Skip to content

Bump the pip group across 7 directories with 5 updates #3067

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Bump the pip group across 7 directories with 5 updates #3067

wants to merge 1 commit into from

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Nov 6, 2025

Bumps the pip group with 1 update in the /integrations/bbot directory: bbot.
Bumps the pip group with 1 update in the /integrations/malware_tools_analyzers/requirements directory: flask.
Bumps the pip group with 1 update in the /integrations/nuclei_analyzer directory: flask.
Bumps the pip group with 1 update in the /integrations/pcap_analyzers directory: flask.
Bumps the pip group with 1 update in the /integrations/thug directory: flask.
Bumps the pip group with 1 update in the /integrations/tor_analyzers directory: flask.
Bumps the pip group with 3 updates in the /requirements directory: django, authlib and deepdiff.

Updates bbot from 2.4.0 to 2.7.0

Changelog

Sourced from bbot's changelog.

2.7.0 - TBD

2.6.0 - Aug 12, 2025

2.5.0 - June 3, 2025

Commits

Updates flask from 3.1.0 to 3.1.1

Release notes

Sourced from flask's releases.

3.1.1

This is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.1/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1 Milestone https://github.com/pallets/flask/milestone/36?closed=1

  • Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g
  • Fix type hint for cli_runner.invoke. #5645
  • flask --help loads the app and plugins first to make sure all commands are shown. #5673
  • Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. #5659
Changelog

Sourced from flask's changelog.

Version 3.1.1

Released 2025-05-13

  • Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g
  • Fix type hint for cli_runner.invoke. :issue:5645
  • flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673
  • Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659
Commits

Updates flask from 3.1.0 to 3.1.1

Release notes

Sourced from flask's releases.

3.1.1

This is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.1/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1 Milestone https://github.com/pallets/flask/milestone/36?closed=1

  • Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g
  • Fix type hint for cli_runner.invoke. #5645
  • flask --help loads the app and plugins first to make sure all commands are shown. #5673
  • Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. #5659
Changelog

Sourced from flask's changelog.

Version 3.1.1

Released 2025-05-13

  • Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g
  • Fix type hint for cli_runner.invoke. :issue:5645
  • flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673
  • Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659
Commits

Updates flask from 3.1.0 to 3.1.1

Release notes

Sourced from flask's releases.

3.1.1

This is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.1/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1 Milestone https://github.com/pallets/flask/milestone/36?closed=1

  • Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g
  • Fix type hint for cli_runner.invoke. #5645
  • flask --help loads the app and plugins first to make sure all commands are shown. #5673
  • Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. #5659
Changelog

Sourced from flask's changelog.

Version 3.1.1

Released 2025-05-13

  • Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g
  • Fix type hint for cli_runner.invoke. :issue:5645
  • flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673
  • Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659
Commits

Updates flask from 3.1.0 to 3.1.1

Release notes

Sourced from flask's releases.

3.1.1

This is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.1/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1 Milestone https://github.com/pallets/flask/milestone/36?closed=1

  • Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g
  • Fix type hint for cli_runner.invoke. #5645
  • flask --help loads the app and plugins first to make sure all commands are shown. #5673
  • Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. #5659
Changelog

Sourced from flask's changelog.

Version 3.1.1

Released 2025-05-13

  • Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g
  • Fix type hint for cli_runner.invoke. :issue:5645
  • flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673
  • Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659
Commits

Updates flask from 3.1.0 to 3.1.1

Release notes

Sourced from flask's releases.

3.1.1

This is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.1/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1 Milestone https://github.com/pallets/flask/milestone/36?closed=1

  • Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g
  • Fix type hint for cli_runner.invoke. #5645
  • flask --help loads the app and plugins first to make sure all commands are shown. #5673
  • Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. #5659
Changelog

Sourced from flask's changelog.

Version 3.1.1

Released 2025-05-13

  • Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g
  • Fix type hint for cli_runner.invoke. :issue:5645
  • flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673
  • Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659
Commits

Updates django from 4.2.17 to 4.2.26

Commits
  • 0dfd59e [4.2.x] Bumped version for 4.2.26 release.
  • 279f8b9 [4.2.x] Refs CVE-2025-64459 -- Avoided propagating invalid arguments to Q on ...
  • 59ae82e [4.2.x] Fixed CVE-2025-64459 -- Prevented SQL injections in Q/QuerySet via th...
  • 770eea3 [4.2.x] Fixed CVE-2025-64458 -- Mitigated potential DoS in HttpResponseRedire...
  • 80976bd [4.2.x] Skipped test_compressed_file_based_raster_creation() test on GDAL 3.5+.
  • 7838add [4.2.x] Fixed RelatedGeoModelTest.test_related_union_aggregate() crash on Pyt...
  • 1b50da7 [4.2.x] Added stub release notes and release date for 4.2.26.
  • cd3b21b [4.2.x] Made RemoteTestResultTest.test_pickle_errors_detection() compatible w...
  • 321af48 [4.2.x] Fixed RelatedGeoModelTest.test_related_union_aggregate() test on Orac...
  • 0f6ee3e [4.2.x] Rewrapped security archive at 79 chars.
  • Additional commits viewable in compare view

Updates authlib from 1.4.0 to 1.6.5

Release notes

Sourced from authlib's releases.

v1.6.5

What's Changed

New Contributors

Full Changelog: authlib/authlib@v1.6.4...v1.6.5

v1.6.4

What's Changed

New Contributors

Full Changelog: authlib/authlib@v1.6.3...v1.6.4

Version 1.6.3

What's Changed

Full Changelog: authlib/authlib@v1.6.2...v1.6.3

Version 1.6.2

What's Changed

Full Changelog: authlib/authlib@v1.6.1...v1.6.2

... (truncated)

Changelog

Sourced from authlib's changelog.

Version 1.6.5

Released on Oct 2, 2025

  • RFC7591 generate_client_info and generate_client_secret take a request parameter.
  • Add size limitation when decode JWS/JWE to prevent DoS.
  • Add size limitation for DEF JWE zip algorithm.

Version 1.6.4

Released on Sep 17, 2025

  • Fix InsecureTransportError error raising. :issue:795
  • Fix response_mode=form_post with Starlette client. :issue:793
  • Validate crit header value, reject unprotected header in crit header.

Version 1.6.3

Released on Aug 26, 2025

  • OIDC id_token are signed according to id_token_signed_response_alg client metadata. :issue:755

Version 1.6.2

Released on Aug 23, 2025

  • Temporarily restore OAuth2Request body parameter. :issue:781 :pr:791
  • Allow 127.0.0.1 in insecure transport mode. :pr:788
  • Raise MissingCodeException when the code parameter is missing. :issue:793 :pr:794
  • Fix id_token generation with EdDSA algs. :issue:799 :pr:800

Version 1.6.1

Released on Jul 20, 2025

  • Filter key set with additional "alg" and "use" parameters.
  • Restore and deprecate OAuth2Request body parameter. :issue:781

Version 1.6.0

Released on May 22, 2025

  • Fix issue when :rfc:RFC9207 <9207> is enabled and the authorization endpoint response is not a redirection. :pr:733

... (truncated)

Commits

Updates deepdiff from 8.2.0 to 8.6.1

Release notes

Sourced from deepdiff's releases.

8.6.1

DeepDiff 8-6-1

  • Patched security vulnerability in the Delta class which was vulnerable to class pollution via its constructor, and when combined with a gadget available in DeltaDiff itself, it could lead to Denial of Service and Remote Code Execution (via insecure Pickle deserialization).

8.5.0

  • Updating deprecated pydantic calls
  • Switching to pyproject.toml
  • Fix for moving nested tables when using iterable_compare_func. by
  • Fix recursion depth limit when hashing numpy.datetime64
  • Moving from legacy setuptools use to pyproject.toml

8.4.1

  • pytz is not required.

8.4.0

  • Adding BaseOperatorPlus base class for custom operators
  • default_timezone can be passed now to set your default timezone to something other than UTC.
  • New summarization algorithm that produces valid json
  • Better type hint support
Commits
  • 60ac5b9 Merge commit from fork
  • 683756e Bump version: 8.6.0 → 8.6.1 and add security vulnerability notes
  • c69c06c Security fix: Prevent class pollution and remote code execution in Delta
  • b639fec updating the docs
  • 6f3d5ee Bump version: 8.5.0 → 8.6.0
  • 388a60e Merge pull request #557 from seperman/dev
  • 0978fb8 adding docs for 8.6.0
  • d469a4c making type hints compatible with old python
  • e16507c fixing type hints
  • 33de087 adding type hints to search
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the pip group across 7 directories with 5 updates
e254471 
Bumps the pip group with 1 update in the /integrations/bbot directory: [bbot](https://github.com/blacklanternsecurity/bbot).
Bumps the pip group with 1 update in the /integrations/malware_tools_analyzers/requirements directory: [flask](https://github.com/pallets/flask).
Bumps the pip group with 1 update in the /integrations/nuclei_analyzer directory: [flask](https://github.com/pallets/flask).
Bumps the pip group with 1 update in the /integrations/pcap_analyzers directory: [flask](https://github.com/pallets/flask).
Bumps the pip group with 1 update in the /integrations/thug directory: [flask](https://github.com/pallets/flask).
Bumps the pip group with 1 update in the /integrations/tor_analyzers directory: [flask](https://github.com/pallets/flask).
Bumps the pip group with 3 updates in the /requirements directory: [django](https://github.com/django/django), [authlib](https://github.com/authlib/authlib) and [deepdiff](https://github.com/seperman/deepdiff).


Updates `bbot` from 2.4.0 to 2.7.0
- [Changelog](https://github.com/blacklanternsecurity/bbot/blob/stable/docs/release_history.md)
- [Commits](https://github.com/blacklanternsecurity/bbot/commits)

Updates `flask` from 3.1.0 to 3.1.1
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.0...3.1.1)

Updates `flask` from 3.1.0 to 3.1.1
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.0...3.1.1)

Updates `flask` from 3.1.0 to 3.1.1
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.0...3.1.1)

Updates `flask` from 3.1.0 to 3.1.1
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.0...3.1.1)

Updates `flask` from 3.1.0 to 3.1.1
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.0...3.1.1)

Updates `django` from 4.2.17 to 4.2.26
- [Commits](django/django@4.2.17...4.2.26)

Updates `authlib` from 1.4.0 to 1.6.5
- [Release notes](https://github.com/authlib/authlib/releases)
- [Changelog](https://github.com/authlib/authlib/blob/main/docs/changelog.rst)
- [Commits](authlib/authlib@v1.4.0...v1.6.5)

Updates `deepdiff` from 8.2.0 to 8.6.1
- [Release notes](https://github.com/seperman/deepdiff/releases)
- [Changelog](https://github.com/seperman/deepdiff/blob/master/docs/changelog.rst)
- [Commits](seperman/deepdiff@8.2.0...8.6.1)

---
updated-dependencies:
- dependency-name: bbot
  dependency-version: 2.7.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: flask
  dependency-version: 3.1.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: flask
  dependency-version: 3.1.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: flask
  dependency-version: 3.1.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: flask
  dependency-version: 3.1.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: flask
  dependency-version: 3.1.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: django
  dependency-version: 4.2.26
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: authlib
  dependency-version: 1.6.5
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: deepdiff
  dependency-version: 8.6.1
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Nov 6, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant