Skip to content

Bump the server-pip group across 1 directory with 4 updates - #1461

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/pip/server/dev/server-pip-e384ad2eea
Open

Bump the server-pip group across 1 directory with 4 updates#1461
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/pip/server/dev/server-pip-e384ad2eea

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the server-pip group with 4 updates in the /server directory: ruff, pyjwt, pycrdt and python-jsonpath.

Updates ruff from 0.16.8 to 0.17.1

Release notes

Sourced from ruff's releases.

0.17.1

Release Notes

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

Install ruff 0.17.1

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.17.1/ruff-installer.ps1 | iex"

Download ruff 0.17.1

| File | Platform | Checksum |

... (truncated)

Changelog

Sourced from ruff's changelog.

0.17.1

Released on 2026-10-15.

Preview features

  • [pycodestyle] Don't treat None, True, or False as keywords (E271-E274) (#29322)

Bug fixes

  • Fix dedent with multiple leading comments (#29382)
  • [flake8-pyi] Detect legacy positional-only parameters in __new__ methods (PYI063) (#28502)
  • [flake8-pyi] Fix false positives on quoted annotations (PYI036) (#29274)
  • [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (#29366)

Rule changes

  • Treat more collections and weakref containers as mutable (#29213)

Documentation

  • [flake8-import-conventions] Update default and example aliases (#29333)

Contributors

0.17.0

Released on 2026-10-09.

The executables in our macOS and Windows release archives and ruff wheels are now code-signed. macOS executables are signed with an Apple Developer ID certificate and notarized by Apple. Windows executables have timestamped Authenticode signatures from Azure Artifact Signing. This enables verification of the release publisher and binary integrity, supports publisher-based allowlisting, and should reduce security warnings and antivirus false positives.

Breaking changes

  • Update the default and latest Python versions for 3.15 (#28792)

    Ruff now defaults to Python 3.11 instead of 3.10 when no Python version is configured through target-version or requires-python. When checking for syntax errors without a configured Python version, Ruff now defaults to Python 3.15

... (truncated)

Commits
  • 4683270 Bump version to 0.17.1 (#29420)
  • 3514027 [ty] Update typing conformance suite pin (#29417)
  • 8294556 Update referenced PR security-review workflow (#29237)
  • d1e1b1f [ty] Preserve recursive aliases when rebuilding intersections (#29057)
  • 9352615 [perflint] Avoid invalid comprehension suggestions (PERF401, PERF403) (...
  • 83a3afc Fix dedent with multiple leading comments (#29382)
  • b42a873 [ty] Clarify object attribute write-contract rationale (#29384)
  • d01678e [ty] Clarify object attribute write-contract rationale (#29384)
  • 355b42a [ty] Avoid writable override contracts from object (#29373)
  • e26e6d2 [ty] Collect intersection inference through constraint relations (#28677)
  • Additional commits viewable in compare view

Updates pyjwt from 2.14.0 to 2.15.1

Release notes

Sourced from pyjwt's releases.

2.15.1

See the 2.15.1 changelog for complete release details.

2.15.0

See the 2.15.0 changelog for complete release details.

Changelog

Sourced from pyjwt's changelog.

v2.15.1 <https://github.com/jpadilla/pyjwt/compare/2.15.0...2.15.1>__

Fixed


- Accept trailing Base64URL ``=`` padding when decoding JWS segments, so
  tokens issued by AWS ALB and similar systems verify instead of raising
  ``DecodeError: Invalid crypto padding``. Non-alphabet junk such as
  ``!!!!`` remains rejected (`[#1209](https://github.com/jpadilla/pyjwt/issues/1209) <https://github.com/jpadilla/pyjwt/issues/1209>`__).

v2.15.0 &lt;https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0&gt;__


Security

  • Wrap recursion errors from deeply nested JWT payloads in DecodeError instead of exposing a raw RecursionError.

Added


- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) <https://github.com/jpadilla/pyjwt/pull/1202>`__

Changed

  • JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS payload, so a cache hit no longer re-parses every key. JWKSetCache.put() accepts either form and raises PyJWKSetError for anything else. As a result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance for as long as it stays cached, rather than a freshly built one per call in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__
  • PyJWKClient.fetch_data() now raises PyJWKClientError("The JWKS endpoint did not return a JSON object") when the endpoint response is not a JSON object, instead of returning it for get_jwk_set() to reject. Callers reaching the JWKS through get_jwk_set() see the same error as before in [#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>__

Fixed


- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError("The JWKS endpoint did not return a JSON
  object")``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) <https://github.com/jpadilla/pyjwt/issues/914>`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) <https://github.com/jpadilla/pyjwt/pull/1208>`__
</tr></table>

... (truncated)

Commits
  • 7d5ef55 chore: prepare 2.15.1 release
  • 7bf3252 Accept canonical Base64URL padding in JWT segments (#1216)
  • 1d41a64 chore: prepare 2.15.0 release
  • 9bc0665 fix: make recursive payload tests deterministic
  • 5fde08a fix: normalize recursive JWT payload errors
  • 171062d utils: mention bytes in force_bytes type error (#1173)
  • c9d4d53 docs/conf: drop duplicate 'and' from read() docstring (#1174)
  • 2763752 Add support for Python 3.15 (#1202)
  • 4adcd02 Catch http.client.HTTPException in PyJWKClient.fetch_data (#1201)
  • 9e501d9 fix: correct docstring typo in _validate_jti (#1179)
  • Additional commits viewable in compare view

Updates pycrdt from 0.14.5 to 0.14.9

Release notes

Sourced from pycrdt's releases.

0.14.9

  • Update dependencies.
  • Drop Python 3.10 and add Python 3.15.

0.14.8

  • Bump yrs to v0.28.0.
  • Cache node IDs to fix deleted XML children.

0.14.6

  • Improve XML children iteration performances.
Changelog

Sourced from pycrdt's changelog.

0.14.9

  • Update dependencies.
  • Drop Python 3.10 and add Python 3.15.

0.14.8

  • Bump yrs to v0.28.0.
  • Cache node IDs to fix deleted XML children.

0.14.6

  • Improve XML children iteration performances.
Commits

Updates python-jsonpath from 2.2.1 to 2.2.2

Release notes

Sourced from python-jsonpath's releases.

Version 2.2.2

Fixes

  • JSON Patch move and copy operations now use add semantics for their target locations. Previously it was not possible to move or copy to the end of an array with the special - index, and we would silently append to arrays given an index greater than the array's length. We now raise a JSONPatchError if the target index is greater than the number of elements in the array.
  • Fixed JSONPatch move operations with immutable Mapping or Sequence source objects. Previously we silently ignored the internal remove op if the source was immutable, making the operation a copy. Now we raise a JSONPatchError.
Changelog

Sourced from python-jsonpath's changelog.

Version 2.2.2

Fixes

  • JSON Patch move and copy operations now use add semantics for their target locations. Previously it was not possible to move or copy to the end of an array with the special - index, and we would silently append to arrays given an index greater than the array's length. We now raise a JSONPatchError if the target index is greater than the number of elements in the array.
  • Fixed JSONPatch move operations with immutable Mapping or Sequence source objects. Previously we silently ignored the internal remove op if the source was immutable, making the operation a copy. Now we raise a JSONPatchError.
Commits
  • 2399899 Release version 2.2.2 [skip ci]
  • 4ca6063 Merge pull request #138 from jg-rp/test-315
  • 7ef4f40 Add type annotations to context managers
  • 84a3a0f Test against 3.15 and remove argparse.FileType
  • 7fcebbe Merge pull request #137 from jg-rp/op-remove
  • 50bf491 Test immutable source objects for move
  • e208c5e Refactor JSON Patch OpRemove and OpMove
  • 07e0b32 Merge pull request #136 from gaoflow/fix-json-patch-move-copy-array-targets
  • 03dce17 Refactor to avoid extra OpAdd instantiation
  • 74009e3 Fix JSON Patch move and copy array targets
  • See full diff in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Oct 20, 2026
@github-actions

github-actions Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Client Test Results

100 tests   100 ✅  0s ⏱️
  8 suites    0 💤
  1 files      0 ❌

Results for commit ecd18e7.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Client V3 Test Results

225 tests   225 ✅  1s ⏱️
 19 suites    0 💤
  1 files      0 ❌

Results for commit ecd18e7.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Python Test Results

    1 files      1 suites   53s ⏱️
1 156 tests 1 156 ✅ 0 💤 0 ❌
1 179 runs  1 179 ✅ 0 💤 0 ❌

Results for commit ecd18e7.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Playwright E2E Results (chromium)

225 tests   225 ✅  2m 23s ⏱️
 14 suites    0 💤
  1 files      0 ❌

Results for commit ecd18e7.

♻️ This comment has been updated with latest results.

@github-actions

github-actions Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

Playwright E2E Results (firefox)

225 tests   225 ✅  2m 18s ⏱️
 14 suites    0 💤
  1 files      0 ❌

Results for commit ecd18e7.

♻️ This comment has been updated with latest results.

@dependabot
dependabot Bot force-pushed the dependabot/pip/server/dev/server-pip-e384ad2eea branch from 9bb6fcd to 6df7799 Compare October 21, 2026 09:33
@dependabot
Bump the server-pip group across 1 directory with 4 updates
ecd18e7 
Bumps the server-pip group with 4 updates in the /server directory: [ruff](https://github.com/astral-sh/ruff), [pyjwt](https://github.com/jpadilla/pyjwt), [pycrdt](https://github.com/y-crdt/pycrdt) and [python-jsonpath](https://github.com/jg-rp/python-jsonpath).


Updates `ruff` from 0.16.8 to 0.17.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.8...0.17.1)

Updates `pyjwt` from 2.14.0 to 2.15.1
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.14.0...2.15.1)

Updates `pycrdt` from 0.14.5 to 0.14.9
- [Release notes](https://github.com/y-crdt/pycrdt/releases)
- [Changelog](https://github.com/y-crdt/pycrdt/blob/main/CHANGELOG.md)
- [Commits](y-crdt/pycrdt@0.14.5...0.14.9)

Updates `python-jsonpath` from 2.2.1 to 2.2.2
- [Release notes](https://github.com/jg-rp/python-jsonpath/releases)
- [Changelog](https://github.com/jg-rp/python-jsonpath/blob/main/CHANGELOG.md)
- [Commits](jg-rp/python-jsonpath@v2.2.1...v2.2.2)

---
updated-dependencies:
- dependency-name: pycrdt
  dependency-version: 0.14.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-pip
- dependency-name: pyjwt
  dependency-version: 2.15.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-pip
- dependency-name: python-jsonpath
  dependency-version: 2.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: server-pip
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: server-pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/server/dev/server-pip-e384ad2eea branch from 6df7799 to ecd18e7 Compare October 22, 2026 09:33
@sonarqubecloud

sonarqubecloud Bot commented Oct 22, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@dependabot
dependabot Bot force-pushed the dependabot/pip/server/dev/server-pip-e384ad2eea branch from 6df7799 to ecd18e7 Compare October 22, 2026 09:35

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants