Update all non-major dependencies by renovate[bot] · Pull Request #1110 · pixee/codemodder-python

renovate · 2025-12-05T21:11:47Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
coverage	`>=7.12,<7.13` → `>=7.15,<7.16`
flask-wtf (changelog)	`~=1.2.0` → `~=1.3.0`
jsonschema (changelog)	`~=4.25.0` → `~=4.26.0`
libcst (changelog)	`>=1.8,<1.9` → `>=1.9,<1.10`
lxml (source, changelog)	`>=6.0.0,<6.1.0` → `>=6.1.1,<6.2.0`
pyjwt	`~=2.10.0` → `~=2.13.0`
python-json-logger	`~=4.0.0` → `~=4.1.0`
requests (changelog)	`~=2.32.1` → `~=2.34.2`
semgrep (changelog)	`>=1.144,<1.145` → `>=1.172,<1.173`
tomlkit	`~=0.13.0` → `~=0.15.1`
types-defusedxml (changelog)	`==0.7.0.20250822` → `==0.7.0.20260504`
types-wtforms (changelog)	`==3.2.1.20250809` → `==3.2.1.20260518`

Release Notes

coveragepy/coveragepy (coverage)

`v7.15.4`

Compare Source

Fix: in the HTML report, a source file name containing a double quote (legal
on POSIX) wasn't escaped where it's dropped into the href of the index
and prev/next links, so it could close the attribute early and inject markup.
Page URLs are now escaped. Thanks, Rajath Mohare <pull 2227_>_.
Fix: the LCOV report wrote file names and other fields into its
line-oriented records without neutralizing control characters. A measured
file whose name contained a newline (legal on POSIX) could forge extra
records, inflating the coverage seen by tools that read the report. Control
characters in a field are now replaced. Thanks, Rajath Mohare <pull 2226_>_.
Wheels are now provided for Python 3.15.

.. _pull 2226: #2226
.. _pull 2227: #2227

.. _changes_7-15-3:

`v7.15.3`

Compare Source

Fix: the sysmon core is incompatible with dynamic contexts. Previously, the
combination would be prevented when read from the coverage.py configuration.
But using the context API as pytest-cov does, contexts would be silently
dropped. Now a warning is issued, thanks to Jisang Han <pull 2234_>.
Closes issue 2200.
A performance improvement in the low-level line number bookkeeping when
combining data files, thanks to Kevin Turcios <pull 2239_>_.
Performance improvement in HTML reporting by reducing the number of times
files have to be parsed, thanks to Kevin Turcios <pull 2240_>_.

.. _issue 2200: #2200
.. _pull 2234: #2234
.. _pull 2239: #2239
.. _pull 2240: #2240

.. _changes_7-15-2:

`v7.15.2`

Compare Source

Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically
increased memory use during reporting for large projects. Now we use a
different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: #2229

.. _changes_7-15-1:

`v7.15.1`

Compare Source

Fix: in the HTML report with show_contexts enabled, a context label
containing </script> (for example a parametrized pytest node id) could
close the inline <script> element in a file page early, injecting markup.
Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.
A number of performance improvements thanks to Paul Kehrer, in pull requests
2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: #2213
.. _pull 2214: #2214
.. _pull 2215: #2215
.. _pull 2216: #2216
.. _pull 2218: #2218
.. _pull 2220: #2220
.. _pull 2221: #2221
.. _pull 2224: #2224

.. _changes_7-15-0:

`v7.15.0`

Compare Source

Since 7.14.0, reporting commands implicitly combine parallel data files. Now
those commands have a new option --keep-combined to retain the data files
after combining them instead of the default, which is to delete them.
Finishes issue 2198_.
Fix: the LCOV report would incorrectly count excluded functions as uncovered,
as described in issue 2205. This is now fixed thanks to Martin Kuntz Jacobsen <pull 2206_>.
When running your program, coverage now correctly sets
yourmodule.__spec__.loader as strongly recommended <--loader--_>,
avoiding the deprecation warning described in issue 2208. Thanks, A5rocks <pull 2209_>_.
Fix: with Python 3.10, running with the -I (isolated mode) option didn't
correctly omit the current directory from the module search path, as
described in issue 2103. That is now fixed thanks to Ilia Sorokin <pull 2211_>.

.. --loader--: https://docs.python.org/3/reference/datamodel.html#module.__loader_
.. _issue 2103: #2103
.. _issue 2198: #2198
.. _issue 2205: #2205
.. _pull 2206: #2206
.. _issue 2208: #2208
.. _pull 2209: #2209
.. _pull 2211: #2211

.. _changes_7-14-3:

`v7.14.3`

Compare Source

Fix: the default ... exclusion rule now also matches function bodies
whose closing return-type bracket is on its own line (for example, after a
long -> dict[ ... ] annotation that a formatter has split over multiple
lines). Closes issue 2185, thanks Mengjia Shang <pull 2196_>.
Fix: On 3.13t, we incorrectly issued Couldn't import C tracer errors.
We can't import the C tracer because in 7.14.2 we stopped shipping compiled
wheels for 3.13t. Thanks, Hugo van Kemenade <pull 2203_>_.

.. _issue 2185: #2185
.. _pull 2196: #2196
.. _pull 2203: #2203

.. _changes_7-14-2:

`v7.14.2`

Compare Source

Fix: some messages were being written to stdout, making coverage json -o - useless for capturing JSON output. Now messages are written to stderr,
fixing issue 2197_.
Fix: CoverageData kept one SQLite connection per thread that recorded
coverage, but never closed them when those threads terminated. On long runs
with many short-lived threads this leaked one file descriptor per dead
thread, eventually failing with OSError: [Errno 24] Too many open files.
Connections belonging to terminated threads are now closed and dropped.
Fixes issue 2192_.
Fix: when using sys.monitoring, we were assuming we could use the
COVERAGE_ID tool id. But other tools might also assume they could use
that id. Pre-allocated ids don't really make sense, so now we search for a
usable one instead. Fixes issue 2187. Thanks, Matthew Lloyd <pull 2198_>.
Following the advice of cibuildwheel <no-13t_>_, we no longer distribute
wheels for Python 3.13 free-threaded.

.. _issue 2187: #2187
.. _issue 2192: #2192
.. _issue 2197: #2197
.. _pull 2198: #2198
.. _no-13t: https://py-free-threading.github.io/ci/#building-free-threaded-wheels-with-cibuildwheel

.. _changes_7-14-1:

`v7.14.1`

Compare Source

Fix: the HTML report used typographic niceties to make file paths more
readable by adding a small amount of space around slashes. Those spaces
interfered with searching the page for file paths of interest. Now the report
uses CSS to accomplish the same visual tweak so that searches with slashes
work correctly. Closes issue 2170_.
Add a 3.16 PyPI classifier <hugo-316_>_ since we test on the 3.16 main
branch.

.. _issue 2170: #2170
.. _hugo-316: https://mastodon.social/@hugovk/116588523571204490

.. _changes_7-14-0:

`v7.14.0`

Compare Source

Feature: now when running one of the reporting commands, if there are
parallel data files that need combining, they will be implicitly combined
before creating the report. There is no option to avoid the combination; let
us know if you have a use case that requires it. Thanks, Tim Hatch <pull 2162_>. Closes issue 1781.
Fix: the output from combine was too verbose, listing each file
considered. Now it shows a single line with the counts of files combined,
files skipped, and files with errors. The -q flag suppresses this line.
The old detailed lines are available with the new --debug=combine option.
Fix: running a Python file through a symlink now sets the sys.path correctly,
matching regular Python behavior. Fixes issue 2157_.
Fix: Collector.flush_data could fail with "RuntimeError: Set changed
size during iteration" when a tracer in another thread added a line to the
per-file set that add_lines (or add_arcs) was iterating. The values
passed to CoverageData are now snapshotted via dict.copy() and
set.copy(), which are atomic under the GIL. Thanks, Alex Vandiver <pull 2165_>_.
Fix: the soft keyword lazy is now bolded in HTML reports.
We are no longer testing eventlet support. Eventlet started issuing stern
deprecation warnings that break our tests. Our support code is still there.

.. _issue 1781: #1781
.. _issue 2157: #2157
.. _pull 2162: #2162
.. _pull 2165: #2165

.. _changes_7-13-5:

`v7.13.5`

Compare Source

Fix: issue 2138_ describes a memory leak that happened when repeatedly
using the Coverage API with in-memory data. This is now fixed.
Fix: the markdown-formatted coverage report didn't fully escape special
characters in file paths (issue 2141). This would be very unlikely to
cause a problem, but now it's done properly, thanks to Ellie Ayla <pull 2142_>.
Fix: the C extension wouldn't build on VS2019, but now it does (issue 2145_).

.. _issue 2138: #2138
.. _issue 2141: #2141
.. _pull 2142: #2142
.. _issue 2145: #2145

.. _changes_7-13-4:

`v7.13.4`

Compare Source

Fix: the third-party code fix in 7.13.3 required examining the parent
directories where coverage was run. In the unusual situation that one of the
parent directories is unreadable, a PermissionError would occur, as
described in issue 2129_. This is now fixed.
Fix: in test suites that change sys.path, coverage.py could fail with
"RuntimeError: Set changed size during iteration" as described and fixed in
pull 2130_. Thanks, Noah Fatsi.
We now publish ppc64le wheels, thanks to Pankhudi Jain <pull 2121_>_.

.. _pull 2121: #2121
.. _issue 2129: #2129
.. _pull 2130: #2130

.. _changes_7-13-3:

`v7.13.3`

Compare Source

Fix: in some situations, third-party code was measured when it shouldn't have
been, slowing down test execution. This happened with layered virtual
environments such as uv sometimes makes. The problem is fixed, closing issue 2082_. Now any directory on sys.path that is inside a virtualenv is
considered third-party code.

.. _issue 2082: #2082

.. _changes_7-13-2:

`v7.13.2`

Compare Source

Fix: when Python is installed via symlinks, for example with Homebrew, the
standard library files could be incorrectly included in coverage reports.
This is now fixed, closing issue 2115_.
Fix: if a data file is created with no read permissions, the combine step
would fail completely. Now a warning is issued and the file is skipped.
Closes issue 2117_.

.. _issue 2115: #2115
.. _issue 2117: #2117

.. _changes_7-13-1:

`v7.13.1`

Compare Source

Added: the JSON report now includes a "start_line" key for function and
class regions, indicating the first line of the region in the source. Closes
issue 2110_.
Added: The debug data command now takes file names as arguments on the
command line, so you can inspect specific data files without needing to set
the COVERAGE_FILE environment variable.
Fix: the JSON report used to report module docstrings as executed lines,
which no other report did, as described in issue 2105_. This is now fixed,
thanks to Jianrong Zhao.
Fix: coverage.py uses a more disciplined approach to detecting where
third-party code is installed, and avoids measuring it. This shouldn't change
any behavior. If you find that it does, please get in touch.
Performance: data files that will be combined now record their hash as part
of the file name. This lets us skip duplicate data more quickly, speeding the
combining step.
Docs: added a section explaining more about what is considered a missing
branch and how it is reported: :ref:branch_explain, as requested in issue 1597. Thanks to Ayisha Mohammed <pull 2092_>.
Tests: the test suite misunderstood what core was being tested if
COVERAGE_CORE wasn't set on 3.14+. This is now fixed, closing issue 2109_.

.. _issue 1597: #1597
.. _pull 2092: #2092
.. _issue 2105: #2105
.. _issue 2109: #2109
.. _issue 2110: #2110

.. _changes_7-13-0:

`v7.13.0`

Compare Source

Feature: coverage.py now supports :file:.coveragerc.toml configuration
files. These files use TOML syntax and take priority over
:file:pyproject.toml but lower priority than :file:.coveragerc files.
Closes issue 1643_ thanks to Olena Yefymenko <pull 1952_>_.
Fix: we now include a permanent .pth file which is installed with the code,
fixing issue 2084. In 7.12.1b1 this was done incorrectly: it didn't work
when using the source wheel (py3-none-any). This is now fixed. Thanks,
Henry Schreiner <pull 2100_>.
Deprecated: when coverage.py is installed, it creates three command entry
points: coverage, coverage3, and coverage-3.10 (if installed for
Python 3.10). The second and third of these are not needed and will
eventually be removed. They still work for now, but print a message about
their deprecation.

.. _issue 1643: #1643
.. _pull 1952: #1952
.. _pull 2100: #2100

.. _changes_7-12-1b1:

python-jsonschema/jsonschema (jsonschema)

`v4.26.0`

Compare Source

=======

Decrease import time by delaying importing of urllib.request (#1416).

Instagram/LibCST (libcst)

`v1.9.0`

Compare Source

Added

Add support for Python 3.15 by @AlexWaygood and @thatch in #1454 and #1456
Add CodemodCommand helpers for adding and removing imports by @frvnkliu in #1432

Fixed

Recognize Python 3.14 parser configurations by @bowiechen in #1452
Allow a trailing comma after **rest in class patterns by @itamaro in #1438

Updated

Document the new CodemodCommand import helpers by @frvnkliu in #1437
Fix the tokenize function's docstring grammar by @galenseilis in #1434
Remove the retired macOS 13 runner from CI by @drinkmorewaterr in #1433

New Contributors

@AlexWaygood made their first contribution in #1454
@bowiechen made their first contribution in #1452
@galenseilis made their first contribution in #1434

Full Changelog: Instagram/LibCST@v1.8.6...v1.9.0

lxml/lxml (lxml)

`v6.1.1`

Compare Source

==================

Bugs fixed

The known link attributes in lxml.html.defs.link_attrs were missing xlink:href,
which can be used for URL bypass attacks in embedded SVG/MathML/etc. content.
GHSA-4jhm-jv67-739f
The Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.
The Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.

`v6.1.0`

Compare Source

==================

This release fixes a possible external entity injection (XXE) vulnerability in
iterparse() and the ETCompatXMLParser.

Features added

GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes
in lxml.html.defs. This allows lxml_html_clean to pass them through.
Patch by oomsveta.
The default chunk size for reading from file-likes in iterparse() is now configurable
with a new chunk_size argument.

Bugs fixed

LP#2146291: The resolve_entities option was still set to True for
iterparse and ETCompatXMLParser, allowing for external entity injection (XXE)
when using these parsers without setting this option explicitly.
The default was now changed to 'internal' only (as for the normal XML and HTML parsers
since lxml 5.0).
Issue found by Sihao Qiu as CVE-2026-41066.

jpadilla/pyjwt (pyjwt)

`v2.13.0`

Compare Source

`v2.12.1`

Compare Source

Changed


- Migrate the ``dev``, ``docs``, and ``tests`` package extras to dependency groups by @kurtmckee in `#&#8203;1152 <https://github.com/jpadilla/pyjwt/pull/1152>`__

`v2.12.1 <https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1>`__
------------------------------------------------------------------------

Fixed
~~~~~

- Add missing ``typing_extensions`` dependency for Python < 3.11 in `#&#8203;1150 <https://github.com/jpadilla/pyjwt/issues/1150>`__

`v2.12.0 <https://github.com/jpadilla/pyjwt/compare/2.11.0...2.12.0>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Annotate PyJWKSet.keys for pyright by @tamird in `#&#8203;1134 <https://github.com/jpadilla/pyjwt/pull/1134>`__
- Close ``HTTPError`` response to prevent ``ResourceWarning`` on Python 3.14 by @veeceey in `#&#8203;1133 <https://github.com/jpadilla/pyjwt/pull/1133>`__
- Do not keep ``algorithms`` dict in PyJWK instances by @akx in `#&#8203;1143 <https://github.com/jpadilla/pyjwt/pull/1143>`__
- Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @dmbs335 in `GHSA-752w-5fwx-jx9f <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f>`__
- Use PyJWK algorithm when encoding without explicit algorithm in `#&#8203;1148 <https://github.com/jpadilla/pyjwt/pull/1148>`__

Added
~~~~~

- Docs: Add ``PyJWKClient`` API reference and document the two-tier caching system (JWK Set cache and signing key LRU cache).

`v2.11.0 <https://github.com/jpadilla/pyjwt/compare/2.10.1...2.11.0>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Enforce ECDSA curve validation per RFC 7518 Section 3.4.
- Fix build system warnings by @kurtmckee in `#&#8203;1105 <https://github.com/jpadilla/pyjwt/pull/1105>`__
- Validate key against allowed types for Algorithm family in `#&#8203;964 <https://github.com/jpadilla/pyjwt/pull/964>`__
- Add iterator for JWKSet in `#&#8203;1041 <https://github.com/jpadilla/pyjwt/pull/1041>`__
- Validate `iss` claim is a string during encoding and decoding by @pachewise in `#&#8203;1040 <https://github.com/jpadilla/pyjwt/pull/1040>`__
- Improve typing/logic for `options` in decode, decode_complete by @pachewise in `#&#8203;1045 <https://github.com/jpadilla/pyjwt/pull/1045>`__
- Declare float supported type for lifespan and timeout by @nikitagashkov in `#&#8203;1068 <https://github.com/jpadilla/pyjwt/pull/1068>`__
- Fix ``SyntaxWarning``\s/``DeprecationWarning``\s caused by invalid escape sequences by @kurtmckee in `#&#8203;1103 <https://github.com/jpadilla/pyjwt/pull/1103>`__
- Development: Build a shared wheel once to speed up test suite setup times by @kurtmckee in `#&#8203;1114 <https://github.com/jpadilla/pyjwt/pull/1114>`__
- Development: Test type annotations across all supported Python versions,
  increase the strictness of the type checking, and remove the mypy pre-commit hook
  by @kurtmckee in `#&#8203;1112 <https://github.com/jpadilla/pyjwt/pull/1112>`__

Added
~~~~~

- Support Python 3.14, and test against PyPy 3.10 and 3.11 by @kurtmckee in `#&#8203;1104 <https://github.com/jpadilla/pyjwt/pull/1104>`__
- Development: Migrate to ``build`` to test package building in CI by @kurtmckee in `#&#8203;1108 <https://github.com/jpadilla/pyjwt/pull/1108>`__
- Development: Improve coverage config and eliminate unused test suite code by @kurtmckee in `#&#8203;1115 <https://github.com/jpadilla/pyjwt/pull/1115>`__
- Docs: Standardize CHANGELOG links to PRs by @kurtmckee in `#&#8203;1110 <https://github.com/jpadilla/pyjwt/pull/1110>`__
- Docs: Fix Read the Docs builds by @kurtmckee in `#&#8203;1111 <https://github.com/jpadilla/pyjwt/pull/1111>`__
- Docs: Add example of using leeway with nbf by @djw8605 in `#&#8203;1034 <https://github.com/jpadilla/pyjwt/pull/1034>`__
- Docs: Refactored docs with ``autodoc``; added ``PyJWS`` and ``jwt.algorithms`` docs by @pachewise in `#&#8203;1045 <https://github.com/jpadilla/pyjwt/pull/1045>`__
- Docs: Documentation improvements for "sub" and "jti" claims by @cleder in `#&#8203;1088 <https://github.com/jpadilla/pyjwt/pull/1088>`__
- Development: Add pyupgrade as a pre-commit hook by @kurtmckee in `#&#8203;1109 <https://github.com/jpadilla/pyjwt/pull/1109>`__
- Add minimum key length validation for HMAC and RSA keys (CWE-326).
  Warns by default via ``InsecureKeyLengthWarning`` when keys are below
  minimum recommended lengths per RFC 7518 Section 3.2 (HMAC) and
  NIST SP 800-131A (RSA). Pass ``enforce_minimum_key_length=True`` in
  options to ``PyJWT`` or ``PyJWS`` to raise ``InvalidKeyError`` instead.
- Refactor ``PyJWT`` to own an internal ``PyJWS`` instance instead of
  calling global ``api_jws`` functions.

`v2.10.1 <https://github.com/jpadilla/pyjwt/compare/2.10.0...2.10.1>`__
-----------------------------------------------------------------------

Fixed
~~~~~

- Prevent partial matching of `iss` claim by @fabianbadoi in `GHSA-75c5-xw7c-p5pm <https://github.com/jpadilla/pyjwt/security/advisories/GHSA-75c5-xw7c-p5pm>`__

`v2.10.0 <https://github.com/jpadilla/pyjwt/compare/2.9.0...2.10.0>`__
-----------------------------------------------------------------------

Changed

Remove algorithm requirement from JWT API, instead relying on JWS API for enforcement, by @luhn in #975 <https://github.com/jpadilla/pyjwt/pull/975>__
Use Sequence for parameter types rather than List where applicable by @imnotjames in #970 <https://github.com/jpadilla/pyjwt/pull/970>__
Add JWK support to JWT encode by @luhn in #979 <https://github.com/jpadilla/pyjwt/pull/979>__
Encoding and decoding payloads using the none algorithm by @jpadilla in #c2629f6 <https://github.com/jpadilla/pyjwt/commit/c2629f66c593459e02616048443231ccbe18be16>__

Before:

.. code-block:: pycon

import jwt
jwt.encode({"payload": "abc"}, key=None, algorithm=None)

After:

.. code-block:: pycon

import jwt
jwt.encode({"payload": "abc"}, key=None, algorithm="none")
Added validation for 'sub' (subject) and 'jti' (JWT ID) claims in tokens by @Divan009 in #1005 <https://github.com/jpadilla/pyjwt/pull/1005>__
Refactor project configuration files from setup.cfg to pyproject.toml by @cleder in #995 <https://github.com/jpadilla/pyjwt/pull/995>__
Ruff linter and formatter changes by @gagandeepp in #1001 <https://github.com/jpadilla/pyjwt/pull/1001>__
Drop support for Python 3.8 (EOL) by @kkirsche in #1007 <https://github.com/jpadilla/pyjwt/pull/1007>__

Fixed


- Encode EC keys with a fixed bit length by @etianen in `#&#8203;990 <https://github.com/jpadilla/pyjwt/pull/990>`__
- Add an RTD config file to resolve Read the Docs build failures by @kurtmckee in `#&#8203;977 <https://github.com/jpadilla/pyjwt/pull/977>`__
- Docs: Update ``iat`` exception docs by @pachewise in `#&#8203;974 <https://github.com/jpadilla/pyjwt/pull/974>`__
- Docs: Fix ``decode_complete`` scope and algorithms by @RbnRncn in `#&#8203;982 <https://github.com/jpadilla/pyjwt/pull/982>`__
- Fix doctest for ``docs/usage.rst`` by @pachewise in `#&#8203;986 <https://github.com/jpadilla/pyjwt/pull/986>`__
- Fix ``test_utils.py`` not to xfail by @pachewise in `#&#8203;987 <https://github.com/jpadilla/pyjwt/pull/987>`__
- Docs: Correct `jwt.decode` audience param doc expression by @peter279k in `#&#8203;994 <https://github.com/jpadilla/pyjwt/pull/994>`__

Added

Add support for python 3.13 by @hugovk in #972 <https://github.com/jpadilla/pyjwt/pull/972>__
Create SECURITY.md by @auvipy and @jpadilla in #973 <https://github.com/jpadilla/pyjwt/pull/973>__
Docs: Add PS256 encoding and decoding usage by @peter279k in #992 <https://github.com/jpadilla/pyjwt/pull/992>__
Docs: Add API docs for PyJWK by @luhn in #980 <https://github.com/jpadilla/pyjwt/pull/980>__
Docs: Add EdDSA algorithm encoding/decoding usage by @peter279k in #993 <https://github.com/jpadilla/pyjwt/pull/993>__
Include checkers and linters for pyproject.toml in pre-commit by @cleder in #1002 <https://github.com/jpadilla/pyjwt/pull/1002>__
Docs: Add ES256 decoding usage by @Gautam-Hegde in #1003 <https://github.com/jpadilla/pyjwt/pull/1003>__

`v2.12.0`

Compare Source

Security

Validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by @dmbs335 in GHSA-752w-5fwx-jx9f

What's Changed

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1132
chore(docs): fix docs build by @tamird in #1137
Annotate PyJWKSet.keys for pyright by @tamird in #1134
fix: close HTTPError to prevent ResourceWarning on Python 3.14 by @veeceey in #1133
chore: remove superfluous constants by @tamird in #1136
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1135
chore(tests): enable mypy by @tamird in #1138
Bump actions/download-artifact from 7 to 8 by @dependabot[bot] in #1142
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1141
[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in #1145
fix: do not store reference to algorithms dict on PyJWK by @akx in #1143
Use PyJWK algorithm when encoding without explicit algorithm by @jpadilla in #1148

New Contributors

@tamird made their first contribution in #1137
@veeceey made their first contribution in #1133

Full Changelog: jpadilla/pyjwt@2.11.0...2.12.0

`v2.11.0`

Compare Source

Fixed


Added

nhairs/python-json-logger (python-json-logger)

`v4.1.0`: 4.1.0

Compare Source

Added

Add support for Python 3.14, PyPy 3.11

Removed

Remove support for Python 3.8, 3.9 (includes PyPy versions).

psf/requests (requests)

`v2.34.2`

Compare Source

Moved headers input type back to Mapping to avoid invariance issues
with MutableMapping and inferred dict types. Users calling
Request.headers.update() may need to narrow typing in their code. (#7441)

`v2.34.1`

Compare Source

Bugfixes

Widened json input type from dict and list to Mapping
and Sequence. (#7436)
Changed headers input type to MutableMapping and removed None from
Request.headers typing to improve handling for users. (#7431)
Response.reason moved from str | None to str to improve handling
for users. (#7437)
Fixed a bug where some bodies with custom __getattr__ implementations
weren't being properly detected as Iterables. (#7433)

`v2.34.0`

Compare Source

Announcements

Requests 2.34.0 introduces inline types, replacing those provided by
typeshed. Public API types should be fully compatible with mypy, pyright,
and ty. We believe types are comprehensive but if you find issues, please
report them to the pinned tracking issue.

Special thanks to @bastimeyer, @cthoyt, @edgarrmondragon, and @srittau for
helping review and test the types ahead of the release. (#7272)

Improvements

Digest Auth hashing algorithms have added usedforsecurity=False to clarify
security considerations. (#7310)
Requests added support for Python 3.15 based on beta1. Downstream projects
should be able to start testing prior to its release in October. (#7422)
Requests added support for Python 3.14t. (#7419)

Bugfixes

Response.history no longer contains a reference to itself, preventing
accidental looping when traversing the history list. (#7328)
Requests no longer performs greedy matching on no_proxy domains. The
proxy_bypass implementation has been updated with CPython's fix from
bpo-39057. (#7427)
Requests no longer incorrectly strips duplicate leading slashes in
URI paths. This should address user issues with specific presigned
URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

`v2.33.1`

Compare Source

Bugfixes

Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary
files in the tmp directory. (#7305)
Fixed Content-Type header parsing for malformed values. (#7309)
Improved error consistency for malformed header values. (#7308)

`v2.33.0`

Compare Source

Announcements

📣 Requests is adding inline types. If you have a typed code base that
uses Requests, please take a look at #7271. Give it a try, and report
any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts
contents to a non-deterministic location to prevent malicious file
replacement. This does not affect default usage of Requests, only
applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause
malformed authentication to be applied to Requests on
Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

semgrep/semgrep (semgrep)

`v1.172.0`

Compare Source

### Added

Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

### Changed

Updated the Ruby parser to tree-sitter-ruby v0.23.1, improving support for !=, case/when expressions with line breaks, and element references that take a block. (LANG-206)
The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

### Fixed

Semgrep will now print richer error messages on segfaults when --debug is NOT passed, matching the segfault error output when --debug is passed (engine-segv)
Fixed a source of rare, nondeterministic crashes and incorrect results caused
by an OCaml compiler bug. Semgrep now builds against a compiler fork that
backports the upstream fix. (ocaml_codegen_fix)
Fixed excessive heap growth after explicit major garbage collections. Semgrep
now builds against an OCaml compiler that improves garbage collection duty
cycle pacing. (ocaml_gc_pacing_fix)
Improved the Scan Status output when no code rules will run (e.g. a
Secrets-only or Supply-Chain-only scan). The summary line no longer reports a
confusing "0 Code rules", and the "Code Rules" section now states explicitly
either that code scanning is not enabled or that there are no code rules to run,
instead of printing an empty table. (ENGINE-2878)
Fixed lockfileless Gradle dependency resolution failing with "Parsing
dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The
github-dependency-graph-gradle-plugin used during resolution was fetched
unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is
now pinned to 1.4.1. (sc-3738)

`v1.171.0`

1.171.0 - 2026-07-22

### Added

Added support for the OpenTofu .tofu file extension. Because OpenTofu uses the same HCL grammar as Terraform, .tofu files are now automatically detected and scanned as Terraform, so they are picked up by recursive scans and Terraform rulesets (e.g. p/terraform) with no extra configuration. (ENGINE-2884)

### Changed

The window for collecting git contributor information during semgrep ci has been extended from the last 30 days to the last 90 days, to match the updated usage policy. (contributor-window-90-days)

### Fixed

Fixed a source of rare, nondeterministic crashes and incorrect results caused
by an OCaml compiler bug. Semgrep now builds against a compiler fork that
backports the upstream fix. (ocaml_codegen_fix)
Fixed excessive heap growth after explicit major garbage collections. Semgrep
now builds against an OCaml compiler that improves garbage collection duty
cycle pacing. (ocaml_gc_pacing_fix)
Improved the Scan Status output when no code rules will run (e.g. a
Secrets-only or Supply-Chain-only scan). The summary line no longer reports a
confusing "0 Code rules", and the "Code Rules" section now states explicitly
either that code scanning is not enabled or that there are no code rules to run,
instead of printing an empty table. (ENGINE-2878)
Fixed lockfileless Gradle dependency resolution failing with "Parsing
dependency output failed (Resolve_gradle.gradle_resolved_dependency)". The
github-dependency-graph-gradle-plugin used during resolution was fetched
unpinned, and its 1.4.2 release renamed keys in its JSON output. The plugin is
now pinned to 1.4.1. (sc-3738)

`v1.170.0`

Compare Source

### Added

Pro C/C++ scans now skip code inside statically-dead preprocessor branches
(for example, #if 0 ... #else ... #endif). Patterns that would otherwise
match against intentionally-disabled code no longer report on it. (cpp-if-zero-filter)
Restored obackward: semgrep-core and semgrep-core-proprietary once again print a backtrace when receiving a fatal signal (e.g. SIGSEGV) (obackward)
semgrep install-semgrep-pro now sends usage metrics so that
installation errors can be tracked. Metrics can be disabled with
--metrics off or SEMGREP_SEND_METRICS=off. Metrics payloads also
now include the method used to install the Semgrep CLI (pip, homebrew,
docker, or unknown), detected heuristically. See metrics.md for
more details of what exactly is sent. (engine-2858)

### Changed

Increased the timeout for dynamic dependency resolution subprocesses from
600 to 900 seconds, giving large projects more time to resolve dependencies
before timing out. (SC-3699)
Pro C/C++ #if 0 filtering now also handles cases where the directive splits a
syntactic unit. For example, a function signature toggle like #if 0 void foo(int i) { #else void foo(uint32_t i) { #endif. (engine-994)

### Fixed

Fixed a crash at startup (Fatal error: Failed to allocate signal stack for domain 0) when running Semgrep on systems with musl 1.2.6 (e.g. Alpine 3.24) on
recent Intel CPUs whose kernel-reported minimum signal-stack size exceeds musl's
build-time SIGSTKSZ (notably AMX-capable Xeons). (ENGINE-2863)
Dockerfile: Fixed parse errors on RUN instructions that use heredoc syntax
(<<EOF, <<-EOF, quoted delimiters). (LANG-263)
metavariable-type now supports fully qualified type names in languages
where a qualified name in type position parses as an expression (e.g.
Python's types: [a.b.C]) when the metavariable's type is determined by
type inference, such as Pro engine cross-file type resolution. (LANG-583)
Updated the ocaml-tree-sitter-core dependency to the latest main.
- Fails loudly on a parser/runtime ABI mismatch
- Stamps every generated parser.c with the tree-sitter version that produced it.
- Changed paths where tree-sitter versions are installed (lang-591)

`v1.169.0`

Compare Source

### Infra/Release Changes

Updated Dart parser to a more recent upstream version. (LANG-579)

`v1.168.0`

Compare Source

### Added

Added an experimental --x-dependency-paths flag to scan and ci that includes the full dependency path(s) for transitive supply-chain findings in --json and --sarif output. (SC-3547)

### Changed

Malicious supply chain rules are now labeled "Malicious" instead of "Basic" in the scan analysis summary table. (SC-3504)

### Infra/Release Changes

semgrep-core no longer depends on libpcre 8.x; libpcre2 10.x is now the sole regex engine. (drop-libpcre)
Aliengrep (generic mode) now uses the maintained libpcre2 10.x regular-expression library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (aliengrep-pcre2)
The metavariable-regex and metavariable-comparison (re.match()) runtimes now use the maintained libpcre2 10.x library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (eval-generic-pcre2)

`v1.167.0`

Compare Source

1.167.0 - 2026-06-17

### Added

Added support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more. (const-folding)
Added a nosemgrep_disabled field to the scan configuration so the platform can disable nosemgrep inline ignore comments org-wide for a scan. (APPEX-1122)
Semgrep now skips binary files (images, archives, compiled executables,
etc.) during scanning by default, detected via matching file extensions
to known file-format magic bytes Pass --no-exclude-binary-files to
scan binary files as before. (ENGINE-2708)

### Fixed

semgrep ci with --sarif now correctly populates the output's ignores
field with nosemgrep-suppressed findings, in accordance with other output
formatters. (gh-6651)

### Infra/Release Changes

Updated the ocaml-tree-sitter-core submodule to the latest upstream main, providing
- improved thread-safety
- bumps the tree-sitter CLI option used from 0.20.6 to 0.20.8.
(ocaml-tree-sitter-core-bump)

`v1.166.0`

Compare Source

### Added

Pro: Added experimental cross-file (interfile) analysis for Gosu, enabling taint tracking across multiple Gosu source files. (gosu-interfile)
Added support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more (ENGINE-2789)

### Fixed

Fixed parsing of integer literals with an underscore immediately after the radix prefix (e.g. 0x_dead_beef, 0o_755, 0b_1010_1010). (LANG-533)
Python parsing now preserves type parameters on def and class definitions. (LANG-536)
Semgrep no longer stores the API token in `~/.

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

sonarqubecloud · 2026-05-10T21:08:09Z