chore(deps): bump the pip group across 17 directories with 9 updates
Type: Pull Request
State: Closed
Association: Unknown
Comments: 1
(about 2 months ago)
(about 1 month ago)
(about 1 month ago)
dependencies python
Bumps the pip group with 1 update in the /alloydb/notebooks directory: nbconvert.
Bumps the pip group with 1 update in the /cloud-media-livestream/keypublisher directory: werkzeug.
Bumps the pip group with 1 update in the /cloud_scheduler/snippets directory: werkzeug.
Bumps the pip group with 5 updates in the /composer/2022_airflow_summit directory:
| Package | From | To |
|---|---|---|
| pyarrow | 11.0.0 |
14.0.1 |
| werkzeug | 2.2.3 |
3.1.5 |
| cryptography | 40.0.2 |
46.0.5 |
| protobuf | 4.23.4 |
5.29.6 |
| sqlparse | 0.4.4 |
0.5.4 |
Bumps the pip group with 4 updates in the /composer/airflow_1_samples directory: pyarrow, werkzeug, cryptography and protobuf.
Bumps the pip group with 5 updates in the /composer/cicd_sample directory:
| Package | From | To |
|---|---|---|
| pyarrow | 11.0.0 |
14.0.1 |
| werkzeug | 2.2.3 |
3.1.5 |
| cryptography | 40.0.2 |
46.0.5 |
| protobuf | 4.23.4 |
5.29.6 |
| sqlparse | 0.4.4 |
0.5.4 |
Bumps the pip group with 4 updates in the /composer/workflows directory: werkzeug, cryptography, protobuf and sqlparse.
Bumps the pip group with 1 update in the /compute/encryption directory: cryptography.
Bumps the pip group with 2 updates in the /dataflow/flex-templates/pipeline_with_dependencies directory: protobuf and sqlparse.
Bumps the pip group with 2 updates in the /dataflow/gemma directory: protobuf and keras.
Bumps the pip group with 2 updates in the /dataflow/run-inference directory: torch and transformers.
Bumps the pip group with 1 update in the /datastore/cloud-ndb directory: werkzeug.
Bumps the pip group with 1 update in the /dialogflow directory: werkzeug.
Bumps the pip group with 1 update in the /dialogflow-cx directory: werkzeug.
Bumps the pip group with 1 update in the /gemma2 directory: protobuf.
Bumps the pip group with 2 updates in the /iap directory: werkzeug and cryptography.
Bumps the pip group with 1 update in the /media_cdn directory: cryptography.
Updates nbconvert from 7.16.6 to 7.17.0
Release notes
Sourced from nbconvert's releases.
v7.17.0
7.17.0
Enhancements made
- Add support for arbitrary browser arguments #2227 (
@shreve,@Carreau,@krassowski)Bugs fixed
- Fix QtPNGExporter returning empty bytes on macOS #2264 (
@h3pdesign,@Carreau,@QuLogic)- Fix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD) #2261 (
@h3pdesign,@krassowski,@mberlanda,@minrk,@salmankadaya,@th3gowtham)- Fix get_export_names and get_exporter default args #2228 (
@shreve,@krassowski)- PyPA-Compliant Summary #2226 (
@hackowitz-af,@Carreau)Maintenance and upkeep improvements
- avoid cov environment on free-threaded Pythons #2267 (
@minrk)- update pre-commit, and fix all issues. #2238 (
@Carreau)- Drop test on 3.9, test on 3.13, 3.14, 3.14t #2237 (
@Carreau)- Bump the actions group across 1 directory with 2 updates #2231 (
@Carreau,@krassowski)- Replace
@flaky.flakydecorate with pytest marker #2229 (@mgorny,@Carreau)- update to mermaid 11.10.0 #2224 (
@bollwyvl,@krassowski)- Drop support for Python 3.8, fix the CI tests #2221 (
@shreve,@minrk)Documentation improvements
- Use
intersphinx_registry#2232 (@Carreau,@krassowski)Contributors to this release
The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.
(GitHub contributors page for this release)
@bollwyvl(activity) |@Carreau(activity) |@h3pdesign(activity) |@hackowitz-af(activity) |@krassowski(activity) |@mberlanda(activity) |@mgorny(activity) |@minrk(activity) |@MSeal(activity) |@QuLogic(activity) |@salmankadaya(activity) |@shreve(activity) |@th3gowtham(activity)
Changelog
Sourced from nbconvert's changelog.
7.17.0
Enhancements made
- Add support for arbitrary browser arguments #2227 (
@shreve,@Carreau,@krassowski)Bugs fixed
- Fix QtPNGExporter returning empty bytes on macOS #2264 (
@h3pdesign,@Carreau,@QuLogic)- Fix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD) #2261 (
@h3pdesign,@krassowski,@mberlanda,@minrk,@salmankadaya,@th3gowtham)- Fix get_export_names and get_exporter default args #2228 (
@shreve,@krassowski)- PyPA-Compliant Summary #2226 (
@hackowitz-af,@Carreau)Maintenance and upkeep improvements
- avoid cov environment on free-threaded Pythons #2267 (
@minrk)- update pre-commit, and fix all issues. #2238 (
@Carreau)- Drop test on 3.9, test on 3.13, 3.14, 3.14t #2237 (
@Carreau)- Bump the actions group across 1 directory with 2 updates #2231 (
@Carreau,@krassowski)- Replace
@flaky.flakydecorate with pytest marker #2229 (@mgorny,@Carreau)- update to mermaid 11.10.0 #2224 (
@bollwyvl,@krassowski)- Drop support for Python 3.8, fix the CI tests #2221 (
@shreve,@minrk)Documentation improvements
- Use
intersphinx_registry#2232 (@Carreau,@krassowski)Contributors to this release
The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.
(GitHub contributors page for this release)
@bollwyvl(activity) |@Carreau(activity) |@h3pdesign(activity) |@hackowitz-af(activity) |@krassowski(activity) |@mberlanda(activity) |@mgorny(activity) |@minrk(activity) |@MSeal(activity) |@QuLogic(activity) |@salmankadaya(activity) |@shreve(activity) |@th3gowtham(activity)
Commits
21b35d8Publish 7.17.0c9ac1d1Fix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD)...b13276davoid cov environment on free-threaded Pythons (#2267)7c7055f[pre-commit.ci] auto fixes from pre-commit.com hooks74f3dddFix QtPNGExporter returning empty bytes on macOS216550bfix links39777actry to comment fialing test7b591caruff-check6ec7638parent59414b3fix mypy- Additional commits viewable in compare view
Updates werkzeug from 3.0.6 to 3.1.5
Release notes
Sourced from werkzeug's releases.
3.1.5
This is the Werkzeug 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/Werkzeug/3.1.5/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5 Milestone: https://github.com/pallets/werkzeug/milestone/43?closed=1
safe_joinon Windows does not allow more special device names, regardless of extension or surrounding spaces. GHSA-87hc-h4r5-73f7- The multipart form parser handles a
\r\nsequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. #3065 #3077- Fix
AttributeErrorwhen initializingDebuggedApplicationwithpin_security=False. #30753.1.4
This is the Werkzeug 3.1.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/Werkzeug/3.1.4/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-4 Milestone: https://github.com/pallets/werkzeug/milestone/42?closed=1
safe_joinon Windows does not allow special device names. This prevents reading from these when usingsend_from_directory.secure_filenamealready prevented writing to these. ghsa-hgf8-39gv-g3f2- The debugger pin fails after 10 attempts instead of 11. #3020
- The multipart form parser handles a
\r\nsequence at a chunk boundary. #3065- Improve CPU usage during Watchdog reloader. #3054
Request.jsonannotation is more accurate. #3067- Traceback rendering handles when the line number is beyond the available source lines. #3044
HTTPException.get_responseannotation and doc better conveys the distinction between WSGI and sans-IO responses. #30563.1.3
This is the Werkzeug 3.1.3 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.
PyPI: https://pypi.org/project/Werkzeug/3.1.3/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-3 Milestone: https://github.com/pallets/werkzeug/milestone/41?closed=1
- Initial data passed to
MultiDictand similar interfaces only acceptslist,tuple, orsetwhen passing multiple values. It had been changed to accept anyCollection, but this matched types that should be treated as single values, such asbytes. #2994- When the
Hostheader is not set andRequest.hostfalls back to the WSGISERVER_NAMEvalue, if that value is an IPv6 address it is wrapped in[]to match theHostheader. #29933.1.2
This is the Werkzeug 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.
PyPI: https://pypi.org/project/Werkzeug/3.1.2/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-2 Milestone: https://github.com/pallets/werkzeug/milestone/40?closed=1
- Improve type annotation for
TypeConversionDict.getto allow thetypeparameter to be a callable. #2988Headersdoes not inherit fromMutableMapping, as it is does not exactly match that interface. #29893.1.1
This is the Werkzeug 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.
... (truncated)
Changelog
Sourced from werkzeug's changelog.
Version 3.1.5
Released 2026-01-08
safe_joinon Windows does not allow more special device names, regardless of extension or surrounding spaces. :ghsa:87hc-h4r5-73f7- The multipart form parser handles a
\r\nsequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. :issue:3065:issue:3077- Fix
AttributeErrorwhen initializingDebuggedApplicationwithpin_security=False. :issue:3075Version 3.1.4
Released 2025-11-28
safe_joinon Windows does not allow special device names. This prevents reading from these when usingsend_from_directory.secure_filenamealready prevented writing to these. :ghsa:hgf8-39gv-g3f2- The debugger pin fails after 10 attempts instead of 11. :pr:
3020- The multipart form parser handles a
\r\nsequence at a chunk boundary. :issue:3065- Improve CPU usage during Watchdog reloader. :issue:
3054Request.jsonannotation is more accurate. :issue:3067- Traceback rendering handles when the line number is beyond the available source lines. :issue:
3044HTTPException.get_responseannotation and doc better conveys the distinction between WSGI and sans-IO responses. :issue:3056Version 3.1.3
Released 2024-11-08
- Initial data passed to
MultiDictand similar interfaces only acceptslist,tuple, orsetwhen passing multiple values. It had been changed to accept anyCollection, but this matched types that should be treated as single values, such asbytes. :issue:2994- When the
Hostheader is not set andRequest.hostfalls back to the WSGISERVER_NAMEvalue, if that value is an IPv6 address it is wrapped in[]to match theHostheader. :issue:2993Version 3.1.2
... (truncated)
Commits
e3d06f4release version 3.1.57ae1d25Merge commit from fork37797absafe_joinprevents windows special device names with compound extensions3db44c7fix duplicate referencea40f8fafix class name typo0f76c35Correct parsing up to a potential partial boundary (#3081)1049dd6Correct parsing up to a potential partial boundaryb48878cinitialize_pinin debugger (#3078)fa0f4f2initialize _pinf637275start version 3.1.5- Additional commits viewable in compare view
Updates werkzeug from 3.0.6 to 3.1.5
Release notes
Sourced from werkzeug's releases.
3.1.5
This is the Werkzeug 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/Werkzeug/3.1.5/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5 Milestone: https://github.com/pallets/werkzeug/milestone/43?closed=1
safe_joinon Windows does not allow more special device names, regardless of extension or surrounding spaces. GHSA-87hc-h4r5-73f7- The multipart form parser handles a
\r\nsequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. #3065 #3077- Fix
AttributeErrorwhen initializingDebuggedApplicationwithpin_security=False. #30753.1.4
This is the Werkzeug 3.1.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/Werkzeug/3.1.4/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-4 Milestone: https://github.com/pallets/werkzeug/milestone/42?closed=1
safe_joinon Windows does not allow special device names. This prevents reading from these when usingsend_from_directory.secure_filenamealready prevented writing to these. ghsa-hgf8-39gv-g3f2- The debugger pin fails after 10 attempts instead of 11. #3020
- The multipart form parser handles a
\r\nsequence at a chunk boundary. #3065- Improve CPU usage during Watchdog reloader. #3054
Request.jsonannotation is more accurate. #3067- Traceback rendering handles when the line number is beyond the available source lines. #3044
HTTPException.get_responseannotation and doc better conveys the distinction between WSGI and sans-IO responses. #30563.1.3
This is the Werkzeug 3.1.3 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.
PyPI: https://pypi.org/project/Werkzeug/3.1.3/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-3 Milestone: https://github.com/pallets/werkzeug/milestone/41?closed=1
- Initial data passed to
MultiDictand similar interfaces only acceptslist,tuple, orsetwhen passing multiple values. It had been changed to accept anyCollection, but this matched types that should be treated as single values, such asbytes. #2994- When the
Hostheader is not set andRequest.hostfalls back to the WSGISERVER_NAMEvalue, if that value is an IPv6 address it is wrapped in[]to match theHostheader. #29933.1.2
This is the Werkzeug 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.
PyPI: https://pypi.org/project/Werkzeug/3.1.2/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-2 Milestone: https://github.com/pallets/werkzeug/milestone/40?closed=1
- Improve type annotation for
TypeConversionDict.getto allow thetypeparameter to be a callable. #2988Headersdoes not inherit fromMutableMapping, as it is does not exactly match that interface. #29893.1.1
This is the Werkzeug 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.
... (truncated)
Changelog
Sourced from werkzeug's changelog.
Version 3.1.5
Released 2026-01-08
safe_joinon Windows does not allow more special device names, regardless of extension or surrounding spaces. :ghsa:87hc-h4r5-73f7- The multipart form parser handles a
\r\nsequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. :issue:3065:issue:3077- Fix
AttributeErrorwhen initializingDebuggedApplicationwithpin_security=False. :issue:3075Version 3.1.4
Released 2025-11-28
safe_joinon Windows does not allow special device names. This prevents reading from these when usingsend_from_directory.secure_filenamealready prevented writing to these. :ghsa:hgf8-39gv-g3f2- The debugger pin fails after 10 attempts instead of 11. :pr:
3020- The multipart form parser handles a
\r\nsequence at a chunk boundary. :issue:3065- Improve CPU usage during Watchdog reloader. :issue:
3054Request.jsonannotation is more accurate. :issue:3067- Traceback rendering handles when the line number is beyond the available source lines. :issue:
3044HTTPException.get_responseannotation and doc better conveys the distinction between WSGI and sans-IO responses. :issue:3056Version 3.1.3
Released 2024-11-08
- Initial data passed to
MultiDictand similar interfaces only acceptslist,tuple, orsetwhen passing multiple values. It had been changed to accept anyCollection, but this matched types that should be treated as single values, such asbytes. :issue:2994- When the
Hostheader is not set andRequest.hostfalls back to the WSGISERVER_NAMEvalue, if that value is an IPv6 address it is wrapped in[]to match theHostheader. :issue:2993Version 3.1.2
... (truncated)
Commits
e3d06f4release version 3.1.57ae1d25Merge commit from fork37797absafe_joinprevents windows special device names with compound extensions3db44c7fix duplicate referencea40f8fafix class name typo0f76c35Correct parsing up to a potential partial boundary (#3081)1049dd6Correct parsing up to a potential partial boundaryb48878cinitialize_pinin debugger (#3078)fa0f4f2initialize _pinf637275start version 3.1.5- Additional commits viewable in compare view
Updates pyarrow from 11.0.0 to 14.0.1
Commits
ba53748MINOR: [Release] Update versions for 14.0.1529f376MINOR: [Release] Update .deb/.rpm changelogs for 14.0.1b84bbcaMINOR: [Release] Update CHANGELOG.md for 14.0.1f141709GH-38607: [Python] Disable PyExtensionType autoload (#38608)5a37e74GH-38431: [Python][CI] Update fs.type_name checks for s3fs tests (#38455)2dcee3fMINOR: [Release] Update versions for 14.0.0297428cMINOR: [Release] Update .deb/.rpm changelogs for 14.0.03e9734fMINOR: [Release] Update CHANGELOG.md for 14.0.09f90995GH-38332: [CI][Release] Resolve symlinks in RAT lint (#38337)bd61239GH-35531: [Python] C Data Interface PyCapsule Protocol (#37797)- Additional commits viewable in compare view
Updates werkzeug from 2.2.3 to 3.1.5
Release notes
Sourced from werkzeug's releases.
3.1.5
This is the Werkzeug 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/Werkzeug/3.1.5/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5 Milestone: https://github.com/pallets/werkzeug/milestone/43?closed=1
safe_joinon Windows does not allow more special device names, regardless of extension or surrounding spaces. GHSA-87hc-h4r5-73f7- The multipart form parser handles a
\r\nsequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. #3065 #3077- Fix
AttributeErrorwhen initializingDebuggedApplicationwithpin_security=False. #30753.1.4
This is the Werkzeug 3.1.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.
PyPI: https://pypi.org/project/Werkzeug/3.1.4/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-4 Milestone: https://github.com/pallets/werkzeug/milestone/42?closed=1
safe_joinon Windows does not allow special device names. This prevents reading from these when usingsend_from_directory.secure_filenamealready prevented writing to these. ghsa-hgf8-39gv-g3f2- The debugger pin fails after 10 attempts instead of 11. #3020
- The multipart form parser handles a
\r\nsequence at a chunk boundary. #3065- Improve CPU usage during Watchdog reloader. #3054
Request.jsonannotation is more accurate. #3067- Traceback rendering handles when the line number is beyond the available source lines. #3044
HTTPException.get_responseannotation and doc better conveys the distinction between WSGI and sans-IO responses. #30563.1.3
This is the Werkzeug 3.1.3 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.
PyPI: https://pypi.org/project/Werkzeug/3.1.3/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-3 Milestone: https://github.com/pallets/werkzeug/milestone/41?closed=1
- Initial data passed to
MultiDictand similar interfaces only acceptslist,tuple, orsetwhen passing multiple values. It had been changed to accept anyCollection, but this matched types that should be treated as single values, such asbytes. #2994- When the
Hostheader is not set andRequest.hostfalls back to the WSGISERVER_NAMEvalue, if that value is an IPv6 address it is wrapped in[]to match theHostheader. #29933.1.2
This is the Werkzeug 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.
PyPI: https://pypi.org/project/Werkzeug/3.1.2/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-2 Milestone: https://github.com/pallets/werkzeug/milestone/40?closed=1
- Improve type annotation for
TypeConversionDict.getto allow thetypeparameter to be a callable. #2988Headersdoes not inherit fromMutableMapping, as it is does not exactly match that interface. #29893.1.1
This is the Werkzeug 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.
... (truncated)
Changelog
Sourced from werkzeug's changelog.
Version 3.1.5
Released 2026-01-08
safe_joinon Windows does not allow more special device names, regardless of extension or surrounding spaces. :ghsa:87hc-h4r5-73f7- The multipart form parser handles a
\r\nsequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. :issue:3065:issue:3077- Fix
AttributeErrorwhen initializingDebuggedApplicationwithpin_security=False. :issue:3075Version 3.1.4
Released 2025-11-28
safe_joinon Windows does not allow special device names. This prevents reading from these when usingsend_from_directory.secure_filenamealready prevented writing to these. :ghsa:hgf8-39gv-g3f2- The debugger pin fails after 10 attempts instead of 11. :pr:
3020- The multipart form parser handles a
\r\nsequence at a chunk boundary. :issue:3065- Improve CPU usage during Watchdog reloader. :issue:
3054Request.jsonannotation is more accurate. :issue:3067- Traceback rendering handles when the line number is beyond the available source lines. :issue:
3044HTTPException.get_responseannotation and doc better conveys the distinction between WSGI and sans-IO responses. :issue:3056Version 3.1.3
Released 2024-11-08
- Initial data passed to
MultiDictand similar interfaces only acceptslist,tuple, orsetwhen passing multiple values. It had been changed to accept anyCollection, but this matched types that should be treated as single values, such asbytes. :issue:2994- When the
Hostheader is not set andRequest.hostfalls back to the WSGISERVER_NAMEvalue, if that value is an IPv6 address it is wrapped in[]to match theHostheader. :issue:2993Version 3.1.2
... (truncated)
Commits
e3d06f4release version 3.1.57ae1d25Merge commit from fork37797absafe_joinprevents windows special device names with compound extensions3db44c7fix duplicate referencea40f8fafix class name typo0f76c35Correct parsing up to a potential partial boundary (#3081)1049dd6Correct parsing up to a potential partial boundaryb48878cinitialize_pinin debugger (#3078)fa0f4f2initialize _pinf637275start version 3.1.5- Additional commits viewable in compare view
Updates cryptography from 40.0.2 to 46.0.5
Changelog
Sourced from cryptography's changelog.
46.0.5 - 2026-02-10
* An attacker could create a malicious public key that reveals portions of your private key when using certain uncommon elliptic curves (binary curves). This version now includes additional security checks to prevent this attack. This issue only affects binary elliptic curves, which are rarely used in real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine** for reporting the issue. **CVE-2026-26007** * Support for ``SECT*`` binary elliptic curves is deprecated and will be removed in the next release... v46-0-4:
46.0.4 - 2026-01-27
Dropped support for win_arm64 wheels_.- Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
.. _v46-0-3:
46.0.3 - 2025-10-15
* Fixed compilation when using LibreSSL 4.2.0... _v46-0-2:
46.0.2 - 2025-09-30
- Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.4.
.. _v46-0-1:
46.0.1 - 2025-09-16
* Fixed an issue where users installing via ``pip`` on Python 3.14 development versions would not properly install a dependency. * Fixed an issue building the free-threaded macOS 3.14 wheels... _v46-0-0:
46.0.0 - 2025-09-16
- BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been removed.
... (truncated)
Commits
06e120ebump version for 46.0.5 release (#14289)0eebb9dEC check key on cofactor > 1 (#14287)bedf6e1fix openssl version on 46 branch (#14220)e6f44fcbump for 46.0.4 and drop win arm64 due to CI issues (#14217)c0af4ddrelease 46.0.3 (#13681)99efe5abump version for 46.0.2 (#13531)e735cfcrelease 46.0.1 (#13450)4e457ffExplicitly specify python in mac uv build invocation (#13447)2726efdDepend on CFFI 2.0.0 or newer on Python > 3.8 (#13448)6223062release 46.0.0 (#13446)- Additional commits viewable in compare view
Updates protobuf from 4.23.4 to 5.29.6
Release notes
Sourced from protobuf's releases.
Protocol Buffers v34.0-rc1
Announcements
- This version includes breaking changes to: C++, Objective-C, PHP, Python.
- [Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (https://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb)
- [C++] Make generator headers private (https://github.com/protocolbuffers/protobuf/commit/3a2af3510f0d454dbe3e4dc281674b61c4d20b9e)
- [C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (https://github.com/protocolbuffers/protobuf/commit/7a7589823d2cfaaf7994b050e98d5d553bc9b1c1)
- [C++] Add [[nodiscard]] to many APIs. (https://github.com/protocolbuffers/protobuf/commit/a70115f33f9af2c4b2202c800b84837e7fe0d738)
- [C++] Make the arena-enabled constructors of
RepeatedField,RepeatedPtrField, andMapprivate. (https://github.com/protocolbuffers/protobuf/commit/ef890c3d0c79398c70e047fe5dd893f460ba2336)- [C++] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (https://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292)
- [C++] Removes proto2::util::MessageDifferencer::AddIgnoreCriteria that takes a raw pointer as an argument in favor of the overload that takes a unique_ptr. Remove macro PROTOBUF_FUTURE_REMOVE_ADD_IGNORE_CRITERIA (https://github.com/protocolbuffers/protobuf/commit/b115358c64127896fed88b8b5ef5d91d86d8cbae)
- [C++] Remove deprecated FieldDescriptor::has_optional_keyword() in OSS. Use is_repeated() or has_presence() instead (https://github.com/protocolbuffers/protobuf/commit/68346ec9348e932664e58c3ecdcd1478f95233a8)
- [C++] Remove AddUnusedImportTrackFile() and ClearUnusedImportTrackFiles(). Remove PROTOBUF_FUTURE_RENAME_ADD_UNUSED_IMPORT (https://github.com/protocolbuffers/protobuf/commit/837a2cd1d6c75402b2503ffe7cd8aeaf25868536)
- [C++] Remove deprecated FieldDescriptor::is_optional() in OSS. Use (!is_required() && !is_repeated()) instead (https://github.com/protocolbuffers/protobuf/commit/9dbc5d479a8e453921485d8d3de47fb3c005f1af)
- [C++] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (https://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00)
- [C++] All entity names have length limit (2afb0dc)
- [ObjC] Remove
generate_minimal_importsgeneration option warning (https://github.com/protocolbuffers/protobuf/commit/45b1297fdaad5a9436d0e207422168c38dc45ac4)- [ObjC] Fix nullability annotations on some
GPB*Dictionarytypes. (https://github.com/protocolbuffers/protobuf/commit/ea67d6d26a48478a567c404679e3bb99cf230d50)- [ObjC] Remove
-[GPBFieldDescriptor optional](https://github.com/protocolbuffers/protobuf/commit/3414dc151eb4dcbdb2ca952e2589993bf7af75c4)- [Other] Remove deprecated flag for enabling MSVC support (https://github.com/protocolbuffers/protobuf/commit/97c979be6e0907e1051bee62584dac4594e73fa7)
- [PHP] Remove deprecated PHP APIs (https://github.com/protocolbuffers/protobuf/commit/9c45014099a4f7004fab6dd1278de2f4f2a393c5)
- [PHP] Remove deprecated PHP APIs FieldDescriptor getLabel, use IsRepeated or isRequired instead. (https://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345, https://github.com/protocolbuffers/protobuf/commit/cd76e675b14d00dda5623b30835d2bc7105fccc6, https://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345)
- [PHP] Add PHP typehints for setters and remove redundant GPBUtil checks (protocolbuffers/protobuf#25296) (https://github....
Description has been truncated
Package Dependencies
Security Advisories
Werkzeug safe_join() allows Windows special device names
nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows
Werkzeug safe_join() allows Windows special device names with compound extensions
cryptography Vulnerable to a Subgroup Attack Due to Missing Subgroup Validation for SECT Curves
Technical Details
| ID: | 14439514 |
| UUID: | 3960087931 |
| Node ID: | PR_kwDOOK9uiM7Eu90A |
| Host: | GitHub |
| Repository: | Reality2byte/python-docs-samples |