From 2d311775a4b1f4c17bc4c573e16f63c4a9013a00 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 23 Jun 2025 11:58:34 +0000 Subject: [PATCH 1/2] Bump pygments from 2.19.1 to 2.19.2 (#11236) [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pygments&package-manager=pip&previous-version=2.19.1&new-version=2.19.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/doc-spelling.txt | 2 +- requirements/doc.txt | 2 +- requirements/lint.txt | 2 +- requirements/test.txt | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 641af5da395..c1df5b5e0ab 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -165,7 +165,7 @@ pydantic-core==2.33.2 # via pydantic pyenchant==3.2.2 # via sphinxcontrib-spelling -pygments==2.19.1 +pygments==2.19.2 # via # pytest # rich diff --git a/requirements/dev.txt b/requirements/dev.txt index d4f448d3e63..24aa4616ade 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -160,7 +160,7 @@ pydantic==2.11.7 # via python-on-whales pydantic-core==2.33.2 # via pydantic -pygments==2.19.1 +pygments==2.19.2 # via # pytest # rich diff --git a/requirements/doc-spelling.txt b/requirements/doc-spelling.txt index 851a468752a..074016b2e48 100644 --- a/requirements/doc-spelling.txt +++ b/requirements/doc-spelling.txt @@ -34,7 +34,7 @@ packaging==25.0 # via sphinx pyenchant==3.2.2 # via sphinxcontrib-spelling -pygments==2.19.1 +pygments==2.19.2 # via sphinx requests==2.32.4 # via diff --git a/requirements/doc.txt b/requirements/doc.txt index 7e26e5fb6ab..0357ff6f143 100644 --- a/requirements/doc.txt +++ b/requirements/doc.txt @@ -32,7 +32,7 @@ markupsafe==3.0.2 # via jinja2 packaging==25.0 # via sphinx -pygments==2.19.1 +pygments==2.19.2 # via sphinx requests==2.32.4 # via sphinx diff --git a/requirements/lint.txt b/requirements/lint.txt index f6dcbba3804..40f696bc373 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -71,7 +71,7 @@ pydantic==2.11.7 # via python-on-whales pydantic-core==2.33.2 # via pydantic -pygments==2.19.1 +pygments==2.19.2 # via # pytest # rich diff --git a/requirements/test.txt b/requirements/test.txt index c94e5f91ea5..cbbbfad95c4 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -91,7 +91,7 @@ pydantic==2.11.7 # via python-on-whales pydantic-core==2.33.2 # via pydantic -pygments==2.19.1 +pygments==2.19.2 # via # pytest # rich From a5aa198ae72efdccaf32c155dfb6d8bac0ddc17e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 23 Jun 2025 12:06:12 +0000 Subject: [PATCH 2/2] Bump sigstore/gh-action-sigstore-python from 3.0.0 to 3.0.1 (#11237) Bumps [sigstore/gh-action-sigstore-python](https://github.com/sigstore/gh-action-sigstore-python) from 3.0.0 to 3.0.1.
Release notes

Sourced from sigstore/gh-action-sigstore-python's releases.

v3.0.1

Changed

  • The minimum Python version supported by this action is now 3.9 (#155)
  • The action's Python dependencies are now fully pinned to specific versions (#165)

Fixed

  • The rfc3161-client dependency has been upgraded to 1.0.3 to resolve a security vulnerability (#182)
Changelog

Sourced from sigstore/gh-action-sigstore-python's changelog.

[3.0.1]

Changed

  • The minimum Python version supported by this action is now 3.9 (#155)
  • The action's Python dependencies are now fully pinned to specific versions (#165)

Fixed

  • The rfc3161-client dependency has been upgrades to 1.0.3 to resolve a security vulnerability (#182)
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=sigstore/gh-action-sigstore-python&package-manager=github_actions&previous-version=3.0.0&new-version=3.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- .github/workflows/ci-cd.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml index d9640337d31..b1ce33f4ca8 100644 --- a/.github/workflows/ci-cd.yml +++ b/.github/workflows/ci-cd.yml @@ -503,7 +503,7 @@ jobs: uses: pypa/gh-action-pypi-publish@release/v1 - name: Sign the dists with Sigstore - uses: sigstore/gh-action-sigstore-python@v3.0.0 + uses: sigstore/gh-action-sigstore-python@v3.0.1 with: inputs: >- ./dist/*.tar.gz