search

google / project-OCEAN

Project OCEAN is an open science collaboration focused on understanding the open source ecosystems creating datasets that enable research and forming a clear understanding of the state of open source communities.
https://vermontcomplexsystems.org/partner/OCEAN/
Apache License 2.0
50 stars 19 forks source link

Bump the pip group across 1 directory with 14 updates #120

Closed dependabot[bot] closed 5 months ago

dependabot[bot] commented 5 months ago

Bumps the pip group with 14 updates in the /archive/mailing-list-data-pipelines directory:

Package From To
certifi 2022.9.24 2023.7.22
cryptography 38.0.3 42.0.4
dnspython 2.2.1 2.6.1
grpcio 1.50.0 1.53.2
idna 3.4 3.7
jinja2 3.1.2 3.1.4
jupyter-server 1.23.2 2.11.2
jupyterlab 3.5.0 3.6.7
paramiko 2.12.0 3.4.0
pyarrow 10.0.0 14.0.1
pymongo 4.3.2 4.6.3
requests 2.28.1 2.32.2
tornado 6.2 6.3.3
urllib3 1.26.12 1.26.18

Updates certifi from 2022.9.24 to 2023.7.22

Commits


Updates cryptography from 38.0.3 to 42.0.4

Changelog

Sourced from cryptography's changelog.

42.0.4 - 2024-02-20


* Fixed a null-pointer-dereference and segfault that could occur when creating
  a PKCS#12 bundle. Credit to **Alexander-Programming** for reporting the
  issue. **CVE-2024-26130**
* Fixed ASN.1 encoding for PKCS7/SMIME signed messages. The fields ``SMIMECapabilities``
  and ``SignatureAlgorithmIdentifier`` should now be correctly encoded according to the
  definitions in :rfc:`2633` :rfc:`3370`.

.. _v42-0-3:


42.0.3 - 2024-02-15

  • Fixed an initialization issue that caused key loading failures for some users.

.. _v42-0-2:

42.0.2 - 2024-01-30


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.2.1.
* Fixed an issue that prevented the use of Python buffer protocol objects in
  ``sign`` and ``verify`` methods on asymmetric keys.
* Fixed an issue with incorrect keyword-argument naming with ``EllipticCurvePrivateKey``
  :meth:`~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey.exchange`,
  ``X25519PrivateKey``
  :meth:`~cryptography.hazmat.primitives.asymmetric.x25519.X25519PrivateKey.exchange`,
  ``X448PrivateKey``
  :meth:`~cryptography.hazmat.primitives.asymmetric.x448.X448PrivateKey.exchange`,
  and ``DHPrivateKey``
  :meth:`~cryptography.hazmat.primitives.asymmetric.dh.DHPrivateKey.exchange`.

.. _v42-0-1:


42.0.1 - 2024-01-24

  • Fixed an issue with incorrect keyword-argument naming with EllipticCurvePrivateKey :meth:~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey.sign.
  • Resolved compatibility issue with loading certain RSA public keys in :func:~cryptography.hazmat.primitives.serialization.load_pem_public_key.

.. _v42-0-0:

42.0.0 - 2024-01-22


</tr></table>

... (truncated)

Commits


Updates dnspython from 2.2.1 to 2.6.1

Release notes

Sourced from dnspython's releases.

dnspython 2.6.1

See What's New for details.

This is a bug fix release for 2.6.0 where the "TuDoor" fix erroneously suppressed legitimate Truncated exceptions. This caused the stub resolver to timeout instead of failing over to TCP when a legitimate truncated response was received over UDP.

This release addresses the potential DoS issue discussed in the "TuDoor" paper (CVE-2023-29483). The dnspython stub resolver is vulnerable to a potential DoS if a bad-in-some-way response from the right address and port forged by an attacker arrives before a legitimate one on the UDP port dnspython is using for that query. In this situation, dnspython might switch to querying another resolver or give up entirely, possibly denying service for that resolution. This release addresses the issue by adopting the recommended mitigation, which is ignoring the bad packets and continuing to listen for a legitimate response until the timeout for the query has expired.

Thank you to all the contributors to this release, and, as usual, thanks to my co-maintainers: Tomáš Křížek, Petr Špaček, and Brian Wellington.

dnspython 2.6.0

See What's New for details.

This release addresses the potential DoS issue discussed in the "TuDoor" paper (CVE-2023-29483). The dnspython stub resolver is vulnerable to a potential DoS if a bad-in-some-way response from the right address and port forged by an attacker arrives before a legitimate one on the UDP port dnspython is using for that query. In this situation, dnspython might switch to querying another resolver or give up entirely, possibly denying service for that resolution. This release addresses the issue by adopting the recommended mitigation, which is ignoring the bad packets and continuing to listen for a legitimate response until the timeout for the query has expired.

Thank you to all the contributors to this release, and, as usual, thanks to my co-maintainers: Tomáš Křížek, Petr Špaček, and Brian Wellington.

dnspython 2.5.0

See the What's New page for a summary of this release.

Thanks to all the contributors, and, as usual, thanks to my co-maintainers: Tomáš Křížek, Petr Špaček, and Brian Wellington.

dnspython 2.4.2

This is a bug fix release, see the What's New page in the documentation for a summary.

Thanks to the people who reported the bugs and, as usual, thanks to my co-maintainers: Tomáš Křížek, Petr Špaček, and Brian Wellington.

Changelog

Sourced from dnspython's changelog.

2.6.1

  • The Tudoor fix ate legitimate Truncated exceptions, preventing the resolver from failing over to TCP and causing the query to timeout #1053.

2.6.0

  • As mentioned in the "TuDoor" paper and the associated CVE-2023-29483, the dnspython stub resolver is vulnerable to a potential DoS if a bad-in-some-way response from the right address and port forged by an attacker arrives before a legitimate one on the UDP port dnspython is using for that query.

    This release addresses the issue by adopting the recommended mitigation, which is ignoring the bad packets and continuing to listen for a legitimate response until the timeout for the query has expired.

  • Added support for the NSID EDNS option.

  • Dnspython now looks for version metadata for optional packages and will not use them if they are too old. This prevents possible exceptions when a feature like DoH is not desired in dnspython, but an old httpx is installed along with dnspython for some other purpose.

  • The DoHNameserver class now allows GET to be used instead of the default POST, and also passes source and source_port correctly to the underlying query methods.

2.5.0

  • Dnspython now uses hatchling for builds.

  • Asynchronous destinationless sockets now work on Windows.

  • Cython is no longer supported due to various typing issues.

  • Dnspython now explicitly canonicalizes IPv4 and IPv6 addresses. Previously it was possible for non-canonical IPv6 forms to be stored in a AAAA address, which would work correctly but possibly cause problmes if the address were used as a key in a dictionary.

  • The number of messages in a section can be retrieved with section_count().

  • Truncation preferences for messages can be specified.

  • The length of a message can be automatically prepended when rendering.

... (truncated)

Commits
  • 0a742b9 update CI
  • 0ea5ad0 The Tudoor fix should not eat valid Truncated exceptions #1053 (#1054)
  • f12d398 2.6.1 version prep
  • cecb853 Further improve CVE fix coverage to 100% for sync and async.
  • 7952e31 test IgnoreErrors
  • e093299 For the Tudoor fix, we also need the UDP nameserver to ignore_unexpected.
  • 3af9f78 2.6.0 versioning
  • ca63d95 Require cryptography >=41 instead of 42.
  • 902cbf3 Create CODE_OF_CONDUCT.md
  • ed9795f github contributing and pull request template
  • Additional commits viewable in compare view


Updates grpcio from 1.50.0 to 1.53.2

Release notes

Sourced from grpcio's releases.

Release v1.53.2

This is release gRPC Core 1.53.2 (glockenspiel).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Core

Release v1.53.1

This is release gRPC Core 1.53.1 (glockenspiel).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

Release v1.53.0

This is release 1.53.0 (glockenspiel) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

  • xDS: fix crash when removing the last endpoint from the last locality in weighted_target. (#32592)
  • filter stack: pass peer name up via recv_initial_metadata batch. (#31933)
  • [EventEngine] Add advice against blocking work in callbacks. (#32397)
  • [http2] Dont drop connections on metadata limit exceeded. (#32309)
  • xDS: reject aggregate cluster with empty cluster list. (#32238)
  • Fix Python epoll1 Fork Support. (#32196)
  • server: introduce ServerMetricRecorder API and move per-call reporting from a C++ interceptor to a C-core filter. (#32106)
  • [EventEngine] Add invalid handle types to the public API. (#32202)
  • [EventEngine] Refactoring the EventEngine Test Suite: Part 1. (#32127)
  • xDS: fix WeightedClusters total weight handling. (#32134)

C++

  • Update minimum MSVC version to 2019. (#32615)
  • Use CMake variables for paths in pkg-config files. (#31671)

... (truncated)

Commits
  • afb307f [v1.53.x][Interop] Backport Python image update (#33864)
  • 7a9373b [Backport] [dependency] Restrict cython to less than 3.X (#33770)
  • fdb64a6 [v1.53][Build] Update Phusion baseimage (#33767) (#33836)
  • cdf4186 [PSM Interop] Legacy tests: fix xDS test client build (v1.53.x backport) (#33...
  • ce5b93a [PSM Interop] Legacy test builds always pull the driver from master (v1.53.x ...
  • b24b6ea [release] Bump release version to 1.53.2 (#33709)
  • 1e86ca5 [backport][iomgr][EventEngine] Improve server handling of file descriptor exh...
  • aff3066 [PSM interop] Don't fail url_map target if sub-target already failed (v1.53.x...
  • 539d75c [PSM interop] Don't fail target if sub-target already failed (#33222) (v1.53....
  • 3e79c88 [Release] Bump version to 1.53.1 (on v1.53.x branch) (#33047)
  • Additional commits viewable in compare view


Updates idna from 3.4 to 3.7

Release notes

Sourced from idna's releases.

v3.7

What's Changed

  • Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

Full Changelog: https://github.com/kjd/idna/compare/v3.6...v3.7

Changelog

Sourced from idna's changelog.

3.7 (2024-04-11) ++++++++++++++++

  • Fix issue where specially crafted inputs to encode() could take exceptionally long amount of time to process. [CVE-2024-3651]

Thanks to Guido Vranken for reporting the issue.

3.6 (2023-11-25) ++++++++++++++++

  • Fix regression to include tests in source distribution.

3.5 (2023-11-24) ++++++++++++++++

  • Update to Unicode 15.1.0
  • String codec name is now "idna2008" as overriding the system codec "idna" was not working.
  • Fix typing error for codec encoding
  • "setup.cfg" has been added for this release due to some downstream lack of adherence to PEP 517. Should be removed in a future release so please prepare accordingly.
  • Removed reliance on a symlink for the "idna-data" tool to comport with PEP 517 and the Python Packaging User Guide for sdist archives.
  • Added security reporting protocol for project

Thanks Jon Ribbens, Diogo Teles Sant'Anna, Wu Tingfeng for contributions to this release.

Commits
  • 1d365e1 Release v3.7
  • c1b3154 Merge pull request #172 from kjd/optimize-contextj
  • 0394ec7 Merge branch 'master' into optimize-contextj
  • cd58a23 Merge pull request #152 from elliotwutingfeng/dev
  • 5beb28b More efficient resolution of joiner contexts
  • 1b12148 Update ossf/scorecard-action to v2.3.1
  • d516b87 Update Github actions/checkout to v4
  • c095c75 Merge branch 'master' into dev
  • 60a0a4c Fix typo in GitHub Actions workflow key
  • 5918a0e Merge branch 'master' into dev
  • Additional commits viewable in compare view


Updates jinja2 from 3.1.2 to 3.1.4

Release notes

Sourced from jinja2's releases.

3.1.4

This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.

PyPI: https://pypi.org/project/Jinja2/3.1.4/ Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-4

  • The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. GHSA-h75v-3vvj-5mfj

3.1.3

This is a fix release for the 3.1.x feature branch.

Changelog

Sourced from jinja2's changelog.

Version 3.1.4

Released 2024-05-05

  • The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. :ghsa:h75v-3vvj-5mfj

Version 3.1.3

Released 2024-01-10

  • Fix compiler error when checking if required blocks in parent templates are empty. :pr:1858
  • xmlattr filter does not allow keys with spaces. :ghsa:h5c8-rqwp-cp95
  • Make error messages stemming from invalid nesting of {% trans %} blocks more helpful. :pr:1918
Commits


Updates jupyter-server from 1.23.2 to 2.11.2

Release notes

Sourced from jupyter-server's releases.

v2.11.2

2.11.2

(Full Changelog)

Contributors to this release

(GitHub contributors page for this release)

v2.11.1

2.11.1

(Full Changelog)

Bugs fixed

Contributors to this release

(GitHub contributors page for this release)

@​blink1073 | @​fcollonval | @​minrk | @​Wh1isper

v2.11.0

2.11.0

(Full Changelog)

Enhancements made

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

... (truncated)

Changelog

Sourced from jupyter-server's changelog.

2.11.2

(Full Changelog)

Contributors to this release

(GitHub contributors page for this release)

2.11.1

(Full Changelog)

Bugs fixed

Contributors to this release

(GitHub contributors page for this release)

@​blink1073 | @​fcollonval | @​minrk | @​Wh1isper

2.11.0

(Full Changelog)

Enhancements made

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

(GitHub contributors page for this release)

@​blink1073 | @​IITII | @​welcome | @​Wh1isper

2.10.1

(Full Changelog)

... (truncated)

Commits


Updates jupyterlab from 3.5.0 to 3.6.7

Release notes

Sourced from jupyterlab's releases.

v3.6.7

3.6.7

(Full Changelog)

Security fixes

Bugs fixed

Maintenance and upkeep improvements

Contributors to this release

(GitHub contributors page for this release)

@​afshin | @​andrii-i | @​blink1073 | @​bollwyvl | @​brichet | @​davidbrochart | @​dharmaquark | @​dlqqq | @​echarles | @​fcollonval | @​g547315 | @​gabalafou | @​GabrielaVives | @​github-actions | @​HaudinFlorence | @​j264415 | @​JasonWeill | @​jtpio | @​jupyterlab-probot | @​krassowski | @​lumberbot-app | @​meeseeksmachine | @​misterfads | @​mlucool | @​parmentelat | @​skyetim | @​tonyfast | @​welcome | @​Wh1isper

v3.6.6

3.6.6

(Full Changelog)

Maintenance and upkeep improvements

Documentation improvements

... (truncated)

Changelog

Sourced from jupyterlab's changelog.

(changelog)=

JupyterLab Changelog

v4.2

Workspaces UI

It is now possible to switch and manage workspaces from within JupyterLab.

Recently opened/closed files

The jupyterlab-recents extension was integrated into JupyterLab.

Users are now able to:

  • re-open recently used files from the main menu:

  • re-open recently closed files from the sidebar:

  • quickly jump to open tabs/recently closed files by using a new searchable modal dialog (press Ctrl+Alt+A to open the dialog, or click on the [↗] icon in the sidebar):

Full notebook windowing mode by default

Notebooks in the full windowing mode only render the visible cells, significantly improving the performance of the application. One limitation of full mode is that the search function in your browser may produce false negatives; using the JupyterLab search function is recommended. To revert to the behaviour from JupyterLab 4.1, go to Settings → Settings Editor → Notebook, scroll to "Windowing mode", and choose defer.

Improved Shortcuts Editor

Among the numerous improvements and bug fixes for the keyboard shortcuts editor:

  • it is now possible to remove the default shortcuts,
  • shortcuts are correctly sorted when using a language pack,
  • shortcuts with different arguments are now correctly displayed as individual entries.

Dark high contrast theme

A new theme, JupyterLab Dark High Contrast, which is intended to benefit users with the need for higher contrast, following the WCAG AAA accessibility standard for color contrast. To select this theme, from the menu bar, choose Settings → Theme → JupyterLab Dark High Contrast. Please provide feedback and suggestions on further improvements to this theme.

... (truncated)

Commits


Updates paramiko from 2.12.0 to 3.4.0

Commits
  • f0881ba Cut 3.4.0
  • 3e4bdf9 Changelog/comment updates
  • 30b447b Linting
  • 33508c9 Expand MessageOrderError use to handle more packet types
  • 96db1e2 Raise exception when sequence numbers rollover during initial kex
  • 58785d2 Changelog tweak re: other new Transport kwarg
  • 8dcb237 Test-suite-only bugfix: defer did not actually imply skip_verify
  • fa46de7 Reset sequence numbers on rekey
  • 75e311d Enforce zero seqno on kexinit
  • 73f079f Fill in CVE number for Terrapin attack
  • Additional commits viewable in compare view


Updates pyarrow from 10.0.0 to 14.0.1

Commits


Updates pymongo from 4.3.2 to 4.6.3

Release notes

Sourced from pymongo's releases.

PyMongo 4.6.2

Release notes: https://www.mongodb.com/community/forums/t/pymongo-4-6-2-released/267404

PyMongo 4.6.1

Release notes: https://www.mongodb.com/community/forums/t/pymongo-4-6-1-released/255752

PyMongo 4.6.0

Release notes: https://www.mongodb.com/community/forums/t/pymongo-4-6-0-released/251866

PyMongo 4.5.0

Release notes: https://www.mongodb.com/community/forums/t/pymongo-4-5-0-released/240662

PyMongo 4.4.1

Release notes: https://www.mongodb.com/community/forums/t/pymongo-4-4-1-released/235045

PyMongo 4.4.0

Release notes: https://www.mongodb.com/community/forums/t/pymongo-4-4-released/232211

PyMongo 4.4.0b0

Release notes: https://www.mongodb.com/community/forums/t/pymongo-4-4-0b0-release/210471

PyMongo 4.3.3

Release notes: https://www.mongodb.com/community/forums/t/pymongo-4-3-3-release/200145

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.6.3

PyMongo 4.6.3 fixes the following bug:

  • Fixed a potential memory access violation when decoding invalid bson.

Issues Resolved ...............

See the PyMongo 4.6.3 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.6.3 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=38360

Changes in Version 4.6.2

PyMongo 4.6.2 fixes the following bug:

  • Fixed a bug appearing in Python 3.12 where "RuntimeError: can't create new thread at interpreter shutdown" could be written to stderr when a MongoClient's thread starts as the python interpreter is shutting down.

Issues Resolved ...............

See the PyMongo 4.6.2 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.6.2 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=37906

Changes in Version 4.6.1

PyMongo 4.6.1 fixes the following bug:

  • Ensure retryable read OperationFailure errors re-raise exception when 0 or NoneType error code is provided.

Issues Resolved ...............

See the PyMongo 4.6.1 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.6.1 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=37138

Changes in Version 4.6

PyMongo 4.6 brings a number of improvements including:

... (truncated)

Commits
  • 8da192f BUMP 4.6.3
  • 56b6b6d PYTHON-4305 Fix bson size check (#1564)
  • 449d0f3 BUMP to 4.6.3.dev0
  • e04576d DEVPROD-3871 Use teardown_task when there is one function/command ... _Description has been truncated_
dependabot[bot] commented 5 months ago

Superseded by #121.