Skip to content

Bump the pip group with 5 updates #325

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
dependabot wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Bump the pip group with 5 updates #325

dependabot wants to merge 3 commits into from
+10 −10

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Jan 1, 2026

Bumps the pip group with 5 updates:

Package From To
python-gnupg 0.5.5 0.5.6
sigstore 3.6.5 4.1.0
mypy 1.19.0 1.19.1
pyfakefs 5.10.2 6.0.0
pytest 8.4.2 9.0.2

Updates python-gnupg from 0.5.5 to 0.5.6

Release notes

Sourced from python-gnupg's releases.

Enhancement and bug-fix release 0.5.6

This is an enhancement and bug-fix release, and all users are encouraged to upgrade.

Brief summary:

  • Fix #261: Ensure capability, fingerprint and keygrip are added to subkey_info.

  • Set username in the result when Verify uses a signing key that has expired or been revoked. Thanks to Steven Galgano for the patch.

This release has been signed with my code signing key:

Vinay Sajip (CODE SIGNING KEY) <vinay_sajip at yahoo.co.uk> Fingerprint: CA74 9061 914E AC13 8E66 EADB 9147 B477 339A 9B86

Commits
  • 54e9ca0 Changes for 0.5.6.
  • 8825037 Add support for Python 3.14 (#268)
  • 909cf60 Remove Travis CI and AppVeyor config (#269)
  • f0bfa1a Drop redundant wheel from PEP 517 build deps (#264)
  • 9b0399b Fix typo: spell decrypted_data correctly in the documentation. (#263)
  • fcedea7 Added capability to subkey_info, reformatted code.
  • eca04eb Set username when Verify uses a signing key that has expired or been (#262)
  • acfa898 Fix #261: Ensure fingerprint and keygrip are added to subkey_info.
  • 8148db4 Bump version.
  • 2e82984 Added tag 0.5.5 for changeset 1b77f5b12ad7
  • See full diff in compare view

Updates sigstore from 3.6.5 to 4.1.0

Release notes

Sourced from sigstore's releases.

v4.1.0

Added

  • cli: Support using other Sigstore instances with --instance URL. New instances are trusted with new top level command trust-instance ROOTFILE. #1548

Changed

  • Added cryptography 46 to list of compatible cryptography releases (#1544)
  • Improved error message when verifying bundles with unsupported log entry versions (#1569)

Fixed

  • cli: Always read/write UTF-8. This fixes an issue on Windows where the platform default encoding was used: the issue has existed for a while, but became more visible with signature bundles that contain rekor2 entries. #1553

v4.0.0

This is a major release with a host of API and functionality changes. The major new feature is Rekor v2 support but many other changes are also included, see list below.

Added

  • cli: Add --rekor-version to sign command arguments: This can be useful if Sigstore instance provides multiple Rekor versions and user wants to override the default choice #1471
  • cli: Support parallel signing. When multiple artifacts are signed, the Rekor requests are submitted in parallel: this is especially useful with Rekor v2. #1468, #1478, #1485
  • oidc (API): Allow custom audience claims via API #1402
  • rekor (API): Support Rekor v2 (aka rekor-tiles) in both verification and signing. #1370, #1422, #1432
  • trust (API): Make TrustedRoot, SigningConfig and ClientTrustConfig public API #1496

Changed

  • cli: Improve verify UX when wrong instance is used #1510
  • deps: replace sigstore_protobuf_specs dependency with sigstore-models #1470

... (truncated)

Changelog

Sourced from sigstore's changelog.

[4.1.0]

Added

  • cli: Support using other Sigstore instances with --instance URL. New instances are trusted with new top level command trust-instance ROOTFILE. #1548

Changed

  • Added cryptography 46 to list of compatible cryptography releases (#1544)
  • Improved error message when verifying bundles with unsupported log entry versions (#1569)

Fixed

  • cli: Always read/write UTF-8. This fixes an issue on Windows where the platform default encoding was used: the issue has existed for a while, but became more visible with signature bundles that contain rekor2 entries. #1553

[4.0.0]

This is a major release with a host of API and functionality changes. The major new feature is Rekor v2 support but many other changes are also included, see list below.

Added

  • cli: Add --rekor-version to sign command arguments: This can be useful if Sigstore instance provides multiple Rekor versions and user wants to override the default choice #1471
  • cli: Support parallel signing. When multiple artifacts are signed, the Rekor requests are submitted in parallel: this is especially useful with Rekor v2. #1468, #1478, #1485
  • oidc (API): Allow custom audience claims via API #1402
  • rekor (API): Support Rekor v2 (aka rekor-tiles) in both verification and signing. #1370, #1422, #1432
  • trust (API): Make TrustedRoot, SigningConfig and ClientTrustConfig public API #1496

Changed

  • cli: Improve verify UX when wrong instance is used #1510
  • deps: replace sigstore_protobuf_specs dependency with sigstore-models

... (truncated)

Commits
  • 3447f96 Forward port entry kindversion error improvement, bump version to 4.1.0 (#1569)
  • 2dbe03a build(deps): bump github/codeql-action in the actions group (#1572)
  • 02daa69 build(deps): bump rich from 14.1.0 to 14.2.0 (#1571)
  • 1615939 build(deps): bump the actions group with 2 updates (#1568)
  • 72b6581 build(deps): update ruff requirement from <0.13.4 to <0.14.1 (#1567)
  • 64dbeba cli: Support using other Sigstore instances (#1548)
  • 508b0e7 build(deps): bump softprops/action-gh-release in the actions group (#1563)
  • e31f481 build(deps): update ruff requirement from <0.13.3 to <0.13.4 (#1562)
  • dec897b build(deps): bump github/codeql-action in the actions group (#1561)
  • 0a54b4f build(deps): bump cryptography from 46.0.1 to 46.0.2 (#1558)
  • Additional commits viewable in compare view

Updates mypy from 1.19.0 to 1.19.1

Changelog

Sourced from mypy's changelog.

Mypy 1.19.1

  • Fix noncommutative joins with bounded TypeVars (Shantanu, PR 20345)
  • Respect output format for cached runs by serializing raw errors in cache metas (Ivan Levkivskyi, PR 20372)
  • Allow types.NoneType in match cases (A5rocks, PR 20383)
  • Fix mypyc generator regression with empty tuple (BobTheBuidler, PR 20371)
  • Fix crash involving Unpack-ed TypeVarTuple (Shantanu, PR 20323)
  • Fix crash on star import of redefinition (Ivan Levkivskyi, PR 20333)
  • Fix crash on typevar with forward ref used in other module (Ivan Levkivskyi, PR 20334)
  • Fail with an explicit error on PyPy (Ivan Levkivskyi, PR 20389)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • A5rocks
  • BobTheBuidler
  • bzoracler
  • Chainfire
  • Christoph Tyralla
  • David Foster
  • Frank Dana
  • Guo Ci
  • iap
  • Ivan Levkivskyi
  • James Hilton-Balfe
  • jhance
  • Joren Hammudoglu
  • Jukka Lehtosalo
  • KarelKenens
  • Kevin Kannammalil
  • Marc Mueller
  • Michael Carlstrom
  • Michael J. Sullivan
  • Piotr Sawicki
  • Randolf Scholz
  • Shantanu
  • Sigve Sebastian Farstad
  • sobolevn
  • Stanislav Terliakov
  • Stephen Morton
  • Theodore Ando
  • Thiago J. Barbalho
  • wyattscarpenter

I’d also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 1.18

We’ve just uploaded mypy 1.18.1 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance

... (truncated)

Commits

Updates pyfakefs from 5.10.2 to 6.0.0

Release notes

Sourced from pyfakefs's releases.

pyfakefs release version 6.0.0

  • removes some deprecated functionality
  • removes support for Python < 3.10
  • see the release notes for a list of changes
Changelog

Sourced from pyfakefs's changelog.

Version 6.0.0 (2025-12-21)

Removes some deprecated functionality, removes support for Python < 3.10.

Breaking Changes

  • removed support for Python versions < 3.10; patch releases based on pyfakefs 5.10 supporting older versions may be made on demand
  • removed support for patching legacy modules scandir and pathlib2
  • changed the default for FakeFilesystem.shuffle_listdir_results to True to reflect the real filesystem behavior

Changes

  • added some support for Python 3.15a3

Fixes

  • fixes a problem with Path type hints using the pipe symbol in wrapped functions inside an fs dependent fixture (see #1242)
  • fixes problem with new coverage in Python 3.14 using the fake filesystem (see #1245)

Documentation

  • added project information to documentation pages

Infrastructure

  • added CI tests for Python 3.15
Commits
  • fe83300 Release 6.0.0
  • 326eaa3 Pin myst-parser to latest version 4.0.1
  • ff7d908 Add project info to documentation
  • 42ad731 Adapt to changes in Python 3.15a3
  • 7613b9f Add CI tests for Python 3.15
  • 4a4dea8 Make old, deprecated "import py" optional (#1257)
  • f0794ee Update furo from 2025.7.19 to 2025.12.19
  • 09a1283 Update pre-commit from 4.5.0 to 4.5.1
  • 57e6dfe [pre-commit.ci] pre-commit autoupdate
  • 722ab00 Bump actions/cache from 4 to 5
  • Additional commits viewable in compare view

Updates pytest from 8.4.2 to 9.0.2

Release notes

Sourced from pytest's releases.

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

  • #13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

    You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

    Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.

  • #13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.

  • #13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0. Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim. It will be deprecated in pytest 9.1 and removed in pytest 10.

  • #13965: Fixed quadratic-time behavior when handling unittest subtests in Python 3.10.

Improved documentation

  • #4492: The API Reference now contains cross-reference-able documentation of pytest's command-line flags <command-line-flags>.

9.0.1

pytest 9.0.1 (2025-11-12)

Bug fixes

  • #13895: Restore support for skipping tests via raise unittest.SkipTest.
  • #13896: The terminal progress plugin added in pytest 9.0 is now automatically disabled when iTerm2 is detected, it generated desktop notifications instead of the desired functionality.
  • #13904: Fixed the TOML type of the verbosity settings in the API reference from number to string.
  • #13910: Fixed UserWarning: Do not expect file_or_dir on some earlier Python 3.12 and 3.13 point versions.

Packaging updates and notes for downstreams

  • #13933: The tox configuration has been adjusted to make sure the desired version string can be passed into its package_env through the SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PYTEST environment variable as a part of the release process -- by webknjaz.

Contributor-facing changes

  • #13891, #13942: The CI/CD part of the release automation is now capable of creating GitHub Releases without having a Git checkout on disk -- by bluetech and webknjaz.
  • #13933: The tox configuration has been adjusted to make sure the desired version string can be passed into its package_env through the SETUPTOOLS_SCM_PRETEND_VERSION_FOR_PYTEST environment variable as a part of the release process -- by webknjaz.

... (truncated)

Commits
  • 3d10b51 Prepare release version 9.0.2
  • 188750b Merge pull request #14030 from pytest-dev/patchback/backports/9.0.x/1e4b01d1f...
  • b7d7bef Merge pull request #14014 from bluetech/compat-note
  • bd08e85 Merge pull request #14013 from pytest-dev/patchback/backports/9.0.x/922b60377...
  • bc78386 Add CLI options reference documentation (#13930)
  • 5a4e398 Fix docs typo (#14005) (#14008)
  • d7ae6df Merge pull request #14006 from pytest-dev/maintenance/update-plugin-list-tmpl...
  • 556f6a2 pre-commit: fix rst-lint after new release (#13999) (#14001)
  • c60fbe6 Fix quadratic-time behavior when handling unittest subtests in Python 3.10 ...
  • 73d9b01 Merge pull request #13995 from nicoddemus/patchback/backports/9.0.x/1b5200c0f...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the pip group with 5 updates
5e5edf8 
Bumps the pip group with 5 updates:

| Package | From | To |
| --- | --- | --- |
| [python-gnupg](https://github.com/vsajip/python-gnupg) | `0.5.5` | `0.5.6` |
| [sigstore](https://github.com/sigstore/sigstore-python) | `3.6.5` | `4.1.0` |
| [mypy](https://github.com/python/mypy) | `1.19.0` | `1.19.1` |
| [pyfakefs](https://github.com/pytest-dev/pyfakefs) | `5.10.2` | `6.0.0` |
| [pytest](https://github.com/pytest-dev/pytest) | `8.4.2` | `9.0.2` |


Updates `python-gnupg` from 0.5.5 to 0.5.6
- [Release notes](https://github.com/vsajip/python-gnupg/releases)
- [Changelog](https://github.com/vsajip/python-gnupg/blob/master/release)
- [Commits](vsajip/python-gnupg@0.5.5...0.5.6)

Updates `sigstore` from 3.6.5 to 4.1.0
- [Release notes](https://github.com/sigstore/sigstore-python/releases)
- [Changelog](https://github.com/sigstore/sigstore-python/blob/main/CHANGELOG.md)
- [Commits](sigstore/sigstore-python@v3.6.5...v4.1.0)

Updates `mypy` from 1.19.0 to 1.19.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.19.0...v1.19.1)

Updates `pyfakefs` from 5.10.2 to 6.0.0
- [Release notes](https://github.com/pytest-dev/pyfakefs/releases)
- [Changelog](https://github.com/pytest-dev/pyfakefs/blob/main/CHANGES.md)
- [Commits](pytest-dev/pyfakefs@v5.10.2...v6.0.0)

Updates `pytest` from 8.4.2 to 9.0.2
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@8.4.2...9.0.2)

---
updated-dependencies:
- dependency-name: python-gnupg
  dependency-version: 0.5.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: sigstore
  dependency-version: 4.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip
- dependency-name: mypy
  dependency-version: 1.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: pyfakefs
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip
- dependency-name: pytest
  dependency-version: 9.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jan 1, 2026
ezio-melotti
ezio-melotti reviewed Jan 1, 2026
View reviewed changes
@hugovk
Copy link
Member

hugovk commented Jan 1, 2026

Test was failing because os.listdir returns a list in arbitrary order, and seems the new pyfakefs 6.0.0 is returning a different order than before.

https://docs.python.org/3/library/os.html#os.listdir

Let's sort to keep the output deterministic.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ezio-melotti ezio-melotti ezio-melotti left review comments

Assignees

@ezio-melotti ezio-melotti

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@hugovk @ezio-melotti