Deps: Bump the python-packages group with 4 updates

[dependabot[bot]]

Bumps the python-packages group with 4 updates: coverage, black, ruff and zipp.

Updates coverage from 7.4.3 to 7.4.4

Changelog

Sourced from coverage's changelog.

Version 7.4.4 — 2024-03-14

• Fix: in some cases, even with [run] relative_files=True, a data file could be created with absolute path names. When combined with other relative data files, it was random whether the absolute file names would be made relative or not. If they weren't, then a file would be listed twice in reports, as detailed in issue 1752_. This is now fixed: absolute file names are always made relative when combining. Thanks to Bruno Rodrigues dos Santos for support.

• Fix: the last case of a match/case statement had an incorrect message if the branch was missed. It said the pattern never matched, when actually the branch is missed if the last case always matched.

• Fix: clicking a line number in the HTML report now positions more accurately.

• Fix: the report:format setting was defined as a boolean, but should be a string. Thanks, Tanaydin Sirin <pull 1754_>_. It is also now documented on the :ref:configuration page <config_report_format>.

.. _issue 1752: nedbat/coveragepy#1752 .. _pull 1754: nedbat/coveragepy#1754

.. _changes_7-4-3:

Commits

• bc5e2d7 docs: sample HTML for 7.4.4
• 9b0008b docs: prep for 7.4.4
• a536161 docs: thanks, Bruno Rodrigues dos Santos
• e06e4f9 chore: make doc_upgrade
• f30818e chore: make upgrade
• 1b19799 fix: ensure absolute paths are relative when combined #1752
• 1ef020d build: more cheats for convenient URLs
• 3d57a07 docs: document the report:format setting
• 8e30221 fix: correct the type of report:format in config.py (#1754)
• 6289be8 refactor: use dataclasses, no namedtuple
• Additional commits viewable in compare view

Updates black from 24.2.0 to 24.3.0

Release notes

Sourced from black's releases.

24.3.0

Highlights

This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.

This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

Stable style

• Don't move comments along with delimiters, which could cause crashes (#4248)
• Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)
• Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)

Performance

• Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)

Documentation

• Note what happens when --check is used with --quiet (#4236)

Changelog

Sourced from black's changelog.

24.3.0

Highlights

This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.

This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

Stable style

• Don't move comments along with delimiters, which could cause crashes (#4248)
• Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)
• Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)

Performance

• Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)

Documentation

• Note what happens when --check is used with --quiet (#4236)

Commits

• 552baf8 Prepare release 24.3.0 (#4279)
• f000936 Fix catastrophic performance in lines_with_leading_tabs_expanded() (#4278)
• 7b5a657 Fix --line-ranges behavior when ranges are at EOF (#4273)
• 1abcffc Use regex where we ignore case on windows (#4252)
• 719e674 Fix 4227: Improve documentation for --quiet --check (#4236)
• e5510af update plugin url for Thonny (#4259)
• 6af7d11 Fix AST safety check false negative (#4270)
• f03ee11 Ensure blib2to3.pygram is initialized before use (#4224)
• e4bfedb fix: Don't move comments while splitting delimiters (#4248)
• d0287e1 Make trailing comma logic more concise (#4202)
• Additional commits viewable in compare view

Updates ruff from 0.3.2 to 0.3.3

Release notes

Sourced from ruff's releases.

v0.3.3

Changes

Preview features

• [flake8-bandit]: Implement S610 rule (#10316)
• [pycodestyle] Implement blank-line-at-end-of-file (W391) (#10243)
• [pycodestyle] Implement redundant-backslash (E502) (#10292)
• [pylint] - implement redeclared-assigned-name (W0128) (#9268)

Rule changes

• [flake8_comprehensions] Handled special case for C400 which also matches C416 (#10419)
• [flake8-bandit] Implement upstream updates for S311, S324 and S605 (#10313)
• [pyflakes] Remove F401 fix for __init__ imports by default and allow opt-in to unsafe fix (#10365)
• [pylint] Implement invalid-bool-return-type (E304) (#10377)
• [pylint] Include builtin warnings in useless-exception-statement (PLW0133) (#10394)

CLI

• Add message on success to ruff check (#8631)

Bug fixes

• [PIE970] Allow trailing ellipsis in typing.TYPE_CHECKING (#10413)
• Avoid TRIO115 if the argument is a variable (#10376)
• [F811] Avoid removing shadowed imports that point to different symbols (#10387)
• Fix F821 and F822 false positives in .pyi files (#10341)
• Fix F821 false negatives in .py files when from __future__ import annotations is active (#10362)
• Fix case where Indexer fails to identify continuation preceded by newline #10351 (#10354)
• Sort hash maps in Settings display (#10370)
• Track conditional deletions in the semantic model (#10415)
• [C413] Wrap expressions in parentheses when negating (#10346)
• [pycodestyle] Do not ignore lines before the first logical line in blank lines rules. (#10382)
• [pycodestyle] Do not trigger E225 and E275 when the next token is a ')' (#10315)
• [pylint] Avoid false-positive slot non-assignment for __dict__ (PLE0237) (#10348)
• Gate f-string struct size test for Rustc < 1.76 (#10371)

Documentation

• Use ruff.toml format in README (#10393)
• [RUF008] Make it clearer that a mutable default in a dataclass is only valid if it is typed as a ClassVar (#10395)
• [pylint] Extend docs and test in invalid-str-return-type (E307) (#10400)
• Remove . from check and format commands (#10217)

Contributors

• @​AlexWaygood
• @​Guilherme-Vasconcelos
• @​KotlinIsland
• @​anuraaga

... (truncated)

Changelog

Sourced from ruff's changelog.

0.3.3

Preview features

• [flake8-bandit]: Implement S610 rule (#10316)
• [pycodestyle] Implement blank-line-at-end-of-file (W391) (#10243)
• [pycodestyle] Implement redundant-backslash (E502) (#10292)
• [pylint] - implement redeclared-assigned-name (W0128) (#9268)

Rule changes

• [flake8_comprehensions] Handled special case for C400 which also matches C416 (#10419)
• [flake8-bandit] Implement upstream updates for S311, S324 and S605 (#10313)
• [pyflakes] Remove F401 fix for __init__ imports by default and allow opt-in to unsafe fix (#10365)
• [pylint] Implement invalid-bool-return-type (E304) (#10377)
• [pylint] Include builtin warnings in useless-exception-statement (PLW0133) (#10394)

CLI

• Add message on success to ruff check (#8631)

Bug fixes

• [PIE970] Allow trailing ellipsis in typing.TYPE_CHECKING (#10413)
• Avoid TRIO115 if the argument is a variable (#10376)
• [F811] Avoid removing shadowed imports that point to different symbols (#10387)
• Fix F821 and F822 false positives in .pyi files (#10341)
• Fix F821 false negatives in .py files when from __future__ import annotations is active (#10362)
• Fix case where Indexer fails to identify continuation preceded by newline #10351 (#10354)
• Sort hash maps in Settings display (#10370)
• Track conditional deletions in the semantic model (#10415)
• [C413] Wrap expressions in parentheses when negating (#10346)
• [pycodestyle] Do not ignore lines before the first logical line in blank lines rules. (#10382)
• [pycodestyle] Do not trigger E225 and E275 when the next token is a ')' (#10315)
• [pylint] Avoid false-positive slot non-assignment for __dict__ (PLE0237) (#10348)
• Gate f-string struct size test for Rustc < 1.76 (#10371)

Documentation

• Use ruff.toml format in README (#10393)
• [RUF008] Make it clearer that a mutable default in a dataclass is only valid if it is typed as a ClassVar (#10395)
• [pylint] Extend docs and test in invalid-str-return-type (E307) (#10400)
• Remove . from check and format commands (#10217)

Commits

• 608df9a Bump version to 0.3.3 (#10425)
• 740c08b [pylint] - implement redeclared-assigned-name (W0128) (#9268)
• 7e652e8 [flake8_comprehensions] Handled special case for C400 which also matches ...
• 9675e18 Allow trailing ellipsis in typing.TYPE_CHECKING (#10413)
• 10ace88 Track conditional deletions in the semantic model (#10415)
• a8e50a7 [RUF008] Make it clearer that a mutable default in a dataclass is only valid ...
• e944c16 [pycodestyle] Do not ignore lines before the first logical line in blank li...
• 5f40371 Use ExprFString for StringLike::FString variant (#10311)
• f7802ad [pylint] Extend docs and test in invalid-str-return-type (E307) (#10400)
• e832327 Require --preview for ruff server (#10368)
• Additional commits viewable in compare view

Updates zipp from 3.17.0 to 3.18.1

Changelog

Sourced from zipp's changelog.

v3.18.1

No significant changes.

v3.18.0

Features

• Bypass ZipFile.namelist in glob for better performance. (#106)
• Refactored glob functionality to support a more generalized solution with support for platform-specific path separators. (#108)

Bugfixes

• Add special accounting for pypy when computing the stack level for text encoding warnings. (#114)

Commits

• bfae834 Finalize
• 487066e Merge changelog into last release.
• 4584ee2 Move changelog entry, saved to the wrong location :(
• 3c06d30 Finalize
• 48b72b8 Merge pull request #113 from jaraco/feature/glob-perf
• 171fa98 Add news fragment.
• ac8ea7a Bypass ZipFile.namelist in glob. Closes #106.
• 4cceb49 Add special accounting for pypy when computing the stack level for text encod...
• 2ec3ed8 Add another test at another magnitude.
• d9bf5aa Fix name generator for width=1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore ` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore ` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore ` will remove the ignore condition of the specified dependency and ignore conditions

[github-actions[bot]]

Dependency Review

✅ No vulnerabilities or license issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA aff88f93417c85ab598a4bfb61e4677829763925.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Manifest Files

poetry.lock

• black@24.3.0
• coverage@7.4.4
• ruff@0.3.3
• zipp@3.18.1
• black@24.2.0
• coverage@7.4.3
• ruff@0.3.2
• zipp@3.17.0

[github-actions[bot]]

Conventional Commits Report

Type	Number
Dependencies	1

:rocket: Conventional commits found.