Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump the deps group with 2 updates #384

Merged
merged 1 commit into from
Mar 18, 2024
Merged

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 18, 2024

Bumps the deps group with 2 updates: black and ruff.

Updates black from 24.2.0 to 24.3.0

Release notes

Sourced from black's releases.

24.3.0

Highlights

This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.

This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

Stable style

  • Don't move comments along with delimiters, which could cause crashes (#4248)
  • Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)
  • Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)

Performance

  • Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)

Documentation

  • Note what happens when --check is used with --quiet (#4236)
Changelog

Sourced from black's changelog.

24.3.0

Highlights

This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.

This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.

Stable style

  • Don't move comments along with delimiters, which could cause crashes (#4248)
  • Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)
  • Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)

Performance

  • Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)

Documentation

  • Note what happens when --check is used with --quiet (#4236)
Commits

Updates ruff from 0.3.2 to 0.3.3

Release notes

Sourced from ruff's releases.

v0.3.3

Changes

Preview features

  • [flake8-bandit]: Implement S610 rule (#10316)
  • [pycodestyle] Implement blank-line-at-end-of-file (W391) (#10243)
  • [pycodestyle] Implement redundant-backslash (E502) (#10292)
  • [pylint] - implement redeclared-assigned-name (W0128) (#9268)

Rule changes

  • [flake8_comprehensions] Handled special case for C400 which also matches C416 (#10419)
  • [flake8-bandit] Implement upstream updates for S311, S324 and S605 (#10313)
  • [pyflakes] Remove F401 fix for __init__ imports by default and allow opt-in to unsafe fix (#10365)
  • [pylint] Implement invalid-bool-return-type (E304) (#10377)
  • [pylint] Include builtin warnings in useless-exception-statement (PLW0133) (#10394)

CLI

  • Add message on success to ruff check (#8631)

Bug fixes

  • [PIE970] Allow trailing ellipsis in typing.TYPE_CHECKING (#10413)
  • Avoid TRIO115 if the argument is a variable (#10376)
  • [F811] Avoid removing shadowed imports that point to different symbols (#10387)
  • Fix F821 and F822 false positives in .pyi files (#10341)
  • Fix F821 false negatives in .py files when from __future__ import annotations is active (#10362)
  • Fix case where Indexer fails to identify continuation preceded by newline #10351 (#10354)
  • Sort hash maps in Settings display (#10370)
  • Track conditional deletions in the semantic model (#10415)
  • [C413] Wrap expressions in parentheses when negating (#10346)
  • [pycodestyle] Do not ignore lines before the first logical line in blank lines rules. (#10382)
  • [pycodestyle] Do not trigger E225 and E275 when the next token is a ')' (#10315)
  • [pylint] Avoid false-positive slot non-assignment for __dict__ (PLE0237) (#10348)
  • Gate f-string struct size test for Rustc < 1.76 (#10371)

Documentation

  • Use ruff.toml format in README (#10393)
  • [RUF008] Make it clearer that a mutable default in a dataclass is only valid if it is typed as a ClassVar (#10395)
  • [pylint] Extend docs and test in invalid-str-return-type (E307) (#10400)
  • Remove . from check and format commands (#10217)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.3.3

Preview features

  • [flake8-bandit]: Implement S610 rule (#10316)
  • [pycodestyle] Implement blank-line-at-end-of-file (W391) (#10243)
  • [pycodestyle] Implement redundant-backslash (E502) (#10292)
  • [pylint] - implement redeclared-assigned-name (W0128) (#9268)

Rule changes

  • [flake8_comprehensions] Handled special case for C400 which also matches C416 (#10419)
  • [flake8-bandit] Implement upstream updates for S311, S324 and S605 (#10313)
  • [pyflakes] Remove F401 fix for __init__ imports by default and allow opt-in to unsafe fix (#10365)
  • [pylint] Implement invalid-bool-return-type (E304) (#10377)
  • [pylint] Include builtin warnings in useless-exception-statement (PLW0133) (#10394)

CLI

  • Add message on success to ruff check (#8631)

Bug fixes

  • [PIE970] Allow trailing ellipsis in typing.TYPE_CHECKING (#10413)
  • Avoid TRIO115 if the argument is a variable (#10376)
  • [F811] Avoid removing shadowed imports that point to different symbols (#10387)
  • Fix F821 and F822 false positives in .pyi files (#10341)
  • Fix F821 false negatives in .py files when from __future__ import annotations is active (#10362)
  • Fix case where Indexer fails to identify continuation preceded by newline #10351 (#10354)
  • Sort hash maps in Settings display (#10370)
  • Track conditional deletions in the semantic model (#10415)
  • [C413] Wrap expressions in parentheses when negating (#10346)
  • [pycodestyle] Do not ignore lines before the first logical line in blank lines rules. (#10382)
  • [pycodestyle] Do not trigger E225 and E275 when the next token is a ')' (#10315)
  • [pylint] Avoid false-positive slot non-assignment for __dict__ (PLE0237) (#10348)
  • Gate f-string struct size test for Rustc < 1.76 (#10371)

Documentation

  • Use ruff.toml format in README (#10393)
  • [RUF008] Make it clearer that a mutable default in a dataclass is only valid if it is typed as a ClassVar (#10395)
  • [pylint] Extend docs and test in invalid-str-return-type (E307) (#10400)
  • Remove . from check and format commands (#10217)
Commits
  • 608df9a Bump version to 0.3.3 (#10425)
  • 740c08b [pylint] - implement redeclared-assigned-name (W0128) (#9268)
  • 7e652e8 [flake8_comprehensions] Handled special case for C400 which also matches ...
  • 9675e18 Allow trailing ellipsis in typing.TYPE_CHECKING (#10413)
  • 10ace88 Track conditional deletions in the semantic model (#10415)
  • a8e50a7 [RUF008] Make it clearer that a mutable default in a dataclass is only valid ...
  • e944c16 [pycodestyle] Do not ignore lines before the first logical line in blank li...
  • 5f40371 Use ExprFString for StringLike::FString variant (#10311)
  • f7802ad [pylint] Extend docs and test in invalid-str-return-type (E307) (#10400)
  • e832327 Require --preview for ruff server (#10368)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the deps group with 2 updates: [black](https://github.com/psf/black) and [ruff](https://github.com/astral-sh/ruff).


Updates `black` from 24.2.0 to 24.3.0
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@24.2.0...24.3.0)

Updates `ruff` from 0.3.2 to 0.3.3
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@v0.3.2...v0.3.3)

---
updated-dependencies:
- dependency-name: black
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: deps
- dependency-name: ruff
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Mar 18, 2024
@brndnmtthws brndnmtthws merged commit 50691c4 into main Mar 18, 2024
8 checks passed
@brndnmtthws brndnmtthws deleted the dependabot/pip/deps-6b4b039dd0 branch March 18, 2024 17:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant