Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump the github-actions-dependencies group in /.github/workflows with 4 updates #86

Merged
merged 1 commit into from
Aug 31, 2023
Merged

Bump the github-actions-dependencies group in /.github/workflows with 4 updates #86

merged 1 commit into from
Aug 31, 2023

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 31, 2023 •
edited
Loading

Bumps the github-actions-dependencies group in /.github/workflows with 4 updates: pip, nox-poetry, poetry and virtualenv.

Updates pip from 23.1.2 to 23.2.1

Changelog

Sourced from pip's changelog.

23.2.1 (2023-07-22)

Bug Fixes

  • Disable PEP 658 metadata fetching with the legacy resolver. ([#12156](https://github.com/pypa/pip/issues/12156) <https://github.com/pypa/pip/issues/12156>_)

23.2 (2023-07-15)

Process

  • Deprecate support for eggs for Python 3.11 or later, when the new importlib.metadata backend is used to load distribution metadata. This only affects the egg distribution format (with the .egg extension); distributions using the .egg-info metadata format (but are not actually eggs) are not affected. For more information about eggs, see relevant section in the setuptools documentation <https://setuptools.pypa.io/en/stable/deprecated/python_eggs.html>__.

Deprecations and Removals

  • Deprecate legacy version and version specifiers that don't conform to PEP 440 <https://peps.python.org/pep-0440/>_ ([#12063](https://github.com/pypa/pip/issues/12063) <https://github.com/pypa/pip/issues/12063>_)
  • freeze no longer excludes the setuptools, distribute, and wheel from the output when running on Python 3.12 or later, where they are not included in a virtual environment by default. Use --exclude if you wish to exclude any of these packages. ([#4256](https://github.com/pypa/pip/issues/4256) <https://github.com/pypa/pip/issues/4256>_)

Features

  • make rejection messages slightly different between 1 and 8, so the user can make the difference. ([#12040](https://github.com/pypa/pip/issues/12040) <https://github.com/pypa/pip/issues/12040>_)

Bug Fixes

  • Fix pip completion --zsh. ([#11417](https://github.com/pypa/pip/issues/11417) <https://github.com/pypa/pip/issues/11417>_)
  • Prevent downloading files twice when PEP 658 metadata is present ([#11847](https://github.com/pypa/pip/issues/11847) <https://github.com/pypa/pip/issues/11847>_)
  • Add permission check before configuration ([#11920](https://github.com/pypa/pip/issues/11920) <https://github.com/pypa/pip/issues/11920>_)
  • Fix deprecation warnings in Python 3.12 for usage of shutil.rmtree ([#11957](https://github.com/pypa/pip/issues/11957) <https://github.com/pypa/pip/issues/11957>_)
  • Ignore invalid or unreadable origin.json files in the cache of locally built wheels. ([#11985](https://github.com/pypa/pip/issues/11985) <https://github.com/pypa/pip/issues/11985>_)
  • Fix installation of packages with PEP658 metadata using non-canonicalized names ([#12038](https://github.com/pypa/pip/issues/12038) <https://github.com/pypa/pip/issues/12038>_)
  • Correctly parse dist-info-metadata values from JSON-format index data. ([#12042](https://github.com/pypa/pip/issues/12042) <https://github.com/pypa/pip/issues/12042>_)
  • Fail with an error if the --python option is specified after the subcommand name. ([#12067](https://github.com/pypa/pip/issues/12067) <https://github.com/pypa/pip/issues/12067>_)
  • Fix slowness when using importlib.metadata (the default way for pip to read metadata in Python 3.11+) and there is a large overlap between already installed and to-be-installed packages. ([#12079](https://github.com/pypa/pip/issues/12079) <https://github.com/pypa/pip/issues/12079>_)
  • Pass the -r flag to mercurial to be explicit that a revision is passed and protect against hg options injection as part of VCS URLs. Users that do not have control on VCS URLs passed to pip are advised to upgrade. ([#12119](https://github.com/pypa/pip/issues/12119) <https://github.com/pypa/pip/issues/12119>_)

Vendored Libraries

... (truncated)

Commits

Updates nox-poetry from 1.0.2 to 1.0.3

Release notes

Sourced from nox-poetry's releases.

v1.0.3

Changes

🪲 Fixes

📦 Dependencies

Commits
  • 82a4d7b 🔖 Release 1.0.3 (#1140)
  • 66ddf00 Include dependency groups in constraints file (#1139)
  • ac16126 Bump release-drafter/release-drafter from 5.23.0 to 5.24.0 (#1138)
  • 6ec2623 Bump pypa/gh-action-pypi-publish from 1.8.6 to 1.8.7 (#1135)
  • 437ed9a Bump crazy-max/ghaction-github-labeler from 4.0.0 to 4.1.0 (#1131)
  • 07827bd ⬆️ [dev]: Bump typing-extensions from 4.6.3 to 4.7.1 (#1137)
  • d684a1a ⬆️ [dev]: Bump mypy from 1.4.0 to 1.4.1 (#1136)
  • 5bea64f Bump actions/upload-artifact from 3.1.0 to 3.1.2 (#1132)
  • b7b5192 ⬆️ [dev]: Bump pytest from 7.3.2 to 7.4.0 (#1134)
  • 168f86a ⬆️ [dev]: Bump mypy from 1.3.0 to 1.4.0 (#1133)
  • Additional commits viewable in compare view

Updates poetry from 1.4.2 to 1.6.1

Release notes

Sourced from poetry's releases.

1.6.1

Fixed

  • Update the minimum required version of requests (#8336).

1.6.0

Added

  • Add support for repositories that do not provide a supported hash algorithm (#8118).
  • Add full support for duplicate dependencies with overlapping markers (#7257).
  • Improve performance of poetry lock for certain edge cases (#8256).
  • Improve performance of poetry install (#8031).
  • poetry check validates that specified readme files do exist (#7444).
  • Add a downgrading note when updating to an older version (#8176).
  • Add support for vox in the xonsh shell (#8203).
  • Add support for pre-commit hooks for projects where the pyproject.toml file is located in a subfolder (#8204).
  • Add support for the git+http:// scheme (#6619).

Changed

  • Drop support for Python 3.7 (#7674).
  • Move poetry lock --check to poetry check --lock and deprecate the former (#8015).
  • Change future warning that PyPI will only be disabled automatically if there are no primary sources (#8151).

Fixed

  • Fix an issue where build-system.requires were not respected for projects with build scripts (#7975).
  • Fix an issue where the encoding was not handled correctly when calling a subprocess (#8060).
  • Fix an issue where poetry show --top-level did not show top level dependencies with extras (#8076).
  • Fix an issue where poetry init handled projects with src layout incorrectly (#8218).
  • Fix an issue where Poetry wrote .pth files with the wrong encoding (#8041).
  • Fix an issue where poetry install did not respect the source if the same version of a package has been locked from different sources (#8304).

Docs

  • Document official Poetry badge (#8066).
  • Update configuration folder path for macOS (#8062).
  • Add a warning about pip ignoring lock files (#8117).
  • Clarify the use of the virtualenvs.in-project setting. (#8126).
  • Change pre-commit YAML style to be consistent with pre-commit's own examples (#8146).
  • Fix command for listing installed plugins (#8200).
  • Mention the nox-poetry package (#8173).
  • Add an example with a PyPI source in the pyproject.toml file (#8171).
  • Use reference instead of deprecated callable in the scripts example (#8211).

poetry-core (1.7.0)

  • Improve performance of marker handling (#609).
  • Allow | as a value separator in markers with the operators in and not in (#608).
  • Put pretty name (instead of normalized name) in metadata (#620).

... (truncated)

Changelog

Sourced from poetry's changelog.

[1.6.1] - 2023-08-21

Fixed

  • Update the minimum required version of requests (#8336).

[1.6.0] - 2023-08-20

Added

  • Add support for repositories that do not provide a supported hash algorithm (#8118).
  • Add full support for duplicate dependencies with overlapping markers (#7257).
  • Improve performance of poetry lock for certain edge cases (#8256).
  • Improve performance of poetry install (#8031).
  • poetry check validates that specified readme files do exist (#7444).
  • Add a downgrading note when updating to an older version (#8176).
  • Add support for vox in the xonsh shell (#8203).
  • Add support for pre-commit hooks for projects where the pyproject.toml file is located in a subfolder (#8204).
  • Add support for the git+http:// scheme (#6619).

Changed

  • Drop support for Python 3.7 (#7674).
  • Move poetry lock --check to poetry check --lock and deprecate the former (#8015).
  • Change future warning that PyPI will only be disabled automatically if there are no primary sources (#8151).

Fixed

  • Fix an issue where build-system.requires were not respected for projects with build scripts (#7975).
  • Fix an issue where the encoding was not handled correctly when calling a subprocess (#8060).
  • Fix an issue where poetry show --top-level did not show top level dependencies with extras (#8076).
  • Fix an issue where poetry init handled projects with src layout incorrectly (#8218).
  • Fix an issue where Poetry wrote .pth files with the wrong encoding (#8041).
  • Fix an issue where poetry install did not respect the source if the same version of a package has been locked from different sources (#8304).

Docs

  • Document official Poetry badge (#8066).
  • Update configuration folder path for macOS (#8062).
  • Add a warning about pip ignoring lock files (#8117).
  • Clarify the use of the virtualenvs.in-project setting. (#8126).
  • Change pre-commit YAML style to be consistent with pre-commit's own examples (#8146).
  • Fix command for listing installed plugins (#8200).
  • Mention the nox-poetry package (#8173).
  • Add an example with a PyPI source in the pyproject.toml file (#8171).
  • Use reference instead of deprecated callable in the scripts example (#8211).

poetry-core (1.7.0)

... (truncated)

Commits
  • 719831a release: bump version to 1.6.1
  • a29a53c Use requests^2.26 (#8336)
  • 0384170 release: bump version to 1.6.0
  • 146dad5 chore: update dependencies (#8332)
  • eb74d62 installer: respect source if the same version of a package has been locked fr...
  • 36332d2 solver: invert heuristics for choosing the next dependency to resolve so that...
  • 5fe3a91 fix: missing git+http:// scheme support (#6619)
  • c9292de [pre-commit.ci] pre-commit autoupdate (#8314)
  • 2b16b2f [pre-commit.ci] pre-commit autoupdate (#8281)
  • 88096ac Misc fixes (#8253)
  • Additional commits viewable in compare view

Updates virtualenv from 20.21.1 to 20.24.4

Release notes

Sourced from virtualenv's releases.

20.24.4

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.24.3...20.24.4

20.24.3

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.24.2...20.24.3

20.24.2

What's Changed

Full Changelog: pypa/virtualenv@20.24.1...20.24.2

20.24.1

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.24.0...20.24.1

... (truncated)

Changelog

Sourced from virtualenv's changelog.

v20.24.4 (2023-08-30)

Bugfixes - 20.24.4

- Upgrade embedded wheels:

    

  • setuptools to 68.1.2 from 68.1.0 on 3.8+
    • 

  • wheel to 0.41.2 from 0.41.1  on 3.7+ (:issue:2628)
    • 



v20.24.3 (2023-08-11)


Bugfixes - 20.24.3

  • Fixed ResourceWarning on exit caused by periodic update subprocess (:issue:2472)

  • Upgrade embedded wheels:

    • wheel to 0.41.1 from 0.41.0 (:issue:2622)

Misc - 20.24.3

- :issue:`2610`

v20.24.2 (2023-07-24)


Bugfixes - 20.24.2

  • Upgrade embedded wheels:

    • pip to 23.2.1 from 23.2
    • wheel to 0.41.0 from 0.40.0 (:issue:2614)

v20.24.1 (2023-07-19)

Bugfixes - 20.24.1

- Upgrade embedded wheels:

    

  • pip to 23.2 from 23.1.2 - by :user:arielkirkwood (:issue:2611)
    • 



v20.24.0 (2023-07-14)


</tr></table>

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 31, 2023
This was referenced Aug 31, 2023
Closed
Closed
@dependabot
Bump the github-actions-dependencies group
6609a9a 
Bumps the github-actions-dependencies group in /.github/workflows with 4 updates: [pip](https://github.com/pypa/pip), [nox-poetry](https://github.com/cjolowicz/nox-poetry), [poetry](https://github.com/python-poetry/poetry) and [virtualenv](https://github.com/pypa/virtualenv).


Updates `pip` from 23.1.2 to 23.2.1
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](pypa/pip@23.1.2...23.2.1)

Updates `nox-poetry` from 1.0.2 to 1.0.3
- [Release notes](https://github.com/cjolowicz/nox-poetry/releases)
- [Commits](cjolowicz/nox-poetry@v1.0.2...v1.0.3)

Updates `poetry` from 1.4.2 to 1.6.1
- [Release notes](https://github.com/python-poetry/poetry/releases)
- [Changelog](https://github.com/python-poetry/poetry/blob/master/CHANGELOG.md)
- [Commits](python-poetry/poetry@1.4.2...1.6.1)

Updates `virtualenv` from 20.21.1 to 20.24.4
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@20.21.1...20.24.4)

---
updated-dependencies:
- dependency-name: pip
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-dependencies
- dependency-name: nox-poetry
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions-dependencies
- dependency-name: poetry
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-dependencies
- dependency-name: virtualenv
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/pip/dot-github/workflows/github-actions-dependencies-d4ff0c58dd branch from 137da5f to 6609a9a Compare August 31, 2023 08:54
@dependabot dependabot bot requested a review from a team as a code owner August 31, 2023 08:54
@mmwinther mmwinther merged commit 12ee3a3 into main Aug 31, 2023
13 checks passed
@mmwinther mmwinther deleted the dependabot/pip/dot-github/workflows/github-actions-dependencies-d4ff0c58dd branch August 31, 2023 08:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mmwinther mmwinther mmwinther approved these changes

Assignees
No one assigned
Labels
dependencies Pull requests that update a dependency file python Pull requests that update Python code
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@mmwinther