Skip to content

chore(deps): bump the python-minor-and-patch group across 1 directory with 6 updates - #636

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/pip/develop/python-minor-and-patch-0a912a637f
Open

chore(deps): bump the python-minor-and-patch group across 1 directory with 6 updates#636
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/pip/develop/python-minor-and-patch-0a912a637f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 6 updates in the / directory:

Package From To
gitpython 3.1.54 3.1.61
markdown 3.10.2 3.10.3
bleach 6.3.0 6.4.0
python-dotenv 1.2.2 1.2.3
stix2-validator 3.2.0 3.3.1
typer 0.27.0 0.27.2

Updates gitpython from 3.1.54 to 3.1.61

Release notes

Sourced from gitpython's releases.

3.1.61

Fix accidental removal of exploitable regex in Actor by bringing it back, and deprecating it.

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.60...3.1.61

3.1.60 Security

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.59...3.1.60

3.1.59 - Security

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.58...3.1.59

3.1.58 - Security and Fixes

What's Changed

New Contributors

... (truncated)

Commits
  • 5346d1b prepare next release
  • d81336b Merge pull request #2221 from gitpython-developers/re-add-regex
  • bc63b02 fix: restore Actor.name_email_regex (#2220)
  • a9fb008 Merge pull request #2219 from Vogtinator/main
  • db1a2cf fix: wait for git daemon to listen before connecting
  • 3481da9 Merge pull request #2218 from gitpython-developers/fix-repo-open
  • 56636c3 prepare new release
  • c7cf4d1 fix: prefer .git during repository discovery
  • d160fb4 Merge pull request #2217 from gitpython-developers/fix-advisory
  • 09f2cf3 fix: require opt-in for no-index diffs
  • Additional commits viewable in compare view

Updates markdown from 3.10.2 to 3.10.3

Release notes

Sourced from markdown's releases.

Release 3.10.3

Fixed

  • Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
  • Add AI Policy to Contributing Guide.
  • Officially document all included extensions as being in maintenance mode.
  • Link the Extension API documentation to the API Reference (#1612).
Changelog

Sourced from markdown's changelog.

[3.10.3] - 2026-07-30

Fixed

  • Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
  • Add AI Policy to Contributing Guide.
  • Officially document all included extensions as being in maintenance mode.
  • Link the Extension API documentation to the API Reference (#1612).
Commits
  • bb50627 Bump version to 3.10.3
  • 8453df0 Update Extension API documentation
  • 93ac448 Document that all extensions are in maintenance mode
  • d38fd4a Create AI Policy
  • ddead47 Prevent mixed =/- chars in Setext-style headings
  • See full diff in compare view

Updates bleach from 6.3.0 to 6.4.0

Changelog

Sourced from bleach's changelog.

Version 6.4.0 (June 5th, 2026)

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

  • Dropped support for pypy 3.10. (#764)

Security fixes

  • Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

    Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.

    For example::

    import bleach payload1 = 'Click' result1 = bleach.clean(payload1) print(repr(result1))

    outputs::

    'Click'

    See the advisory for details.

  • Fix GHSA-gj48-438w-jh9v.

    Fix issue where URI sanitization wasn't happening in formaction attributes.

    See the advisory for details.

Bug fixes

  • Add support for pypy 3.11. (#764)

  • Drop version max in tinycss2 pin. (#772)

    This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.

Commits
  • f0355a7 fix: fix last release date in CHANGES
  • ae4e8a2 chore: bleach 6.4.0 and final release
  • 970df58 fix: uri-sanitization in formaction attributes
  • 7c4867c fix: xss bypass in allowed protocol test using unicode invisible characters
  • 913ab75 fix: reduce redundancy in workflow jobs
  • 218c15a fix: rework pip caching
  • 4f0b097 fix: fix tox platform restrictions
  • e95a79d chore: update pytest
  • 91539d4 Bump actions/cache from 5.0.3 to 5.0.4
  • cd47b4c fix: handle left-angle-bracket that's not a tag (#733)
  • Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Commits
  • 49515af Bump version: 1.2.2 → 1.2.3
  • 8ac846f chore: add release runbook (RELEASING.md) and make release target
  • bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
  • f7b18d9 fix: round-trip backslashes through set_key (#680)
  • 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
  • f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
  • 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
  • 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
  • 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
  • 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
  • Additional commits viewable in compare view

Updates stix2-validator from 3.2.0 to 3.3.1

Release notes

Sourced from stix2-validator's releases.

cti-stix-validator v3.3.1 released

What's Changed

Full Changelog: oasis-open/cti-stix-validator@v3.3.0...v3.3.1

cti-stix-validator v3.3.0 Release Notes

Release date: 2026-05-12

Overview

cti-stix-validator v3.3.0 updates the supported Python versions, refreshes schema support, improves validation behavior around timestamp comparisons, and includes several test and documentation improvements.

This release also includes performance improvements for schema lookup caching and additional fixes around STIX object reference validation.

Highlights

  • Updated supported Python versions, including support for Python 3.14.
  • Added the required minimum Python version metadata.
  • Improved timestamp comparison handling to avoid validation errors when malformed timestamp values are encountered.
  • Updated schema pinning to the latest STIX 2.1 schema commit.
  • Improved schema lookup performance through caching.
  • Fixed object reference validation to prevent invalid SDO usage in SCO object reference properties.
  • Updated maintainers list and ReadTheDocs configuration.
  • Added and improved tests for timestamp handling, campaign objects, STIX 2.0 Course of Action objects, and object reference validation.

Changes

Python Support

  • Bumped the latest supported version.
  • Added the required minimum Python version.
  • Updated the list of supported Python versions.
  • Added Python 3.14 support.

Validation Fixes

  • Fixed timestamp field comparison to avoid exceptions when comparing invalid or improperly formatted timestamp values.
  • Added checks to ensure both timestamp values are valid datetime objects before comparison.
  • Improved handling of cases where one timestamp may still be a string due to invalid formatting.
  • Fixed additional datetime comparison issues that could previously lead to incorrect negative validation results.

STIX Schema and Object Reference Validation

  • Updated schema pinning to the latest STIX 2.1 schema commit.
  • Improved validation for object_refs.
  • Added schema allow/deny patterns to limit object_refs to SCO and SRO where appropriate.

... (truncated)

Changelog

Sourced from stix2-validator's changelog.

CHANGELOG

Commits
  • d3ef2a5 Merge branch 'master' of github.com:oasis-open/cti-stix-validator
  • 3059025 chg: [release] version v3.3.1
  • d9266a9 Merge pull request #247 from chrisr3d/master
  • 7d4af31 fix: [tests] Trying with a better assertion for error message raised with inv...
  • b767784 Merge branch 'master' of github.com:oasis-open/cti-stix-validator
  • ae71357 fix: Using latest pattern validator version
  • 9e4a1ea Merge pull request #246 from chrisr3d/master
  • 1885714 chg: Bumped latest version and added required minimum python version
  • 503daa7 Merge branch 'master' of github.com:chrisr3d/cti-stix-validator
  • fbcf543 Merge branch 'master' of github.com:oasis-open/cti-stix-validator
  • Additional commits viewable in compare view

Updates typer from 0.27.0 to 0.27.2

Release notes

Sourced from typer's releases.

0.27.2

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

0.27.1

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

Changelog

Sourced from typer's changelog.

0.27.2 (2026-08-28)

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

0.27.1 (2026-08-03)

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

Docs

Internal

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 20, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/develop/python-minor-and-patch-0a912a637f branch from 895b3e8 to a1d4131 Compare August 27, 2026 18:53
@dependabot
chore(deps): bump the python-minor-and-patch group across 1 directory…
59311d5 
… with 6 updates

Bumps the python-minor-and-patch group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.54` | `3.1.61` |
| [markdown](https://github.com/Python-Markdown/markdown) | `3.10.2` | `3.10.3` |
| [bleach](https://github.com/mozilla/bleach) | `6.3.0` | `6.4.0` |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.3` |
| [stix2-validator](https://github.com/oasis-open/cti-stix-validator) | `3.2.0` | `3.3.1` |
| [typer](https://github.com/fastapi/typer) | `0.27.0` | `0.27.2` |



Updates `gitpython` from 3.1.54 to 3.1.61
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@3.1.54...3.1.61)

Updates `markdown` from 3.10.2 to 3.10.3
- [Release notes](https://github.com/Python-Markdown/markdown/releases)
- [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md)
- [Commits](Python-Markdown/markdown@3.10.2...3.10.3)

Updates `bleach` from 6.3.0 to 6.4.0
- [Changelog](https://github.com/mozilla/bleach/blob/main/CHANGES)
- [Commits](mozilla/bleach@v6.3.0...v6.4.0)

Updates `python-dotenv` from 1.2.2 to 1.2.3
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.3)

Updates `stix2-validator` from 3.2.0 to 3.3.1
- [Release notes](https://github.com/oasis-open/cti-stix-validator/releases)
- [Changelog](https://github.com/oasis-open/cti-stix-validator/blob/master/CHANGELOG)
- [Commits](oasis-open/cti-stix-validator@v3.2.0...v3.3.1)

Updates `typer` from 0.27.0 to 0.27.2
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.0...0.27.2)

---
updated-dependencies:
- dependency-name: bleach
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: gitpython
  dependency-version: 3.1.59
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: markdown
  dependency-version: 3.10.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: stix2-validator
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: typer
  dependency-version: 0.27.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/develop/python-minor-and-patch-0a912a637f branch from a1d4131 to 59311d5 Compare September 3, 2026 18:53
@sonarqubecloud

sonarqubecloud Bot commented Sep 3, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants