fix(deps): bump the python-pip group across 1 directory with 6 updates

[dependabot]

Bumps the python-pip group with 6 updates in the / directory:

Package	From	To
flask	3.0.3	3.1.0
setuptools	75.2.0	75.6.0
numpy	2.1.2	2.2.0
six	1.16.0	1.17.0
werkzeug	3.1.1	3.1.3
zipp	3.20.2	3.21.0

Updates flask from 3.0.3 to 3.1.0

Release notes

Sourced from flask's releases.

3.1.0

This is the Flask 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

PyPI: https://pypi.org/project/Flask/3.1.0/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-0 Milestone: https://github.com/pallets/flask/milestone/33?closed=1

• Drop support for Python 3.8. #5623
• Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. #5624, #5633
• Provide a configuration option to control automatic option responses. #5496
• Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. #5504
• Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation about resource limits to the security page. #5625
• Add support for the Partitioned cookie attribute (CHIPS), with the SESSION_COOKIE_PARTITIONED config. #5472
• -e path takes precedence over default .env and .flaskenv files. load_dotenv loads default files in addition to a path unless load_defaults=False is passed. #5628
• Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support. #5621
• Fix how setting host_matching=True or subdomain_matching=False interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts requests to only that domain. #5553
• Request.trusted_hosts is checked during routing, and can be set through the TRUSTED_HOSTS config. #5636

Changelog

Sourced from flask's changelog.

Version 3.1.0

Released 2024-11-13

• Drop support for Python 3.8. :pr:5623
• Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633
• Provide a configuration option to control automatic option responses. :pr:5496
• Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. :issue:5504
• Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation about resource limits to the security page. :issue:5625
• Add support for the Partitioned cookie attribute (CHIPS), with the SESSION_COOKIE_PARTITIONED config. :issue:5472
• -e path takes precedence over default .env and .flaskenv files. load_dotenv loads default files in addition to a path unless load_defaults=False is passed. :issue:5628
• Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support. :issue:5621
• Fix how setting host_matching=True or subdomain_matching=False interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts requests to only that domain. :issue:5553
• Request.trusted_hosts is checked during routing, and can be set through the TRUSTED_HOSTS config. :issue:5636

Commits

• ab81496 release version 3.1.0
• 70602a1 remove test pypi
• 6748a09 update dev dependencies
• 22c48a7 Merge remote-tracking branch 'origin/stable'
• 2eab96a use generic bases for session (#5638)
• f49dbfd use generic bases for session
• 7b21d43 configure and check request.trusted_hosts (#5637)
• 4f7156f configure and check trusted_hosts
• 10bdf61 setting SERVER_NAME does not restrict routing for both subdomain_matching...
• 4995a77 fix subdomain_matching=False behavior
• Additional commits viewable in compare view

Updates setuptools from 75.2.0 to 75.6.0

Changelog

Sourced from setuptools's changelog.

v75.6.0

Features

• Preserve original PKG-INFO into METADATA when creating wheel (instead of calling wheel.metadata.pkginfo_to_metadata). This helps to be more compliant with the flow specified in PEP 517. (#4701)
• Changed the WindowsSdkVersion, FrameworkVersion32 and FrameworkVersion64 properties of setuptools.msvc.PlatformInfo to return an empty tuple instead of None as a fallthrough case -- by :user:Avasam (#4754)

v75.5.0

Features

• Removed support for SETUPTOOLS_DANGEROUSLY_SKIP_PYPROJECT_VALIDATION, as it is deemed prone to errors. (#4746)

v75.4.0

Features

• Added support for the environment variable SETUPTOOLS_DANGEROUSLY_SKIP_PYPROJECT_VALIDATION=true, allowing users to bypass the validation of pyproject.toml. This option should be used only as a last resort when resolving dependency issues, as it may lead to improper functioning. Users who enable this setting are responsible for ensuring that pyproject.toml complies with setuptools requirements. (#4611)

  .. attention:: This environment variable was removed in a later version of setuptools.

• Require Python 3.9 or later. (#4718)

• Remove dependency on importlib_resources and the vendored copy of the library. Instead, setuptools consistently rely on stdlib's importlib.resources (available on Python 3.9+). (#4718)

• Setuptools' bdist_wheel implementation no longer produces wheels with the m SOABI flag (pymalloc-related). This flag was removed on Python 3.8+ (see :obj:sys.abiflags). (#4718)

• Updated vendored packaging version to 24.2. (#4740)

... (truncated)

Commits

• bf2ced2 Bump version: 75.5.0 → 75.6.0
• 8685c80 Empty tuple instead of None for PlatformInfo version properties fallthrough (...
• 50d671b Rename news fragment
• 2b471c2 Changed the WindowsSdkVersion, FrameworkVersion32 and ``FrameworkVers...
• 2c77cd2 Runtime typing fixes for typeshed return type merge (#4753
• 9a4c8d4 Runtime typing fixes for typeshed return type merge
• e622859 Preserve original PKG-INFO contents when creating wheel (instead of calling...
• 0b5b417 Mark tests that may depend on external network
• a4fa01d Add news fragment
• 089aca9 Ignore coverage in test code
• Additional commits viewable in compare view

Updates numpy from 2.1.2 to 2.2.0

Release notes

Sourced from numpy's releases.

2.2.0 (Dec 8, 2024)

NumPy 2.2.0 Release Notes

The NumPy 2.2.0 release is quick release that brings us back into sync with the usual twice yearly release cycle. There have been an number of small cleanups, as well as work bringing the new StringDType to completion and improving support for free threaded Python. Highlights are:

• New functions matvec and vecmat, see below.
• Many improved annotations.
• Improved support for the new StringDType.
• Improved support for free threaded Python
• Fixes for f2py

This release supports Python versions 3.10-3.13.

Deprecations

• _add_newdoc_ufunc is now deprecated. ufunc.__doc__ = newdoc should be used instead.

  (gh-27735)

Expired deprecations

• bool(np.array([])) and other empty arrays will now raise an error. Use arr.size > 0 instead to check whether an array has no elements.

  (gh-27160)

Compatibility notes

• numpy.cov now properly transposes single-row (2d array) design matrices when rowvar=False. Previously, single-row design matrices would return a scalar in this scenario, which is not correct, so this is a behavior change and an array of the appropriate shape will now be returned.

  (gh-27661)

New Features

• New functions for matrix-vector and vector-matrix products

  Two new generalized ufuncs were defined:

  • numpy.matvec - matrix-vector product, treating the arguments as stacks of matrices and column vectors,

... (truncated)

Commits

• e7a123b Merge pull request #27928 from charris/prepare-2.2.0
• d97d071 MAINT: Try fixing MacOS cirrus build failures. [wheel build]
• 1ed7b67 REL: Prepare for the NumPy 2.2.0 release [wheel build]
• fd9e7ef Merge pull request #27916 from charris/backport-27915
• 2e0941f MAINT: Bump actions/cache from 4.1.2 to 4.2.0
• 013656d Merge pull request #27912 from charris/backport-27877
• 7895ba6 Merge pull request #27913 from charris/backport-27896
• ee8d1cd PERF: improve multithreaded ufunc scaling (#27896)
• 77fff6b ENH: Refactor __qualname__ across API (#27877)
• b30a338 Merge pull request #27911 from charris/backport-27891
• Additional commits viewable in compare view

Updates six from 1.16.0 to 1.17.0

Changelog

Sourced from six's changelog.

1.17.0

• Pull request #388: Remove URLopener and FancyURLopener classes from urllib.request when running on Python 3.14 or greater.

• Pull request #365, issue #283: six.moves.UserDict now points to UserDict.IterableUserDict instead of UserDict.UserDict on Python 2.

Commits

• ebd9b3a six 1.17.0
• 40d248e Expunge travis.
• dd7940e Add PyPI publication workflow. (#390)
• 8cb688f Update copyright years.
• 86f89c5 Add a GitHub actions CI workflow. (#389)
• 06430b9 Make test_getoutput work on Windows.
• ceddaf2 Add a changelog for #314.
• 9a05aab Python 3.14 removed the URLopener and FancyURLopener classes from urllib.req...
• c1b416f Fix deprecation warning from setuptools (#382)
• 02c3bca tkinter.tix was removed from Python 3.13, skip the test (#377)
• Additional commits viewable in compare view

Updates werkzeug from 3.1.1 to 3.1.3

Release notes

Sourced from werkzeug's releases.

3.1.3

This is the Werkzeug 3.1.3 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.

PyPI: https://pypi.org/project/Werkzeug/3.1.3/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-3 Milestone: https://github.com/pallets/werkzeug/milestone/41?closed=1

• Initial data passed to MultiDict and similar interfaces only accepts list, tuple, or set when passing multiple values. It had been changed to accept any Collection, but this matched types that should be treated as single values, such as bytes. #2994
• When the Host header is not set and Request.host falls back to the WSGI SERVER_NAME value, if that value is an IPv6 address it is wrapped in [] to match the Host header. #2993

3.1.2

This is the Werkzeug 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.

PyPI: https://pypi.org/project/Werkzeug/3.1.2/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-2 Milestone: https://github.com/pallets/werkzeug/milestone/40?closed=1

• Improve type annotation for TypeConversionDict.get to allow the type parameter to be a callable. #2988
• Headers does not inherit from MutableMapping, as it is does not exactly match that interface. #2989

Changelog

Sourced from werkzeug's changelog.

Version 3.1.3

Released 2024-11-08

• Initial data passed to MultiDict and similar interfaces only accepts list, tuple, or set when passing multiple values. It had been changed to accept any Collection, but this matched types that should be treated as single values, such as bytes. :issue:2994
• When the Host header is not set and Request.host falls back to the WSGI SERVER_NAME value, if that value is an IPv6 address it is wrapped in [] to match the Host header. :issue:2993

Version 3.1.2

Released 2024-11-04

• Improve type annotation for TypeConversionDict.get to allow the type parameter to be a callable. :issue:2988
• Headers does not inherit from MutableMapping, as it is does not exactly match that interface. :issue:2989

Commits

• 6389612 release version 3.1.3
• ba15683 wrap IPv6 SERVER_NAME in [] (#2997)
• d99f72d wrap IPv6 SERVER_NAME in []
• ea93b54 restrict containers accepted by multi (#2995)
• 598bb1d restrict containers accepted by multi
• 1a1728e start version 3.1.3
• 4fd7073 release version 3.1.2 (#2992)
• 4764684 release version 3.1.2
• 1803db6 Headers is not MutableMapping (#2991)
• ac87bf8 Headers is not MutableMapping
• Additional commits viewable in compare view

Updates zipp from 3.20.2 to 3.21.0

Changelog

Sourced from zipp's changelog.

v3.21.0

Features

• Improve performances of :meth:zipfile.Path.open for non-reading modes. (1a1928d)
• Rely on cached_property to cache values on the instance.
• Rely on save_method_args to save method args.

Commits

• 45b7f67 Finalize
• 71ddd8d Skip zipfile.Path.existspython/cpython#126576
• 9a2705e Merge https://github.com/jaraco/skeleton
• 5c34e69 Use extend for proper workaround.
• ee027f6 Merge https://github.com/jaraco/skeleton
• 750a189 Require Python 3.9 or later now that Python 3.8 is EOL.
• e61a9df Include pyproject.toml in ruff.toml.
• db4dfc4jaraco/skeleton#151
• 62b6678 Bump pre-commit hook for ruff to avoid clashes with pytest-ruff (jaraco/skele...
• 466f535 Merge pull request #109 from jaraco/feature/functools
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.