chore(deps): bump the pip group across 1 directory with 6 updates #28
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
Bumps the pip group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [aiohttp](https://github.com/aio-libs/aiohttp) | `3.9.3` | `3.9.4` | | [black](https://github.com/psf/black) | `24.2.0` | `24.3.0` | | [idna](https://github.com/kjd/idna) | `3.4` | `3.7` | | [langchain-core](https://github.com/langchain-ai/langchain) | `0.1.26` | `0.1.35` | | [pydantic](https://github.com/pydantic/pydantic) | `2.2.1` | `2.4.0` | | [tqdm](https://github.com/tqdm/tqdm) | `4.66.1` | `4.66.3` | Updates `aiohttp` from 3.9.3 to 3.9.4 - [Release notes](https://github.com/aio-libs/aiohttp/releases) - [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst) - [Commits](aio-libs/aiohttp@v3.9.3...v3.9.4) Updates `black` from 24.2.0 to 24.3.0 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](psf/black@24.2.0...24.3.0) Updates `idna` from 3.4 to 3.7 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst) - [Commits](kjd/idna@v3.4...v3.7) Updates `langchain-core` from 0.1.26 to 0.1.35 - [Release notes](https://github.com/langchain-ai/langchain/releases) - [Commits](https://github.com/langchain-ai/langchain/commits) Updates `pydantic` from 2.2.1 to 2.4.0 - [Release notes](https://github.com/pydantic/pydantic/releases) - [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md) - [Commits](pydantic/pydantic@v2.2.1...v2.4.0) Updates `tqdm` from 4.66.1 to 4.66.3 - [Release notes](https://github.com/tqdm/tqdm/releases) - [Commits](tqdm/tqdm@v4.66.1...v4.66.3) --- updated-dependencies: - dependency-name: aiohttp dependency-type: direct:production dependency-group: pip - dependency-name: black dependency-type: direct:production dependency-group: pip - dependency-name: idna dependency-type: direct:production dependency-group: pip - dependency-name: langchain-core dependency-type: direct:production dependency-group: pip - dependency-name: pydantic dependency-type: direct:production dependency-group: pip - dependency-name: tqdm dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <[email protected]>
|
Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.
Note 🟢 Risk threshold not exceeded. Change Summary (click to expand)The following is a summary of changes in this pull request made by me, your security buddy 🤖. Summary: The changes in this pull request focus on updating the Python dependencies listed in the
From an application security perspective, these updates are generally positive, as they likely include bug fixes and security improvements. However, it's important to review the release notes for each updated dependency to ensure that there are no known security vulnerabilities introduced by the new versions. The update to the Overall, the changes in this pull request appear to be routine updates to the project's dependencies, which is a good practice to maintain the security and stability of the application. Files Changed:
Powered by DryRun Security |
|
Superseded by #29. |
Bumps the pip group with 6 updates in the / directory:
3.9.33.9.424.2.024.3.03.43.70.1.260.1.352.2.12.4.04.66.14.66.3Updates
aiohttpfrom 3.9.3 to 3.9.4Release notes
Sourced from aiohttp's releases.
... (truncated)
Changelog
Sourced from aiohttp's changelog.
... (truncated)
Commits
b3397c7Release v3.9.4 (#8201)a7e240a[PR #8320/9ba9a4e5 backport][3.9] Fix Python parser to mark responses without...2833552Escape filenames and paths in HTML when generating index pages (#8317) (#8319)ed43040[PR #8309/c29945a1 backport][3.9] Improve reliability of run_app test (#8315)ec2be05[PR #8299/28d026eb backport][3.9] Create marker for internal tests (#8307)292d961[PR #8304/88c80c14 backport][3.9] Check for backports in CI (#8305)cebe526Fix handling of multipart/form-data (#8280) (#8302)270ae9c[PR #8297/d15f07cf backport][3.9] Upgrade to llhttp 9.2.1 (#8292) (#8298)bb23105[PR #8283/54e13b0a backport][3.9] Fix blocking I/O in the event loop while pr...3f79241[PR #8286/28f1fd88 backport][3.9] docs: remove repetitive word in comment (#8...Updates
blackfrom 24.2.0 to 24.3.0Release notes
Sourced from black's releases.
Changelog
Sourced from black's changelog.
Commits
552baf8Prepare release 24.3.0 (#4279)f000936Fix catastrophic performance in lines_with_leading_tabs_expanded() (#4278)7b5a657Fix --line-ranges behavior when ranges are at EOF (#4273)1abcffcUse regex where we ignore case on windows (#4252)719e674Fix 4227: Improve documentation for --quiet --check (#4236)e5510afupdate plugin url for Thonny (#4259)6af7d11Fix AST safety check false negative (#4270)f03ee11Ensureblib2to3.pygramis initialized before use (#4224)e4bfedbfix: Don't move comments while splitting delimiters (#4248)d0287e1Make trailing comma logic more concise (#4202)Updates
idnafrom 3.4 to 3.7Release notes
Sourced from idna's releases.
Changelog
Sourced from idna's changelog.
Commits
1d365e1Release v3.7c1b3154Merge pull request #172 from kjd/optimize-contextj0394ec7Merge branch 'master' into optimize-contextjcd58a23Merge pull request #152 from elliotwutingfeng/dev5beb28bMore efficient resolution of joiner contexts1b12148Update ossf/scorecard-action to v2.3.1d516b87Update Github actions/checkout to v4c095c75Merge branch 'master' into dev60a0a4cFix typo in GitHub Actions workflow key5918a0eMerge branch 'master' into devUpdates
langchain-corefrom 0.1.26 to 0.1.35Commits
Updates
pydanticfrom 2.2.1 to 2.4.0Release notes
Sourced from pydantic's releases.
... (truncated)
Changelog
Sourced from pydantic's changelog.
... (truncated)
Commits
1f59075fix unintentional drop of character in HISTORY (#7600)7183c3eaddingmkdocs_run_depsto docs (#7602)cd44ac1Add missing@Kludexmention to theHISTORY.md(#7603)6136b9aPrepare release 2.4.0 (#7568)389c074Revert unecessary regex change from e4393ae (#7599)4279fc5WIP fixing redirects (#7596)829af25Improvements to version info message (#7594)cc4b8c2Small improvements to import performance (#7590)0af0cc3revert plugin performance regression (#7589)0c760c0improve formatting of generated release notes (#7592)Updates
tqdmfrom 4.66.1 to 4.66.3Release notes
Sourced from tqdm's releases.
Commits
4e613f8Merge pull request from GHSA-g7vv-2v7x-gj9pb53348ccli: eval safetycc372d0bump version, merge pull request #1549 from tqdm/devele9f0c05use PyPI trusted publishing7323d5bslight makefile clean5306125tests: bump pre-commit4a6fd4ffix datetime.utcfromtimestamp py3.12 warning (#1519)6f13759tests: fix macos notebook indentation3abcd2atests: fix asva4d15c8tests: fix pandas warningsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.