Skip to content

Bump the python-dependencies group across 1 directory with 4 updates - #5

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-dependencies-3ffd51d63e
Open

Bump the python-dependencies group across 1 directory with 4 updates#5
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/python-dependencies-3ffd51d63e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the python-dependencies group with 4 updates in the / directory: cryptography, uvicorn, ruff and pyinstaller.

Updates cryptography from 46.0.7 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

Updates uvicorn from 0.52.3 to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Changelog

Sourced from uvicorn's changelog.

0.52.4 (August 18, 2026)

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
Commits

Updates ruff from 0.16.3 to 0.16.4

Release notes

Sourced from ruff's releases.

0.16.4

Release Notes

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)

Documentation

  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)

Other changes

  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.4

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)

Documentation

  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)

Other changes

  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)

Contributors

... (truncated)

Commits

Updates pyinstaller from 6.21.0 to 6.22.2

Release notes

Sourced from pyinstaller's releases.

v6.22.2

Please see the v6.22.2 section of the changelog for a list of the changes since v6.22.1.

v6.22.1

Please see the v6.22.1 section of the changelog for a list of the changes since v6.22.0.

v6.22.0

Please see the v6.22.0 section of the changelog for a list of the changes since v6.21.0.

Changelog

Sourced from pyinstaller's changelog.

6.22.2 (2026-08-17)

Bugfix


* (Windows) Fix spurious security validation error when a ``onefile``
  executable is launched from a symlinked directory or a junction.
  (:issue:`9508`)

6.22.1 (2026-08-15)


Bugfix

  • Fix invalid spec file generation when :option:--hide-console option is given (regression introduced in v6.22.0). (:issue:9503)
  • (NetBSD) Fix binary dependency analysis. (:issue:9505)
  • (NetBSD) Fix/improve NetBSD support: add the is_netbsd platform flag, treat NetBSD as a Unix platform, and search /usr/local/lib for shared libraries, as is already done for FreeBSD and OpenBSD. (:issue:9496)
  • (OpenBSD) Fix binary dependency analysis. (:issue:9505)

Incompatible Changes


* (POSIX) Executables built in ``onedir`` mode with ``setuid`` bit set
  now validate the owner and permissions on their contents directory
  (typically the ``_internal`` directory); the owner ID must match the
  effective user ID under which the process is running, and the
  permissions on the directory need to be `0700`. This aims to prevent
  unprivileged users from modifying contents of an application that
  runs in privileged mode. (:issue:`9492`)
* (POSIX) When running as a ``onefile`` child process (on POSIX platforms
  other than OpenBSD and AIX), the bootloader now attempts to verify
  the parent process executable via ``procfs`` lookup. This check is
  mandatory for ``onefile`` executables with ``setuid`` bit set; if the
  relevant ``procfs`` entry is inaccessible (for example, due to ``procfs``
  not being mounted, as is the case on FreeBSD by default, or due to access
  being blocked by local security policy), the process will exit with
  security validation error message. For regular ``onefile`` executables
  (without ``setuid`` bit set), the parent-process check is enforced when the
  relevant ``procfs`` entry is accessible, and skipped when it happens to be
  inaccessible. (:issue:`9492`)
* (POSIX) When running as a ``onefile`` child process and the executable
  has ``setuid`` bit set, the bootloader now validates the owner and
  permissions on the (inherited) temporary directory. The owner ID of the
</tr></table>

... (truncated)

Commits
  • 19f42e7 Release v6.22.2. [skip ci]
  • 72bbdb4 bootloader: Windows: use QueryFullProcessImageNameW for executable resolution
  • 0d6941c tests: add test to ensure security validation works with symlinked executables
  • 6e00368 Tests: Requirements: Scheduled weekly dependency update for week 33 (#9506)
  • 22ea0f2 Release v6.22.1. [skip ci]
  • e709c04 bootloader: relax parent-process validation requirements on POSIX platforms
  • e0388d3 bootloader: relax parent-process validation requirements on FreeBSD
  • 92afdf8 tests: test_application_home_directory_hijack: handle 8.3 short paths
  • 4b509a2 tests: improve logging in test_application_home_directory_hijack
  • 66b0249 doc: document the new security validation and its implications
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python-dependencies group across 1 directory with 4 updates
526f943 
Bumps the python-dependencies group with 4 updates in the / directory: [cryptography](https://github.com/pyca/cryptography), [uvicorn](https://github.com/Kludex/uvicorn), [ruff](https://github.com/astral-sh/ruff) and [pyinstaller](https://github.com/pyinstaller/pyinstaller).


Updates `cryptography` from 46.0.7 to 50.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@46.0.7...50.0.0)

Updates `uvicorn` from 0.52.3 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.3...0.52.4)

Updates `ruff` from 0.16.3 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.3...0.16.4)

Updates `pyinstaller` from 6.21.0 to 6.22.2
- [Release notes](https://github.com/pyinstaller/pyinstaller/releases)
- [Changelog](https://github.com/pyinstaller/pyinstaller/blob/develop/doc/CHANGES.rst)
- [Commits](pyinstaller/pyinstaller@v6.21.0...v6.22.2)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-dependencies
- dependency-name: uvicorn
  dependency-version: 0.52.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: ruff
  dependency-version: 0.16.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pyinstaller
  dependency-version: 6.22.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 23, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants