Bump the pip group across 2 directories with 6 updates #1
Conversation
Bumps the pip group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [black](https://github.com/psf/black) | `23.3.0` | `24.3.0` | | [tornado](https://github.com/tornadoweb/tornado) | `6.3.3` | `6.4` | | [cryptography](https://github.com/pyca/cryptography) | `41.0.6` | `42.0.4` | | [jupyter-server](https://github.com/jupyter-server/jupyter_server) | `1.23.5` | `2.11.2` | | [pymongo](https://github.com/mongodb/mongo-python-driver) | `4.3.3` | `4.6.3` | | [dbt-core](https://github.com/dbt-labs/dbt-core) | `1.7.4` | `1.7.13` | Bumps the pip group with 1 update in the /mage_integrations directory: [pymongo](https://github.com/mongodb/mongo-python-driver). Updates `black` from 23.3.0 to 24.3.0 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](psf/black@23.3.0...24.3.0) Updates `tornado` from 6.3.3 to 6.4 - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.3.3...v6.4.0) Updates `cryptography` from 41.0.6 to 42.0.4 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@41.0.6...42.0.4) Updates `jupyter-server` from 1.23.5 to 2.11.2 - [Release notes](https://github.com/jupyter-server/jupyter_server/releases) - [Changelog](https://github.com/jupyter-server/jupyter_server/blob/main/CHANGELOG.md) - [Commits](jupyter-server/jupyter_server@v1.23.5...v2.11.2) Updates `pymongo` from 4.3.3 to 4.6.3 - [Release notes](https://github.com/mongodb/mongo-python-driver/releases) - [Changelog](https://github.com/mongodb/mongo-python-driver/blob/master/doc/changelog.rst) - [Commits](mongodb/mongo-python-driver@4.3.3...4.6.3) Updates `dbt-core` from 1.7.4 to 1.7.13 - [Release notes](https://github.com/dbt-labs/dbt-core/releases) - [Changelog](https://github.com/dbt-labs/dbt-core/blob/v1.7.13/CHANGELOG.md) - [Commits](dbt-labs/dbt-core@v1.7.4...v1.7.13) Updates `pymongo` from 4.3.3 to 4.6.3 - [Release notes](https://github.com/mongodb/mongo-python-driver/releases) - [Changelog](https://github.com/mongodb/mongo-python-driver/blob/master/doc/changelog.rst) - [Commits](mongodb/mongo-python-driver@4.3.3...4.6.3) --- updated-dependencies: - dependency-name: black dependency-type: direct:development dependency-group: pip - dependency-name: tornado dependency-type: direct:production dependency-group: pip - dependency-name: cryptography dependency-type: direct:production dependency-group: pip - dependency-name: jupyter-server dependency-type: direct:production dependency-group: pip - dependency-name: pymongo dependency-type: direct:production dependency-group: pip - dependency-name: dbt-core dependency-type: direct:production dependency-group: pip - dependency-name: pymongo dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>
|
Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.
Note 🟢 Risk threshold not exceeded. Change Summary (click to expand)The following is a summary of changes in this pull request made by me, your security buddy 🤖. Summary: The changes in this pull request primarily involve updating the dependency versions for various Python libraries and tools used in the Mage AI project. These updates include:
From an application security perspective, these changes are generally positive, as they allow the project to take advantage of the latest bug fixes and security patches. However, it's important to thoroughly test the updated dependencies to ensure that there are no regressions or compatibility issues. Additionally, it's worth noting that the Overall, the changes in this pull request appear to be routine dependency updates, which is a common practice in software development. As long as the application is thoroughly tested after the updates, there does not seem to be any significant security concern based on the information provided. Files Changed:
Powered by DryRun Security |
|
Superseded by #2. |
Bumps the pip group with 6 updates in the / directory:
23.3.024.3.06.3.36.441.0.642.0.41.23.52.11.24.3.34.6.31.7.41.7.13Bumps the pip group with 1 update in the /mage_integrations directory: pymongo.
Updates
blackfrom 23.3.0 to 24.3.0Release notes
Sourced from black's releases.
... (truncated)
Changelog
Sourced from black's changelog.
... (truncated)
Commits
552baf8Prepare release 24.3.0 (#4279)f000936Fix catastrophic performance in lines_with_leading_tabs_expanded() (#4278)7b5a657Fix --line-ranges behavior when ranges are at EOF (#4273)1abcffcUse regex where we ignore case on windows (#4252)719e674Fix 4227: Improve documentation for --quiet --check (#4236)e5510afupdate plugin url for Thonny (#4259)6af7d11Fix AST safety check false negative (#4270)f03ee11Ensureblib2to3.pygramis initialized before use (#4224)e4bfedbfix: Don't move comments while splitting delimiters (#4248)d0287e1Make trailing comma logic more concise (#4202)Updates
tornadofrom 6.3.3 to 6.4Changelog
Sourced from tornado's changelog.
... (truncated)
Commits
b3f2a4bMerge pull request #3352 from bdarnell/master451419cSet version to 6.4 final5a87723Merge pull request #3348 from bdarnell/iostream-hostname-test2da0a99iostream_test: Don't require server-side log on windows06e1a65iostream_test: Test check_hostname functionality.a6dfd70Merge pull request #3341 from bdarnell/more-utcnowc60d80cweb,demos: Remove more uses of deprecated datetime utc methods55db80eMerge pull request #3339 from tornadoweb/dependabot/pip/urllib3-1.26.18ec59fa0Merge pull request #3332 from bdarnell/selector-thread-atexitdcc6e59build(deps): bump urllib3 from 1.26.17 to 1.26.18Updates
cryptographyfrom 41.0.6 to 42.0.4Changelog
Sourced from cryptography's changelog.
... (truncated)
Commits
fe18470Bump for 42.0.4 release (#10445)aaa2dd0Fix ASN.1 issues in PKCS#7 and S/MIME signing (#10373) (#10442)7a4d012Fixes #10422 -- don't crash when a PKCS#12 key and cert don't match (#10423) ...df314bbbackport actions m1 switch to 42.0.x (#10415)c49a7a5changelog and version bump for 42.0.3 (#10396)396bcf6fix provider loading take two (#10390) (#10395)0e0e46fbackport: initialize openssl's legacy provider in rust (#10323) (#10333)2202123changelog and version bump 42.0.2 (#10268)f7032bdbump openssl in CI (#10298) (#10299)002e886Fixes #10294 -- correct accidental change to exchange kwarg (#10295) (#10296)Updates
jupyter-serverfrom 1.23.5 to 2.11.2Release notes
Sourced from jupyter-server's releases.
... (truncated)
Changelog
Sourced from jupyter-server's changelog.
... (truncated)
Commits
9bd9657Publish 2.11.20056c3aMerge pull request from GHSA-h56g-gq9v-vc8r88eca99Bump to 2.12.0.dev03755794Publish 2.11.140a95e5avoid unhandled error on some invalid paths (#1369)ecd5b1fChange md5 to hash and hash_algorithm, fix incompatibility (#1367)8e5d766Bump to 2.12.0.dev0cc74bb6Publish 2.11.0e7c0f33Update api docs with md5 param (#1364)0983b71Update ruff and typings (#1365)Updates
pymongofrom 4.3.3 to 4.6.3Release notes
Sourced from pymongo's releases.
Changelog
Sourced from pymongo's changelog.
... (truncated)
Commits
8da192fBUMP 4.6.356b6b6dPYTHON-4305 Fix bson size check (#1564)449d0f3BUMP to 4.6.3.dev0e04576dDEVPROD-3871 Use teardown_task when there is one function/command (#1533)cf1c6a1PYTHON-4219 Prep for 4.6.2 Release (#1530)d29b2b7PYTHON-4147 [v4.6]: Silence noisy thread.start() RuntimeError at shutdown (#1...0477b9bPYTHON-4077 [v4.6]: Ensure there is a MacOS wheel for Python 3.7 (#1527)ecad17dBUMP 4.6.2.dev0485e0a5BUMP 4.6.1995365cPYTHON-4038 [v4.6]: Ensure retryable readOperationFailures re-raise except...Updates
dbt-corefrom 1.7.4 to 1.7.13Release notes
Sourced from dbt-core's releases.
... (truncated)
Changelog
Sourced from dbt-core's changelog.
... (truncated)
Commits
6095b02Bumping version to 1.7.13 and generate changelog483a4e8[BACKPORT 1.7] bump sqlparse (#9965)f9cff92[Automated] Merged prep-release/1.7.12_8708637173 into target 1.7.latest duri...ef37e62Bumping version to 1.7.12 and generate changelog227877ebe less explicit (#9936) (#9937)ffa1a38update to wrk for all versions (#9916) (#9919)2c24aa7[1.7] Fix Workflow Deprecations (#9799)947f397[BACKPORT 1.7] Exclude password-like fields for considering reparse (#9844) ...b8681a3[Backport to 1.7.latest] Fix assorted source freshness edgecases so check is ...dd070b9[Automated] Merged prep-release/1.7.11_8461692987 into target 1.7.latest duri...Updates
pymongofrom 4.3.3 to 4.6.3Release notes
Sourced from pymongo's releases.
Changelog
Sourced from pymongo's changelog.
... (truncated)
Commits
8da192fBUMP 4.6.356b6b6dPYTHON-4305 Fix bson size check (#1564)449d0f3BUMP to 4.6.3.dev0e04576dDEVPROD-3871 Use teardown_task when there is one function/command (#1533)cf1c6a1PYTHON-4219 Prep for 4.6.2 Release (#1530)d29b2b7PYTHON-4147 [v4.6]: Silence noisy thread.start() RuntimeError at shutdown (#1...0477b9bPYTHON-4077 [v4.6]: Ensure there is a MacOS wheel for Python 3.7 (#1527)ecad17dBUMP 4.6.2.dev0485e0a5BUMP 4.6.1995365cPYTHON-4038 [v4.6]: Ensure retryable readOperationFailures re-raise except...Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.