chore(deps): bump the python-packages group in /mutate with 16 updates #1093

dependabot · 2025-03-18T13:15:31Z

Bumps the python-packages group in /mutate with 16 updates:

Package	From	To
pyjwt	`2.8.0`	`2.10.1`
requests	`2.31.0`	`2.32.3`
docker	`6.1.3`	`7.1.0`
jinja2	`3.1.2`	`3.1.6`
psycopg2-binary	`2.9.9`	`2.9.10`
pycryptodome	`3.19.0`	`3.22.0`
cryptography	`41.0.4`	`44.0.2`
certifi	`2023.7.22`	`2025.1.31`
cffi	`1.16.0`	`1.17.1`
charset-normalizer	`3.3.1`	`3.4.1`
idna	`3.7`	`3.10`
markupsafe	`2.1.3`	`3.0.2`
packaging	`23.2`	`24.2`
pycparser	`2.21`	`2.22`
urllib3	`2.0.7`	`2.3.0`
websocket-client	`1.6.4`	`1.8.0`

Updates pyjwt from 2.8.0 to 2.10.1

Release notes

Sourced from pyjwt's releases.

2.10.1

Fixed

Prevent partial matching of iss claim. Thanks @fabianbadoi! (See: GHSA-75c5-xw7c-p5pm)

Full Changelog: jpadilla/pyjwt@2.10.0...2.10.1

2.10.0

What's Changed

chore: use sequence for typing rather than list by @imnotjames in jpadilla/pyjwt#970

Add support for Python 3.13 by @hugovk in jpadilla/pyjwt#972

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in jpadilla/pyjwt#971

Add an RTD config file to resolve RTD build failures by @kurtmckee in jpadilla/pyjwt#977

docs: Update iat exception docs by @pachewise in jpadilla/pyjwt#974

Remove algorithm requirement for JWT API by @luhn in jpadilla/pyjwt#975

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in jpadilla/pyjwt#978

Create SECURITY.md by @auvipy in jpadilla/pyjwt#973

docs fix: decode_complete scope and algorithms by @RbnRncn in jpadilla/pyjwt#982

fix doctest for docs/usage.rst by @pachewise in jpadilla/pyjwt#986

fix test_utils.py not to xfail by @pachewise in jpadilla/pyjwt#987

Correct jwt.decode audience param doc expression by @peter279k in jpadilla/pyjwt#994

Add PS256 encoding and decoding usage by @peter279k in jpadilla/pyjwt#992

Add API docs for PyJWK by @luhn in jpadilla/pyjwt#980

Refactor project configuration files from setup.cfg to pyproject.toml PEP-518 by @cleder in jpadilla/pyjwt#995

Add JWK support to JWT encode by @luhn in jpadilla/pyjwt#979

Update pre-commit hooks to lint pyproject.toml by @cleder in jpadilla/pyjwt#1002

Add EdDSA algorithm encoding/decoding usage by @peter279k in jpadilla/pyjwt#993

Ruff linter and formatter changes by @gagandeepp in jpadilla/pyjwt#1001

Validate sub and jti claims for the token by @Divan009 in jpadilla/pyjwt#1005

Add ES256 usage by @Gautam-Hegde in jpadilla/pyjwt#1003

Encode EC keys with a fixed bit length by @way-dave in jpadilla/pyjwt#990

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in jpadilla/pyjwt#1000

Drop support for Python 3.8 by @kkirsche in jpadilla/pyjwt#1007

Prepare 2.10.0 release by @benvdh in jpadilla/pyjwt#1011

Bump codecov/codecov-action from 4 to 5 by @dependabot in jpadilla/pyjwt#1014

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci in jpadilla/pyjwt#1006

New Contributors

@imnotjames made their first contribution in jpadilla/pyjwt#970

@kurtmckee made their first contribution in jpadilla/pyjwt#977

@pachewise made their first contribution in jpadilla/pyjwt#974

@RbnRncn made their first contribution in jpadilla/pyjwt#982

@peter279k made their first contribution in jpadilla/pyjwt#994

@cleder made their first contribution in jpadilla/pyjwt#995

@gagandeepp made their first contribution in jpadilla/pyjwt#1001

@Divan009 made their first contribution in jpadilla/pyjwt#1005

@Gautam-Hegde made their first contribution in jpadilla/pyjwt#1003

@way-dave made their first contribution in jpadilla/pyjwt#990

Full Changelog: jpadilla/pyjwt@2.9.0...2.10.0

... (truncated)

Changelog

Sourced from pyjwt's changelog.

v2.10.1 <https://github.com/jpadilla/pyjwt/compare/2.10.0...2.10.1>__

Fixed
- Prevent partial matching of `iss` claim by @fabianbadoi in `GHSA-75c5-xw7c-p5pm <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm>`__
v2.10.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.9.0...2.10.0&gt;__
Changed
Remove algorithm requirement from JWT API, instead relying on JWS API for enforcement, by @luhn in [#975](https://github.com/jpadilla/pyjwt/issues/975) <https://github.com/jpadilla/pyjwt/pull/975>__

Use Sequence for parameter types rather than List where applicable by @imnotjames in [#970](https://github.com/jpadilla/pyjwt/issues/970) <https://github.com/jpadilla/pyjwt/pull/970>__

Add JWK support to JWT encode by @luhn in [#979](https://github.com/jpadilla/pyjwt/issues/979) <https://github.com/jpadilla/pyjwt/pull/979>__

Encoding and decoding payloads using the none algorithm by @jpadilla in #c2629f6 <https://github.com/jpadilla/pyjwt/commit/c2629f66c593459e02616048443231ccbe18be16>

Before:

.. code-block:: pycon

import jwt jwt.encode({"payload": "abc"}, key=None, algorithm=None)

After:

.. code-block:: pycon

import jwt jwt.encode({"payload": "abc"}, key=None, algorithm="none")

Added validation for 'sub' (subject) and 'jti' (JWT ID) claims in tokens by @Divan009 in [#1005](https://github.com/jpadilla/pyjwt/issues/1005) <https://github.com/jpadilla/pyjwt/pull/1005>__

Refactor project configuration files from setup.cfg to pyproject.toml by @cleder in [#995](https://github.com/jpadilla/pyjwt/issues/995) <https://github.com/jpadilla/pyjwt/pull/995>__

Ruff linter and formatter changes by @gagandeepp in [#1001](https://github.com/jpadilla/pyjwt/issues/1001) <https://github.com/jpadilla/pyjwt/pull/1001>__

Drop support for Python 3.8 (EOL) by @kkirsche in [#1007](https://github.com/jpadilla/pyjwt/issues/1007) <https://github.com/jpadilla/pyjwt/pull/1007>__

Fixed
- Encode EC keys with a fixed bit length by @etianen in `[#990](https://github.com/jpadilla/pyjwt/issues/990) <https://github.com/jpadilla/pyjwt/pull/990>`__
- Add an RTD config file to resolve Read the Docs build failures by @kurtmckee in `[#977](https://github.com/jpadilla/pyjwt/issues/977) <https://github.com/jpadilla/pyjwt/pull/977>`__
- Docs: Update ``iat`` exception docs by @pachewise in `[#974](https://github.com/jpadilla/pyjwt/issues/974) <https://github.com/jpadilla/pyjwt/pull/974>`__
- Docs: Fix ``decode_complete`` scope and algorithms by @RbnRncn in `[#982](https://github.com/jpadilla/pyjwt/issues/982) <https://github.com/jpadilla/pyjwt/pull/982>`__
- Fix doctest for ``docs/usage.rst`` by @pachewise in `[#986](https://github.com/jpadilla/pyjwt/issues/986) <https://github.com/jpadilla/pyjwt/pull/986>`__
</tr></table> 

... (truncated)

Commits

3ebbb22 fix lint
37748dc update changelog
33022c2 Merge commit from fork
783f324 [pre-commit.ci] pre-commit autoupdate (#1006)
0116fc6 Bump codecov/codecov-action from 4 to 5 (#1014)
b032353 feat: surface jwt.decode_complete(...)
a759c45 Prepare 2.10.0 release (#1011)
b6b8bce Drop support for Python 3.8 (#1007)
189c256 Update index.rst
1900857 Update index.rst
Additional commits viewable in compare view

Updates requests from 2.31.0 to 2.32.3

Release notes

Sourced from requests's releases.

v2.32.3

2.32.3 (2024-05-29)

Bugfixes

Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of HTTPAdapter. (#6716)

Fixed issue where Requests started failing to run on Python versions compiled without the ssl module. (#6724)

v2.32.2

2.32.2 (2024-05-21)

Deprecations

To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

v2.32.1

2.32.1 (2024-05-20)

Bugfixes

Add missing test certs to the sdist distributed on PyPI.

v2.32.0

2.32.0 (2024-05-20)

🐍 PYCON US 2024 EDITION 🐍

Security

Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification, regardless of the value of verify. (GHSA-9wx4-h78v-vm56)

Improvements

verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems when using a Python version built with OpenSSL 3.x. (#6667)

Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored.

... (truncated)

Changelog

Sourced from requests's changelog.

2.32.3 (2024-05-29)

Bugfixes

Fixed bug breaking the ability to specify custom SSLContexts in sub-classes of HTTPAdapter. (#6716)

Fixed issue where Requests started failing to run on Python versions compiled without the ssl module. (#6724)

2.32.2 (2024-05-21)

Deprecations

To provide a more stable migration for custom HTTPAdapters impacted by the CVE changes in 2.32.0, we've renamed _get_connection to a new public API, get_connection_with_tls_context. Existing custom HTTPAdapters will need to migrate their code to use this new API. get_connection is considered deprecated in all versions of Requests>=2.32.0.

A minimal (2-line) example has been provided in the linked PR to ease migration, but we strongly urge users to evaluate if their custom adapter is subject to the same issue described in CVE-2024-35195. (#6710)

2.32.1 (2024-05-20)

Bugfixes

Add missing test certs to the sdist distributed on PyPI.

2.32.0 (2024-05-20)

Security

Fixed an issue where setting verify=False on the first request from a Session will cause subsequent requests to the same origin to also ignore cert verification, regardless of the value of verify. (GHSA-9wx4-h78v-vm56)

Improvements

verify=True now reuses a global SSLContext which should improve request time variance between first and subsequent requests. It should also minimize certificate load time on Windows systems when using a Python version built with OpenSSL 3.x. (#6667)

Requests now supports optional use of character detection (chardet or charset_normalizer) when repackaged or vendored. This enables pip and other projects to minimize their vendoring surface area. The Response.text() and apparent_encoding APIs will default to utf-8 if neither library is present. (#6702)

... (truncated)

Commits

0e322af v2.32.3
e188799 Don't create default SSLContext if ssl module isn't present (#6724)
145b539 Merge pull request #6716 from sigmavirus24/bug/6715
b1d73dd Don't use default SSLContext with custom poolmanager kwargs
6badbac Update HISTORY.md
a62a2d3 Allow for overriding of specific pool key params
88dce9d v2.32.2
c98e4d1 Merge pull request #6710 from nateprewitt/api_rename
92075b3 Add deprecation warning
aa1461b Move _get_connection to get_connection_with_tls_context
Additional commits viewable in compare view

Updates docker from 6.1.3 to 7.1.0

Release notes

Sourced from docker's releases.

7.1.0

Upgrade Notes

Bumped minimum engine API version to 1.24

Bumped default engine API version to 1.44 (Moby 25.0)

Bugfixes

Fixed issue with tag parsing when the registry address includes ports that resulted in invalid tag format errors

Fixed issue preventing creating new configs (ConfigCollection), which failed with a KeyError due to the name field

Fixed an issue due to an update in the requests package breaking docker-py by applying the suggested fix

Miscellaneous

Documentation improvements

Updated Ruff (linter) and fixed minor linting issues

Packaging/CI updates

Started using hatch for packaging (https://github.com/pypa/hatch)

Updated setup-python github action

Updated tests

Stopped checking for deprecated container and image related fields (Container and ContainerConfig)

Updated tests that check NetworkSettings.Networks.<network>.Aliases due to engine changes

What's Changed

Bump default API version to 1.43 (Moby 24.0) by @vvoland in docker/docker-py#3199

integration/commit: Don't check for deprecated fields by @vvoland in docker/docker-py#3203

fix: tag regex should allow ports by @artificial-intelligence in docker/docker-py#3196

utils: Fix datetime_to_timestamp by @vvoland in docker/docker-py#3208

fix: keyerror when creating new config(#3110) by @Khushiyant in docker/docker-py#3200

Update Ruff, fix some minor issues by @akx in docker/docker-py#3206

docs: change image.history() return type to list (#3076) by @Khushiyant in docker/docker-py#3202

lint: fix string formatting by @milas in docker/docker-py#3211

Drop packaging dependency by @akx in docker/docker-py#3205

Bump default API version to 1.44 (Moby 25.0) by @vvoland in docker/docker-py#3231

Modernize build to use hatchling and hatch-vcs by @akx in docker/docker-py#3207

Enable Ruff I (import sort), autofix by @akx in docker/docker-py#3212

chore(ci): fix-ups across Make / Docker / GitHub Actions by @milas in docker/docker-py#3241

chore: fix return type docs for container.logs() by @BobDu in docker/docker-py#2240

CI fix by @krissetto in docker/docker-py#3260

Fix for requests 2.32 by @felixfontein in docker/docker-py#3257

Added 7.1.0 changelog by @krissetto in docker/docker-py#3262

Fix env var name in release pipeline by @krissetto in docker/docker-py#3263

Change env var name in release pipeline to match hatch expectations by @krissetto in docker/docker-py#3264

New Contributors

@vvoland made their first contribution in docker/docker-py#3199

@artificial-intelligence made their first contribution in docker/docker-py#3196

@Khushiyant made their first contribution in docker/docker-py#3200

@BobDu made their first contribution in docker/docker-py#2240

@krissetto made their first contribution in docker/docker-py#3260

Full Changelog: docker/docker-py@7.0.0...7.1.0

... (truncated)

Commits

a365202 Merge pull request #3264 from krissetto/rename-env-var-in-release-pipeline
1ab40c8 Fix env var name in release pipeline to match hatch expectations
b33088e Merge pull request #3263 from krissetto/fix-release-pipeline
45488ac Fix env var name in release pipeline
20879ec Merge pull request #3262 from krissetto/changelog-7.1.0
4f2a26d Added 7.1.0 changelog
7785ad9 Merge pull request #3257 from felixfontein/requests-hotfix
d8e9bcb requests 2.32.0 and 2.32.1 have been yanked.
2a059a9 Extend fix to requests 2.32.2+.
e33e0a4 Hotfix for requests 2.32.0.
Additional commits viewable in compare view

Updates jinja2 from 3.1.2 to 3.1.6

Release notes

Sourced from jinja2's releases.

3.1.6

This is the Jinja 3.1.6 security release, which fixes security issues but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Jinja2/3.1.6/ Changes: https://jinja.palletsprojects.com/en/stable/changes/#version-3-1-6

The |attr filter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. GHSA-cpwx-vrp4-4pq7

3.1.5

This is the Jinja 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Jinja2/3.1.5/ Changes: https://jinja.palletsprojects.com/changes/#version-3-1-5 Milestone: https://github.com/pallets/jinja/milestone/16?closed=1

The sandboxed environment handles indirect calls to str.format, such as by passing a stored reference to a filter that calls its argument. GHSA-q2x7-8rv6-6q7h

Escape template name before formatting it into error messages, to avoid issues with names that contain f-string syntax. #1792, GHSA-gmj6-6f8f-6699

Sandbox does not allow clear and pop on known mutable sequence types. #2032

Calling sync render for an async template uses asyncio.run. #1952

Avoid unclosed auto_aiter warnings. #1960

Return an aclose-able AsyncGenerator from Template.generate_async. #1960

Avoid leaving root_render_func() unclosed in Template.generate_async. #1960

Avoid leaving async generators unclosed in blocks, includes and extends. #1960

The runtime uses the correct concat function for the current environment when calling block references. #1701

Make |unique async-aware, allowing it to be used after another async-aware filter. #1781

|int filter handles OverflowError from scientific notation. #1921

Make compiling deterministic for tuple unpacking in a {% set ... %} call. #2021

Fix dunder protocol (copy/pickle/etc) interaction with Undefined objects. #2025

Fix copy/pickle support for the internal missing object. #2027

Environment.overlay(enable_async) is applied correctly. #2061

The error message from FileSystemLoader includes the paths that were searched. #1661

PackageLoader shows a clearer error message when the package does not contain the templates directory. #1705

Improve annotations for methods returning copies. #1880

urlize does not add mailto: to values like @a@b. #1870

Tests decorated with @pass_context can be used with the |select filter. #1624

Using set for multiple assignment (a, b = 1, 2) does not fail when the target is a namespace attribute. #1413

Using set in all branches of {% if %}{% elif %}{% else %} blocks does not cause the variable to be considered initially undefined. #1253

3.1.4

This is the Jinja 3.1.4 security release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes.

PyPI: https://pypi.org/project/Jinja2/3.1.4/ Changes: https://jinja.palletsprojects.com/en/3.1.x/changes/#version-3-1-4

The xmlattr filter does not allow keys with / solidus, > greater-than sign, or = equals sign, in addition to disallowing spaces. Regardless of any validation done by Jinja, user input should never be used as keys to this filter, or must be separately validated first. GHSA-h75v-3vvj-5mfj

3.1.3

This is a fix release for the 3.1.x feature branch.

Fix for GHSA-h5c8-rqwp-cp95. You are affected if you are using xmlattr and passing user input as attribute keys.

... (truncated)

Changelog

Sourced from jinja2's changelog.

Version 3.1.6

Released 2025-03-05

The |attr filter does not bypass the environment's attribute lookup, allowing the sandbox to apply its checks. :ghsa:cpwx-vrp4-4pq7

Version 3.1.5

Released 2024-12-21

The sandboxed environment handles indirect calls to str.format, such as by passing a stored reference to a filter that calls its argument. :ghsa:q2x7-8rv6-6q7h

Escape template name before formatting it into error messages, to avoid issues with names that contain f-string syntax. :issue:1792, :ghsa:gmj6-6f8f-6699

Sandbox does not allow clear and pop on known mutable sequence types. :issue:2032

Calling sync render for an async template uses asyncio.run. :pr:1952

Avoid unclosed auto_aiter warnings. :pr:1960

Return an aclose-able AsyncGenerator from Template.generate_async. :pr:1960

Avoid leaving root_render_func() unclosed in Template.generate_async. :pr:1960

Avoid leaving async generators unclosed in blocks, includes and extends. :pr:1960

The runtime uses the correct concat function for the current environment when calling block references. :issue:1701

Make |unique async-aware, allowing it to be used after another async-aware filter. :issue:1781

|int filter handles OverflowError from scientific notation. :issue:1921

Make compiling deterministic for tuple unpacking in a {% set ... %} call. :issue:2021

Fix dunder protocol (copy/pickle/etc) interaction with Undefined objects. :issue:2025

Fix copy/pickle support for the internal missing object. :issue:2027

Environment.overlay(enable_async) is applied correctly. :pr:2061

The error message from FileSystemLoader includes the paths that were searched. :issue:1661

PackageLoader shows a clearer error message when the package does not contain the templates directory. :issue:1705

Improve annotations for methods returning copies. :pr:1880

urlize does not add mailto: to values like @a@b. :pr:1870

... (truncated)

Commits

1520688 release version 3.1.6
90457bb Merge commit from fork
065334d attr filter uses env.getattr
033c200 start version 3.1.6
bc68d4e use global contributing guide (#2070)
247de5e use global contributing guide
ab8218c use project advisory link instead of global
b4ffc8f release version 3.1.5 (#2066)
877f6e5 release version 3.1.5
8d58859 remove test pypi
Additional commits viewable in compare view

Updates psycopg2-binary from 2.9.9 to 2.9.10

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Add support for Python 3.13.

Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).

~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.

Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

Add support for Python 3.12.

Drop support for Python 3.6.

What's new in psycopg 2.9.8 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

Wheel package bundled with PostgreSQL 16 libpq in order to add support for recent features, such as sslcertmode.

What's new in psycopg 2.9.7 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

Fix propagation of exceptions raised during module initialization (:ticket:[#1598](https://github.com/psycopg/psycopg2/issues/1598)).

Fix building when pg_config returns an empty string (:ticket:[#1599](https://github.com/psycopg/psycopg2/issues/1599)).

Wheel package bundled with OpenSSL 1.1.1v.

What's new in psycopg 2.9.6 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

Package manylinux 2014 for aarch64 and ppc64le platforms, in order to include libpq 15 in the binary package (:ticket:[#1396](https://github.com/psycopg/psycopg2/issues/1396)).

Wheel package bundled with OpenSSL 1.1.1t.

What's new in psycopg 2.9.5 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

Add support for Python 3.11.

Add support for rowcount in MERGE statements in binary packages (:ticket:[#1497](https://github.com/psycopg/psycopg2/issues/1497)).

... (truncated)

Commits

a805acf chore: bump to version 2.9.10
78561ac Merge pull request #1728 from romank0/fetch-notifications-on-commit
5283a83 chore: add TransactionTimeout error, added in PostgreSQL 17
f64dd39 docs: add news entry about notifications on commit
cba6d39 removes duplication in tests
282360d adds notifications processing after every PQexec
362cb00 Adds notifies processing in pq_commit
eaeeb76 Merge pull request #1729 from edgarrmondragon/1692-py313-wheels
4987362 ci(windows): drop Python 3.8 packages
8c9a35d ci: test with PostgreSQL 17
Additional commits viewable in compare view

Updates pycryptodome from 3.19.0 to 3.22.0

Release notes

Sourced from pycryptodome's releases.

v3.22.0 - Caen

New features

Added support for HPKE (RFC 9180).

Resolved issues

GH#812: CCM ciphers will now fail before encrypting (or decrypting) data beyond the limit imposed by the nonce length.

GH#846: fix infinite loop with RC4 for data larger than 4GB.

GH#852: handle correctly invalid PEM files with less than 3 lines.

Other changes

Remove support for Python 3.6.

v3.21.0 - Bourdeaux

New features

By setting the PYCRYPTODOME_DISABLE_GMP environment variable, the GMP library will not be used even if detected.

Add support for Curve25519 / X25519.

Add support for Curve448 / X448.

Add attribute curve to EccPoint and EccXPoint classes, with the canonical name of the curve.

GH#781: the label for the SP800_108_Counter KDF may now contain zero bytes. Thanks to Julien Rische.

GH#814: RSA keys for PSS can be imported.

Resolved issues

GH#810: fixed negation of Ed25519 points.

GH#819: accept an RFC5916 ECPrivateKey even if it doesn't contain any of the optional elements (parameters [0] and publicKey[1]).

Other changes

Remove support for Python 3.5.

v3.20.0 - Amiens

New features

Added support for TurboSHAKE128 and TurboSHAKE256.

Added method Crypto.Hash.new() to generate a hash object given a hash name.

Added support for AES-GCM encryption of PBES2 and PKCS#8 containers.

Added support for SHA-2 and SHA-3 algorithms in PBKDF2 when creating PBES2 and PKCS#8 containers.

... (truncated)

Changelog

Sourced from pycryptodome's changelog.

3.22.0 (16 March 2025) ++++++++++++++++++++++++++

New features

Added support for HPKE (RFC 9180).

Resolved issues

GH#812: CCM ciphers will now fail before encrypting (or decrypting) data beyond the limit imposed by the nonce length.

GH#846: fix infinite loop with RC4 for data larger than 4GB.

GH#852: handle correctly invalid PEM files with less than 3 lines.

Other changes

Remove support for Python 3.6.

3.21.0 (30 September 2024) ++++++++++++++++++++++++++

New features

By setting the PYCRYPTODOME_DISABLE_GMP environment variable, the GMP library will not be used even if detected.

Add support for Curve25519 / X25519.

Add support for Curve448 / X448.

Add attribute curve to EccPoint and EccXPoint classes, with the canonical name of the curve.

GH#781: the label for the SP800_108_Counter KDF may now contain zero bytes. Thanks to Julien Rische.

GH#814: RSA keys for PSS can be imported.

Resolved issues

GH#810: fixed negation of Ed25519 points.

GH#819: accept an RFC5916 ECPrivateKey even if it doesn't contain any of the optional elements (parameters [0] and publicKey[1]).

Other changes

Remove support for Python 3.5.

3.20.0 (9 January 2024) ++++++++++++++++++++++++++

New features

Added support for TurboSHAKE128 and TurboSHAKE256.

... (truncated)

Commits

e1f06ed Include OS and package type in the wheels archive
208d281 Bump version
f277db8 Fix typing info
75dc6e0 Fix GH#812: CCM will now fail before en/decrypting too much data
eac9de8 Fix GH#852: a PEM file must have at least 3 lines
46bf040 Clarify how ChaCha20.seek() can be used to seek to blocks
fd3c7f2 Some clarifications for SecretSharing
967938f Update Changelog
f979abf GH#846: fix infinite loop with RC4 for data larger than 4GB
291400c Stress that passwords should not be used as PSK
Additional commits viewable in compare view

Updates cryptography from 41.0.4 to 44.0.2

Changelog

Sourced from cryptography's changelog.

44.0.2 - 2025-03-01

* We now build wheels for PyPy 3.11. .. _v44-0-1:

44.0.1 - 2025-02-11

Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.1.
We now build armv7l manylinux wheels and publish them to PyPI.
We now build manylinux_2_34 wheels and publish them to PyPI.

.. _v44-0-0:

44.0.0 - 2024-11-27

* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 3.9. * Deprecated Python 3.7 support. Python 3.7 is no longer supported by the Python core team. Support for Python 3.7 will be removed in a future ``cryptography`` release. * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.0. * macOS wheels are now built against the macOS 10.13 SDK. Users on older versions of macOS should upgrade, or they will need to build ``cryptography`` themselves. * Enforce the :rfc:`5280` requirement that extended key usage extensions must not be empty. * Added support for timestamp extraction to the :class:`~cryptography.fernet.MultiFernet` class. * Relax the Authority Key Identifier requirements on root CA certificates during X.509 verification to allow fields permitted by :rfc:`5280` but forbidden by the CA/Browser BRs. * Added support for :class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` when using OpenSSL 3.2.0+. * Added support for the :class:`~cryptography.x509.Admissions` certificate extension. * Added basic support for PKCS7 decryption (including S/MIME 3.2) via :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`, :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_pem`, and :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_smime`. .. _v43-0-3:

43.0.3 - 2024-10-18

Fixed release metadata for cryptography-vectors

.. _v43-0-2:

... (truncated)

Commits

56cfce6 44.0.2 release (#12537)
7b4cc26 Backport PyPy3.11 support (#12536)
adaaaed Bump for 44.0.1 release (#12441)
ccc61da [backport] test and build on armv7l (#12420) (#12431)
f299a48 remove deprecated call (#12052)
439eb05 Bump version for 44.0.0 (#12051)
2c5ad4d chore(deps): bump maturin from 1.7.4 to 1.7.5 in /.github/requirements (#12050)
d23968a chore(deps): bump libc from 0.2.165 to 0.2.166 (#12049)
133c0e0 Bump x509-limbo and/or wycheproof in CI (#12047)
f2259d7 Bump BoringSSL and/or OpenSSL in CI (#12046)
Additional commits viewable in compare view

Updates certifi from 2023.7.22 to 2025.1.31

Commits

088f931 2025.01.31 (#336)
1c17795 Bump pypa/gh-action-pypi-publish from 1.12.3 to 1.12.4 (#335)
a2e88f0 Bump actions/upload-artifact from 4.5.0 to 4.6.0 (#334)
82284ed Bump peter-evans/create-pull-request from 7.0.5 to 7.0.6 (#333)
10d3d1d Bump actions/upload-artifact from 4.4.3 to 4.5.0 (#332)
4ba3900 2024.12.14 (#329)
9164660 Bump pypa/gh-action-pypi-publish from 1.12.2 to 1.12.3 (#331)
3dc3651 Bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.2 (#328)
c5bf18d Bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0 (#327)
b908391 Bump actions/setup-python from 5.2.0 to 5.3.0 (#326)
Additional commits viewable in compare view

Updates cffi from 1.16.0 to 1.17.1

Release notes

Sourced from cffi's releases.

v1.17.1

Fix failing distutils.msvc9compiler imports under Windows (#118).

ffibuilder.emit_python_code() and ffibuiler.emit_c_code() accept file-like objects (#115).

ffiplatform calls are bypassed by ffibuilder.emit_python_code() and ffibuilder.emit_c_code() (#81).

Full Changelog: python-cffi/cffi@v1.17.0...v1.17.1

v1.17.0

Add support for Python 3.13.

Free-threaded CPython builds (i.e. python3.13t and the 3.13t ABI) are not currently supported.

In API mode, when you get a function from a C library by writing fn = lib.myfunc, you get an object of a special type for performance reasons, instead of a <cdata 'C-function-type'>. Before version 1.17 you could only call such objects. You could write ffi.addressof(lib, "myfunc") in order to get a real <cdata> object, based on the idea that in these cases in C you'd usually write &myfunc instead of myfunc. In version 1.17, the special object lib.myfunc can now be passed in many places where CFFI expects a regular <cdata> object. For example, you can now pass it as a callback to a C function call, or write it inside a C structure field of the correct pointer-to-function type, or use ffi.cast() or ffi.typeof() on it.

Full Changelog: python-cffi/cffi@v1.16.0...v1.17.0

v1.17.0rc1

Add support for Python 3.13.

In API mode, when you get a function from a C library by writing fn = lib.myfunc, you get an object of a special type for performance reasons, instead of a object. For example, you can now pass it as a callback to a C function call, or write it inside a C structure field of the correct pointer-to-function type, or use ffi.cast() or ffi.typeof() on it.

Build wheels for ...
Description has been truncated

Bumps the python-packages group in /mutate with 16 updates: | Package | From | To | | --- | --- | --- | | [pyjwt](https://github.com/jpadilla/pyjwt) | `2.8.0` | `2.10.1` | | [requests](https://github.com/psf/requests) | `2.31.0` | `2.32.3` | | [docker](https://github.com/docker/docker-py) | `6.1.3` | `7.1.0` | | [jinja2](https://github.com/pallets/jinja) | `3.1.2` | `3.1.6` | | [psycopg2-binary](https://github.com/psycopg/psycopg2) | `2.9.9` | `2.9.10` | | [pycryptodome](https://github.com/Legrandin/pycryptodome) | `3.19.0` | `3.22.0` | | [cryptography](https://github.com/pyca/cryptography) | `41.0.4` | `44.0.2` | | [certifi](https://github.com/certifi/python-certifi) | `2023.7.22` | `2025.1.31` | | [cffi](https://github.com/python-cffi/cffi) | `1.16.0` | `1.17.1` | | [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.3.1` | `3.4.1` | | [idna](https://github.com/kjd/idna) | `3.7` | `3.10` | | [markupsafe](https://github.com/pallets/markupsafe) | `2.1.3` | `3.0.2` | | [packaging](https://github.com/pypa/packaging) | `23.2` | `24.2` | | [pycparser](https://github.com/eliben/pycparser) | `2.21` | `2.22` | | [urllib3](https://github.com/urllib3/urllib3) | `2.0.7` | `2.3.0` | | [websocket-client](https://github.com/websocket-client/websocket-client) | `1.6.4` | `1.8.0` | Updates `pyjwt` from 2.8.0 to 2.10.1 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.8.0...2.10.1) Updates `requests` from 2.31.0 to 2.32.3 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.31.0...v2.32.3) Updates `docker` from 6.1.3 to 7.1.0 - [Release notes](https://github.com/docker/docker-py/releases) - [Commits](docker/docker-py@6.1.3...7.1.0) Updates `jinja2` from 3.1.2 to 3.1.6 - [Release notes](https://github.com/pallets/jinja/releases) - [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst) - [Commits](pallets/jinja@3.1.2...3.1.6) Updates `psycopg2-binary` from 2.9.9 to 2.9.10 - [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS) - [Commits](psycopg/psycopg2@2.9.9...2.9.10) Updates `pycryptodome` from 3.19.0 to 3.22.0 - [Release notes](https://github.com/Legrandin/pycryptodome/releases) - [Changelog](https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst) - [Commits](Legrandin/pycryptodome@v3.19.0...v3.22.0) Updates `cryptography` from 41.0.4 to 44.0.2 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@41.0.4...44.0.2) Updates `certifi` from 2023.7.22 to 2025.1.31 - [Commits](certifi/python-certifi@2023.07.22...2025.01.31) Updates `cffi` from 1.16.0 to 1.17.1 - [Release notes](https://github.com/python-cffi/cffi/releases) - [Commits](python-cffi/cffi@v1.16.0...v1.17.1) Updates `charset-normalizer` from 3.3.1 to 3.4.1 - [Release notes](https://github.com/jawah/charset_normalizer/releases) - [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md) - [Commits](jawah/charset_normalizer@3.3.1...3.4.1) Updates `idna` from 3.7 to 3.10 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst) - [Commits](kjd/idna@v3.7...v3.10) Updates `markupsafe` from 2.1.3 to 3.0.2 - [Release notes](https://github.com/pallets/markupsafe/releases) - [Changelog](https://github.com/pallets/markupsafe/blob/main/CHANGES.rst) - [Commits](pallets/markupsafe@2.1.3...3.0.2) Updates `packaging` from 23.2 to 24.2 - [Release notes](https://github.com/pypa/packaging/releases) - [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst) - [Commits](pypa/packaging@23.2...24.2) Updates `pycparser` from 2.21 to 2.22 - [Release notes](https://github.com/eliben/pycparser/releases) - [Changelog](https://github.com/eliben/pycparser/blob/main/CHANGES) - [Commits](eliben/pycparser@release_v2.21...release_v2.22) Updates `urllib3` from 2.0.7 to 2.3.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.0.7...2.3.0) Updates `websocket-client` from 1.6.4 to 1.8.0 - [Release notes](https://github.com/websocket-client/websocket-client/releases) - [Changelog](https://github.com/websocket-client/websocket-client/blob/master/ChangeLog) - [Commits](websocket-client/websocket-client@v1.6.4...v1.8.0) --- updated-dependencies: - dependency-name: pyjwt dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: requests dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: docker dependency-type: direct:production update-type: version-update:semver-major dependency-group: python-packages - dependency-name: jinja2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-packages - dependency-name: psycopg2-binary dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python-packages - dependency-name: pycryptodome dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: cryptography dependency-type: direct:production update-type: version-update:semver-major dependency-group: python-packages - dependency-name: certifi dependency-type: direct:production update-type: version-update:semver-major dependency-group: python-packages - dependency-name: cffi dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: charset-normalizer dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: idna dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: markupsafe dependency-type: direct:production update-type: version-update:semver-major dependency-group: python-packages - dependency-name: packaging dependency-type: direct:production update-type: version-update:semver-major dependency-group: python-packages - dependency-name: pycparser dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: urllib3 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-packages - dependency-name: websocket-client dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python-packages ... Signed-off-by: dependabot[bot] <[email protected]>

Kbayero · 2025-06-05T21:37:48Z

Not support for updates in mutate any more

dependabot · 2025-06-05T21:37:50Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot bot added dependencies Pull requests that update a dependency file python labels Mar 18, 2025

dependabot bot force-pushed the dependabot/pip/mutate/python-packages-3d57133fa1 branch 5 times, most recently from a50bb86 to 1d3b1a4 Compare March 27, 2025 14:05

dependabot bot force-pushed the dependabot/pip/mutate/python-packages-3d57133fa1 branch 4 times, most recently from b0f9347 to 614efc2 Compare April 4, 2025 13:34

dependabot bot force-pushed the dependabot/pip/mutate/python-packages-3d57133fa1 branch 5 times, most recently from 5da6b28 to 7bc1448 Compare April 15, 2025 13:14

dependabot bot force-pushed the dependabot/pip/mutate/python-packages-3d57133fa1 branch 3 times, most recently from e095387 to cc5d959 Compare April 23, 2025 13:28

dependabot bot force-pushed the dependabot/pip/mutate/python-packages-3d57133fa1 branch 6 times, most recently from 0036737 to 9be677f Compare April 30, 2025 13:51

dependabot bot force-pushed the dependabot/pip/mutate/python-packages-3d57133fa1 branch 3 times, most recently from 0127770 to 49f05ca Compare May 7, 2025 14:02

dependabot bot force-pushed the dependabot/pip/mutate/python-packages-3d57133fa1 branch from 49f05ca to 09b8071 Compare June 3, 2025 13:37

Kbayero closed this Jun 5, 2025

dependabot bot deleted the dependabot/pip/mutate/python-packages-3d57133fa1 branch June 5, 2025 21:37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the python-packages group in /mutate with 16 updates #1093

chore(deps): bump the python-packages group in /mutate with 16 updates #1093

Uh oh!

dependabot bot commented on behalf of github Mar 18, 2025 •

edited

Loading

`v2.10.0 <https://github.com/jpadilla/pyjwt/compare/2.9.0...2.10.0>`__

Uh oh!

Kbayero commented Jun 5, 2025

Uh oh!

dependabot bot commented on behalf of github Jun 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

chore(deps): bump the python-packages group in /mutate with 16 updates #1093

chore(deps): bump the python-packages group in /mutate with 16 updates #1093

Uh oh!

Conversation

dependabot bot commented on behalf of github Mar 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

2.10.1

Fixed

2.10.0

What's Changed

New Contributors

v2.10.1 <https://github.com/jpadilla/pyjwt/compare/2.10.0...2.10.1>__

v2.10.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.9.0...2.10.0&gt;__

v2.32.3

2.32.3 (2024-05-29)

v2.32.2

2.32.2 (2024-05-21)

v2.32.1

2.32.1 (2024-05-20)

v2.32.0

2.32.0 (2024-05-20)

🐍 PYCON US 2024 EDITION 🐍

2.32.3 (2024-05-29)

2.32.2 (2024-05-21)

2.32.1 (2024-05-20)

2.32.0 (2024-05-20)

7.1.0

Upgrade Notes

Bugfixes

Miscellaneous

What's Changed

New Contributors

3.1.6

3.1.5

3.1.4

3.1.3

Version 3.1.6

Version 3.1.5

Current release

v3.22.0 - Caen

New features

Resolved issues

Other changes

v3.21.0 - Bourdeaux

New features

Resolved issues

Other changes

v3.20.0 - Amiens

New features

New features

Resolved issues

Other changes

New features

Resolved issues

Other changes

New features

v1.17.1

v1.17.0

v1.17.0rc1

Uh oh!

Kbayero commented Jun 5, 2025

Uh oh!

dependabot bot commented on behalf of github Jun 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

dependabot bot commented on behalf of github Mar 18, 2025 •

edited

Loading

`v2.10.1 <https://github.com/jpadilla/pyjwt/compare/2.10.0...2.10.1>`__

`v2.10.0 <https://github.com/jpadilla/pyjwt/compare/2.9.0...2.10.0>`__