Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

chore(deps): bump the pip group across 53 directories with 8 updates

Open
Number: #236
Type: Pull Request
State: Open
Author: dependabot[bot] dependabot[bot]
Association: Unknown
Comments: 1
Created: May 06, 2026 at 12:05 PM UTC
(27 days ago)
Updated: May 13, 2026 at 05:47 AM UTC
(20 days ago)
Labels:
dependencies python
Description:

Bumps the pip group with 2 updates in the /alloydb/notebooks directory: pytest and nbconvert.
Bumps the pip group with 2 updates in the /auth/cloud-client-temp directory: pytest and python-dotenv.
Bumps the pip group with 1 update in the /bigquery-connection/snippets directory: pytest.
Bumps the pip group with 1 update in the /bigquery-datatransfer/snippets directory: pytest.
Bumps the pip group with 1 update in the /bigquery-migration/snippets directory: pytest.
Bumps the pip group with 1 update in the /bigquery-reservation/snippets directory: pytest.
Bumps the pip group with 1 update in the /bigquery/bigframes directory: pytest.
Bumps the pip group with 1 update in the /bigquery/bqml directory: pytest.
Bumps the pip group with 1 update in the /bigquery/cloud-client directory: pytest.
Bumps the pip group with 1 update in the /bigquery/continuous-queries directory: pytest.
Bumps the pip group with 1 update in the /bigquery/pandas-gbq-migration directory: pytest.
Bumps the pip group with 1 update in the /blog/introduction_to_data_models_in_cloud_datastore directory: pytest.
Bumps the pip group with 2 updates in the /cloud-media-livestream/keypublisher directory: pytest and lxml.
Bumps the pip group with 1 update in the /cloud_scheduler/snippets directory: pytest.
Bumps the pip group with 1 update in the /cloud_tasks/http_queues directory: pytest.
Bumps the pip group with 1 update in the /cloud_tasks/snippets directory: pytest.
Bumps the pip group with 1 update in the /cloudbuild/snippets directory: pytest.
Bumps the pip group with 2 updates in the /composer/2022_airflow_summit directory: pytest and apache-airflow.
Bumps the pip group with 2 updates in the /composer/cicd_sample directory: pytest and apache-airflow.
Bumps the pip group with 1 update in the /composer/functions directory: pytest.
Bumps the pip group with 1 update in the /composer/rest directory: pytest.
Bumps the pip group with 2 updates in the /composer/workflows directory: pytest and apache-airflow.
Bumps the pip group with 1 update in the /compute/api directory: pytest.
Bumps the pip group with 1 update in the /compute/auth directory: pytest.
Bumps the pip group with 1 update in the /compute/client_library directory: pytest.
Bumps the pip group with 2 updates in the /compute/encryption directory: pytest and cryptography.
Bumps the pip group with 1 update in the /compute/load_balancing directory: pytest.
Bumps the pip group with 1 update in the /compute/metadata directory: pytest.
Bumps the pip group with 1 update in the /compute/oslogin directory: pytest.
Bumps the pip group with 1 update in the /connectgateway directory: pytest.
Bumps the pip group with 1 update in the /contact-center-insights/snippets directory: pytest.
Bumps the pip group with 1 update in the /container/snippets directory: pytest.
Bumps the pip group with 1 update in the /containeranalysis/snippets directory: pytest.
Bumps the pip group with 1 update in the /contentwarehouse/snippets directory: pytest.
Bumps the pip group with 1 update in the /datacatalog/quickstart directory: pytest.
Bumps the pip group with 1 update in the /datacatalog/snippets directory: pytest.
Bumps the pip group with 1 update in the /datacatalog/v1beta1 directory: pytest.
Bumps the pip group with 1 update in the /dataflow/encryption-keys directory: pytest.
Bumps the pip group with 1 update in the /dataflow/extensible-templates directory: pytest.
Bumps the pip group with 2 updates in the /dataflow/gemma directory: pytest and keras.
Bumps the pip group with 1 update in the /dataflow/gemma-flex-template directory: pytest.
Bumps the pip group with 1 update in the /dataflow/run-inference directory: pytest.
Bumps the pip group with 1 update in the /dataflow/snippets directory: pytest.
Bumps the pip group with 1 update in the /datalabeling/snippets directory: pytest.
Bumps the pip group with 1 update in the /dataplex/snippets directory: pytest.
Bumps the pip group with 1 update in the /dataproc/snippets directory: pytest.
Bumps the pip group with 1 update in the /datastore/cloud-client directory: pytest.
Bumps the pip group with 1 update in the /functions/imagemagick directory: pytest.
Bumps the pip group with 1 update in the /gemma2 directory: pytest.
Bumps the pip group with 2 updates in the /genai/bounding_box directory: pytest and pillow.
Bumps the pip group with 2 updates in the /genai/code_execution directory: pytest and pillow.
Bumps the pip group with 2 updates in the /genai/image_generation directory: pytest and pillow.
Bumps the pip group with 2 updates in the /genai/tools directory: pytest and pillow.

Updates pytest from 8.3.3 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

  • #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

  • #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

    Previously this resulted in an internal assertion failure during plugin loading.

    Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

  • #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

  • #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

  • #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

  • #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
  • #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
  • #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
  • #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

  • #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

    -- by aleguy02

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

  • #13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

    You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

    Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.

  • #13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.

  • #13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0. Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim. It will be deprecated in pytest 9.1 and removed in pytest 10.

... (truncated)

Commits

Updates nbconvert from 7.16.6 to 7.17.1

Release notes

Sourced from nbconvert's releases.

v7.17.1

7.17.1

This is a security release, fixing two CVEs:

(full advisories will be published seven days after release, on 2026-04-14).

(Full Changelog)

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​akhmerov (activity) | @​bollwyvl (activity) | @​Carreau (activity) | @​ctcjab (activity) | @​davidbrochart (activity) | @​Ken-B (activity) | @​krassowski (activity) | @​mgeier (activity) | @​minrk (activity) | @​mpacer (activity) | @​MSeal (activity) | @​SylvainCorlay (activity) | @​takluyver (activity) | @​timkpaine (activity)

v7.17.0

7.17.0

(Full Changelog)

Enhancements made

Bugs fixed

... (truncated)

Changelog

Sourced from nbconvert's changelog.

7.17.1

This is a security release, fixing two CVEs:

(full advisories will be published seven days after release, on 2026-04-14).

(Full Changelog)

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@​akhmerov (activity) | @​bollwyvl (activity) | @​Carreau (activity) | @​ctcjab (activity) | @​davidbrochart (activity) | @​Ken-B (activity) | @​krassowski (activity) | @​mgeier (activity) | @​minrk (activity) | @​mpacer (activity) | @​MSeal (activity) | @​SylvainCorlay (activity) | @​takluyver (activity) | @​timkpaine (activity)

7.17.0

(Full Changelog)

Enhancements made

Bugs fixed

... (truncated)

Commits

Updates pytest from 9.0.2 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

  • #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

  • #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

    Previously this resulted in an internal assertion failure during plugin loading.

    Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

  • #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

  • #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

  • #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

  • #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
  • #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
  • #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
  • #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

  • #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

    -- by aleguy02

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

  • #13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

    You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

    Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.

  • #13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.

  • #13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0. Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim. It will be deprecated in pytest 9.1 and removed in pytest 10.

... (truncated)

Commits

Updates python-dotenv from 1.2.1 to 1.2.2

Release notes

Sourced from python-dotenv's releases.

v1.2.2

Added

  • Support for Python 3.14, including the free-threaded (3.14t) build. (#)

Changed

  • The dotenv run command now forwards flags directly to the specified command by @​bbc2 in theskumar/python-dotenv#607
  • Improved documentation clarity regarding override behavior and the reference page.
  • Updated PyPy support to version 3.11.
  • Documentation for FIFO file support.
  • Support for Python 3.9.

Fixed

Breaking Changes

  • dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

  • In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

  • dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

Misc

New Contributors

Full Changelog: https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2

Changelog

Sourced from python-dotenv's changelog.

[1.2.2] - 2026-03-01

Added

  • Support for Python 3.14, including the free-threaded (3.14t) build. (#588)

Changed

  • The dotenv run command now forwards flags directly to the specified command by [@​bbc2] in #607
  • Improved documentation clarity regarding override behavior and the reference page.
  • Updated PyPy support to version 3.11.
  • Documentation for FIFO file support.
  • Dropped Support for Python 3.9.

Fixed

  • Improved set_key and unset_key behavior when interacting with symlinks by [@​bbc2] in [790c5c0]
  • Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by [@​JYOuyang] in #590

Breaking Changes

  • dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

  • In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

  • dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

Commits

Updates pytest from 8.2.0 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

  • #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

  • #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

    Previously this resulted in an internal assertion failure during plugin loading.

    Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

  • #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

  • #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

  • #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

  • #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
  • #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
  • #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
  • #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

  • #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

    -- by aleguy02

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

  • #13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

    You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

    Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.

  • #13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.

  • #13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0. Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim. It will be deprecated in pytest 9.1 and removed in pytest 10.

... (truncated)

Commits

Updates pytest from 8.2.0 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

  • #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

  • #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

    Previously this resulted in an internal assertion failure during plugin loading.

    Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

  • #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

  • #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

  • #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

  • #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
  • #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
  • #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
  • #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

  • #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

    -- by aleguy02

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

  • #13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

    You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

    Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.

  • #13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.

  • #13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0. Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim. It will be deprecated in pytest 9.1 and removed in pytest 10.

... (truncated)

Commits

Updates pytest from 8.2.0 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

  • #12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

  • #13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

    Previously this resulted in an internal assertion failure during plugin loading.

    Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

  • #13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

  • #14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

  • #14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

  • #13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.
  • #13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.
  • #14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.
  • #14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

  • #12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

    -- by aleguy02

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

  • #13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

    You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

    Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.

  • Package Dependencies
    Package:
     pytest
    Ecosystem:
    pip
    Version Change:
    8.3.3 → 9.0.3
    Update Type:
    Major
    Package:
    python-dotenv
    Ecosystem:
    pip
    Version Change:
    1.2.1 → 1.2.2
    Update Type:
    Patch
    Package:
    nbconvert
    Ecosystem:
    pip
    Version Change:
    7.16.6 → 7.17.1
    Update Type:
    Minor
Security Advisories
nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows
GHSA-xm59-rqc7-hhvf CVE-2025-53000 HIGH
### Summary On Windows, converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a `inkscape.bat` file that defines a [Wi...
pytest has vulnerable tmpdir handling
GHSA-6w46-j5rx-g56g CVE-2025-71176 MODERATE
pytest through 9.0.2 on UNIX relies on directories with the `/tmp/pytest-of-{user}` name pattern, which allows local users to cause a denial of service or possibly gain privileges.
nbconvert has an Arbitrary File Read via Path Traversal in HTMLExporter Image Embedding
GHSA-7jqv-fw35-gmx9 CVE-2026-39378 MODERATE
## Summary When `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive fil...
nbconvert has an Arbitrary File Write via Path Traversal in Cell Attachment Filenames
GHSA-4c99-qj7h-p3vg CVE-2026-39377 MODERATE
# Arbitrary File Write via Path Traversal in Cell Attachment Filenames ## Summary nbconvert allows arbitrary file writes to locations outside the intended output directory when processing noteboo...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 15785540
UUID: 4391173959
Node ID: PR_kwDOOK9uiM7YwVqK
Host: GitHub
Repository: Reality2byte/python-docs-samples