JPEG 2000 images #7900 [@scaramallion]

Raise ValueError if kmeans is negative #7891 [@radarhere]

Remove TIFF tag OSUBFILETYPE when saving using libtiff #7893 [@radarhere]

Raise ValueError for negative values when loading P1-P3 PPM images #7882 [@radarhere]

Added reading of JPEG2000 palettes #7870 [@radarhere]

Added alpha_quality argument when saving WebP images #7872 [@radarhere]

Fixed joined corners for ImageDraw rounded_rectangle() non-integer dimensions #7881 [@radarhere]

Removed Python and NumPy pinning on Cygwin #7880 [@radarhere]

Update UnidentifiedImageError and version imports #7644 [@radarhere]

Stop reading EPS image at EOF marker #7753 [@radarhere]

PSD layer co-ordinates may be negative #7706 [@radarhere]

Use subprocess with CREATE_NO_WINDOW flag in ImageShow WindowsViewer #7791 [@radarhere]

When saving GIF frame that restores to background color, do not fill identical pixels #7788 [@radarhere]

Fixed reading PNG iCCP compression method #7823 [@radarhere]

Allow writing IFDRational to UNDEFINED tag #7840 [@radarhere]

Fix logged tag name when loading Exif data #7842 [@radarhere]

Use maximum frame size in IHDR chunk when saving APNG images #7821 [@radarhere]

Prevent opening P TGA images without a palette #7797 [@radarhere]

Use palette when loading ICO images #7798 [@radarhere]

Use consistent arguments for load_read and load_seek #7713 [@radarhere]

Turn off nullability warnings for macOS SDK #7827 [@radarhere]

Fix shift-sign issue in Convert.c #7838 [@r-barnes]

winbuild: Refactor dependency versions into constants #7843 [@hugovk]

Build macOS arm64 wheels natively #7852 [@radarhere]

Fixed typo #7855 [@radarhere]

Open 16-bit grayscale PNGs as I;16 #7849 [@radarhere]

Handle truncated chunks at the end of PNG images #7709 [@lajiyuan]

Match mask size to pasted image size in GifImagePlugin #7779 [@radarhere]

Changed SupportsGetMesh protocol to be public #7841 [@radarhere]

Release GIL while calling WebPAnimDecoderGetNext #7782 [@evanmiller]

Fixed reading FLI/FLC images with a prefix chunk #7804 [@twolife]

Updated package name for Tidelift #7810 [@radarhere]

Removed unused code #7744 [@radarhere]

... (truncated)

Changelog

Sourced from pillow's changelog.

10.3.0 (2024-04-01)

CVE-2024-28219: Use strncpy to avoid buffer overflow #7928 [radarhere, hugovk]

Deprecate eval(), replacing it with lambda_eval() and unsafe_eval() #7927 [radarhere, hugovk]

Raise ValueError if seeking to greater than offset-sized integer in TIFF #7883 [radarhere]

Add --report argument to __main__.py to omit supported formats #7818 [nulano, radarhere, hugovk]

Added RGB to I;16, I;16L, I;16B and I;16N conversion #7918, #7920 [radarhere]

Fix editable installation with custom build backend and configuration options #7658 [nulano, radarhere]

Fix putdata() for I;16N on big-endian #7209 [Yay295, hugovk, radarhere]

Determine MPO size from markers, not EXIF data #7884 [radarhere]

Improved conversion from RGB to RGBa, LA and La #7888 [radarhere]

Support FITS images with GZIP_1 compression #7894 [radarhere]

Use I;16 mode for 9-bit JPEG 2000 images #7900 [scaramallion, radarhere]

Raise ValueError if kmeans is negative #7891 [radarhere]

Remove TIFF tag OSUBFILETYPE when saving using libtiff #7893 [radarhere]

Raise ValueError for negative values when loading P1-P3 PPM images #7882 [radarhere]

Added reading of JPEG2000 palettes #7870 [radarhere]

Added alpha_quality argument when saving WebP images #7872 [radarhere]

... (truncated)

Commits

5c89d88 10.3.0 version bump
63cbfcf Update CHANGES.rst [ci skip]
2776126 Merge pull request #7928 from python-pillow/lcms
aeb51cb Merge branch 'main' into lcms
5beb0b6 Update CHANGES.rst [ci skip]
cac6ffa Merge pull request #7927 from python-pillow/imagemath
f5eeeac Name as 'options' in lambda_eval and unsafe_eval, but '_dict' in deprecated eval
facf3af Added release notes
2a93aba Use strncpy to avoid buffer overflow
a670597 Update CHANGES.rst [ci skip]
Additional commits viewable in compare view

Updates pydantic from 1.9.2 to 1.10.13

Release notes

Sourced from pydantic's releases.

V1.10.13 2023-09-27

What's Changed

Update pip commands to install 1.10 by @chbndrhnns in pydantic/pydantic#6930

Make the v1 mypy plugin work with both v1 and v2 by @dmontagu in pydantic/pydantic#6920

[Backport] Add max length check to validate_email by @hramezani in pydantic/pydantic#7673

Full Changelog: pydantic/pydantic@v1.10.12...v1.10.13

V1.10.12

What's Changed

Deque's maxlen property dropped on V1 validation by @maciekglowka in pydantic/pydantic#6586

Prepare release 1.10.12 by @hramezani in pydantic/pydantic#6825

New Contributors

@maciekglowka made their first contribution in pydantic/pydantic#6586

Full Changelog: pydantic/pydantic@v1.10.11...v1.10.12

V1.10.11

What's Changed

Fix import of create_model in tools.py by @SharathHuddar in pydantic/pydantic#6364

Prepare for 1.10.11 by @hramezani in pydantic/pydantic#6420

New Contributors

@SharathHuddar made their first contribution in pydantic/pydantic#6364

Full Changelog: pydantic/pydantic@v1.10.10...v1.10.11

V1.10.10

What's Changed

Fix racy doctests by @K900 in pydantic/pydantic#6103

✅ Update FastAPI test script by @Kludex in pydantic/pydantic#6117

add roadmap to annoucement by @samuelcolvin in pydantic/pydantic#6120

Fixed literal validator errors for unhashable values by @markus1978 in pydantic/pydantic#6194

Bug fix for forward refs in generics by @mark-todd in pydantic/pydantic#6157

Add Pydantic Json field support to settings management by @hramezani in pydantic/pydantic#6250

New Contributors

@K900 made their first contribution in pydantic/pydantic#6103

@markus1978 made their first contribution in pydantic/pydantic#6194

Full Changelog: pydantic/pydantic@v1.10.9...v1.10.10

V1.10.9

What's Changed

Add Pydantic classifier by @hramezani in pydantic/pydantic#5847

📌 Use Cython < v3 by @lig in pydantic/pydantic#5845

[cherry-pick] Fix mypy plugin for 1.4.0 (#5927) by @cdce8p in pydantic/pydantic#5928

Add future and past date hypothesis strategies by @bschoenmaeckers in pydantic/pydantic#5850

... (truncated)

Changelog

Sourced from pydantic's changelog.

v1.10.13 (2023-09-27)

Fix: Add max length check to pydantic.validate_email, #7673 by @hramezani

Docs: Fix pip commands to install v1, #6930 by @chbndrhnns

v1.10.12 (2023-07-24)

Fixes the maxlen property being dropped on deque validation. Happened only if the deque item has been typed. Changes the _validate_sequence_like func, #6581 by @maciekglowka

v1.10.11 (2023-07-04)

Importing create_model in tools.py through relative path instead of absolute path - so that it doesn't import V2 code when copied over to V2 branch, #6361 by @SharathHuddar

v1.10.10 (2023-06-30)

Add Pydantic Json field support to settings management, #6250 by @hramezani

Fixed literal validator errors for unhashable values, #6188 by @markus1978

Fixed bug with generics receiving forward refs, #6130 by @mark-todd

Update install method of FastAPI for internal tests in CI, #6117 by @Kludex

v1.10.9 (2023-06-07)

Fix trailing zeros not ignored in Decimal validation, #5968 by @hramezani

Fix mypy plugin for v1.4.0, #5928 by @cdce8p

Add future and past date hypothesis strategies, #5850 by @bschoenmaeckers

Discourage usage of Cython 3 with Pydantic 1.x, #5845 by @lig

v1.10.8 (2023-05-23)

Fix a bug in Literal usage with typing-extension==4.6.0, #5826 by @hramezani

This solves the (closed) issue #3849 where aliased fields that use discriminated union fail to validate when the data contains the non-aliased field name, #5736 by @benwah

Update email-validator dependency to >=2.0.0post2, #5627 by @adriangb

update AnyClassMethod for changes in python/typeshed#9771, #5505 by @ITProKyle

v1.10.7 (2023-03-22)

Fix creating schema from model using ConstrainedStr with regex as dict key, #5223 by @matejetz

Address bug in mypy plugin caused by explicit_package_bases=True, #5191 by @dmontagu

Add implicit defaults in the mypy plugin for Field with no default argument, #5190 by @dmontagu

Fix schema generated for Enum values used as Literals in discriminated unions, #5188 by @javibookline

Fix mypy failures caused by the pydantic mypy plugin when users define from_orm in their own classes, #5187 by @dmontagu

Fix InitVar usage with pydantic dataclasses, mypy version 1.1.1 and the custom mypy plugin, #5162 by @cdce8p

v1.10.6 (2023-03-08)

Implement logic to support creating validators from non standard callables by using defaults to identify them and unwrapping functools.partial and functools.partialmethod when checking the signature, #5126 by @JensHeinrich

Fix mypy plugin for v1.1.1, and fix dataclass_transform decorator for pydantic dataclasses, #5111 by @cdce8p

Raise ValidationError, not ConfigError, when a discriminator value is unhashable, #4773 by @kurtmckee

v1.10.5 (2023-02-15)

... (truncated)

Commits

8822578 Prepare release 1.10.13 (#7674)
59d8f38 [Backport] Add max length check to validate_email (#7673)
69b92b5 Make the v1 mypy plugin work with both v1 and v2 (#6920)
87bf417 Update pip commands to install 1.10 (#6930)
d9c2af3 Prepare release 1.10.12 (#6825)
2aaddf6 Deque's maxlen property dropped on V1 validation (#6586)
15c82d9 Prepare for 1.10.11 (#6420)
8750c37 no longer tag docs release as latest
2c0e2a6 Fix import of create_model in tools.py (#6364)
0e8a387 Prepare for 1.10.10 (#6308)
Additional commits viewable in compare view

Updates requests from 2.28.1 to 2.31.0

Release notes

Sourced from requests's releases.

v2.31.0

2.31.0 (2023-05-22)

Security

Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential forwarding of Proxy-Authorization headers to destination servers when following HTTPS redirects.

When proxies are defined with user info (https://user:pass@proxy:8080), Requests will construct a Proxy-Authorization header that is attached to the request to authenticate with the proxy.

In cases where Requests receives a redirect response, it previously reattached the Proxy-Authorization header incorrectly, resulting in the value being sent through the tunneled connection to the destination server. Users who rely on defining their proxy credentials in the URL are strongly encouraged to upgrade to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy credentials once the change has been fully deployed.

Users who do not use a proxy or do not supply their proxy credentials through the user information portion of their proxy URL are not subject to this vulnerability.

Full details can be read in our Github Security Advisory and CVE-2023-32681.

v2.30.0

2.30.0 (2023-05-03)

Dependencies

⚠️ Added support for urllib3 2.0. ⚠️

This may contain minor breaking changes so we advise careful testing and reviewing https://urllib3.readthedocs.io/en/latest/v2-migration-guide.html prior to upgrading.

Users who wish to stay on urllib3 1.x can pin to urllib3<2.

v2.29.0

2.29.0 (2023-04-26)

Improvements

Requests now defers chunked requests to the urllib3 implementation to improve standardization. (#6226)

Requests relaxes header component requirements to support bytes/str subclasses. (#6356)

... (truncated)

Changelog

Sourced from requests's changelog.

2.31.0 (2023-05-22)

Security

Versions of Requests between v2.3.0 and v2.30.0 are vulnerable to potential forwarding of Proxy-Authorization headers to destination servers when following HTTPS redirects.

When proxies are defined with user info (https://user:pass@proxy:8080), Requests will construct a Proxy-Authorization header that is attached to the request to authenticate with the proxy.

In cases where Requests receives a redirect response, it previously reattached the Proxy-Authorization header incorrectly, resulting in the value being sent through the tunneled connection to the destination server. Users who rely on defining their proxy credentials in the URL are strongly encouraged to upgrade to Requests 2.31.0+ to prevent unintentional leakage and rotate their proxy credentials once the change has been fully deployed.

Users who do not use a proxy or do not supply their proxy credentials through the user information portion of their proxy URL are not subject to this vulnerability.

Full details can be read in our Github Security Advisory and CVE-2023-32681.

2.30.0 (2023-05-03)

Dependencies

⚠️ Added support for urllib3 2.0. ⚠️

This may contain minor breaking changes so we advise careful testing and reviewing https://urllib3.readthedocs.io/en/latest/v2-migration-guide.html prior to upgrading.

Users who wish to stay on urllib3 1.x can pin to urllib3<2.

2.29.0 (2023-04-26)

Improvements

Requests now defers chunked requests to the urllib3 implementation to improve standardization. (#6226)

Requests relaxes header component requirements to support bytes/str subclasses. (#6356)

2.28.2 (2023-01-12)

... (truncated)

Commits

147c851<... Description has been truncated

Bumps the pip group with 9 updates in the /loc.gov JSON API/Chronicling_America_Title_Essay_Datasets directory: | Package | From | To | | --- | --- | --- | | [certifi](https://github.com/certifi/python-certifi) | `2022.12.7` | `2023.7.22` | | [fonttools](https://github.com/fonttools/fonttools) | `4.32.0` | `4.43.0` | | [idna](https://github.com/kjd/idna) | `3.3` | `3.7` | | [jinja2](https://github.com/pallets/jinja) | `3.0.1` | `3.1.3` | | [pillow](https://github.com/python-pillow/Pillow) | `9.3.0` | `10.3.0` | | [pydantic](https://github.com/pydantic/pydantic) | `1.9.2` | `1.10.13` | | [requests](https://github.com/psf/requests) | `2.28.1` | `2.31.0` | | [tornado](https://github.com/tornadoweb/tornado) | `6.1` | `6.3.3` | | [urllib3](https://github.com/urllib3/urllib3) | `1.26.10` | `1.26.18` | Updates `certifi` from 2022.12.7 to 2023.7.22 - [Commits](certifi/python-certifi@2022.12.07...2023.07.22) Updates `fonttools` from 4.32.0 to 4.43.0 - [Release notes](https://github.com/fonttools/fonttools/releases) - [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst) - [Commits](fonttools/fonttools@4.32.0...4.43.0) Updates `idna` from 3.3 to 3.7 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst) - [Commits](kjd/idna@v3.3...v3.7) Updates `jinja2` from 3.0.1 to 3.1.3 - [Release notes](https://github.com/pallets/jinja/releases) - [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst) - [Commits](pallets/jinja@3.0.1...3.1.3) Updates `pillow` from 9.3.0 to 10.3.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@9.3.0...10.3.0) Updates `pydantic` from 1.9.2 to 1.10.13 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v1.9.2...v1.10.13) Updates `requests` from 2.28.1 to 2.31.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.28.1...v2.31.0) Updates `tornado` from 6.1 to 6.3.3 - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.1.0...v6.3.3) Updates `urllib3` from 1.26.10 to 1.26.18 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@1.26.10...1.26.18) --- updated-dependencies: - dependency-name: certifi dependency-type: direct:production dependency-group: pip - dependency-name: fonttools dependency-type: direct:production dependency-group: pip - dependency-name: idna dependency-type: direct:production dependency-group: pip - dependency-name: jinja2 dependency-type: direct:production dependency-group: pip - dependency-name: pillow dependency-type: direct:production dependency-group: pip - dependency-name: pydantic dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-type: direct:production dependency-group: pip - dependency-name: tornado dependency-type: direct:production dependency-group: pip - dependency-name: urllib3 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2024-05-03T20:50:05Z

Superseded by #65.

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Apr 25, 2024

dependabot bot mentioned this pull request Apr 25, 2024

Bump the pip group across 1 directory with 8 updates #63

Closed

dependabot bot closed this May 3, 2024

dependabot bot deleted the dependabot/pip/loc.gov-JSON-API/Chronicling_America_Title_Essay_Datasets/pip-48962e1c9d branch May 3, 2024 20:50

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the pip group across 1 directory with 9 updates #64

Bump the pip group across 1 directory with 9 updates #64

Uh oh!

dependabot bot commented on behalf of github Apr 25, 2024

Uh oh!

dependabot bot commented on behalf of github May 3, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Bump the pip group across 1 directory with 9 updates #64

Bump the pip group across 1 directory with 9 updates #64

Uh oh!

Conversation

dependabot bot commented on behalf of github Apr 25, 2024

4.43.0

4.42.1

4.42.0

4.41.1

4.41.0

4.40.0

4.43.0 (released 2023-09-29)

4.42.1 (released 2023-08-20)

4.42.0 (released 2023-08-02)

4.41.1 (released 2023-07-21)

4.41.0 (released 2023-07-12)

v3.7

What's Changed

3.1.3

3.1.2

3.1.1

3.1.0

3.0.3

3.0.2

Version 3.1.3

Version 3.1.2

Version 3.1.1

Version 3.1.0

10.3.0

Changes

10.3.0 (2024-04-01)

V1.10.13 2023-09-27

What's Changed

V1.10.12

What's Changed

New Contributors

V1.10.11

What's Changed

New Contributors

V1.10.10

What's Changed

New Contributors

V1.10.9

What's Changed

v1.10.13 (2023-09-27)

v1.10.12 (2023-07-24)

v1.10.11 (2023-07-04)

v1.10.10 (2023-06-30)

v1.10.9 (2023-06-07)

v1.10.8 (2023-05-23)

v1.10.7 (2023-03-22)

v1.10.6 (2023-03-08)

v1.10.5 (2023-02-15)

v2.31.0

2.31.0 (2023-05-22)

v2.30.0

2.30.0 (2023-05-03)

v2.29.0

2.29.0 (2023-04-26)

2.31.0 (2023-05-22)

2.30.0 (2023-05-03)

2.29.0 (2023-04-26)

2.28.2 (2023-01-12)

Uh oh!

dependabot bot commented on behalf of github May 3, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant