github-actions[bot]
commented
6 months ago Dependency Review
The following issues were found:
- ✅ 0 vulnerable package(s)
- ✅ 0 package(s) with incompatible licenses
- ✅ 0 package(s) with invalid SPDX license definitions
- ⚠️ 1 package(s) with unknown licenses.
Snapshot Warnings
⚠️: No snapshots were found for the head SHA fd84c669a38cec98489b1a73d737b8c614e3c607.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.
License Issues
poetry.lock
| Package | Version | License | Issue Type |
| cryptography | 42.0.6 | Null | Unknown License |
Allowed Licenses: 0BSD, AGPL-3.0-or-later, GPL-3.0-or-later, LGPL-2.1, EPL-2.0, Python-2.0, GPL-2.0-or-later, GPL-2.0-only, GPL-3.0-or-later AND LGPL-2.1-only, GPL-3.0-or-later AND LGPL-3.0 AND LGPL-3.0-only, GPL-2.0 AND GPL-2.0-only AND GPL-2.0-or-later AND LGPL-2.1-or-later, MIT, ISC, Unlicense, Apache-2.0, BSD-3-Clause, BSD-2-Clause, BSD-2-Clause AND MIT, MPL-2.0, CC-BY-4.0, CC-BY-3.0, CC-BY-SA-4.0, CC0-1.0, BSD-2-Clause AND BSD-3-Clause, BSD-3-Clause AND BSD-3-Clause-Clear, MIT OR Apache-2.0, MIT AND Python-2.0, (Apache-2.0 AND BSD-3-Clause) OR (Apache-2.0 AND MIT), (MIT OR Apache-2.0) AND Unicode-DFS-2016, OFL-1.1, Apache-2.0 AND BSD-3-Clause AND MIT AND OFL-1.1, BlueOak-1.0.0, BSL-1.0, Python-2.0.1, MIT AND PSF-2.0, CAL-1.0
OpenSSF Scorecard
Scorecard details
| Package | Version | Score | Details | ||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| pip/babel | 2.15.0 | :green_circle: 5.7 | Details
| ||||||||||||||||||||||||||||||||||||||||||||||||
| pip/bcrypt | 4.1.3 | :green_circle: 6 | Details
| ||||||||||||||||||||||||||||||||||||||||||||||||
| pip/coverage | 7.5.1 | :green_circle: 8.3 | Details
| ||||||||||||||||||||||||||||||||||||||||||||||||
| pip/cryptography | 42.0.6 | :green_circle: 8.5 | Details
| ||||||||||||||||||||||||||||||||||||||||||||||||
| pip/jinja2 | 3.1.4 | :green_circle: 6.9 | Details
| ||||||||||||||||||||||||||||||||||||||||||||||||
| pip/pygments | 2.18.0 | :green_circle: 6.2 | Details
| ||||||||||||||||||||||||||||||||||||||||||||||||
| pip/ruff | 0.4.3 | Unknown | Unknown | ||||||||||||||||||||||||||||||||||||||||||||||||
| pip/babel | 2.14.0 | :green_circle: 5.7 | Details
| ||||||||||||||||||||||||||||||||||||||||||||||||
| pip/bcrypt | 4.1.2 | :green_circle: 6 | Details
| ||||||||||||||||||||||||||||||||||||||||||||||||
| pip/coverage | 7.5.0 | :green_circle: 8.3 | Details
| ||||||||||||||||||||||||||||||||||||||||||||||||
| pip/cryptography | 42.0.5 | :green_circle: 8.5 | Details
| ||||||||||||||||||||||||||||||||||||||||||||||||
| pip/jinja2 | 3.1.3 | :green_circle: 6.9 | Details
| ||||||||||||||||||||||||||||||||||||||||||||||||
| pip/pygments | 2.17.2 | :green_circle: 6.2 | Details
| ||||||||||||||||||||||||||||||||||||||||||||||||
| pip/ruff | 0.4.2 | Unknown | Unknown |
Scanned Manifest Files
poetry.lock
- babel@2.15.0
- bcrypt@4.1.3
- coverage@7.5.1
- cryptography@42.0.6
- jinja2@3.1.4
- pygments@2.18.0
- ruff@0.4.3
- babel@2.14.0
- bcrypt@4.1.2
- coverage@7.5.0
- cryptography@42.0.5
- jinja2@3.1.3
- pygments@2.17.2
- ruff@0.4.2
Bumps the python-packages group with 7 updates:
7.5.07.5.12.14.02.15.04.1.24.1.342.0.542.0.63.1.33.1.42.17.22.18.00.4.20.4.3Updates
coveragefrom 7.5.0 to 7.5.1Changelog
Sourced from coverage's changelog.
Commits
be938eadocs: sample HTML for 7.5.102c66d7docs: prep for 7.5.15fa9f67fix: avoid max recursion errors in ast code. #177434af01dbuild: easier to run metasmoke on desired python version6b0cac5perf: cache _human_key to speed html report by about 10%fdc0ee8docs: oops, typo60e6cb4docs: changelog for #754 and #1773277c8c4fix: '# pragma: no branch' in multiline if statements. #754 (#1773)34d3eb7docs: update changelog for #1786. Thanks, Daniel Diniz2bb5ef2fix(html): make HTML column sorting consistent across index pages (fix #1766)...Updates
babelfrom 2.14.0 to 2.15.0Release notes
Sourced from babel's releases.
Changelog
Sourced from babel's changelog.
Commits
40b194fPrepare for 2.15.0 release (#1079)c2e6c6eEncode support for the "fall back to short format" logic for time delta forma...1a03526Include Unicode license inlocale-dataand in documentation (#1074)c0fb56eAllow alternative space characters as group separator when parsing numbers (#...fe82fbcUse CLDR 44 and adjust tests to match new data (#1071)e0d1018Improve .po IO (#1068)40e60a1Upgrade GitHub Actions (#1054)2a1709aDrop support for Python 3.7 (EOL since June 2023) (#1048)Updates
bcryptfrom 4.1.2 to 4.1.3Commits
35e5a6fBump version for 4.1.3 release (#791)d99d1e5Bump autocfg from 1.2.0 to 1.3.0 in /src/_bcrypt (#790)0775d47allow testing with pytest 8.2.0 (#786)97d09acBump base64 from 0.22.0 to 0.22.1 in /src/_bcrypt (#787)ee4a9a8use ubuntu rolling in arm64 CI (#784)7d2474fBump libc from 0.2.153 to 0.2.154 in /src/_bcrypt (#783)7a252ddTry blocking pytest 8.2.0 (#785)297a915Remove brew install rust from macOS CI (#782)6b3f99eBump parking_lot_core from 0.9.9 to 0.9.10 in /src/_bcrypt (#778)c88b310Bump parking_lot from 0.12.1 to 0.12.2 in /src/_bcrypt (#780)Updates
cryptographyfrom 42.0.5 to 42.0.6Changelog
Sourced from cryptography's changelog.
Commits
cfad004Prepare backports for 42.0.6 release (#10929)Updates
jinja2from 3.1.3 to 3.1.4Release notes
Sourced from jinja2's releases.
Changelog
Sourced from jinja2's changelog.
Commits
dd4a8b5release version 3.1.40668239Merge pull request from GHSA-h75v-3vvj-5mfjd655030disallow invalid characters in keys to xmlattr filtera7863baadd ghsa linksb5c98e7start version 3.1.4da3a9f0update project files (#1968)0ee5eb4satisfy formatter, linter, and strict mypy20477c6update project files (#5457)e491223update pyyaml dev dependency36f9885fix pr linkUpdates
pygmentsfrom 2.17.2 to 2.18.0Release notes
Sourced from pygments's releases.
... (truncated)
Changelog
Sourced from pygments's changelog.
... (truncated)
Commits
d7d11f6Last steps for 2.18 release.ec7bfd2Fix Janet version_added.ea9c823Update CHANGES.338d366Merge pull request #2670 from Kodiologist/hylex4d1371bLock down the pytest version.8dd97e0Improve docs.26179d6Fix deprecated variable usage in tests.ad125caPrepare 2.18 release.24deeb9Lock the ruff version in tox.ini.c9165cfFix format string usage.Updates
rufffrom 0.4.2 to 0.4.3Release notes
Sourced from ruff's releases.
... (truncated)
Changelog
Sourced from ruff's changelog.
Commits
1e91a09Bump version to v0.4.3 (#11274)d0f51c6Remove remainingruff_shrinkingreferences (#11272)8dd3811Use function range forreimplemented-operatordiagnostics (#11271)894cd13[refurb] Ignore methods inreimplemented-operator(FURB118) (#11270)f3284fdRemove unnecessary check for RUF020 enabled (#11268)82dd5e6[red-knot] resolve class members (#11256)6a1e555Upgrade to Rust 1.78 (#11260)349a4cfRemove trailing reference section (#11257)dfbeca5ruff serverno longer hangs after shutdown (#11222)9e69cd6Rephrase rationale forpytest-incorrect-pytest-import(#11255)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show