Scheduled monthly dependency update for May

Update Flask from 2.0.1 to 2.1.2.

Changelog

### 2.1.2 ``` ------------- Released 2022-04-28 - Fix type annotation for ``json.loads``, it accepts str or bytes. :issue:`4519` - The ``--cert`` and ``--key`` options on ``flask run`` can be given in either order. :issue:`4459` ``` ### 2.1.1 ``` ------------- Released on 2022-03-30 - Set the minimum required version of importlib_metadata to 3.6.0, which is required on Python < 3.10. :issue:`4502` ``` ### 2.1.0 ``` ------------- Released 2022-03-28 - Drop support for Python 3.6. :pr:`4335` - Update Click dependency to >= 8.0. :pr:`4008` - Remove previously deprecated code. :pr:`4337` - The CLI does not pass ``script_info`` to app factory functions. - ``config.from_json`` is replaced by ``config.from_file(name, load=json.load)``. - ``json`` functions no longer take an ``encoding`` parameter. - ``safe_join`` is removed, use ``werkzeug.utils.safe_join`` instead. - ``total_seconds`` is removed, use ``timedelta.total_seconds`` instead. - The same blueprint cannot be registered with the same name. Use ``name=`` when registering to specify a unique name. - The test client's ``as_tuple`` parameter is removed. Use ``response.request.environ`` instead. :pr:`4417` - Some parameters in ``send_file`` and ``send_from_directory`` were renamed in 2.0. The deprecation period for the old names is extended to 2.2. Be sure to test with deprecation warnings visible. - ``attachment_filename`` is renamed to ``download_name``. - ``cache_timeout`` is renamed to ``max_age``. - ``add_etags`` is renamed to ``etag``. - ``filename`` is renamed to ``path``. - The ``RequestContext.g`` property is deprecated. Use ``g`` directly or ``AppContext.g`` instead. :issue:`3898` - ``copy_current_request_context`` can decorate async functions. :pr:`4303` - The CLI uses ``importlib.metadata`` instead of ``setuptools`` to load command entry points. :issue:`4419` - Overriding ``FlaskClient.open`` will not cause an error on redirect. :issue:`3396` - Add an ``--exclude-patterns`` option to the ``flask run`` CLI command to specify patterns that will be ignored by the reloader. :issue:`4188` - When using lazy loading (the default with the debugger), the Click context from the ``flask run`` command remains available in the loader thread. :issue:`4460` - Deleting the session cookie uses the ``httponly`` flag. :issue:`4485` - Relax typing for ``errorhandler`` to allow the user to use more precise types and decorate the same function multiple times. :issue:`4095, 4295, 4297` - Fix typing for ``__exit__`` methods for better compatibility with ``ExitStack``. :issue:`4474` - From Werkzeug, for redirect responses the ``Location`` header URL will remain relative, and exclude the scheme and domain, by default. :pr:`4496` - Add ``Config.from_prefixed_env()`` to load config values from environment variables that start with ``FLASK_`` or another prefix. This parses values as JSON by default, and allows setting keys in nested dicts. :pr:`4479` ``` ### 2.0.3 ``` ------------- Released 2022-02-14 - The test client's ``as_tuple`` parameter is deprecated and will be removed in Werkzeug 2.1. It is now also deprecated in Flask, to be removed in Flask 2.1, while remaining compatible with both in 2.0.x. Use ``response.request.environ`` instead. :pr:`4341` - Fix type annotation for ``errorhandler`` decorator. :issue:`4295` - Revert a change to the CLI that caused it to hide ``ImportError`` tracebacks when importing the application. :issue:`4307` - ``app.json_encoder`` and ``json_decoder`` are only passed to ``dumps`` and ``loads`` if they have custom behavior. This improves performance, mainly on PyPy. :issue:`4349` - Clearer error message when ``after_this_request`` is used outside a request context. :issue:`4333` ``` ### 2.0.2 ``` ------------- Released 2021-10-04 - Fix type annotation for ``teardown_*`` methods. :issue:`4093` - Fix type annotation for ``before_request`` and ``before_app_request`` decorators. :issue:`4104` - Fixed the issue where typing requires template global decorators to accept functions with no arguments. :issue:`4098` - Support View and MethodView instances with async handlers. :issue:`4112` - Enhance typing of ``app.errorhandler`` decorator. :issue:`4095` - Fix registering a blueprint twice with differing names. :issue:`4124` - Fix the type of ``static_folder`` to accept ``pathlib.Path``. :issue:`4150` - ``jsonify`` handles ``decimal.Decimal`` by encoding to ``str``. :issue:`4157` - Correctly handle raising deferred errors in CLI lazy loading. :issue:`4096` - The CLI loader handles ``**kwargs`` in a ``create_app`` function. :issue:`4170` - Fix the order of ``before_request`` and other callbacks that trigger before the view returns. They are called from the app down to the closest nested blueprint. :issue:`4229` ```

Links

- PyPI: https://pypi.org/project/flask - Changelog: https://pyup.io/changelogs/flask/ - Homepage: https://palletsprojects.com/p/flask

Update pystache from 0.5.4 to 0.6.0.

Changelog

### 0.6.0 ``` ------------------ - Bump spec versions to latest => v1.1.3 - Modernize python and CI tools, update docs/doctests - Update unicode conversion test for py3-only - Add pep8speaks cfg, cleanup warnings - Remove superfluous setup test/unused imports - Add conda recipe/CI build ``` ### 0.5.42 ``` -------------------- - Merge pull request 1 from sarnold/rebase-up - Bugfix: test_specloader.py: fix test_find__with_directory on other OSs - Bugfix: pystache/loader.py: remove stray windows line-endings - fix crufty (and insecure) http urls - Bugfix: modernize python versions (keep py27) and fix spec_test load cmd ``` ### 0.5.6 ``` ------------------ - Use correct wheel name in release workflow, limit wheels - Add install check/test of downloaded wheel - Update/add ci workflows and tox cfg, bump to next dev0 version ``` ### 0.5.5 ``` ------------------ - fix document processing, update pandoc args and history - add release.yml to CI, test env settings - fix bogus commit message, update versions and tox cf - add post-test steps for building pkgs with/without doc updates - add CI build check, fix MANIFEST.in pruning ```

Links

- PyPI: https://pypi.org/project/pystache - Changelog: https://pyup.io/changelogs/pystache/ - Repo: https://github.com/sarnold/pystache

Update coverage from 5.5 to 6.3.2.

Changelog

### 6.3.2 ``` -------------------------- - Fix: adapt to pypy3.9's decorator tracing behavior. It now traces function decorators like CPython 3.8: both the -line and the def-line are traced. Fixes `issue 1326`_. - Debug: added ``pybehave`` to the list of :ref:`cmd_debug` and :ref:`cmd_run_debug` options. - Fix: show an intelligible error message if ``--concurrency=multiprocessing`` is used without a configuration file. Closes `issue 1320`_. .. _issue 1320: https://github.com/nedbat/coveragepy/issues/1320 .. _issue 1326: https://github.com/nedbat/coveragepy/issues/1326 .. _changes_631: ``` ### 6.3.1 ``` -------------------------- - Fix: deadlocks could occur when terminating processes. Some of these deadlocks (described in `issue 1310`_) are now fixed. - Fix: a signal handler was being set from multiple threads, causing an error: "ValueError: signal only works in main thread". This is now fixed, closing `issue 1312`_. - Fix: ``--precision`` on the command-line was being ignored while considering ``--fail-under``. This is now fixed, thanks to `Marcelo Trylesinski <pull 1317_>`_. - Fix: releases no longer provide 3.11.0-alpha wheels. Coverage.py uses CPython internal fields which are moving during the alpha phase. Fixes `issue 1316`_. .. _issue 1310: https://github.com/nedbat/coveragepy/issues/1310 .. _issue 1312: https://github.com/nedbat/coveragepy/issues/1312 .. _issue 1316: https://github.com/nedbat/coveragepy/issues/1316 .. _pull 1317: https://github.com/nedbat/coveragepy/pull/1317 .. _changes_63: ``` ### 6.3 ``` ------------------------ - Feature: Added the ``lcov`` command to generate reports in LCOV format. Thanks, `Bradley Burns <pull 1289_>`_. Closes issues `587 <issue 587_>`_ and `626 <issue 626_>`_. - Feature: the coverage data file can now be specified on the command line with the ``--data-file`` option in any command that reads or writes data. This is in addition to the existing ``COVERAGE_FILE`` environment variable. Closes `issue 624`_. Thanks, `Nikita Bloshchanevich <pull 1304_>`_. - Feature: coverage measurement data will now be written when a SIGTERM signal is received by the process. This includes :meth:`Process.terminate <python:multiprocessing.Process.terminate>`, and other ways to terminate a process. Currently this is only on Linux and Mac; Windows is not supported. Fixes `issue 1307`_. - Dropped support for Python 3.6, which reached end-of-life on 2021-12-23. - Updated Python 3.11 support to 3.11.0a4, fixing `issue 1294`_. - Fix: the coverage data file is now created in a more robust way, to avoid problems when multiple processes are trying to write data at once. Fixes issues `1303 <issue 1303_>`_ and `883 <issue 883_>`_. - Fix: a .gitignore file will only be written into the HTML report output directory if the directory is empty. This should prevent certain unfortunate accidents of writing the file where it is not wanted. - Releases now have MacOS arm64 wheels for Apple Silicon, fixing `issue 1288`_. .. _issue 587: https://github.com/nedbat/coveragepy/issues/587 .. _issue 624: https://github.com/nedbat/coveragepy/issues/624 .. _issue 626: https://github.com/nedbat/coveragepy/issues/626 .. _issue 883: https://github.com/nedbat/coveragepy/issues/883 .. _issue 1288: https://github.com/nedbat/coveragepy/issues/1288 .. _issue 1294: https://github.com/nedbat/coveragepy/issues/1294 .. _issue 1303: https://github.com/nedbat/coveragepy/issues/1303 .. _issue 1307: https://github.com/nedbat/coveragepy/issues/1307 .. _pull 1289: https://github.com/nedbat/coveragepy/pull/1289 .. _pull 1304: https://github.com/nedbat/coveragepy/pull/1304 .. _changes_62: ``` ### 6.2 ``` ------------------------ - Feature: Now the ``--concurrency`` setting can now have a list of values, so that threads and another lightweight threading package can be measured together, such as ``--concurrency=gevent,thread``. Closes `issue 1012`_ and `issue 1082`_. - Fix: A module specified as the ``source`` setting is imported during startup, before the user program imports it. This could cause problems if the rest of the program isn't ready yet. For example, `issue 1203`_ describes a Django setting that is accessed before settings have been configured. Now the early import is wrapped in a try/except so errors then don't stop execution. - Fix: A colon in a decorator expression would cause an exclusion to end too early, preventing the exclusion of the decorated function. This is now fixed. - Fix: The HTML report now will not overwrite a .gitignore file that already exists in the HTML output directory (follow-on for `issue 1244`_). - API: The exceptions raised by Coverage.py have been specialized, to provide finer-grained catching of exceptions by third-party code. - API: Using ``suffix=False`` when constructing a Coverage object with multiprocessing wouldn't suppress the data file suffix (`issue 989`_). This is now fixed. - Debug: The ``coverage debug data`` command will now sniff out combinable data files, and report on all of them. - Debug: The ``coverage debug`` command used to accept a number of topics at a time, and show all of them, though this was never documented. This no longer works, to allow for command-line options in the future. .. _issue 989: https://github.com/nedbat/coveragepy/issues/989 .. _issue 1012: https://github.com/nedbat/coveragepy/issues/1012 .. _issue 1082: https://github.com/nedbat/coveragepy/issues/1082 .. _issue 1203: https://github.com/nedbat/coveragepy/issues/1203 .. _changes_612: ``` ### 6.1.2 ``` -------------------------- - Python 3.11 is supported (tested with 3.11.0a2). One still-open issue has to do with `exits through with-statements <issue 1270_>`_. - Fix: When remapping file paths through the ``[paths]`` setting while combining, the ``[run] relative_files`` setting was ignored, resulting in absolute paths for remapped file names (`issue 1147`_). This is now fixed. - Fix: Complex conditionals over excluded lines could have incorrectly reported a missing branch (`issue 1271`_). This is now fixed. - Fix: More exceptions are now handled when trying to parse source files for reporting. Problems that used to terminate coverage.py can now be handled with ``[report] ignore_errors``. This helps with plugins failing to read files (`django_coverage_plugin issue 78`_). - Fix: Removed another vestige of jQuery from the source tarball (`issue 840`_). - Fix: Added a default value for a new-to-6.x argument of an internal class. This unsupported class is being used by coveralls (`issue 1273`_). Although I'd rather not "fix" unsupported interfaces, it's actually nicer with a default value. .. _django_coverage_plugin issue 78: https://github.com/nedbat/django_coverage_plugin/issues/78 .. _issue 1147: https://github.com/nedbat/coveragepy/issues/1147 .. _issue 1270: https://github.com/nedbat/coveragepy/issues/1270 .. _issue 1271: https://github.com/nedbat/coveragepy/issues/1271 .. _issue 1273: https://github.com/nedbat/coveragepy/issues/1273 .. _changes_611: ``` ### 6.1.1 ``` -------------------------- - Fix: The sticky header on the HTML report didn't work unless you had branch coverage enabled. This is now fixed: the sticky header works for everyone. (Do people still use coverage without branch measurement!? j/k) - Fix: When using explicitly declared namespace packages, the "already imported a file that will be measured" warning would be issued (`issue 888`_). This is now fixed. .. _issue 888: https://github.com/nedbat/coveragepy/issues/888 .. _changes_61: ``` ### 6.1 ``` ------------------------ - Deprecated: The ``annotate`` command and the ``Coverage.annotate`` function will be removed in a future version, unless people let me know that they are using it. Instead, the ``html`` command gives better-looking (and more accurate) output, and the ``report -m`` command will tell you line numbers of missing lines. Please get in touch if you have a reason to use ``annotate`` over those better options: nednedbatchelder.com. - Feature: Coverage now sets an environment variable, ``COVERAGE_RUN`` when running your code with the ``coverage run`` command. The value is not important, and may change in the future. Closes `issue 553`_. - Feature: The HTML report pages for Python source files now have a sticky header so the file name and controls are always visible. - Feature: The ``xml`` and ``json`` commands now describe what they wrote where. - Feature: The ``html``, ``combine``, ``xml``, and ``json`` commands all accept a ``-q/--quiet`` option to suppress the messages they write to stdout about what they are doing (`issue 1254`_). - Feature: The ``html`` command writes a ``.gitignore`` file into the HTML output directory, to prevent the report from being committed to git. If you want to commit it, you will need to delete that file. Closes `issue 1244`_. - Feature: Added support for PyPy 3.8. - Fix: More generated code is now excluded from measurement. Code such as `attrs`_ boilerplate, or doctest code, was being measured though the synthetic line numbers meant they were never reported. Once Cython was involved though, the generated .so files were parsed as Python, raising syntax errors, as reported in `issue 1160`_. This is now fixed. - Fix: When sorting human-readable names, numeric components are sorted correctly: file10.py will appear after file9.py. This applies to file names, module names, environment variables, and test contexts. - Performance: Branch coverage measurement is faster, though you might only notice on code that is executed many times, such as long-running loops. - Build: jQuery is no longer used or vendored (`issue 840`_ and `issue 1118`_). Huge thanks to Nils Kattenbeck (septatrix) for the conversion to vanilla JavaScript in `pull request 1248`_. .. _issue 553: https://github.com/nedbat/coveragepy/issues/553 .. _issue 840: https://github.com/nedbat/coveragepy/issues/840 .. _issue 1118: https://github.com/nedbat/coveragepy/issues/1118 .. _issue 1160: https://github.com/nedbat/coveragepy/issues/1160 .. _issue 1244: https://github.com/nedbat/coveragepy/issues/1244 .. _pull request 1248: https://github.com/nedbat/coveragepy/pull/1248 .. _issue 1254: https://github.com/nedbat/coveragepy/issues/1254 .. _attrs: https://www.attrs.org/ .. _changes_602: ``` ### 6.0.2 ``` -------------------------- - Namespace packages being measured weren't properly handled by the new code that ignores third-party packages. If the namespace package was installed, it was ignored as a third-party package. That problem (`issue 1231`_) is now fixed. - Packages named as "source packages" (with ``source``, or ``source_pkgs``, or pytest-cov's ``--cov``) might have been only partially measured. Their top-level statements could be marked as unexecuted, because they were imported by coverage.py before measurement began (`issue 1232`_). This is now fixed, but the package will be imported twice, once by coverage.py, then again by your test suite. This could cause problems if importing the package has side effects. - The :meth:`.CoverageData.contexts_by_lineno` method was documented to return a dict, but was returning a defaultdict. Now it returns a plain dict. It also no longer returns negative numbered keys. .. _issue 1231: https://github.com/nedbat/coveragepy/issues/1231 .. _issue 1232: https://github.com/nedbat/coveragepy/issues/1232 .. _changes_601: ``` ### 6.0.1 ``` -------------------------- - In 6.0, the coverage.py exceptions moved from coverage.misc to coverage.exceptions. These exceptions are not part of the public supported API, CoverageException is. But a number of other third-party packages were importing the exceptions from coverage.misc, so they are now available from there again (`issue 1226`_). - Changed an internal detail of how tomli is imported, so that tomli can use coverage.py for their own test suite (`issue 1228`_). - Defend against an obscure possibility under code obfuscation, where a function can have an argument called "self", but no local named "self" (`pull request 1210`_). Thanks, Ben Carlsson. .. _pull request 1210: https://github.com/nedbat/coveragepy/pull/1210 .. _issue 1226: https://github.com/nedbat/coveragepy/issues/1226 .. _issue 1228: https://github.com/nedbat/coveragepy/issues/1228 .. _changes_60: ``` ### 6.0 ``` ------------------------ - The ``coverage html`` command now prints a message indicating where the HTML report was written. Fixes `issue 1195`_. - The ``coverage combine`` command now prints messages indicating each data file being combined. Fixes `issue 1105`_. - The HTML report now includes a sentence about skipped files due to ``skip_covered`` or ``skip_empty`` settings. Fixes `issue 1163`_. - Unrecognized options in the configuration file are no longer errors. They are now warnings, to ease the use of coverage across versions. Fixes `issue 1035`_. - Fix handling of exceptions through context managers in Python 3.10. A missing exception is no longer considered a missing branch from the with statement. Fixes `issue 1205`_. - Fix another rarer instance of "Error binding parameter 0 - probably unsupported type." (`issue 1010`_). - Creating a directory for the coverage data file now is safer against conflicts when two coverage runs happen simultaneously (`pull 1220`_). Thanks, Clément Pit-Claudel. .. _issue 1035: https://github.com/nedbat/coveragepy/issues/1035 .. _issue 1105: https://github.com/nedbat/coveragepy/issues/1105 .. _issue 1163: https://github.com/nedbat/coveragepy/issues/1163 .. _issue 1195: https://github.com/nedbat/coveragepy/issues/1195 .. _issue 1205: https://github.com/nedbat/coveragepy/issues/1205 .. _pull 1220: https://github.com/nedbat/coveragepy/pull/1220 .. _changes_60b1: ``` ### 6.0b1 ``` -------------------------- - Dropped support for Python 2.7, PyPy 2, and Python 3.5. - Added support for the Python 3.10 ``match/case`` syntax. - Data collection is now thread-safe. There may have been rare instances of exceptions raised in multi-threaded programs. - Plugins (like the `Django coverage plugin`_) were generating "Already imported a file that will be measured" warnings about Django itself. These have been fixed, closing `issue 1150`_. - Warnings generated by coverage.py are now real Python warnings. - Using ``--fail-under=100`` with coverage near 100% could result in the self-contradictory message :code:`total of 100 is less than fail-under=100`. This bug (`issue 1168`_) is now fixed. - The ``COVERAGE_DEBUG_FILE`` environment variable now accepts ``stdout`` and ``stderr`` to write to those destinations. - TOML parsing now uses the `tomli`_ library. - Some minor changes to usually invisible details of the HTML report: - Use a modern hash algorithm when fingerprinting, for high-security environments (`issue 1189`_). When generating the HTML report, we save the hash of the data, to avoid regenerating an unchanged HTML page. We used to use MD5 to generate the hash, and now use SHA-3-256. This was never a security concern, but security scanners would notice the MD5 algorithm and raise a false alarm. - Change how report file names are generated, to avoid leading underscores (`issue 1167`_), to avoid rare file name collisions (`issue 584`_), and to avoid file names becoming too long (`issue 580`_). .. _Django coverage plugin: https://pypi.org/project/django-coverage-plugin/ .. _issue 580: https://github.com/nedbat/coveragepy/issues/580 .. _issue 584: https://github.com/nedbat/coveragepy/issues/584 .. _issue 1150: https://github.com/nedbat/coveragepy/issues/1150 .. _issue 1167: https://github.com/nedbat/coveragepy/issues/1167 .. _issue 1168: https://github.com/nedbat/coveragepy/issues/1168 .. _issue 1189: https://github.com/nedbat/coveragepy/issues/1189 .. _tomli: https://pypi.org/project/tomli/ .. _changes_56b1: ``` ### 5.6b1 ``` -------------------------- Note: 5.6 final was never released. These changes are part of 6.0. - Third-party packages are now ignored in coverage reporting. This solves a few problems: - Coverage will no longer report about other people's code (`issue 876`_). This is true even when using ``--source=.`` with a venv in the current directory. - Coverage will no longer generate "Already imported a file that will be measured" warnings about coverage itself (`issue 905`_). - The HTML report uses j/k to move up and down among the highlighted chunks of code. They used to highlight the current chunk, but 5.0 broke that behavior. Now the highlighting is working again. - The JSON report now includes ``percent_covered_display``, a string with the total percentage, rounded to the same number of decimal places as the other reports' totals. .. _issue 876: https://github.com/nedbat/coveragepy/issues/876 .. _issue 905: https://github.com/nedbat/coveragepy/issues/905 .. _changes_55: ```

Links

- PyPI: https://pypi.org/project/coverage - Changelog: https://pyup.io/changelogs/coverage/ - Repo: https://github.com/nedbat/coveragepy

Update coveralls from 3.2.0 to 3.3.1.

Changelog

### 3.3.1 ``` Bug Fixes * correctly support parallel execution on CircleCI (336) ([2610885a](2610885a)) Internal * exclude a few incompatible `coverage` versions (337) `coverage` versions v6.0.0 through v6.1.1 exhibited some incompatibilies with `coveralls`; we've updated our version compatibility ranges to exclude those versions. <a name="3.3.0"></a> ``` ### 3.3.0 ``` Features * **cli:** add --srcdir option (306) ([4120c540](4120c540)) * **deps:** add support for coverage v6.x (330) ([372443dc](372443dc), closes [326](326)) Note this implicitly improves support for Python 3.10, as coverage v6.x includes some fixes for v3.10 of Python. Bug Fixes * **env:** fixup handling of default env service values (314) ([1a0fd9b3](1a0fd9b3), closes [303](303)) This solves some edge cases around duplicated / unmerged coverage results in parallel runs. <a name="3.2.0"></a> ```

Links

- PyPI: https://pypi.org/project/coveralls - Changelog: https://pyup.io/changelogs/coveralls/ - Repo: http://github.com/TheKevJames/coveralls-python

hasgeek / hasmail