build(deps): bump the pip group across 1 directory with 5 updates #8

dependabot · 2024-12-02T22:48:28Z

Bumps the pip group with 5 updates in the / directory:

Package	From	To
mypy	`1.11.2`	`1.13.0`
ruff	`0.6.9`	`0.8.1`
bandit	`1.7.10`	`1.8.0`
semgrep	`1.90.0`	`1.97.0`
pre-commit	`4.0.0`	`4.0.1`

Updates mypy from 1.11.2 to 1.13.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next release

Change to enum membership semantics

As per the updated typing specification for enums, enum members must be left unannotated.
class Pet(Enum):
    CAT = 1  # Member attribute
    DOG = 2  # Member attribute
    WOLF: int = 3  # New error: Enum members must be left unannotated
species: str  # Considered a non-member attribute
In particular, the specification change can result in issues in type stubs (.pyi files), since historically it was common to leave the value absent:
# In a type stub (.pyi file)
class Pet(Enum):
# Change in semantics: previously considered members, now non-member attributes
CAT: int
DOG: int
# Mypy will now issue a warning if it detects this situation in type stubs:
# &gt; Detected enum &quot;Pet&quot; in a type stub with zero members.
# &gt; There is a chance this is due to a recent change in the semantics of enum membership.
# &gt; If so, use `member = value` to mark an enum member, instead of `member: type`

class Pet(Enum):
# As per the specification, you should now do one of the following:
DOG = 1  # Member attribute with value 1 and known type
WOLF = cast(int, ...)  # Member attribute with unknown value but known type
LION = ...  # Member attribute with unknown value and unknown type
Contributed by Terence Honles in PR 17207 and Shantanu Jain in PR 18068.

Mypy 1.13

We’ve just uploaded mypy 1.13 to the Python Package Index (PyPI). Mypy is a static type checker for Python. You can install it as follows:
python3 -m pip install -U mypy

... (truncated)

Commits

eb31034 Bump version to 1.13.0
2eeb588 Update changelog for 1.12.1 (#17999)
bc0386b Changelog for 1.13 (#18000)
5c4d2db Add faster-cache extra, test in CI (#17978)
854ad18 Make is_sub_path faster (#17962)
50aa4ca Speed up stubs suggestions (#17965)
7c27808 Use orjson instead of json, when available (#17955)
2cd2406 Use fast path in modulefinder more often (#17950)
e20aaee Let mypyc optimise os.path.join (#17949)
159974c Use sha1 for hashing (#17953)
Additional commits viewable in compare view

Updates ruff from 0.6.9 to 0.8.1

Release notes

Sourced from ruff's releases.

0.8.1

Release Notes

Preview features

Formatter: Avoid invalid syntax for format-spec with quotes for all Python versions (#14625)

Formatter: Consider quotes inside format-specs when choosing the quotes for an f-string (#14493)

Formatter: Do not consider f-strings with escaped newlines as multiline (#14624)

Formatter: Fix f-string formatting in assignment statement (#14454)

Formatter: Fix unnecessary space around power operator (**) in overlong f-string expressions (#14489)

[airflow] Avoid implicit schedule argument to DAG and @dag (AIR301) (#14581)

[flake8-builtins] Exempt private built-in modules (A005) (#14505)

[flake8-pytest-style] Fix pytest.mark.parametrize rules to check calls instead of decorators (#14515)

[flake8-type-checking] Implement runtime-cast-value (TC006) (#14511)

[flake8-type-checking] Implement unquoted-type-alias (TC007) and quoted-type-alias (TC008) (#12927)

[flake8-use-pathlib] Recommend Path.iterdir() over os.listdir() (PTH208) (#14509)

[pylint] Extend invalid-envvar-default to detect os.environ.get (PLW1508) (#14512)

[pylint] Implement len-test (PLC1802) (#14309)

[refurb] Fix bug where methods defined using lambdas were flagged by FURB118 (#14639)

[ruff] Auto-add r prefix when string has no backslashes for unraw-re-pattern (RUF039) (#14536)

[ruff] Implement invalid-assert-message-literal-argument (RUF040) (#14488)

[ruff] Implement unnecessary-nested-literal (RUF041) (#14323)

[ruff] Implement unnecessary-regular-expression (RUF055) (#14659)

Rule changes

Ignore more rules for stub files (#14541)

[pep8-naming] Eliminate false positives for single-letter names (N811, N814) (#14584)

[pyflakes] Avoid false positives in @no_type_check contexts (F821, F722) (#14615)

[ruff] Detect redirected-noqa in file-level comments (RUF101) (#14635)

[ruff] Mark fixes for unsorted-dunder-all and unsorted-dunder-slots as unsafe when there are complex comments in the sequence (RUF022, RUF023) (#14560)

Bug fixes

Avoid fixing code to None | None for redundant-none-literal (PYI061) and never-union (RUF020) (#14583, #14589)

[flake8-bugbear] Fix mutable-contextvar-default to resolve annotated function calls properly (B039) (#14532)

[flake8-pyi, ruff] Fix traversal of nested literals and unions (PYI016, PYI051, PYI055, PYI062, RUF041) (#14641)

[flake8-pyi] Avoid rewriting invalid type expressions in unnecessary-type-union (PYI055) (#14660)

[flake8-type-checking] Avoid syntax errors and type checking problem for quoted annotations autofix (TC003, TC006) (#14634)

[pylint] Do not wrap function calls in parentheses in the fix for unnecessary-dunder-call (PLC2801) (#14601)

[ruff] Handle attrs's auto_attribs correctly (RUF009) (#14520)

Contributors

@AlexWaygood

@Daverball

@Glyphack

@InSyncWithFoo

@Lokejoke

@MichaReiser

@cake-monotone

... (truncated)

Changelog

Sourced from ruff's changelog.

0.8.1

Preview features

Formatter: Avoid invalid syntax for format-spec with quotes for all Python versions (#14625)

Formatter: Consider quotes inside format-specs when choosing the quotes for an f-string (#14493)

Formatter: Do not consider f-strings with escaped newlines as multiline (#14624)

Formatter: Fix f-string formatting in assignment statement (#14454)

Formatter: Fix unnecessary space around power operator (**) in overlong f-string expressions (#14489)

[airflow] Avoid implicit schedule argument to DAG and @dag (AIR301) (#14581)

[flake8-builtins] Exempt private built-in modules (A005) (#14505)

[flake8-pytest-style] Fix pytest.mark.parametrize rules to check calls instead of decorators (#14515)

[flake8-type-checking] Implement runtime-cast-value (TC006) (#14511)

[flake8-type-checking] Implement unquoted-type-alias (TC007) and quoted-type-alias (TC008) (#12927)

[flake8-use-pathlib] Recommend Path.iterdir() over os.listdir() (PTH208) (#14509)

[pylint] Extend invalid-envvar-default to detect os.environ.get (PLW1508) (#14512)

[pylint] Implement len-test (PLC1802) (#14309)

[refurb] Fix bug where methods defined using lambdas were flagged by FURB118 (#14639)

[ruff] Auto-add r prefix when string has no backslashes for unraw-re-pattern (RUF039) (#14536)

[ruff] Implement invalid-assert-message-literal-argument (RUF040) (#14488)

[ruff] Implement unnecessary-nested-literal (RUF041) (#14323)

[ruff] Implement unnecessary-regular-expression (RUF055) (#14659)

Rule changes

Ignore more rules for stub files (#14541)

[pep8-naming] Eliminate false positives for single-letter names (N811, N814) (#14584)

[pyflakes] Avoid false positives in @no_type_check contexts (F821, F722) (#14615)

[ruff] Detect redirected-noqa in file-level comments (RUF101) (#14635)

[ruff] Mark fixes for unsorted-dunder-all and unsorted-dunder-slots as unsafe when there are complex comments in the sequence (RUF022, RUF023) (#14560)

Bug fixes

Avoid fixing code to None | None for redundant-none-literal (PYI061) and never-union (RUF020) (#14583, #14589)

[flake8-bugbear] Fix mutable-contextvar-default to resolve annotated function calls properly (B039) (#14532)

[flake8-pyi, ruff] Fix traversal of nested literals and unions (PYI016, PYI051, PYI055, PYI062, RUF041) (#14641)

[flake8-pyi] Avoid rewriting invalid type expressions in unnecessary-type-union (PYI055) (#14660)

[flake8-type-checking] Avoid syntax errors and type checking problem for quoted annotations autofix (TC003, TC006) (#14634)

[pylint] Do not wrap function calls in parentheses in the fix for unnecessary-dunder-call (PLC2801) (#14601)

[ruff] Handle attrs's auto_attribs correctly (RUF009) (#14520)

0.8.0

Check out the blog post for a migration guide and overview of the changes!

Breaking changes

See also, the "Remapped rules" section which may result in disabled rules.

Default to Python 3.9

... (truncated)

Commits

b3b2c98 Update CHANGELOG.md with the new commits for 0.8.1 (#14664)
abb3c6e [flake8-pyi] Avoid rewriting invalid type expressions in `unnecessary-type-...
224fe75 [ruff] Implement unnecessary-regular-expression (RUF055) (#14659)
dc29f52 [flake8-pyi, ruff] Fix traversal of nested literals and unions (PYI016,...
d9cbf2f Avoids unnecessary overhead for TC004, when TC001-003 are disabled (#14657)
3f6c65e [red-knot] Fix merged type after if-else without explicit else branch (#14621)
976c37a Bump version to 0.8.1 (#14655)
a378ff3 [red-knot] Fix Boolean flags in mdtests (#14654)
d8bca0d Fix bug where methods defined using lambdas were flagged by FURB118 (#14639)
6f1cf5b [red-knot] Minor fix in MRO tests (#14652)
Additional commits viewable in compare view

Updates bandit from 1.7.10 to 1.8.0

Release notes

Sourced from bandit's releases.

1.8.0

What's Changed

Bump docker/build-push-action from 6.7.0 to 6.9.0 by @dependabot in PyCQA/bandit#1178

Rename doc file to match proper bandit ID by @ericwb in PyCQA/bandit#1183

Removal of Python 3.8 support by @ericwb in PyCQA/bandit#1174

Add more insecure cryptography cipher algorithms by @ericwb in PyCQA/bandit#1185

Bump docker/setup-buildx-action from 3.6.1 to 3.7.1 by @dependabot in PyCQA/bandit#1186

Bump sigstore/cosign-installer from 3.6.0 to 3.7.0 by @dependabot in PyCQA/bandit#1187

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in PyCQA/bandit#1162

No need to check httpx client without timeout defined by @ericwb in PyCQA/bandit#1177

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in PyCQA/bandit#1191

Mark Python 3.13 as officially supported by @ericwb in PyCQA/bandit#1192

Update project urls with added links by @ericwb in PyCQA/bandit#1193

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in PyCQA/bandit#1196

Add a JSON to seek funding from the FLOSS/fund by @ericwb in PyCQA/bandit#1194

Remove Sentry as a sponsor by @ericwb in PyCQA/bandit#1198

Remove more leftover OpenStack references by @ericwb in PyCQA/bandit#1195

Full Changelog: PyCQA/bandit@1.7.10...1.8.0

Commits

8fd258a Remove more leftover OpenStack references (#1195)
a19b072 Remove Sentry as a sponsor (#1198)
48e0258 Add a JSON to seek funding from the FLOSS/fund (#1194)
5300a21 [pre-commit.ci] pre-commit autoupdate (#1196)
0b249d9 Update project urls with added links (#1193)
4be653d Mark Python 3.13 as officially supported (#1192)
8e6dc1b [pre-commit.ci] pre-commit autoupdate (#1191)
071386b No need to check httpx client without timeout defined (#1177)
9b4d480 [pre-commit.ci] pre-commit autoupdate (#1162)
ddf9b48 Bump sigstore/cosign-installer from 3.6.0 to 3.7.0 (#1187)
Additional commits viewable in compare view

Updates semgrep from 1.90.0 to 1.97.0

Release notes

Sourced from semgrep's releases.

Release v1.97.0

1.97.0 - 2024-11-19

Added

Improved logic for interfile analysis in TypeScript projects using project references. (code-7677)

Semgrep Pro engine now resolves method invocations on abstract classes. In addition to the existing resolution for interface method invocations, this change further enhances dataflow tracking accuracy for dynamic method invocations. (code-7750)

Added the ability to validate temporary AWS tokens in the secrets product. (gh-2554)

Poetry.lock & Pyproject.toml parsers can now handle multiline strings. (ssc-1942)

Fixed

Improved error handling for some networking errors (e.g., premature server disconnection). In some cases this would previously cause a fatal error, but we should instead be able to recover in most instances (and now can). (code-7715)

Target file selection in git projects: files containing special characters (according to git) are now scanned correctly instead of being ignored. (saf-1687)

Swift: Ellipses and metavariable ellipses can now be used as function parameters in patterns. (saf-1721)

Semgrep will no longer freeze when tracing is enabled and it has a low memory limit (saf-1722)

osemgrep-pro: Autofix and nosemgrep now work properly (saf-1724)

Release v1.96.0

1.96.0 - 2024-11-07

Added
The pro engine now handles duplicate function names in C. When duplicate functions are found, we assume that any of the duplicated functions could be called. For example, if the function foo is defined in two different files, taint errors will be reported for both instances:
// "a/test.h"
void foo(int x) {
    //deepruleid: dup-symbols
    sink(x);
}
// "b/test.h"

void foo(int x) {

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.97.0 - 2024-11-19

Added

Improved logic for interfile analysis in TypeScript projects using project references. (code-7677)

Semgrep Pro engine now resolves method invocations on abstract classes. In addition to the existing resolution for interface method invocations, this change further enhances dataflow tracking accuracy for dynamic method invocations. (code-7750)

Added the ability to validate temporary AWS tokens in the secrets product. (gh-2554)

Poetry.lock & Pyproject.toml parsers can now handle multiline strings. (ssc-1942)

Fixed

Improved error handling for some networking errors (e.g., premature server disconnection). In some cases this would previously cause a fatal error, but we should instead be able to recover in most instances (and now can). (code-7715)

Target file selection in git projects: files containing special characters (according to git) are now scanned correctly instead of being ignored. (saf-1687)

Swift: Ellipses and metavariable ellipses can now be used as function parameters in patterns. (saf-1721)

Semgrep will no longer freeze when tracing is enabled and it has a low memory limit (saf-1722)

osemgrep-pro: Autofix and nosemgrep now work properly (saf-1724)

1.96.0 - 2024-11-07

Added
The pro engine now handles duplicate function names in C. When duplicate functions are found, we assume that any of the duplicated functions could be called. For example, if the function foo is defined in two different files, taint errors will be reported for both instances:
// "a/test.h"
void foo(int x) {
    //deepruleid: dup-symbols
    sink(x);
}
// "b/test.h"

void foo(int x) {

//deepruleid: dup-symbols

... (truncated)

Commits

f6cf572 chore: release version 1.97.0
fd2717csemgrep/semgrep-proprietary#2662
eea3125 Don't fix the newlines on the generated .dockerignore in OSS/ (semgrep/semgre...
c8a7112 feat(ts): improved module resolution for ts project refs (semgrep/semgrep-pro...
b4ffea1 osemgrep: show also parse errors in semgrep show dump-ast (semgrep/semgrep-...
b8b0784 Cron - update semgrep-rules and semgrep-rules-pro submodules (semgrep/semgrep...
7be45c3 Disable gitignore-to-dockerignore in the standalone semgrep repo (semgrep/sem...
d8d94fcsemgrep/semgrep-proprietary#2622
527ed50 feat(sca): Added multiline string parsing + tests for all poetry parsers (sem...
b4f6d5csemgrep/semgrep-proprietary#2653
Additional commits viewable in compare view

Updates pre-commit from 4.0.0 to 4.0.1

Release notes

Sourced from pre-commit's releases.

pre-commit v4.0.1

Fixes

Fix pre-commit migrate-config for unquoted deprecated stages names with purelib pyyaml.

#3324 PR by @asottile.

pre-commit-ci/issues#234 issue by @lorenzwalthert.

Changelog

Sourced from pre-commit's changelog.

4.0.1 - 2024-10-08

Fixes

Fix pre-commit migrate-config for unquoted deprecated stages names with purelib pyyaml.

#3324 PR by @asottile.

pre-commit-ci/issues#234 issue by @lorenzwalthert.

Commits

cc4a522 v4.0.1
772d7d4 Merge pull request #3324 from pre-commit/migrate-config-purelib
222c62b fix migrate-config for purelib yaml
3d5548b Merge pull request #3323 from pre-commit/pre-commit-ci-update-config
4235a87 [pre-commit.ci] pre-commit autoupdate
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the pip group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [mypy](https://github.com/python/mypy) | `1.11.2` | `1.13.0` | | [ruff](https://github.com/astral-sh/ruff) | `0.6.9` | `0.8.1` | | [bandit](https://github.com/PyCQA/bandit) | `1.7.10` | `1.8.0` | | [semgrep](https://github.com/returntocorp/semgrep) | `1.90.0` | `1.97.0` | | [pre-commit](https://github.com/pre-commit/pre-commit) | `4.0.0` | `4.0.1` | Updates `mypy` from 1.11.2 to 1.13.0 - [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md) - [Commits](python/mypy@v1.11.2...v1.13.0) Updates `ruff` from 0.6.9 to 0.8.1 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.6.9...0.8.1) Updates `bandit` from 1.7.10 to 1.8.0 - [Release notes](https://github.com/PyCQA/bandit/releases) - [Commits](PyCQA/bandit@1.7.10...1.8.0) Updates `semgrep` from 1.90.0 to 1.97.0 - [Release notes](https://github.com/returntocorp/semgrep/releases) - [Changelog](https://github.com/semgrep/semgrep/blob/develop/CHANGELOG.md) - [Commits](semgrep/semgrep@v1.90.0...v1.97.0) Updates `pre-commit` from 4.0.0 to 4.0.1 - [Release notes](https://github.com/pre-commit/pre-commit/releases) - [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md) - [Commits](pre-commit/pre-commit@v4.0.0...v4.0.1) --- updated-dependencies: - dependency-name: mypy dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip - dependency-name: ruff dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip - dependency-name: bandit dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip - dependency-name: semgrep dependency-type: direct:production update-type: version-update:semver-minor dependency-group: pip - dependency-name: pre-commit dependency-type: direct:production update-type: version-update:semver-patch dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2024-12-09T19:54:55Z

Superseded by #9.

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Dec 2, 2024

dependabot bot closed this Dec 9, 2024

dependabot bot deleted the dependabot/pip/pip-35014b55bf branch December 9, 2024 19:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the pip group across 1 directory with 5 updates #8

build(deps): bump the pip group across 1 directory with 5 updates #8

Uh oh!

dependabot bot commented on behalf of github Dec 2, 2024 •

edited

Loading

Uh oh!

dependabot bot commented on behalf of github Dec 9, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

build(deps): bump the pip group across 1 directory with 5 updates #8

build(deps): bump the pip group across 1 directory with 5 updates #8

Uh oh!

Conversation

dependabot bot commented on behalf of github Dec 2, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Mypy Release Notes

Next release

Change to enum membership semantics

Mypy 1.13

0.8.1

Release Notes

Preview features

Rule changes

Bug fixes

Contributors

0.8.1

Preview features

Rule changes

Bug fixes

0.8.0

Breaking changes

1.8.0

What's Changed

Release v1.97.0

1.97.0 - 2024-11-19

Added

Fixed

Release v1.96.0

1.96.0 - 2024-11-07

Added

1.97.0 - 2024-11-19

Added

Fixed

1.96.0 - 2024-11-07

Added

pre-commit v4.0.1

Fixes

4.0.1 - 2024-10-08

Fixes

Uh oh!

dependabot bot commented on behalf of github Dec 9, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Dec 2, 2024 •

edited

Loading