Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Deps: Bump the python-packages group across 1 directory with 6 updates #775

Closed
wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Dec 16, 2024

Bumps the python-packages group with 6 updates in the / directory:

Package From To
pontos 24.9.0 24.12.3
ruff 0.8.1 0.8.3
anyio 4.6.2.post1 4.7.0
certifi 2024.8.30 2024.12.14
httpx 0.28.0 0.28.1
six 1.16.0 1.17.0

Updates pontos from 24.9.0 to 24.12.3

Release notes

Sourced from pontos's releases.

pontos 24.12.3

24.12.3 - 2024-12-13

Added

  • Tests for CPE match string API ae1dc66

Bug Fixes

  • Make cpe_last_modified of CPE matches optional a215412
  • Convert matchCriteriaId to string for HTTP requests 31e47e8

pontos 24.12.2

24.12.2 - 2024-12-13

Added

pontos 24.12.1

24.12.1 - 2024-12-12

Changed

Dependencies

  • Bump the python-packages group with 5 updates 54d814c

pontos 24.12.0

[24.12.0] - 2024-12-06

Added

Changed

Bug Fixes

Dependencies

  • Bump the python-packages group across 1 directory with 7 updates c48ff39
  • Bump the python-packages group with 5 updates c6f4e38
  • Bump pypa/gh-action-pypi-publish in the actions group 74ba4db
  • Bump the python-packages group with 4 updates 3b5fdc8
  • Bump pypa/gh-action-pypi-publish in the actions group 60838a5

... (truncated)

Commits
  • 4ae86b3 Automatic release to 24.12.3
  • a215412 Fix: Make cpe_last_modified of CPE matches optional
  • b2fa245 Remove duplicate test_cpe_matches_request_results, sort imports
  • 9e64235 Fix formatting for new CPE match API tests
  • ae1dc66 Add: Tests for CPE match string API
  • 31e47e8 Fix: Convert matchCriteriaId to string for HTTP requests
  • 1e5103c Automatic adjustments after release [skip ci]
  • 721a24b Automatic release to 24.12.2
  • 1fc864f Add: Retrying for NVDApi (#1070)
  • 01eeea2 Automatic adjustments after release [skip ci]
  • Additional commits viewable in compare view

Updates ruff from 0.8.1 to 0.8.3

Release notes

Sourced from ruff's releases.

0.8.3

Release Notes

Preview features

  • Fix fstring formatting removing overlong implicit concatenated string in expression part (#14811)
  • [airflow] Add fix to remove deprecated keyword arguments (AIR302) (#14887)
  • [airflow]: Extend rule to include deprecated names for Airflow 3.0 (AIR302) (#14765 and #14804)
  • [flake8-bugbear] Improve error messages for except* (B025, B029, B030, B904) (#14815)
  • [flake8-bugbear] itertools.batched() without explicit strict (B911) (#14408)
  • [flake8-use-pathlib] Dotless suffix passed to Path.with_suffix() (PTH210) (#14779)
  • [pylint] Include parentheses and multiple comparators in check for boolean-chained-comparison (PLR1716) (#14781)
  • [ruff] Do not simplify round() calls (RUF046) (#14832)
  • [ruff] Don't emit used-dummy-variable on function parameters (RUF052) (#14818)
  • [ruff] Implement if-key-in-dict-del (RUF051) (#14553)
  • [ruff] Mark autofix for RUF052 as always unsafe (#14824)
  • [ruff] Teach autofix for used-dummy-variable about TypeVars etc. (RUF052) (#14819)

Rule changes

  • [flake8-bugbear] Offer unsafe autofix for no-explicit-stacklevel (B028) (#14829)
  • [flake8-pyi] Skip all type definitions in string-or-bytes-too-long (PYI053) (#14797)
  • [pyupgrade] Do not report when a UTF-8 comment is followed by a non-UTF-8 one (UP009) (#14728)
  • [pyupgrade] Mark fixes for convert-typed-dict-functional-to-class and convert-named-tuple-functional-to-class as unsafe if they will remove comments (UP013, UP014) (#14842)

Bug fixes

  • Raise syntax error for mixing except and except* (#14895)
  • [flake8-bugbear] Fix B028 to allow stacklevel to be explicitly assigned as a positional argument (#14868)
  • [flake8-bugbear] Skip B028 if warnings.warn is called with *args or **kwargs (#14870)
  • [flake8-comprehensions] Skip iterables with named expressions in unnecessary-map (C417) (#14827)
  • [flake8-pyi] Also remove self and cls's annotation (PYI034) (#14801)
  • [flake8-pytest-style] Fix pytest-parametrize-names-wrong-type (PT006) to edit both argnames and argvalues if both of them are single-element tuples/lists (#14699)
  • [perflint] Improve autofix for PERF401 (#14369)
  • [pylint] Fix PLW1508 false positive for default string created via a mult operation (#14841)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.8.3

Preview features

  • Fix fstring formatting removing overlong implicit concatenated string in expression part (#14811)
  • [airflow] Add fix to remove deprecated keyword arguments (AIR302) (#14887)
  • [airflow]: Extend rule to include deprecated names for Airflow 3.0 (AIR302) (#14765 and #14804)
  • [flake8-bugbear] Improve error messages for except* (B025, B029, B030, B904) (#14815)
  • [flake8-bugbear] itertools.batched() without explicit strict (B911) (#14408)
  • [flake8-use-pathlib] Dotless suffix passed to Path.with_suffix() (PTH210) (#14779)
  • [pylint] Include parentheses and multiple comparators in check for boolean-chained-comparison (PLR1716) (#14781)
  • [ruff] Do not simplify round() calls (RUF046) (#14832)
  • [ruff] Don't emit used-dummy-variable on function parameters (RUF052) (#14818)
  • [ruff] Implement if-key-in-dict-del (RUF051) (#14553)
  • [ruff] Mark autofix for RUF052 as always unsafe (#14824)
  • [ruff] Teach autofix for used-dummy-variable about TypeVars etc. (RUF052) (#14819)

Rule changes

  • [flake8-bugbear] Offer unsafe autofix for no-explicit-stacklevel (B028) (#14829)
  • [flake8-pyi] Skip all type definitions in string-or-bytes-too-long (PYI053) (#14797)
  • [pyupgrade] Do not report when a UTF-8 comment is followed by a non-UTF-8 one (UP009) (#14728)
  • [pyupgrade] Mark fixes for convert-typed-dict-functional-to-class and convert-named-tuple-functional-to-class as unsafe if they will remove comments (UP013, UP014) (#14842)

Bug fixes

  • Raise syntax error for mixing except and except* (#14895)
  • [flake8-bugbear] Fix B028 to allow stacklevel to be explicitly assigned as a positional argument (#14868)
  • [flake8-bugbear] Skip B028 if warnings.warn is called with *args or **kwargs (#14870)
  • [flake8-comprehensions] Skip iterables with named expressions in unnecessary-map (C417) (#14827)
  • [flake8-pyi] Also remove self and cls's annotation (PYI034) (#14801)
  • [flake8-pytest-style] Fix pytest-parametrize-names-wrong-type (PT006) to edit both argnames and argvalues if both of them are single-element tuples/lists (#14699)
  • [perflint] Improve autofix for PERF401 (#14369)
  • [pylint] Fix PLW1508 false positive for default string created via a mult operation (#14841)

0.8.2

Preview features

  • [airflow] Avoid deprecated values (AIR302) (#14582)
  • [airflow] Extend removed names for AIR302 (#14734)
  • [ruff] Extend unnecessary-regular-expression to non-literal strings (RUF055) (#14679)
  • [ruff] Implement used-dummy-variable (RUF052) (#14611)
  • [ruff] Implement unnecessary-cast-to-int (RUF046) (#14697)

Rule changes

  • [airflow] Check AIR001 from builtin or providers operators module (#14631)
  • [flake8-pytest-style] Remove @ in pytest.mark.parametrize rule messages (#14770)
  • [pandas-vet] Skip rules if the panda module hasn't been seen (#14671)

... (truncated)

Commits

Updates anyio from 4.6.2.post1 to 4.7.0

Release notes

Sourced from anyio's releases.

4.7.0

  • Updated TaskGroup to work with asyncio's eager task factories (#764)
  • Added the wait_readable() and wait_writable() functions which will accept an object with a .fileno() method or an integer handle, and deprecated their now obsolete versions (wait_socket_readable() and wait_socket_writable()) (PR by @​davidbrochart)
  • Changed EventAdapter (an Event with no bound async backend) to allow set() to work even before an async backend is bound to it (#819)
  • Added support for wait_readable() and wait_writable() on ProactorEventLoop (used on asyncio + Windows by default)
  • Fixed a misleading ValueError in the context of DNS failures (#815; PR by @​graingert)
  • Fixed the return type annotations of readinto() and readinto1() methods in the anyio.AsyncFile class (#825)
  • Fixed TaskInfo.has_pending_cancellation() on asyncio returning false positives in cleanup code on Python >= 3.11 (#832; PR by @​gschaffner)
  • Fixed cancelled cancel scopes on asyncio calling asyncio.Task.uncancel when propagating a CancelledError on exit to a cancelled parent scope (#790; PR by @​gschaffner)
Changelog

Sourced from anyio's changelog.

Version history

This library adheres to Semantic Versioning 2.0 <http://semver.org/>_.

4.7.0

  • Updated TaskGroup to work with asyncio's eager task factories ([#764](https://github.com/agronholm/anyio/issues/764) <https://github.com/agronholm/anyio/issues/764>_)
  • Added the wait_readable() and wait_writable() functions which will accept an object with a .fileno() method or an integer handle, and deprecated their now obsolete versions (wait_socket_readable() and wait_socket_writable()) (PR by @​davidbrochart)
  • Changed EventAdapter (an Event with no bound async backend) to allow set() to work even before an async backend is bound to it ([#819](https://github.com/agronholm/anyio/issues/819) <https://github.com/agronholm/anyio/issues/819>_)
  • Added support for wait_readable() and wait_writable() on ProactorEventLoop (used on asyncio + Windows by default)
  • Fixed a misleading ValueError in the context of DNS failures ([#815](https://github.com/agronholm/anyio/issues/815) <https://github.com/agronholm/anyio/issues/815>_; PR by @​graingert)
  • Fixed the return type annotations of readinto() and readinto1() methods in the anyio.AsyncFile class ([#825](https://github.com/agronholm/anyio/issues/825) <https://github.com/agronholm/anyio/issues/825>_)
  • Fixed TaskInfo.has_pending_cancellation() on asyncio returning false positives in cleanup code on Python >= 3.11 ([#832](https://github.com/agronholm/anyio/issues/832) <https://github.com/agronholm/anyio/issues/832>_; PR by @​gschaffner)
  • Fixed cancelled cancel scopes on asyncio calling asyncio.Task.uncancel when propagating a CancelledError on exit to a cancelled parent scope ([#790](https://github.com/agronholm/anyio/issues/790) <https://github.com/agronholm/anyio/pull/790>_; PR by @​gschaffner)

4.6.2

  • Fixed regression caused by ([#807](https://github.com/agronholm/anyio/issues/807) <https://github.com/agronholm/anyio/pull/807>_) that prevented the use of parametrized async fixtures

4.6.1

This release contains all the changes from both v4.5.1 and v4.6.0, plus:

  • Fixed TaskGroup and CancelScope producing cyclic references in tracebacks when raising exceptions ([#806](https://github.com/agronholm/anyio/issues/806) <https://github.com/agronholm/anyio/pull/806>_) (PR by @​graingert)

4.6.0

This release is the successor to v4.5.0 with Python 3.8 support dropped, and does not contain the changes from v4.5.1.

  • Dropped support for Python 3.8 (as [#698](https://github.com/agronholm/anyio/issues/698) <https://github.com/agronholm/anyio/issues/698>_ cannot be resolved

... (truncated)

Commits
  • c967f5c Bumped up the version
  • f47ac5e Rearranged changelog entries
  • f316ce5 Allowed Event to be set before it's bound to an async backend (#835)
  • 93a5746 Fixed asyncio.Task.cancelling issues (#790)
  • 39cf394 Avoid exposing extra variables key and value in anyio.abc (#833)
  • a2150f5 Fixed design issues in PR template (#834)
  • 0f80611 Added support for wait_readable() and wait_writable() on ProactorEventLoop (#...
  • 97d5fe6 Made asyncio TaskGroup work with eager task factories (#822)
  • 44405f4 Updated downstream test workflows and their target Python versions
  • 93c0cd6 Replaced mentions to run_sync_in_process with to_process.run_sync (#829)
  • Additional commits viewable in compare view

Updates certifi from 2024.8.30 to 2024.12.14

Commits
  • 4ba3900 2024.12.14 (#329)
  • 9164660 Bump pypa/gh-action-pypi-publish from 1.12.2 to 1.12.3 (#331)
  • 3dc3651 Bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.2 (#328)
  • c5bf18d Bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0 (#327)
  • b908391 Bump actions/setup-python from 5.2.0 to 5.3.0 (#326)
  • bc26b41 Bump actions/checkout from 4.2.1 to 4.2.2 (#325)
  • 57afc22 Bump actions/upload-artifact from 4.4.1 to 4.4.3 (#323)
  • a495091 test against 3.13 final
  • 62f8144 Added 3.13 classifier (#322)
  • 94d23a0 Bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3 (#321)
  • Additional commits viewable in compare view

Updates httpx from 0.28.0 to 0.28.1

Release notes

Sourced from httpx's releases.

Version 0.28.1

0.28.1 (6th December, 2024)

  • Fix SSL case where verify=False together with client side certificates.
Changelog

Sourced from httpx's changelog.

0.28.1 (6th December, 2024)

  • Fix SSL case where verify=False together with client side certificates.
Commits

Updates six from 1.16.0 to 1.17.0

Changelog

Sourced from six's changelog.

1.17.0

  • Pull request #388: Remove URLopener and FancyURLopener classes from urllib.request when running on Python 3.14 or greater.

  • Pull request #365, issue #283: six.moves.UserDict now points to UserDict.IterableUserDict instead of UserDict.UserDict on Python 2.

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python-packages group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [pontos](https://github.com/greenbone/pontos) | `24.9.0` | `24.12.3` |
| [ruff](https://github.com/astral-sh/ruff) | `0.8.1` | `0.8.3` |
| [anyio](https://github.com/agronholm/anyio) | `4.6.2.post1` | `4.7.0` |
| [certifi](https://github.com/certifi/python-certifi) | `2024.8.30` | `2024.12.14` |
| [httpx](https://github.com/encode/httpx) | `0.28.0` | `0.28.1` |
| [six](https://github.com/benjaminp/six) | `1.16.0` | `1.17.0` |



Updates `pontos` from 24.9.0 to 24.12.3
- [Release notes](https://github.com/greenbone/pontos/releases)
- [Commits](greenbone/pontos@v24.9.0...v24.12.3)

Updates `ruff` from 0.8.1 to 0.8.3
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.8.1...0.8.3)

Updates `anyio` from 4.6.2.post1 to 4.7.0
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Changelog](https://github.com/agronholm/anyio/blob/master/docs/versionhistory.rst)
- [Commits](agronholm/anyio@4.6.2.post1...4.7.0)

Updates `certifi` from 2024.8.30 to 2024.12.14
- [Commits](certifi/python-certifi@2024.08.30...2024.12.14)

Updates `httpx` from 0.28.0 to 0.28.1
- [Release notes](https://github.com/encode/httpx/releases)
- [Changelog](https://github.com/encode/httpx/blob/master/CHANGELOG.md)
- [Commits](encode/httpx@0.28.0...0.28.1)

Updates `six` from 1.16.0 to 1.17.0
- [Changelog](https://github.com/benjaminp/six/blob/main/CHANGES)
- [Commits](benjaminp/six@1.16.0...1.17.0)

---
updated-dependencies:
- dependency-name: pontos
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: ruff
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: anyio
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: certifi
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
- dependency-name: httpx
  dependency-type: indirect
  update-type: version-update:semver-patch
  dependency-group: python-packages
- dependency-name: six
  dependency-type: indirect
  update-type: version-update:semver-minor
  dependency-group: python-packages
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested a review from a team as a code owner December 16, 2024 04:20
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Dec 16, 2024
Copy link

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ❌ 1 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 1 package(s) with unknown licenses.
See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA e7d6e2d.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

poetry.lock

PackageVersionLicenseIssue Type
pontos24.12.3GPL-3.0 AND GPL-3.0-only AND GPL-3.0-or-laterIncompatible License
certifi2024.12.14NullUnknown License
Allowed Licenses: 0BSD, AGPL-3.0-or-later, Apache-2.0, BlueOak-1.0.0, BSD-2-Clause, BSD-3-Clause-Clear, BSD-3-Clause, BSL-1.0, CAL-1.0, CC-BY-3.0, CC-BY-4.0, CC-BY-SA-4.0, CC0-1.0, EPL-2.0, GPL-2.0-only, GPL-2.0-or-later, GPL-2.0, GPL-3.0-or-later, ISC, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-2.1, LGPL-3.0-only, LGPL-3.0, LGPL-3.0-or-later, MIT, MIT-CMU, MPL-1.1, MPL-2.0, OFL-1.1, PSF-2.0, Python-2.0, Python-2.0.1, Unicode-DFS-2016, Unlicense

OpenSSF Scorecard

PackageVersionScoreDetails
pip/anyio 4.7.0 🟢 5.6
Details
CheckScoreReason
Code-Review🟢 5Found 15/29 approved changesets -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 1030 commit(s) and 23 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/certifi 2024.12.14 🟢 7.2
Details
CheckScoreReason
Code-Review🟢 6Found 2/3 approved changesets -- score normalized to 6
Binary-Artifacts🟢 10no binaries found in the repo
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained🟢 1015 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies🟢 5dependency not pinned by hash detected -- score normalized to 5
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Vulnerabilities🟢 100 existing vulnerabilities detected
Signed-Releases⚠️ -1no releases found
License🟢 9license file detected
Fuzzing⚠️ 0project is not fuzzed
Packaging🟢 10packaging workflow detected
Branch-Protection🟢 3branch protection is not maximal on development and all release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/httpx 0.28.1 🟢 6.7
Details
CheckScoreReason
Maintained🟢 1030 commit(s) and 18 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Code-Review🟢 5Found 15/29 approved changesets -- score normalized to 5
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Vulnerabilities🟢 100 existing vulnerabilities detected
Security-Policy🟢 10security policy file detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/pontos 24.12.3 🟢 7.1
Details
CheckScoreReason
Binary-Artifacts🟢 10no binaries found in the repo
Branch-Protection🟢 8branch protection is not maximal on development and all release branches
CI-Tests🟢 1016 out of 16 merged PRs checked by a CI test -- score normalized to 10
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Code-Review🟢 3Found 5/13 approved changesets -- score normalized to 3
Contributors🟢 6project has 2 contributing companies or organizations -- score normalized to 6
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Dependency-Update-Tool🟢 10update tool detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging🟢 10packaging workflow detected
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
SAST🟢 10SAST tool is run on all commits
Security-Policy⚠️ 0security policy file not detected
Signed-Releases🟢 85 out of the last 5 releases have a total of 5 signed artifacts.
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Vulnerabilities🟢 100 existing vulnerabilities detected
pip/ruff 0.8.3 UnknownUnknown
pip/six 1.17.0 🟢 5.1
Details
CheckScoreReason
Code-Review🟢 3Found 9/30 approved changesets -- score normalized to 3
Maintained🟢 810 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 8
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 10license file detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Vulnerabilities🟢 100 existing vulnerabilities detected
Branch-Protection⚠️ 0branch protection not enabled on development/release branches
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0

Scanned Files

  • poetry.lock

Copy link

Conventional Commits Report

Type Number
Dependencies 1

🚀 Conventional commits found.

Copy link
Contributor Author

dependabot bot commented on behalf of github Dec 23, 2024

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Dec 23, 2024
@dependabot dependabot bot deleted the dependabot/pip/python-packages-4a34064808 branch December 23, 2024 04:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants