Skip to content

Bump the pip group with 3 updates#173

Merged
rmanaem merged 2 commits intomainfrom
dependabot/pip/pip-757af668ed
Jul 16, 2025
Merged

Bump the pip group with 3 updates#173
rmanaem merged 2 commits intomainfrom
dependabot/pip/pip-757af668ed

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 9, 2025 •
edited
Loading

Bumps the pip group with 3 updates: cryptography, starlette and virtualenv.

Updates cryptography from 44.0.0 to 44.0.1

Changelog

Sourced from cryptography's changelog.

44.0.1 - 2025-02-11


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.1.
* We now build ``armv7l`` ``manylinux`` wheels and publish them to PyPI.
* We now build ``manylinux_2_34`` wheels and publish them to PyPI.

.. _v44-0-0:

Commits

Updates starlette from 0.37.2 to 0.40.0

Release notes

Sourced from starlette's releases.

Version 0.40.0

This release fixes a Denial of service (DoS) via multipart/form-data requests.

You can view the full security advisory: GHSA-f96h-pmfr-66vw

Fixed

  • Add max_part_size to MultiPartParser to limit the size of parts in multipart/form-data requests fd038f3.

Version 0.39.2

Fixed

  • Allow use of request.url_for when only "app" scope is available #2672.
  • Fix internal type hints to support python-multipart==0.0.12 #2708.

Full Changelog: Kludex/starlette@0.39.1...0.39.2

Version 0.39.1

Fixed

  • Avoid regex re-compilation in responses.py and schemas.py #2700.
  • Improve performance of get_route_path by removing regular expression usage #2701.
  • Consider FileResponse.chunk_size when handling multiple ranges #2703.
  • Use token_hex for generating multipart boundary strings #2702.

Full Changelog: Kludex/starlette@0.39.0...0.39.1

Version 0.39.0

Added

  • Add support for HTTP Range to FileResponse #2697

Full Changelog: Kludex/starlette@0.38.6...0.39.0

Version 0.38.6

Fixed

  • Close unclosed MemoryObjectReceiveStream in TestClient #2693.

Full Changelog: Kludex/starlette@0.38.5...0.38.6

... (truncated)

Changelog

Sourced from starlette's changelog.

0.40.0 (October 15, 2024)

This release fixes a Denial of service (DoS) via multipart/form-data requests.

You can view the full security advisory: GHSA-f96h-pmfr-66vw

Fixed

  • Add max_part_size to MultiPartParser to limit the size of parts in multipart/form-data requests fd038f3.

0.39.2 (September 29, 2024)

Fixed

  • Allow use of request.url_for when only "app" scope is available #2672.
  • Fix internal type hints to support python-multipart==0.0.12 #2708.

0.39.1 (September 25, 2024)

Fixed

  • Avoid regex re-compilation in responses.py and schemas.py #2700.
  • Improve performance of get_route_path by removing regular expression usage #2701.
  • Consider FileResponse.chunk_size when handling multiple ranges #2703.
  • Use token_hex for generating multipart boundary strings #2702.

0.39.0 (September 23, 2024)

Added

0.38.6 (September 22, 2024)

Fixed

  • Close unclosed MemoryObjectReceiveStream in TestClient #2693.

0.38.5 (September 7, 2024)

Fixed

  • Schedule BackgroundTasks from within BaseHTTPMiddleware #2688. This behavior was removed in 0.38.3, and is now restored.

0.38.4 (September 1, 2024)

... (truncated)

Commits

Updates virtualenv from 20.16.7 to 20.26.6

Release notes

Sourced from virtualenv's releases.

20.26.6

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.26.5...20.26.6

20.26.5

What's Changed

Full Changelog: pypa/virtualenv@20.26.4...20.26.5

20.26.4

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.26.3...20.26.4

20.26.3

What's Changed

Full Changelog: pypa/virtualenv@20.26.2...20.26.3

20.26.2

... (truncated)

Changelog

Sourced from virtualenv's changelog.

v20.26.6 (2024-09-27)

Bugfixes - 20.26.6

- Properly quote string placeholders in activation script templates to mitigate
  potential command injection - by :user:`y5c4l3`. (:issue:`2768`)

v20.26.5 (2024-09-17)


Bugfixes - 20.26.5

  • Upgrade embedded wheels: setuptools to 75.1.0 from 74.1.2 - by :user:gaborbernat. (:issue:2765)

v20.26.4 (2024-09-07)

Bugfixes - 20.26.4

- no longer create `()` output in console during activation of a virtualenv by .bat file. (:issue:`2728`)
- Upgrade embedded wheels:

    

  • wheel to 0.44.0 from 0.43.0
    • 

  • pip to 24.2 from 24.1
    • 

  • setuptools to 74.1.2 from 70.1.0 (:issue:2760)
    • 



v20.26.3 (2024-06-21)


Bugfixes - 20.26.3

  • Upgrade embedded wheels:

    • setuptools to 70.1.0 from 69.5.1
    • pip to 24.1 from 24.0 (:issue:2741)

v20.26.2 (2024-05-13)

Bugfixes - 20.26.2

- ``virtualenv.pyz`` no longer fails when zipapp path contains a symlink - by :user:`HandSonic` and :user:`petamas`. (:issue:`1949`)
- Fix bad return code from activate.sh if hashing is disabled - by :user:'fenkes-ibm'. (:issue:`2717`)

v20.26.1 (2024-04-29)


Bugfixes - 20.26.1

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by Sourcery

Update dependencies for cryptography, starlette, and virtualenv to their latest patch and minor versions

New Features:

  • Add support for HTTP Range to Starlette's FileResponse

Bug Fixes:

  • Fix Denial of Service vulnerability in Starlette's multipart/form-data handling
  • Quote template strings in virtualenv activation scripts to prevent potential command injection
  • Fix console output during virtualenv activation

Enhancements:

  • Upgrade embedded wheels in virtualenv
  • Improve Starlette performance by removing regex usage

@dependabot dependabot bot added _bot [BOT only] Issue or PR made by a bot. dependencies Dependency updates and their version upgrades. labels Apr 9, 2025
@sourcery-ai
Copy link
Copy Markdown

sourcery-ai bot commented Apr 9, 2025 •
edited
Loading

Reviewer's Guide by Sourcery

This pull request bumps the pip group with updates to cryptography, starlette, and virtualenv. cryptography updates its wheels and OpenSSL. starlette addresses a DoS vulnerability and introduces performance improvements and new features. virtualenv includes bug fixes and upgrades to embedded wheels.

Updated class diagram for Starlette's MultiPartParser

classDiagram
  class MultiPartParser {
    +max_part_size: int
    +parse() : MultiPartMessage
  }
  note for MultiPartParser "max_part_size added to limit part size in multipart/form-data requests to prevent DoS vulnerability"
Loading

File-Level Changes

Change Details Files
Updated cryptography from 44.0.0 to 44.0.1. This update includes improvements to the wheels and OpenSSL.
  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.1.
  • Built and published armv7l manylinux wheels to PyPI.
  • Built and published manylinux_2_34 wheels to PyPI.
 requirements.txt
Updated starlette from 0.37.2 to 0.40.0. This update includes a fix for a Denial of Service (DoS) vulnerability, support for HTTP Range requests, and performance improvements.
  • Added max_part_size to MultiPartParser to limit the size of parts in multipart/form-data requests, addressing a DoS vulnerability.
  • Allowed the use of request.url_for when only the "app" scope is available.
  • Fixed internal type hints to support python-multipart==0.0.12.
  • Avoided regex re-compilation in responses.py and schemas.py.
  • Improved the performance of get_route_path by removing regular expression usage.
  • Considered FileResponse.chunk_size when handling multiple ranges.
  • Used token_hex for generating multipart boundary strings.
  • Added support for HTTP Range to FileResponse.
  • Closed unclosed MemoryObjectReceiveStream in TestClient.
 requirements.txt
Updated virtualenv from 20.16.7 to 20.26.6. This update includes bug fixes and improvements to embedded wheels.
  • Properly quoted string placeholders in activation script templates to mitigate potential command injection.
  • Upgraded embedded wheels: setuptools to 75.1.0 from 74.1.2.
  • No longer create () output in console during activation of a virtualenv by .bat file.
  • Upgraded embedded wheels: wheel to 0.44.0 from 0.43.0, pip to 24.2 from 24.1, and setuptools to 74.1.2 from 70.1.0.
  • Upgraded embedded wheels: setuptools to 70.1.0 from 69.5.1 and pip to 24.1 from 24.0.
  • virtualenv.pyz no longer fails when zipapp path contains a symlink.
  • Fixed bad return code from activate.sh if hashing is disabled.
  • Used uv over pip.
 requirements.txt
Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!
  • Generate a plan of action for an issue: Comment @sourcery-ai plan on
    an issue to generate a plan of action for it.

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@neurobagel-bot neurobagel-bot bot moved this to Automation in Neurobagel Apr 10, 2025
@surchs
Copy link
Copy Markdown
Contributor

surchs commented Apr 22, 2025

@dependabot rebase

@dependabot dependabot bot force-pushed the dependabot/pip/pip-757af668ed branch from 87be54d to 35daf2c Compare April 22, 2025 21:21
@surchs surchs mentioned this pull request Apr 22, 2025
Open
1 task
@rmanaem
Copy link
Copy Markdown
Contributor

rmanaem commented Jul 16, 2025

@dependabot recreate

@dependabot
Bump the pip group with 3 updates
ba4dd36 
Bumps the pip group with 3 updates: [cryptography](https://github.com/pyca/cryptography), [starlette](https://github.com/encode/starlette) and [virtualenv](https://github.com/pypa/virtualenv).


Updates `cryptography` from 44.0.0 to 44.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@44.0.0...44.0.1)

Updates `starlette` from 0.37.2 to 0.40.0
- [Release notes](https://github.com/encode/starlette/releases)
- [Changelog](https://github.com/encode/starlette/blob/master/docs/release-notes.md)
- [Commits](Kludex/starlette@0.37.2...0.40.0)

Updates `virtualenv` from 20.16.7 to 20.26.6
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@20.16.7...20.26.6)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 44.0.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: starlette
  dependency-version: 0.40.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: virtualenv
  dependency-version: 20.26.6
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/pip/pip-757af668ed branch from 35daf2c to ba4dd36 Compare July 16, 2025 21:52
@codecov
Copy link
Copy Markdown

codecov bot commented Jul 16, 2025 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 97.41%. Comparing base (b4977b9) to head (37dc8eb).
Report is 1 commits behind head on main.

Additional details and impacted files 
@@           Coverage Diff           @@
##             main     #173   +/-   ##
=======================================
  Coverage   97.41%   97.41%           
=======================================
  Files          23       23           
  Lines         735      735           
=======================================
  Hits          716      716           
  Misses         19       19

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@rmanaem rmanaem self-requested a review July 16, 2025 22:45
@rmanaem rmanaem moved this from Automation to Review - Active in Neurobagel Jul 16, 2025
rmanaem
rmanaem approved these changes Jul 16, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@rmanaem rmanaem left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧑‍🍳

@rmanaem rmanaem merged commit f42244a into main Jul 16, 2025
9 checks passed
@rmanaem rmanaem deleted the dependabot/pip/pip-757af668ed branch July 16, 2025 22:45
@github-project-automation github-project-automation bot moved this from Review - Active to Review - Done in Neurobagel Jul 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@rmanaem rmanaem rmanaem approved these changes

Assignees

No one assigned

Labels

_bot [BOT only] Issue or PR made by a bot. dependencies Dependency updates and their version upgrades.

Projects

Neurobagel
Status: Review - Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@surchs @rmanaem