testplan
testplan copied to clipboard
Bump the pip group across 1 directory with 3 updates
Updates the requirements on werkzeug, black and jinja2 to permit the latest version.
Updates werkzeug
to 3.0.1
Release notes
Sourced from werkzeug's releases.
3.0.1
This is a security release for the 3.0.x feature branch.
Changelog
Sourced from werkzeug's changelog.
Version 3.0.1
Released 2023-10-24
- Fix slow multipart parsing for large parts potentially enabling DoS attacks. :cwe:
CWE-407
Version 3.0.0
Released 2023-09-30
- Remove previously deprecated code. :pr:
2768
- Deprecate the
__version__
attribute. Use feature detection, orimportlib.metadata.version("werkzeug")
, instead. :issue:2770
generate_password_hash
uses scrypt by default. :issue:2769
- Add the
"werkzeug.profiler"
item to the WSGIenviron
dictionary passed toProfilerMiddleware
'sfilename_format
function. It contains theelapsed
andtime
values for the profiled request. :issue:2775
- Explicitly marked the PathConverter as non path isolating. :pr:
2784
Version 2.3.8
Released 2023-11-08
- Fix slow multipart parsing for large parts potentially enabling DoS attacks. :cwe:
CWE-407
Version 2.3.7
Released 2023-08-14
- Use
flit_core
instead ofsetuptools
as build backend.- Fix parsing of multipart bodies. :issue:
2734
- Adjust index of last newline in data start. :issue:
2761
- Parsing ints from header values strips spacing first. :issue:
2734
- Fix empty file streaming when testing. :issue:
2740
- Clearer error message when URL rule does not start with slash. :pr:
2750
Accept
q
value can be a float without a decimal part. :issue:2751
Version 2.3.6
Released 2023-06-08
... (truncated)
Commits
ce4eff5
Release version 3.0.1b1916c0
Fix: slow multipart parsing for huge files with few CR/LF characters726eaa2
Release version 3.0.06427542
Default the PathConverter (and descendants) to be non part isolating4820d8c
Provide elapsed and timestamp info to filename_format599993d
Bump pypa/gh-action-pypi-publish from 1.8.8 to 1.8.10 (#2780)a2394ed
Bump slsa-framework/slsa-github-generator from 1.7.0 to 1.9.0 (#2779)1efd6f3
Bump actions/checkout from 3.5.3 to 3.6.0 (#2778)76a5419
Bump pypa/gh-action-pypi-publish from 1.8.8 to 1.8.10ce8cfe7
Bump slsa-framework/slsa-github-generator from 1.7.0 to 1.9.0- Additional commits viewable in compare view
Updates black
to 24.3.0
Release notes
Sourced from black's releases.
24.3.0
Highlights
This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.
This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.
Stable style
- Don't move comments along with delimiters, which could cause crashes (#4248)
- Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)
- Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)
Performance
- Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)
Documentation
- Note what happens when
--check
is used with--quiet
(#4236)
Changelog
Sourced from black's changelog.
24.3.0
Highlights
This release is a milestone: it fixes Black's first CVE security vulnerability. If you run Black on untrusted input, or if you habitually put thousands of leading tab characters in your docstrings, you are strongly encouraged to upgrade immediately to fix CVE-2024-21503.
This release also fixes a bug in Black's AST safety check that allowed Black to make incorrect changes to certain f-strings that are valid in Python 3.12 and higher.
Stable style
- Don't move comments along with delimiters, which could cause crashes (#4248)
- Strengthen AST safety check to catch more unsafe changes to strings. Previous versions of Black would incorrectly format the contents of certain unusual f-strings containing nested strings with the same quote type. Now, Black will crash on such strings until support for the new f-string syntax is implemented. (#4270)
- Fix a bug where line-ranges exceeding the last code line would not work as expected (#4273)
Performance
- Fix catastrophic performance on docstrings that contain large numbers of leading tab characters. This fixes CVE-2024-21503. (#4278)
Documentation
- Note what happens when
--check
is used with--quiet
(#4236)24.2.0
Stable style
- Fixed a bug where comments where mistakenly removed along with redundant parentheses (#4218)
Preview style
- Move the
hug_parens_with_braces_and_square_brackets
feature to the unstable style due to an outstanding crash and proposed formatting tweaks (#4198)- Fixed a bug where base expressions caused inconsistent formatting of ** in tenary expression (#4154)
- Checking for newline before adding one on docstring that is almost at the line limit (#4185)
- Remove redundant parentheses in
case
statementif
guards (#4214).
... (truncated)
Commits
552baf8
Prepare release 24.3.0 (#4279)f000936
Fix catastrophic performance in lines_with_leading_tabs_expanded() (#4278)7b5a657
Fix --line-ranges behavior when ranges are at EOF (#4273)1abcffc
Use regex where we ignore case on windows (#4252)719e674
Fix 4227: Improve documentation for --quiet --check (#4236)e5510af
update plugin url for Thonny (#4259)6af7d11
Fix AST safety check false negative (#4270)f03ee11
Ensureblib2to3.pygram
is initialized before use (#4224)e4bfedb
fix: Don't move comments while splitting delimiters (#4248)d0287e1
Make trailing comma logic more concise (#4202)- Additional commits viewable in compare view
Updates jinja2
to 3.1.3
Release notes
Sourced from jinja2's releases.
3.1.3
This is a fix release for the 3.1.x feature branch.
- Fix for GHSA-h5c8-rqwp-cp95. You are affected if you are using
xmlattr
and passing user input as attribute keys.- Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-3
- Milestone: https://github.com/pallets/jinja/milestone/15?closed=1
Changelog
Sourced from jinja2's changelog.
Version 3.1.3
Released 2024-01-10
- Fix compiler error when checking if required blocks in parent templates are empty. :pr:
1858
xmlattr
filter does not allow keys with spaces. GHSA-h5c8-rqwp-cp95- Make error messages stemming from invalid nesting of
{% trans %}
blocks more helpful. :pr:1918
Version 3.1.2
Released 2022-04-28
- Add parameters to
Environment.overlay
to match__init__
. :issue:1645
- Handle race condition in
FileSystemBytecodeCache
. :issue:1654
Version 3.1.1
Released 2022-03-25
- The template filename on Windows uses the primary path separator. :issue:
1637
Version 3.1.0
Released 2022-03-24
Drop support for Python 3.6. :pr:
1534
Remove previously deprecated code. :pr:
1544
WithExtension
andAutoEscapeExtension
are built-in now.contextfilter
andcontextfunction
are replaced bypass_context
.evalcontextfilter
andevalcontextfunction
are replaced bypass_eval_context
.environmentfilter
andenvironmentfunction
are replaced bypass_environment
.Markup
andescape
should be imported from MarkupSafe.- Compiled templates from very old Jinja versions may need to be recompiled.
- Legacy resolve mode for
Context
subclasses is no longer supported. Overrideresolve_or_missing
instead of
... (truncated)
Commits
d9de4bb
release version 3.1.350124e1
skip test pypi9ea7222
use trusted publishingda703f7
use trusted publishingbce1746
use trusted publishing7277d80
update pre-commit hooks5c8a105
Make nested-trans-block exceptions nicer (#1918)19a55db
Make nested-trans-block exceptions nicer7167953
Merge pull request from GHSA-h5c8-rqwp-cp957dd3680
xmlattr filter disallows keys with spaces- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase
.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
-
@dependabot rebase
will rebase this PR -
@dependabot recreate
will recreate this PR, overwriting any edits that have been made to it -
@dependabot merge
will merge this PR after your CI passes on it -
@dependabot squash and merge
will squash and merge this PR after your CI passes on it -
@dependabot cancel merge
will cancel a previously requested merge and block automerging -
@dependabot reopen
will reopen this PR if it is closed -
@dependabot close
will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually -
@dependabot show <dependency name> ignore conditions
will show all of the ignore conditions of the specified dependency -
@dependabot ignore <dependency name> major version
will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) -
@dependabot ignore <dependency name> minor version
will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) -
@dependabot ignore <dependency name>
will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) -
@dependabot unignore <dependency name>
will remove all of the ignore conditions of the specified dependency -
@dependabot unignore <dependency name> <ignore condition>
will remove the ignore condition of the specified dependency and ignore conditions You can disable automated security fix PRs for this repo from the Security Alerts page.