Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Deps: Bump the python-packages group across 1 directory with 3 updates #1209

Merged
merged 1 commit into from
Mar 10, 2025

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 10, 2025

Bumps the python-packages group with 3 updates in the / directory: autohooks-plugin-ruff, pontos and ruff.

Updates autohooks-plugin-ruff from 25.2.0 to 25.3.0

Commits

Updates pontos from 25.1.0 to 25.3.2

Release notes

Sourced from pontos's releases.

pontos 25.3.2

25.3.2 - 2025-03-07

Changed

  • adding wildcard support to CPE Part; unrequire product, vendor (#1099) 2926d37

pontos 25.3.1

25.3.1 - 2025-03-06

Added

Changed

Dependencies

  • Bump jinja2 from 3.1.5 to 3.1.6 25a2369

pontos 25.3.0

[25.3.0] - 2025-03-03

Added

  • Allow to load changelog from file when creating a release ec97640
  • Allow to set a last release version 060e507
  • Add --last-release-version argument to release create CLI 5d64c6c

Changed

  • Determine git signing key when necessary only 794a235
  • Improve getting last release version for CreateReleaseCommand 357d65f
  • Improve using the project name in CreateReleaseCommand a19718b
  • Allow to pass a git instance to CreateReleaseCommand 2df6ec9
  • Allow to pass git instance for release helper functions 8de5601
  • Don't require terminals for release Commands 9e18386
  • Use sane defaults for CreateReleaseCommand async_run method bb511f5
  • Always use the same git tag prefix ca6dad2
  • Reuse matches in CPE match strings API fa75049

Dependencies

... (truncated)

Commits
  • 859e154 Automatic release to 25.3.2
  • 2926d37 Change: adding wildcard support to CPE Part; unrequire product, vendor (#1099)
  • 9b5f3e4 Automatic adjustments after release [skip ci]
  • 35fb52b Automatic release to 25.3.1
  • 6dee935 Add: Another unit test
  • 1f718d8 Change: Fix docstrings / variable names
  • 4b8a3e5 Change: Fix missing aenter method
  • d924ac8 Change: Add token to CLI interface
  • 336b2aa Add: Unit tests for SourceApi
  • 5834b86 Change: Fix typo
  • Additional commits viewable in compare view

Updates ruff from 0.9.9 to 0.9.10

Release notes

Sourced from ruff's releases.

0.9.10

Release Notes

Preview features

  • [ruff] Add new rule RUF059: Unused unpacked assignment (#16449)
  • [syntax-errors] Detect assignment expressions before Python 3.8 (#16383)
  • [syntax-errors] Named expressions in decorators before Python 3.9 (#16386)
  • [syntax-errors] Parenthesized keyword argument names after Python 3.8 (#16482)
  • [syntax-errors] Positional-only parameters before Python 3.8 (#16481)
  • [syntax-errors] Tuple unpacking in return and yield before Python 3.8 (#16485)
  • [syntax-errors] Type parameter defaults before Python 3.13 (#16447)
  • [syntax-errors] Type parameter lists before Python 3.12 (#16479)
  • [syntax-errors] except* before Python 3.11 (#16446)
  • [syntax-errors] type statements before Python 3.12 (#16478)

Bug fixes

  • Escape template filenames in glob patterns in configuration (#16407)
  • [flake8-simplify] Exempt unittest context methods for SIM115 rule (#16439)
  • Formatter: Fix syntax error location in notebooks (#16499)
  • [pyupgrade] Do not offer fix when at least one target is global/nonlocal (UP028) (#16451)
  • [flake8-builtins] Ignore variables matching module attribute names (A001) (#16454)
  • [pylint] Convert code keyword argument to a positional argument in fix for (PLR1722) (#16424)

CLI

  • Move rule code from description to check_name in GitLab output serializer (#16437)

Documentation

  • [pydocstyle] Clarify that D417 only checks docstrings with an arguments section (#16494)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.9.10

Preview features

  • [ruff] Add new rule RUF059: Unused unpacked assignment (#16449)
  • [syntax-errors] Detect assignment expressions before Python 3.8 (#16383)
  • [syntax-errors] Named expressions in decorators before Python 3.9 (#16386)
  • [syntax-errors] Parenthesized keyword argument names after Python 3.8 (#16482)
  • [syntax-errors] Positional-only parameters before Python 3.8 (#16481)
  • [syntax-errors] Tuple unpacking in return and yield before Python 3.8 (#16485)
  • [syntax-errors] Type parameter defaults before Python 3.13 (#16447)
  • [syntax-errors] Type parameter lists before Python 3.12 (#16479)
  • [syntax-errors] except* before Python 3.11 (#16446)
  • [syntax-errors] type statements before Python 3.12 (#16478)

Bug fixes

  • Escape template filenames in glob patterns in configuration (#16407)
  • [flake8-simplify] Exempt unittest context methods for SIM115 rule (#16439)
  • Formatter: Fix syntax error location in notebooks (#16499)
  • [pyupgrade] Do not offer fix when at least one target is global/nonlocal (UP028) (#16451)
  • [flake8-builtins] Ignore variables matching module attribute names (A001) (#16454)
  • [pylint] Convert code keyword argument to a positional argument in fix for (PLR1722) (#16424)

CLI

  • Move rule code from description to check_name in GitLab output serializer (#16437)

Documentation

  • [pydocstyle] Clarify that D417 only checks docstrings with an arguments section (#16494)
Commits
  • 0dfa810 Bump 0.9.10 (#16556)
  • 9cd0cde Assert that formatted code doesn't introduce any new unsupported syntax error...
  • 05a4c29 print MDTEST_TEST_FILTER value in single-quotes (and escaped) (#16548)
  • b3c884f [syntax-errors] Parenthesized keyword argument names after Python 3.8 (#16482)
  • 6c14225 [syntax-errors] Tuple unpacking in return and yield before Python 3.8 (#1...
  • 0a627ef [red-knot] Never is callable and iterable. Arbitrary attributes can be access...
  • a25be46 Clarify that D417 only checks docstrings with an arguments section (#16494)
  • ce0018c Add OsSystem support to mdtests (#16518)
  • 48f906e Add tests for case-sensitive module resolution (#16517)
  • ebd172e [red-knot] Several failing tests for generics (#16509)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot bot requested a review from a team as a code owner March 10, 2025 08:18
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Mar 10, 2025
Copy link

github-actions bot commented Mar 10, 2025

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ❌ 1 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ✅ 0 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA d98e3e9.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

poetry.lock

PackageVersionLicenseIssue Type
ruff0.9.100BSD AND Apache-2.0 AND BSD-3-Clause AND MITIncompatible License
Allowed Licenses: 0BSD, AGPL-3.0-or-later, Apache-2.0, BlueOak-1.0.0, BSD-2-Clause, BSD-3-Clause-Clear, BSD-3-Clause, BSL-1.0, CAL-1.0, CC-BY-3.0, CC-BY-4.0, CC-BY-SA-4.0, CC0-1.0, EPL-2.0, GPL-2.0-only, GPL-2.0-or-later, GPL-2.0, GPL-3.0-or-later, ISC, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-2.1, LGPL-3.0-only, LGPL-3.0, LGPL-3.0-or-later, MIT, MIT-CMU, MPL-1.1, MPL-2.0, OFL-1.1, PSF-2.0, Python-2.0, Python-2.0.1, Unicode-DFS-2016, Unlicense, Zlib, ZPL-2.1

OpenSSF Scorecard

PackageVersionScoreDetails
pip/autohooks-plugin-ruff 25.3.0 UnknownUnknown
pip/pontos 25.3.2 🟢 7.4
Details
CheckScoreReason
Code-Review🟢 3Found 3/9 approved changesets -- score normalized to 3
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Binary-Artifacts🟢 10no binaries found in the repo
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 3dependency not pinned by hash detected -- score normalized to 3
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Packaging🟢 10packaging workflow detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
SAST🟢 10SAST tool is run on all commits
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
Security-Policy🟢 10security policy file detected
CI-Tests🟢 105 out of 5 merged PRs checked by a CI test -- score normalized to 10
Contributors🟢 6project has 2 contributing companies or organizations -- score normalized to 6
pip/ruff 0.9.10 UnknownUnknown

Scanned Files

  • poetry.lock

@greenbonebot greenbonebot enabled auto-merge (rebase) March 10, 2025 08:18
Copy link

Conventional Commits Report

Type Number
Dependencies 1

🚀 Conventional commits found.

Bumps the python-packages group with 3 updates in the / directory: [autohooks-plugin-ruff](https://github.com/greeenbone/autohooks-plugin-ruff), [pontos](https://github.com/greenbone/pontos) and [ruff](https://github.com/astral-sh/ruff).


Updates `autohooks-plugin-ruff` from 25.2.0 to 25.3.0
- [Commits](https://github.com/greeenbone/autohooks-plugin-ruff/commits)

Updates `pontos` from 25.1.0 to 25.3.2
- [Release notes](https://github.com/greenbone/pontos/releases)
- [Commits](greenbone/pontos@v25.1.0...v25.3.2)

Updates `ruff` from 0.9.9 to 0.9.10
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.9.9...0.9.10)

---
updated-dependencies:
- dependency-name: autohooks-plugin-ruff
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: pontos
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: ruff
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-packages
...

Signed-off-by: dependabot[bot] <support@github.com>
@y0urself y0urself force-pushed the dependabot/pip/python-packages-0170112062 branch from 7330e5d to d98e3e9 Compare March 10, 2025 08:26
@y0urself y0urself requested a review from a team as a code owner March 10, 2025 08:26
@greenbonebot greenbonebot merged commit 4b6f42e into main Mar 10, 2025
20 of 21 checks passed
@greenbonebot greenbonebot deleted the dependabot/pip/python-packages-0170112062 branch March 10, 2025 08:27
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants