From 9a3f9ad5bc96111f11d014e047f1ac7dc644ff56 Mon Sep 17 00:00:00 2001 From: "pre-commit-ci[bot]" <66853113+pre-commit-ci[bot]@users.noreply.github.com> Date: Tue, 3 Oct 2023 00:40:18 +0000 Subject: [PATCH 1/6] [pre-commit.ci] pre-commit autoupdate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit updates: - [github.com/asottile/add-trailing-comma.git: v3.0.0 → v3.1.0](https://github.com/asottile/add-trailing-comma.git/compare/v3.0.0...v3.1.0) - [github.com/Lucas-C/pre-commit-hooks.git: v1.5.1 → v1.5.4](https://github.com/Lucas-C/pre-commit-hooks.git/compare/v1.5.1...v1.5.4) - [github.com/python-jsonschema/check-jsonschema.git: 0.23.2 → 0.27.0](https://github.com/python-jsonschema/check-jsonschema.git/compare/0.23.2...0.27.0) - [github.com/codespell-project/codespell: v2.2.5 → v2.2.6](https://github.com/codespell-project/codespell/compare/v2.2.5...v2.2.6) - [github.com/PyCQA/flake8.git: 6.0.0 → 6.1.0](https://github.com/PyCQA/flake8.git/compare/6.0.0...6.1.0) - [github.com/PyCQA/flake8.git: 4.0.1 → 6.1.0](https://github.com/PyCQA/flake8.git/compare/4.0.1...6.1.0) - [github.com/PyCQA/pylint.git: v3.0.0a6 → v3.0.0](https://github.com/PyCQA/pylint.git/compare/v3.0.0a6...v3.0.0) --- .pre-commit-config.yaml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index de2c13a..096fad8 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -5,7 +5,7 @@ ci: repos: - repo: https://github.com/asottile/add-trailing-comma.git - rev: v3.0.0 + rev: v3.1.0 hooks: - id: add-trailing-comma @@ -17,12 +17,12 @@ repos: - --honor-noqa - repo: https://github.com/Lucas-C/pre-commit-hooks.git - rev: v1.5.1 + rev: v1.5.4 hooks: - id: remove-tabs - repo: https://github.com/python-jsonschema/check-jsonschema.git - rev: 0.23.2 + rev: 0.27.0 hooks: - id: check-github-actions - id: check-github-workflows @@ -62,7 +62,7 @@ repos: language_version: python3 - repo: https://github.com/codespell-project/codespell - rev: v2.2.5 + rev: v2.2.6 hooks: - id: codespell @@ -78,7 +78,7 @@ repos: - --strict - repo: https://github.com/PyCQA/flake8.git - rev: 6.0.0 + rev: 6.1.0 hooks: - id: flake8 alias: flake8-no-wps @@ -98,7 +98,7 @@ repos: - repo: https://github.com/PyCQA/flake8.git # NOTE: This is kept at v4 for until WPS starts supporting flake v5. - rev: 4.0.1 # enforce-version: 4.0.1 + rev: 6.1.0 # enforce-version: 4.0.1 hooks: - id: flake8 alias: flake8-only-wps @@ -130,7 +130,7 @@ repos: - wemake-python-styleguide ~= 0.17.0 - repo: https://github.com/PyCQA/pylint.git - rev: v3.0.0a6 + rev: v3.0.0 hooks: - id: pylint args: From 102f507b758434b11f3a302e53c72ebad30ebef8 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 17 Oct 2023 21:02:57 +0000 Subject: [PATCH 2/6] Bump urllib3 from 2.0.6 to 2.0.7 in /requirements Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.0.6 to 2.0.7. - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](https://github.com/urllib3/urllib3/compare/2.0.6...2.0.7) --- updated-dependencies: - dependency-name: urllib3 dependency-type: indirect ... Signed-off-by: dependabot[bot] --- requirements/runtime.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements/runtime.txt b/requirements/runtime.txt index dc497f2..a4b7e1c 100644 --- a/requirements/runtime.txt +++ b/requirements/runtime.txt @@ -76,7 +76,7 @@ typing-extensions==4.7.1 # via # pydantic # pydantic-core -urllib3==2.0.6 +urllib3==2.0.7 # via # requests # twine From 70a33caeb93cb7e19240fbec59f10b44df0c20ce Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Thu, 2 Nov 2023 21:42:46 +0000 Subject: [PATCH 3/6] Bump pip from 22.3.1 to 23.3 in /requirements Bumps [pip](https://github.com/pypa/pip) from 22.3.1 to 23.3. - [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst) - [Commits](https://github.com/pypa/pip/compare/22.3.1...23.3) --- updated-dependencies: - dependency-name: pip dependency-type: indirect ... Signed-off-by: dependabot[bot] --- requirements/runtime-prerequisites.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements/runtime-prerequisites.txt b/requirements/runtime-prerequisites.txt index 8cad830..ab411a2 100644 --- a/requirements/runtime-prerequisites.txt +++ b/requirements/runtime-prerequisites.txt @@ -5,8 +5,8 @@ # pip-compile --allow-unsafe --output-file=requirements/runtime-prerequisites.txt --resolver=backtracking --strip-extras requirements/runtime-prerequisites.in # pip-with-requires-python==1.0.1 - # via -r requirements/runtime-prerequisites.in + # via -r runtime-prerequisites.in # The following packages are considered to be unsafe in a requirements file: -pip==22.3.1 +pip==23.3 # via pip-with-requires-python From 254a0d4ec4eacf3fd4c21bdd327fdd72c45213d9 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Sun, 5 Nov 2023 23:53:52 -0500 Subject: [PATCH 4/6] twine-upload: add a nudge for password auth Closes #187. --- twine-upload.sh | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/twine-upload.sh b/twine-upload.sh index e11c559..3f7632c 100755 --- a/twine-upload.sh +++ b/twine-upload.sh @@ -40,6 +40,13 @@ INPUT_VERIFY_METADATA="$(get-normalized-input 'verify-metadata')" INPUT_SKIP_EXISTING="$(get-normalized-input 'skip-existing')" INPUT_PRINT_HASH="$(get-normalized-input 'print-hash')" +PASSWORD_DEPRECATION_NUDGE="::warning title=Password-based uploads deprecated::\ +Starting in 2024, PyPI will require all users to enable Two-Factor \ +Authentication. This will consequently require all users to switch \ +to either API tokens or Trusted Publishers (preferred) for package \ +uploads. Read more: \ +https://blog.pypi.org/posts/2023-05-25-securing-pypi-with-2fa/" + TRUSTED_PUBLISHING_NUDGE="::warning title=Upgrade to Trusted Publishing::\ Trusted Publishers allows publishing packages to PyPI from automated \ environments like GitHub Actions without needing to use username/password \ @@ -69,6 +76,7 @@ else "against ${INPUT_REPOSITORY_URL}" if [[ "${INPUT_REPOSITORY_URL}" =~ pypi\.org ]]; then + echo "${PASSWORD_DEPRECATION_NUDGE}" echo "${TRUSTED_PUBLISHING_NUDGE}" fi fi From 2319287e0a60524271d7d771003e897075162148 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Wed, 22 Nov 2023 17:28:02 -0500 Subject: [PATCH 5/6] twine-upload: ::error, switch nudge order Signed-off-by: William Woodruff --- twine-upload.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/twine-upload.sh b/twine-upload.sh index 3f7632c..e4d5149 100755 --- a/twine-upload.sh +++ b/twine-upload.sh @@ -40,10 +40,10 @@ INPUT_VERIFY_METADATA="$(get-normalized-input 'verify-metadata')" INPUT_SKIP_EXISTING="$(get-normalized-input 'skip-existing')" INPUT_PRINT_HASH="$(get-normalized-input 'print-hash')" -PASSWORD_DEPRECATION_NUDGE="::warning title=Password-based uploads deprecated::\ +PASSWORD_DEPRECATION_NUDGE="::error title=Password-based uploads deprecated::\ Starting in 2024, PyPI will require all users to enable Two-Factor \ Authentication. This will consequently require all users to switch \ -to either API tokens or Trusted Publishers (preferred) for package \ +to either Trusted Publishers (preferred) or API tokens for package \ uploads. Read more: \ https://blog.pypi.org/posts/2023-05-25-securing-pypi-with-2fa/" From 41f3f53c7540cba18712b77660518afd98e0b65a Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 28 Nov 2023 23:56:20 +0000 Subject: [PATCH 6/6] Bump cryptography from 41.0.3 to 41.0.6 in /requirements Bumps [cryptography](https://github.com/pyca/cryptography) from 41.0.3 to 41.0.6. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](https://github.com/pyca/cryptography/compare/41.0.3...41.0.6) --- updated-dependencies: - dependency-name: cryptography dependency-type: indirect ... Signed-off-by: dependabot[bot] --- requirements/runtime.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/requirements/runtime.txt b/requirements/runtime.txt index dc497f2..5033861 100644 --- a/requirements/runtime.txt +++ b/requirements/runtime.txt @@ -14,7 +14,7 @@ cffi==1.15.1 # via cryptography charset-normalizer==3.2.0 # via requests -cryptography==41.0.3 +cryptography==41.0.6 # via secretstorage docutils==0.20.1 # via readme-renderer