Data

Tools

Indexes

Applications

Experiments

Dependabot

An open index of dependabot pull requests across open source projects.

chore(deps): bump the python-packages group in /mutate with 16 updates

Closed
Number: #1243
Type: Pull Request
State: Closed
Author: dependabot[bot] dependabot[bot]
Association: Contributor
Comments: 2
Created: June 06, 2025 at 01:51 PM UTC
(about 1 year ago)
Updated: June 11, 2025 at 03:44 PM UTC
(12 months ago)
Closed: June 11, 2025 at 03:44 PM UTC
(12 months ago)
Time to Close: 5 days
Labels:
dependencies python
Description:

Bumps the python-packages group in /mutate with 16 updates:

Package From To
pyjwt 2.8.0 2.10.1
requests 2.31.0 2.32.3
docker 6.1.3 7.1.0
jinja2 3.1.2 3.1.6
psycopg2-binary 2.9.9 2.9.10
pycryptodome 3.19.0 3.23.0
cryptography 41.0.4 45.0.3
certifi 2023.7.22 2025.4.26
cffi 1.16.0 1.17.1
charset-normalizer 3.3.1 3.4.2
idna 3.7 3.10
markupsafe 2.1.3 3.0.2
packaging 23.2 25.0
pycparser 2.21 2.22
urllib3 2.0.7 2.4.0
websocket-client 1.6.4 1.8.0

Updates pyjwt from 2.8.0 to 2.10.1

Release notes

Sourced from pyjwt's releases.

2.10.1

Fixed

Full Changelog: https://github.com/jpadilla/pyjwt/compare/2.10.0...2.10.1

2.10.0

What's Changed

New Contributors

Full Changelog: https://github.com/jpadilla/pyjwt/compare/2.9.0...2.10.0

... (truncated)

Changelog

Sourced from pyjwt's changelog.

v2.10.1 <https://github.com/jpadilla/pyjwt/compare/2.10.0...2.10.1>__

Fixed


- Prevent partial matching of `iss` claim by @fabianbadoi in `GHSA-75c5-xw7c-p5pm <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm>`__

v2.10.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.9.0...2.10.0&gt;__


Changed

  • Remove algorithm requirement from JWT API, instead relying on JWS API for enforcement, by @​luhn in [#975](https://github.com/jpadilla/pyjwt/issues/975) <https://github.com/jpadilla/pyjwt/pull/975>__

  • Use Sequence for parameter types rather than List where applicable by @​imnotjames in [#970](https://github.com/jpadilla/pyjwt/issues/970) <https://github.com/jpadilla/pyjwt/pull/970>__

  • Add JWK support to JWT encode by @​luhn in [#979](https://github.com/jpadilla/pyjwt/issues/979) <https://github.com/jpadilla/pyjwt/pull/979>__

  • Encoding and decoding payloads using the none algorithm by @​jpadilla in #c2629f6 <https://github.com/jpadilla/pyjwt/commit/c2629f66c593459e02616048443231ccbe18be16>

    Before:

    .. code-block:: pycon

    import jwt jwt.encode({"payload": "abc"}, key=None, algorithm=None)

    After:

    .. code-block:: pycon

    import jwt jwt.encode({"payload": "abc"}, key=None, algorithm="none")

  • Added validation for 'sub' (subject) and 'jti' (JWT ID) claims in tokens by @​Divan009 in [#1005](https://github.com/jpadilla/pyjwt/issues/1005) <https://github.com/jpadilla/pyjwt/pull/1005>__

  • Refactor project configuration files from setup.cfg to pyproject.toml by @​cleder in [#995](https://github.com/jpadilla/pyjwt/issues/995) <https://github.com/jpadilla/pyjwt/pull/995>__

  • Ruff linter and formatter changes by @​gagandeepp in [#1001](https://github.com/jpadilla/pyjwt/issues/1001) <https://github.com/jpadilla/pyjwt/pull/1001>__

  • Drop support for Python 3.8 (EOL) by @​kkirsche in [#1007](https://github.com/jpadilla/pyjwt/issues/1007) <https://github.com/jpadilla/pyjwt/pull/1007>__

Fixed


- Encode EC keys with a fixed bit length by @etianen in `[#990](https://github.com/jpadilla/pyjwt/issues/990) <https://github.com/jpadilla/pyjwt/pull/990>`__
- Add an RTD config file to resolve Read the Docs build failures by @kurtmckee in `[#977](https://github.com/jpadilla/pyjwt/issues/977) <https://github.com/jpadilla/pyjwt/pull/977>`__
- Docs: Update ``iat`` exception docs by @pachewise in `[#974](https://github.com/jpadilla/pyjwt/issues/974) <https://github.com/jpadilla/pyjwt/pull/974>`__
- Docs: Fix ``decode_complete`` scope and algorithms by @RbnRncn in `[#982](https://github.com/jpadilla/pyjwt/issues/982) <https://github.com/jpadilla/pyjwt/pull/982>`__
- Fix doctest for ``docs/usage.rst`` by @pachewise in `[#986](https://github.com/jpadilla/pyjwt/issues/986) <https://github.com/jpadilla/pyjwt/pull/986>`__
</tr></table>

... (truncated)

Commits

Updates requests from 2.31.0 to 2.32.3

Release notes

Sourced from requests's releases.

v2.32.3

2.32.3 (2024-05-29)

Bugfixes

  • Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of HTTPAdapter. (#6716)
  • Fixed issue where Requests started failing to run on Python versions compiled without the ssl module. (#6724)

v2.32.2

2.32.2 (2024-05-21)

Deprecations

  • To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

    A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

v2.32.1

2.32.1 (2024-05-20)

Bugfixes

  • Add missing test certs to the sdist distributed on PyPI.

v2.32.0

2.32.0 (2024-05-20)

🐍 PYCON US 2024 EDITION 🐍

Security

Improvements

  • verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems when using a Python version built with OpenSSL 3.x. (#6667)
  • Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored.

... (truncated)

Changelog

Sourced from requests's changelog.

2.32.3 (2024-05-29)

Bugfixes

  • Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of HTTPAdapter. (#6716)
  • Fixed issue where Requests started failing to run on Python versions compiled without the ssl module. (#6724)

2.32.2 (2024-05-21)

Deprecations

  • To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

    A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

2.32.1 (2024-05-20)

Bugfixes

  • Add missing test certs to the sdist distributed on PyPI.

2.32.0 (2024-05-20)

Security

Improvements

  • verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems when using a Python version built with OpenSSL 3.x. (#6667)
  • Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored. This enables pip and other projects to minimize their vendoring surface area. The Response.text() and apparent_encoding APIs will default to utf-8 if neither library is present. (#6702)

... (truncated)

Commits
  • 0e322af v2.32.3
  • e188799 Don't create default SSLContext if ssl module isn't present (#6724)
  • 145b539 Merge pull request #6716 from sigmavirus24/bug/6715
  • b1d73dd Don't use default SSLContext with custom poolmanager kwargs
  • 6badbac Update HISTORY.md
  • a62a2d3 Allow for overriding of specific pool key params
  • 88dce9d v2.32.2
  • c98e4d1 Merge pull request #6710 from nateprewitt/api_rename
  • 92075b3 Add deprecation warning
  • aa1461b Move _get_connection to get_connection_with_tls_context
  • Additional commits viewable in compare view

Updates docker from 6.1.3 to 7.1.0

Release notes

Sourced from docker's releases.

7.1.0

Upgrade Notes

  • Bumped minimum engine API version to 1.24
  • Bumped default engine API version to 1.44 (Moby 25.0)

Bugfixes

  • Fixed issue with tag parsing when the registry address includes ports that resulted in invalid tag format errors
  • Fixed issue preventing creating new configs (ConfigCollection), which failed with a KeyError due to the name field
  • Fixed an issue due to an update in the requests package breaking docker-py by applying the suggested fix

Miscellaneous

  • Documentation improvements
  • Updated Ruff (linter) and fixed minor linting issues
  • Packaging/CI updates
  • Updated tests
    • Stopped checking for deprecated container and image related fields (Container and ContainerConfig)
    • Updated tests that check NetworkSettings.Networks.<network>.Aliases due to engine changes

What's Changed

New Contributors

Full Changelog: https://github.com/docker/docker-py/compare/7.0.0...7.1.0

... (truncated)

Commits
  • a365202 Merge pull request #3264 from krissetto/rename-env-var-in-release-pipeline
  • 1ab40c8 Fix env var name in release pipeline to match hatch expectations
  • b33088e Merge pull request #3263 from krissetto/fix-release-pipeline
  • 45488ac Fix env var name in release pipeline
  • 20879ec Merge pull request #3262 from krissetto/changelog-7.1.0
  • 4f2a26d Added 7.1.0 changelog
  • 7785ad9 Merge pull request #3257 from felixfontein/requests-hotfix
  • d8e9bcb requests 2.32.0 and 2.32.1 have been yanked.
  • 2a059a9 Extend fix to requests 2.32.2+.
  • e33e0a4 Hotfix for requests 2.32.0.
  • Additional commits viewable in compare view

Updates jinja2 from 3.1.2 to 3.1.6

Release notes

Sourced from jinja2's releases.

3.1.6

This is the Jinja 3.1.6 security release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Jinja2/3.1.6/ Changes: https://jinja.palletsprojects.com/en/stable/changes/#version-3-1-6

3.1.5

This is the Jinja 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Jinja2/3.1.5/ Changes: https://jinja.palletsprojects.com/changes/#version-3-1-5 Milestone: https://github.com/pallets/jinja/milestone/16?closed=1

  • The sandboxed environment handles indirect calls to str.format, such as by passing a stored reference to a filter that calls its argument. GHSA-q2x7-8rv6-6q7h
  • Escape template name before formatting it into error messages, to avoid issues with names that contain f-string syntax. #1792, GHSA-gmj6-6f8f-6699
  • Sandbox does not allow clear and pop on known mutable sequence types. #2032
  • Calling sync render for an async template uses asyncio.run. #1952
  • Avoid unclosed auto_aiter warnings. #1960
  • Return an aclose-able AsyncGenerator from Template.generate_async. #1960
  • Avoid leaving root_render_func() unclosed in Template.generate_async. #1960
  • Avoid leaving async generators unclosed in blocks, includes and extends. #1960
  • The runtime uses the correct concat function for the current environment when calling block references. #1701
  • Make |unique async-aware, allowing it to be used after another async-aware filter. #1781
  • |int filter handles OverflowError from scientific notation. #1921
  • Make compiling deterministic for tuple unpacking in a {% set ... %} call. #2021
  • Fix dunder protocol (copy/pickle/etc) interaction with Undefined objects. #2025
  • Fix copy/pickle support for the internal missing object. #2027
  • Environment.overlay(enable_async) is applied correctly. #2061
  • The error message from FileSystemLoader includes the paths that were searched. #1661
  • PackageLoader shows a clearer error message when the package does not contain the templates directory. #1705
  • Improve annotations for methods returning copies. #1880
  • urlize does not add mailto: to values like @a@b. #1870
  • Tests decorated with @pass_context can be used with the |select filter. #1624
  • Using set for multiple assignment (a, b = 1, 2) does not fail when the target is a namespace attribute. #1413
  • Using set in all branches of {% if %}{% elif %}{% else %} blocks does not cause the variable to be considered initially undefined. #1253

3.1.4

This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.

PyPI: https://pypi.org/project/Jinja2/3.1.4/ Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-4

  • The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. GHSA-h75v-3vvj-5mfj

3.1.3

This is a fix release for the 3.1.x feature branch.

  • Fix for GHSA-h5c8-rqwp-cp95. You are affected if you are using xmlattr and passing user input as attribute keys.

... (truncated)

Changelog

Sourced from jinja2's changelog.

Version 3.1.6

Released 2025-03-05

  • The |attr filter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. :ghsa:cpwx-vrp4-4pq7

Version 3.1.5

Released 2024-12-21

  • The sandboxed environment handles indirect calls to str.format, such as by passing a stored reference to a filter that calls its argument. :ghsa:q2x7-8rv6-6q7h
  • Escape template name before formatting it into error messages, to avoid issues with names that contain f-string syntax. :issue:1792, :ghsa:gmj6-6f8f-6699
  • Sandbox does not allow clear and pop on known mutable sequence types. :issue:2032
  • Calling sync render for an async template uses asyncio.run. :pr:1952
  • Avoid unclosed auto_aiter warnings. :pr:1960
  • Return an aclose-able AsyncGenerator from Template.generate_async. :pr:1960
  • Avoid leaving root_render_func() unclosed in Template.generate_async. :pr:1960
  • Avoid leaving async generators unclosed in blocks, includes and extends. :pr:1960
  • The runtime uses the correct concat function for the current environment when calling block references. :issue:1701
  • Make |unique async-aware, allowing it to be used after another async-aware filter. :issue:1781
  • |int filter handles OverflowError from scientific notation. :issue:1921
  • Make compiling deterministic for tuple unpacking in a {% set ... %} call. :issue:2021
  • Fix dunder protocol (copy/pickle/etc) interaction with Undefined objects. :issue:2025
  • Fix copy/pickle support for the internal missing object. :issue:2027
  • Environment.overlay(enable_async) is applied correctly. :pr:2061
  • The error message from FileSystemLoader includes the paths that were searched. :issue:1661
  • PackageLoader shows a clearer error message when the package does not contain the templates directory. :issue:1705
  • Improve annotations for methods returning copies. :pr:1880
  • urlize does not add mailto: to values like @a@b. :pr:1870

... (truncated)

Commits

Updates psycopg2-binary from 2.9.9 to 2.9.10

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.13.
  • Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
  • ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
  • Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.12.
  • Drop support for Python 3.6.

What's new in psycopg 2.9.8 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Wheel package bundled with PostgreSQL 16 libpq in order to add support for recent features, such as sslcertmode.

What's new in psycopg 2.9.7 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Fix propagation of exceptions raised during module initialization (:ticket:[#1598](https://github.com/psycopg/psycopg2/issues/1598)).
  • Fix building when pg_config returns an empty string (:ticket:[#1599](https://github.com/psycopg/psycopg2/issues/1599)).
  • Wheel package bundled with OpenSSL 1.1.1v.

What's new in psycopg 2.9.6 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Package manylinux 2014 for aarch64 and ppc64le platforms, in order to include libpq 15 in the binary package (:ticket:[#1396](https://github.com/psycopg/psycopg2/issues/1396)).
  • Wheel package bundled with OpenSSL 1.1.1t.

What's new in psycopg 2.9.5 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.11.
  • Add support for rowcount in MERGE statements in binary packages (:ticket:[#1497](https://github.com/psycopg/psycopg2/issues/1497)).

... (truncated)

Commits
  • a805acf chore: bump to version 2.9.10
  • 78561ac Merge pull request #1728 from romank0/fetch-notifications-on-commit
  • 5283a83 chore: add TransactionTimeout error, added in PostgreSQL 17
  • f64dd39 docs: add news entry about notifications on commit
  • cba6d39 removes duplication in tests
  • 282360d adds notifications processing after every PQexec
  • 362cb00 Adds notifies processing in pq_commit
  • eaeeb76 Merge pull request #1729 from edgarrmondragon/1692-py313-wheels
  • 4987362 ci(windows): drop Python 3.8 packages
  • 8c9a35d ci: test with PostgreSQL 17
  • Additional commits viewable in compare view

Updates pycryptodome from 3.19.0 to 3.23.0

Release notes

Sourced from pycryptodome's releases.

v3.23.0 - Dunkerque

New features

  • Added cipher modes Key Wrap (KW, RFC3394) and Key Wrap with Padding (KWP, RFC5649). Both are defined also in NIST SP 800-38F.
  • Wheels for Windows ARM.

Resolved issues

  • GH#862: For HashEdDSA and Ed448, sign() and verify() modified the state of the XOF.

v3.22.0 - Caen

New features

  • Added support for HPKE (RFC 9180).

Resolved issues

  • GH#812: CCM ciphers will now fail before encrypting (or decrypting) data beyond the limit imposed by the nonce length.
  • GH#846: fix infinite loop with RC4 for data larger than 4GB.
  • GH#852: handle correctly invalid PEM files with less than 3 lines.

Other changes

  • Remove support for Python 3.6.

v3.21.0 - Bourdeaux

New features

  • By setting the PYCRYPTODOME_DISABLE_GMP environment variable, the GMP library will not be used even if detected.
  • Add support for Curve25519 / X25519.
  • Add support for Curve448 / X448.
  • Add attribute curve to EccPoint and EccXPoint classes, with the canonical name of the curve.
  • GH#781: the label for the SP800_108_Counter KDF may now contain zero bytes. Thanks to Julien Rische.
  • GH#814: RSA keys for PSS can be imported.

Resolved issues

  • GH#810: fixed negation of Ed25519 points.
  • GH#819: accept an RFC5916 ECPrivateKey even if it doesn't contain any of the optional elements (parameters [0] and publicKey[1]).

Other changes

  • Remove support for Python 3.5.

... (truncated)

Changelog

Sourced from pycryptodome's changelog.

3.23.0 (17 May 2025) ++++++++++++++++++++++++++

New features

  • Added cipher modes Key Wrap (KW, RFC3394) and Key Wrap with Padding (KWP, RFC5649). Both are defined also in NIST SP 800-38F.
  • Wheels for Windows ARM.

Resolved issues

  • GH#862: For HashEdDSA and Ed448, sign() and verify() modified the state of the XOF.

3.22.0 (16 March 2025) ++++++++++++++++++++++++++

New features

  • Added support for HPKE (RFC 9180).

Resolved issues

  • GH#812: CCM ciphers will now fail before encrypting (or decrypting) data beyond the limit imposed by the nonce length.
  • GH#846: fix infinite loop with RC4 for data larger than 4GB.
  • GH#852: handle correctly invalid PEM files with less than 3 lines.

Other changes

  • Remove support for Python 3.6.

3.21.0 (30 September 2024) ++++++++++++++++++++++++++

New features

  • By setting the PYCRYPTODOME_DISABLE_GMP environment variable, the GMP library will not be used even if detected.
  • Add support for Curve25519 / X25519.
  • Add support for Curve448 / X448.
  • Add attribute curve to EccPoint and EccXPoint classes, with the canonical name of the curve.
  • GH#781: the label for the SP800_108_Counter KDF may now contain zero bytes. Thanks to Julien Rische.
  • GH#814: RSA keys for PSS can be imported.

Resolved issues

  • GH#810: fixed negation of Ed25519 points.
  • GH#819: accept an RFC5916 ECPrivateKey even if it doesn't

... (truncated)

Commits

Updates cryptography from 41.0.4 to 45.0.3

Changelog

Sourced from cryptography's changelog.

45.0.3 - 2025-05-25


* Fixed decrypting PKCS#8 files encrypted with long salts (this impacts keys
  encrypted by Bouncy Castle).
* Fixed decrypting PKCS#8 files encrypted with DES-CBC-MD5. While wildly
  insecure, this remains prevalent.

.. _v45-0-2:


45.0.2 - 2025-05-17

  • Fixed using mypy with cryptography on older versions of Python.

.. _v45-0-1:

45.0.1 - 2025-05-17


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.0.

.. _v45-0-0:


45.0.0 - 2025-05-17 (YANKED)

  • Support for Python 3.7 is deprecated and will be removed in the next cryptography release.
  • Updated the minimum supported Rust version (MSRV) to 1.74.0, from 1.65.0.
  • Added support for serialization of PKCS#12 Java truststores in :func:~cryptography.hazmat.primitives.serialization.pkcs12.serialize_java_truststore
  • Added :meth:~cryptography.hazmat.primitives.kdf.argon2.Argon2id.derive_phc_encoded and :meth:~cryptography.hazmat.primitives.kdf.argon2.Argon2id.verify_phc_encoded methods to support password hashing in the PHC string format
  • Added support for PKCS7 decryption and encryption using AES-256 as the content algorithm, in addition to AES-128.
  • BACKWARDS INCOMPATIBLE: Made SSH private key loading more consistent with other private key loading: :func:~cryptography.hazmat.primitives.serialization.load_ssh_private_key now raises a TypeError if the key is unencrypted but a password is provided (previously no exception was raised), and raises a TypeError if the key is encrypted but no password is provided (previously a ValueError was raised).
  • Added __copy__ to the :class:~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePrivateKey, :class:~cryptography.hazmat.primitives.asymmetric.ec.EllipticCurvePublicKey, :class:~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PublicKey, :class:~cryptography.hazmat.primitives.asymmetric.ed25519.Ed25519PrivateKey, :class:~cryptography.hazmat.primitives.asymmetric.ed448.Ed448PublicKey,

... (truncated)

Commits

Updates certifi from 2023.7.22 to 2025.4.26

Commits
  • 275c9eb 2025.04.26 (#347)
  • 3788331 Bump actions/setup-python from 5.4.0 to 5.5.0 (#346)
  • 9d1f1b7 Bump actions/download-artifact from 4.1.9 to 4.2.1 (#344)
  • 96b97a5 Bump actions/upload-artifact from 4.6.1 to 4.6.2 (#343)
  • c054ed3 Bump peter-evans/create-pull-request from 7.0.7 to 7.0.8 (#342)
  • 44547fc Bump actions/download-artifact from 4.1.8 to 4.1.9 (#341)
  • 5ea5124 Bump actions/upload-artifact from 4.6.0 to 4.6.1 (#340)
  • 2f142b7 Bump peter-evans/create-pull-request from 7.0.6 to 7.0.7 (#339)
  • 80d2ebd Bump actions/setup-python from 5.3.0 to 5.4.0 (#337)
  • 088f931 2025.01.31 (#336)
  • Additional commits viewable in compare view

Updates cffi from 1.16.0 to 1.17.1

Release notes

Sourced from cffi's releases.

v1.17.1

  • Fix failing distutils.msvc9compiler imports under Windows (#118).
  • ffibuilder.emit_python_code() and ffibuiler.emit_c_code() accept file-like objects (#115).
  • ffiplatform calls are bypassed by ffibuilder.emit_python_code() and ffibuilder.emit_c_code() (#81).

Full Changelog: https://github.com/python-cffi/cffi/compare/v1.17.0...v1.17.1

v1.17.0

  • Add support for Python 3.13.
    • Free-threaded CPython builds (i.e. python3.13t and the 3.13t ABI) are not currently supported.
  • In API mode, when you get a function from a C library by writing fn = lib.myfunc, you get an object of a special type for performance reasons, instead of a <cdata 'C-function-type'>. Before version 1.17 you could only call such objects. You could write ffi.addressof(lib, "myfunc") in order to get a real <cdata> object, based on the idea that in these cases in C you'd usually write &myfunc instead of myfunc. In version 1.17, the special object lib.myfunc can now be passed in many places where CFFI expects a regular <cdata> object. For example, you can now pass it as a callback to a C function call, or write it inside a C structure field of the correct pointer-to-function type, or use ffi.cast() or ffi.typeof() on it.

Full Changelog: https://github.com/python-cffi/cffi/compare/v1.16.0...v1.17.0

v1.17.0rc1

  • Add support for Python 3.13.
  • In API mode, when you get a function from a C library by writing fn = lib.myfunc, you get an object of a special type for performance reasons, instead of a object. For example, you ca...

    Description has been truncated

Pull Request Statistics
Commits:
0
Files Changed:
0
Additions:
+0
Deletions:
-0
Package Dependencies
Package:
pycryptodome
Ecosystem:
pip
Version Change:
3.19.0 → 3.23.0
Update Type:
Minor
Path:
/mutate
Package:
jinja2
Ecosystem:
pip
Version Change:
3.1.2 → 3.1.6
Update Type:
Patch
Path:
/mutate
Package:
charset-normalizer
Ecosystem:
pip
Version Change:
3.3.1 → 3.4.2
Update Type:
Minor
Path:
/mutate
Package:
packaging
Ecosystem:
pip
Version Change:
23.2 → 25.0
Path:
/mutate
Package:
certifi
Ecosystem:
pip
Version Change:
2023.7.22 → 2025.4.26
Update Type:
Major
Path:
/mutate
Package:
urllib3
Ecosystem:
pip
Version Change:
2.0.7 → 2.4.0
Update Type:
Minor
Path:
/mutate
Package:
cryptography
Ecosystem:
pip
Version Change:
41.0.4 → 45.0.3
Update Type:
Major
Path:
/mutate
Package:
requests
Ecosystem:
pip
Version Change:
2.31.0 → 2.32.3
Update Type:
Minor
Path:
/mutate
Package:
idna
Ecosystem:
pip
Version Change:
3.7 → 3.10
Path:
/mutate
Package:
markupsafe
Ecosystem:
pip
Version Change:
2.1.3 → 3.0.2
Update Type:
Major
Path:
/mutate
Package:
pyjwt
Ecosystem:
pip
Version Change:
2.8.0 → 2.10.1
Update Type:
Minor
Path:
/mutate
Package:
docker
Ecosystem:
pip
Version Change:
6.1.3 → 7.1.0
Update Type:
Major
Path:
/mutate
Package:
psycopg2-binary
Ecosystem:
pip
Version Change:
2.9.9 → 2.9.10
Update Type:
Patch
Path:
/mutate
Package:
cffi
Ecosystem:
pip
Version Change:
1.16.0 → 1.17.1
Update Type:
Minor
Path:
/mutate
Package:
pycparser
Ecosystem:
pip
Version Change:
2.21 → 2.22
Path:
/mutate
Package:
websocket-client
Ecosystem:
pip
Version Change:
1.6.4 → 1.8.0
Update Type:
Minor
Path:
/mutate
Security Advisories
Requests `Session` object does not verify requests after making first request with verify=False
GHSA-9wx4-h78v-vm56 CVE-2024-35195 MODERATE
When using a `requests.Session`, if the first request to a given origin is made with `verify=False`, TLS certificate verification may remain disabled for all subsequent requests to that origin, eve...
PyJWT Issuer field partial matches allowed
GHSA-75c5-xw7c-p5pm CVE-2024-53861 LOW
### Summary The wrong string if check is run for `iss` checking, resulting in `"acb"` being accepted for `"_abc_"`. ### Details This is a bug introduced in version [2.10.0](https://github.com/jpad...
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
GHSA-h75v-3vvj-5mfj CVE-2024-34064 MODERATE
The `xmlattr` filter in affected versions of Jinja accepts keys containing non-attribute characters. XML/HTML attributes cannot contain spaces, `/`, `>`, or `=`, as each would then be interpreted a...
Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filter
GHSA-h5c8-rqwp-cp95 CVE-2024-22195 MODERATE
The `xmlattr` filter in affected versions of Jinja accepts keys containing spaces. XML/HTML attributes cannot contain spaces, as each would then be interpreted as a separate attribute. If an applic...
Jinja has a sandbox breakout through indirect reference to format method
GHSA-q2x7-8rv6-6q7h CVE-2024-56326 MODERATE
An oversight in how the Jinja sandboxed environment detects calls to `str.format` allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulner...
Jinja has a sandbox breakout through malicious filenames
GHSA-gmj6-6f8f-6699 CVE-2024-56201 MODERATE
A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the ...
Jinja2 vulnerable to sandbox breakout through attr filter selecting format method
GHSA-cpwx-vrp4-4pq7 CVE-2025-27516 MODERATE
An oversight in how the Jinja sandboxed environment interacts with the `|attr` filter allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vu...
Actions
View on GitHub View Repository All Dependabot PRs
Technical Details
ID: 1475386
UUID: 3124850611
Node ID: PR_kwDOKVqxZ86ZZUS8
Host: GitHub
Repository: utmstack/UTMStack