Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump the python group in /tests with 4 updates #5324

Merged
merged 5 commits into from
Apr 8, 2024

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Apr 1, 2024

Bumps the python group in /tests with 4 updates: protobuf, pyasn1, pyasn1-modules and pycparser.

Updates protobuf from 5.26.0 to 5.26.1

Commits
  • 2434ef2 Updating version.json and repo version numbers to: 26.1
  • 49253b1 Merge pull request #16308 from protocolbuffers/cp-26x-3
  • 9bf69ec Fix validateFeatures to be called after resolved features are actually set to...
  • b752bc2 Merge pull request #16307 from protocolbuffers/cp-26x-2
  • f7d2326 Merge pull request #16309 from protocolbuffers/cp-26x-4
  • 2e51ff6 Cherry-pick required label handling in JRuby field descriptor from https://gi...
  • a2f5303 Update cmake stalenes
  • 6a177d2 Merge branch '26.x' into cp-26x-4
  • 2d3d8ba Expand cpp_features_proto_srcs visibility
  • e1092ee Merge pull request #16294 from protocolbuffers/cp-26x
  • Additional commits viewable in compare view

Updates pyasn1 from 0.5.1 to 0.6.0

Release notes

Sourced from pyasn1's releases.

Release 0.6.0

It's a major release where we drop Python 2 support entirely. The most significant changes are:

  • Removed support for EOL Python 2.7, 3.6, 3.7
  • Added support for previously missing RELATIVE-OID construct
  • Updated link to Layman's Guide

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.0, released 26-03-2024

  • Added support for previously missing RELATIVE-OID construct [pr #48](pyasn1/pyasn1#48)
  • Updated link to Layman's Guide Now it provides a link to links to a formatted PDF version of the paper, at a stable domain (researchgate), using https [pr #50](pyasn1/pyasn1#50)
  • Removed support for EOL Python 2.7, 3.6, 3.7 [pr #56](pyasn1/pyasn1#56)
Commits

Updates pyasn1-modules from 0.3.0 to 0.4.0

Release notes

Sourced from pyasn1-modules's releases.

Release 0.4.0

It's a major release where we drop Python 2 support entirely. The most significant changes are:

  • Added support for Python 3.11, 3.12
  • Removed support for EOL Pythons 2.7, 3.6, 3.7

A full list of changes can be seen in the CHANGELOG.

Changelog

Sourced from pyasn1-modules's changelog.

Revision 0.4.0, released 26-03-2024

  • Added support for Python 3.11, 3.12
  • Removed support for EOL Pythons 2.7, 3.6, 3.7
Commits

Updates pycparser from 2.21 to 2.22

Release notes

Sourced from pycparser's releases.

release_v2.22

What's Changed

New Contributors

Full Changelog: eliben/pycparser@release_v2.21...release_v2.22

Changelog

Sourced from pycparser's changelog.

Commits
  • 129d32e Prepare for release 2.22
  • c3e2644 update CHANGES file for future changes
  • c500fb6 ply: Make generated lextab.py deterministic (#531)
  • f740995 Add support for Python 3.12 (#515)
  • 6cf69df New example to generate AST from scratch (#507)
  • 50a26ac Remove unneeded import in an example
  • d86a9e5 Remove from future imports from all files in this repo
  • a9f073e Remove from future imports in examples
  • 670979b Update SECURITY.md
  • 9e8cd29 Create a Security Policy (#499)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python group in /tests with 4 updates: [protobuf](https://github.com/protocolbuffers/protobuf), [pyasn1](https://github.com/pyasn1/pyasn1), [pyasn1-modules](https://github.com/pyasn1/pyasn1-modules) and [pycparser](https://github.com/eliben/pycparser).


Updates `protobuf` from 5.26.0 to 5.26.1
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Changelog](https://github.com/protocolbuffers/protobuf/blob/main/protobuf_release.bzl)
- [Commits](protocolbuffers/protobuf@v5.26.0...v5.26.1)

Updates `pyasn1` from 0.5.1 to 0.6.0
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.5.1...v0.6.0)

Updates `pyasn1-modules` from 0.3.0 to 0.4.0
- [Release notes](https://github.com/pyasn1/pyasn1-modules/releases)
- [Changelog](https://github.com/pyasn1/pyasn1-modules/blob/main/CHANGES.txt)
- [Commits](pyasn1/pyasn1-modules@v0.3.0...v0.4.0)

Updates `pycparser` from 2.21 to 2.22
- [Release notes](https://github.com/eliben/pycparser/releases)
- [Changelog](https://github.com/eliben/pycparser/blob/main/CHANGES)
- [Commits](eliben/pycparser@release_v2.21...release_v2.22)

---
updated-dependencies:
- dependency-name: protobuf
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: pyasn1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pyasn1-modules
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: pycparser
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot requested a review from a team as a code owner April 1, 2024 17:09
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Apr 1, 2024
Copy link

github-actions bot commented Apr 1, 2024

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ❌ 1 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

License Issues

tests/requirements.txt

PackageVersionLicenseIssue Type
pycparser2.22BSD-2-Clause AND BSD-3-ClauseIncompatible License
protobuf5.26.1NullUnknown License
Allowed Licenses: Apache-1.1, Apache-2.0, BSD-2-Clause, BSD-3-Clause, BSL-1.0, ISC, MIT, NCSA, OpenSSL, Python-2.0, X11
Excluded from license check: pkg:githubactions/fossas/fossa-action, pkg:golang/github.com/shoenig/go-m1cpu, pkg:pypi/pytest-metadata

OpenSSF Scorecard

PackageVersionScoreDetails
pip/protobuf 5.26.1 🟢 6.3
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 1015 out of 15 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 3found 20 unreviewed changesets out of 30 -- score normalized to 3
Contributors🟢 1011 different organizations found -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing🟢 10project is fuzzed
License🟢 9license file detected
Maintained🟢 1030 commit(s) out of 30 and 7 issue activity out of 30 found in the last 90 days -- score normalized to 10
Packaging⚠️ -1no published package detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ 00 out of 5 artifacts are signed or have provenance
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Vulnerabilities🟢 82 existing vulnerabilities detected
pip/pyasn1 0.6.0 🟢 5.4
Details
CheckScoreReason
Code-Review🟢 3found 18 unreviewed changesets out of 28 -- score normalized to 3
Maintained🟢 34 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/pyasn1-modules 0.4.0 UnknownUnknown
pip/pycparser 2.22 🟢 6.3
Details
CheckScoreReason
Maintained🟢 40 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 4
Code-Review🟢 4found 18 unreviewed changesets out of 30 -- score normalized to 4
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/protobuf 5.26.0 🟢 6.3
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
CI-Tests🟢 1015 out of 15 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 3found 20 unreviewed changesets out of 30 -- score normalized to 3
Contributors🟢 1011 different organizations found -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing🟢 10project is fuzzed
License🟢 9license file detected
Maintained🟢 1030 commit(s) out of 30 and 7 issue activity out of 30 found in the last 90 days -- score normalized to 10
Packaging⚠️ -1no published package detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Security-Policy🟢 10security policy file detected
Signed-Releases⚠️ 00 out of 5 artifacts are signed or have provenance
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Vulnerabilities🟢 82 existing vulnerabilities detected
pip/pyasn1 0.5.1 🟢 5.4
Details
CheckScoreReason
Code-Review🟢 3found 18 unreviewed changesets out of 28 -- score normalized to 3
Maintained🟢 34 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
Security-Policy⚠️ 0security policy file not detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/pyasn1-modules 0.3.0 UnknownUnknown
pip/pycparser 2.21 🟢 6.3
Details
CheckScoreReason
Maintained🟢 40 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 4
Code-Review🟢 4found 18 unreviewed changesets out of 30 -- score normalized to 4
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Security-Policy🟢 10security policy file detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing🟢 10project is fuzzed
Vulnerabilities🟢 100 existing vulnerabilities detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0

Scanned Manifest Files

tests/requirements.txt
  • protobuf@5.26.1
  • pyasn1@0.6.0
  • pyasn1-modules@0.4.0
  • pycparser@2.22
  • protobuf@5.26.0
  • pyasn1@0.5.1
  • pyasn1-modules@0.3.0
  • pycparser@2.21

@pdabelf5 pdabelf5 added this pull request to the merge queue Apr 5, 2024
@github-merge-queue github-merge-queue bot removed this pull request from the merge queue due to failed status checks Apr 5, 2024
@pdabelf5 pdabelf5 added this pull request to the merge queue Apr 5, 2024
@pdabelf5 pdabelf5 removed this pull request from the merge queue due to the queue being cleared Apr 5, 2024
@pdabelf5 pdabelf5 enabled auto-merge (squash) April 5, 2024 15:13
@pdabelf5 pdabelf5 disabled auto-merge April 5, 2024 16:07
@pdabelf5 pdabelf5 merged commit f21d50e into main Apr 8, 2024
77 checks passed
@pdabelf5 pdabelf5 deleted the dependabot/pip/tests/python-c1456a23c0 branch April 8, 2024 07:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants