From bcab504a13daabe2bec6e71d3d2b04572601f463 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 18 Mar 2024 09:10:42 +0900 Subject: [PATCH 1/3] Bump github/codeql-action from 3.24.6 to 3.24.7 (#1340) Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.24.6 to 3.24.7.
Changelog

Sourced from github/codeql-action's changelog.

CodeQL Action Changelog

See the releases page for the relevant changes to the CodeQL CLI and language packs.

Note that the only difference between v2 and v3 of the CodeQL Action is the node version they support, with v3 running on node 20 while we continue to release v2 to support running on node 16. For example 3.22.11 was the first v3 release and is functionally identical to 2.22.11. This approach ensures an easy way to track exactly which features are included in different versions, indicated by the minor and patch version numbers.

[UNRELEASED]

No user facing changes.

3.24.7 - 12 Mar 2024

3.24.6 - 29 Feb 2024

No user facing changes.

3.24.5 - 23 Feb 2024

3.24.4 - 21 Feb 2024

3.24.3 - 15 Feb 2024

3.24.2 - 15 Feb 2024

3.24.1 - 13 Feb 2024

3.24.0 - 02 Feb 2024

3.23.2 - 26 Jan 2024

3.23.1 - 17 Jan 2024

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github/codeql-action&package-manager=github_actions&previous-version=3.24.6&new-version=3.24.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/codeql.yml | 4 ++-- .github/workflows/scorecard.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 39688270e9..f0cc6e27f5 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -52,7 +52,7 @@ jobs: # Initializes the CodeQL tools for scanning. - name: Initialize CodeQL - uses: github/codeql-action/init@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6 + uses: github/codeql-action/init@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7 with: languages: ${{ matrix.language }} # If you wish to specify custom queries, you can do so here or in a config file. @@ -73,6 +73,6 @@ jobs: python -m build - name: Perform CodeQL Analysis - uses: github/codeql-action/analyze@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6 + uses: github/codeql-action/analyze@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7 with: category: "/language:${{matrix.language}}" diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index c7b52a16cb..2040fcc86f 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -67,6 +67,6 @@ jobs: # Upload the results to GitHub's code scanning dashboard. - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@8a470fddafa5cbb6266ee11b37ef4d8aae19c571 # v3.24.6 + uses: github/codeql-action/upload-sarif@3ab4101902695724f9365a384f86c1074d94e18c # v3.24.7 with: sarif_file: results.sarif From 7a5eb2d02eefdc27ebbf872f1eee74a7a24b36f3 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 18 Mar 2024 09:10:52 +0900 Subject: [PATCH 2/3] Bump black from 24.2.0 to 24.3.0 in /tests (#1349) Bumps [black](https://github.com/psf/black) from 24.2.0 to 24.3.0.
Release notes

Sourced from black's releases.

24.3.0

Highlights

This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.

This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

Stable style

  • Don't move comments along with delimiters, which could cause crashes (#4248)
  • Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)
  • Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)

Performance

  • Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)

Documentation

  • Note what happens when --check is used with --quiet (#4236)
Changelog

Sourced from black's changelog.

24.3.0

Highlights

This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.

This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

Stable style

  • Don't move comments along with delimiters, which could cause crashes (#4248)
  • Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)
  • Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)

Performance

  • Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)

Documentation

  • Note what happens when --check is used with --quiet (#4236)
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=black&package-manager=pip&previous-version=24.2.0&new-version=24.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- tests/requirements-linters.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/requirements-linters.txt b/tests/requirements-linters.txt index 1a5217cf0d..921b21ce4d 100644 --- a/tests/requirements-linters.txt +++ b/tests/requirements-linters.txt @@ -1,6 +1,6 @@ # linters bandit>=1.7.0 isort==5.13.2 -black==24.2.0 +black==24.3.0 nbqa[toolchain]==1.8.4 ruff==0.3.2 From f9366173a0a5ba6fe479703800a2f3a0caf15530 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 18 Mar 2024 09:11:32 +0900 Subject: [PATCH 3/3] Bump ruff from 0.3.2 to 0.3.3 in /tests (#1348) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit [//]: # (dependabot-start) ⚠️ **Dependabot is rebasing this PR** ⚠️ Rebasing might not happen immediately, so don't worry if this takes some time. Note: if you make any changes to this PR yourself, they will take precedence over the rebase. --- [//]: # (dependabot-end) Bumps [ruff](https://github.com/astral-sh/ruff) from 0.3.2 to 0.3.3.
Release notes

Sourced from ruff's releases.

v0.3.3

Changes

Preview features

  • [flake8-bandit]: Implement S610 rule (#10316)
  • [pycodestyle] Implement blank-line-at-end-of-file (W391) (#10243)
  • [pycodestyle] Implement redundant-backslash (E502) (#10292)
  • [pylint] - implement redeclared-assigned-name (W0128) (#9268)

Rule changes

  • [flake8_comprehensions] Handled special case for C400 which also matches C416 (#10419)
  • [flake8-bandit] Implement upstream updates for S311, S324 and S605 (#10313)
  • [pyflakes] Remove F401 fix for __init__ imports by default and allow opt-in to unsafe fix (#10365)
  • [pylint] Implement invalid-bool-return-type (E304) (#10377)
  • [pylint] Include builtin warnings in useless-exception-statement (PLW0133) (#10394)

CLI

  • Add message on success to ruff check (#8631)

Bug fixes

  • [PIE970] Allow trailing ellipsis in typing.TYPE_CHECKING (#10413)
  • Avoid TRIO115 if the argument is a variable (#10376)
  • [F811] Avoid removing shadowed imports that point to different symbols (#10387)
  • Fix F821 and F822 false positives in .pyi files (#10341)
  • Fix F821 false negatives in .py files when from __future__ import annotations is active (#10362)
  • Fix case where Indexer fails to identify continuation preceded by newline #10351 (#10354)
  • Sort hash maps in Settings display (#10370)
  • Track conditional deletions in the semantic model (#10415)
  • [C413] Wrap expressions in parentheses when negating (#10346)
  • [pycodestyle] Do not ignore lines before the first logical line in blank lines rules. (#10382)
  • [pycodestyle] Do not trigger E225 and E275 when the next token is a ')' (#10315)
  • [pylint] Avoid false-positive slot non-assignment for __dict__ (PLE0237) (#10348)
  • Gate f-string struct size test for Rustc < 1.76 (#10371)

Documentation

  • Use ruff.toml format in README (#10393)
  • [RUF008] Make it clearer that a mutable default in a dataclass is only valid if it is typed as a ClassVar (#10395)
  • [pylint] Extend docs and test in invalid-str-return-type (E307) (#10400)
  • Remove . from check and format commands (#10217)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.3.3

Preview features

  • [flake8-bandit]: Implement S610 rule (#10316)
  • [pycodestyle] Implement blank-line-at-end-of-file (W391) (#10243)
  • [pycodestyle] Implement redundant-backslash (E502) (#10292)
  • [pylint] - implement redeclared-assigned-name (W0128) (#9268)

Rule changes

  • [flake8_comprehensions] Handled special case for C400 which also matches C416 (#10419)
  • [flake8-bandit] Implement upstream updates for S311, S324 and S605 (#10313)
  • [pyflakes] Remove F401 fix for __init__ imports by default and allow opt-in to unsafe fix (#10365)
  • [pylint] Implement invalid-bool-return-type (E304) (#10377)
  • [pylint] Include builtin warnings in useless-exception-statement (PLW0133) (#10394)

CLI

  • Add message on success to ruff check (#8631)

Bug fixes

  • [PIE970] Allow trailing ellipsis in typing.TYPE_CHECKING (#10413)
  • Avoid TRIO115 if the argument is a variable (#10376)
  • [F811] Avoid removing shadowed imports that point to different symbols (#10387)
  • Fix F821 and F822 false positives in .pyi files (#10341)
  • Fix F821 false negatives in .py files when from __future__ import annotations is active (#10362)
  • Fix case where Indexer fails to identify continuation preceded by newline #10351 (#10354)
  • Sort hash maps in Settings display (#10370)
  • Track conditional deletions in the semantic model (#10415)
  • [C413] Wrap expressions in parentheses when negating (#10346)
  • [pycodestyle] Do not ignore lines before the first logical line in blank lines rules. (#10382)
  • [pycodestyle] Do not trigger E225 and E275 when the next token is a ')' (#10315)
  • [pylint] Avoid false-positive slot non-assignment for __dict__ (PLE0237) (#10348)
  • Gate f-string struct size test for Rustc < 1.76 (#10371)

Documentation

  • Use ruff.toml format in README (#10393)
  • [RUF008] Make it clearer that a mutable default in a dataclass is only valid if it is typed as a ClassVar (#10395)
  • [pylint] Extend docs and test in invalid-str-return-type (E307) (#10400)
  • Remove . from check and format commands (#10217)
Commits
  • 608df9a Bump version to 0.3.3 (#10425)
  • 740c08b [pylint] - implement redeclared-assigned-name (W0128) (#9268)
  • 7e652e8 [flake8_comprehensions] Handled special case for C400 which also matches ...
  • 9675e18 Allow trailing ellipsis in typing.TYPE_CHECKING (#10413)
  • 10ace88 Track conditional deletions in the semantic model (#10415)
  • a8e50a7 [RUF008] Make it clearer that a mutable default in a dataclass is only valid ...
  • e944c16 [pycodestyle] Do not ignore lines before the first logical line in blank li...
  • 5f40371 Use ExprFString for StringLike::FString variant (#10311)
  • f7802ad [pylint] Extend docs and test in invalid-str-return-type (E307) (#10400)
  • e832327 Require --preview for ruff server (#10368)
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ruff&package-manager=pip&previous-version=0.3.2&new-version=0.3.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- tests/requirements-linters.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/requirements-linters.txt b/tests/requirements-linters.txt index 921b21ce4d..6c5a756ba9 100644 --- a/tests/requirements-linters.txt +++ b/tests/requirements-linters.txt @@ -3,4 +3,4 @@ bandit>=1.7.0 isort==5.13.2 black==24.3.0 nbqa[toolchain]==1.8.4 -ruff==0.3.2 +ruff==0.3.3