Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump the production-dependencies group across 1 directory with 5 updates #756

Closed

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Aug 5, 2024

Bumps the production-dependencies group with 5 updates in the / directory:

Package From To
asteval 1.0.0 1.0.2
cachetools 5.3.3 5.4.0
numpy 2.0.0 2.0.1
pyphen 0.15.0 0.16.0
shapely 2.0.4 2.0.5

Updates asteval from 1.0.0 to 1.0.2

Release notes

Sourced from asteval's releases.

1.0.2

bug fixes:

  • fix NameError handling in expression code
  • make exception messages more Python-like

1.0.1

security fixes, based on audit by Andrew Effenhauser, Ayman Hammad, and Daniel Crowley, IBM X-Force Security Research division

  • remove numpy modules polynomial, fft, linalg by default for security concerns
  • disallow string.format(), improve security of f-string evaluation
Commits
  • 22f6f48 more work to make exception messages more Python like
  • d837fb9 put exception name with message, more like Python exception
  • 1dec732 Merge pull request #130 from shazarivf/fix-nameerror-handling
  • cab435a fix NameError handling in expression code
  • c673c8b update doc to describe audit by IBM security research group
  • d85e7cb remove numpy modules polynomial, fft, linalg by default for security concerns
  • 1b453ec disallow string.format(), improve security of f-string evaluation
  • See full diff in compare view

Updates cachetools from 5.3.3 to 5.4.0

Changelog

Sourced from cachetools's changelog.

v5.4.0 (2024-07-15)

  • Add the keys.typedmethodkey decorator.

  • Deprecate MRUCache class.

  • Deprecate @func.mru_cache decorator.

  • Update CI environment.

Commits
  • 990665b Release v5.4.0.
  • ebff841 Fix #256: Deprecate MRUCache class.
  • f9021d5 Fix #256: Deprecate @​mru_cache decorator.
  • f461c73 Merge remote-tracking branch 'origin/dependabot/github_actions/codecov/codeco...
  • a56d38e Merge remote-tracking branch 'origin/dependabot/github_actions/actions/checko...
  • 7354593 Bump actions/checkout from 4.1.6 to 4.1.7
  • 1a4bd04 Bump codecov/codecov-action from 4.4.1 to 4.5.0
  • e669b99 Add the keys.typedmethodkey decorator
  • fbf0b7e Bump actions/checkout from 4.1.4 to 4.1.6
  • 226028d Bump codecov/codecov-action from 4.3.1 to 4.4.1
  • Additional commits viewable in compare view

Updates numpy from 2.0.0 to 2.0.1

Release notes

Sourced from numpy's releases.

v2.0.1

NumPy 2.0.1 Release Notes

NumPy 2.0.1 is a maintenance release that fixes bugs and regressions discovered after the 2.0.0 release. NumPy 2.0.1 is the last planned release in the 2.0.x series, 2.1.0rc1 should be out shortly.

The Python versions supported by this release are 3.9-3.12.

NOTE: Do not use the GitHub generated "Source code" files listed in the "Assets", they are garbage.

Improvements

np.quantile with method closest_observation chooses nearest even order statistic

This changes the definition of nearest for border cases from the nearest odd order statistic to nearest even order statistic. The numpy implementation now matches other reference implementations.

(gh-26656)

Contributors

A total of 15 people contributed to this release. People with a "+" by their names contributed a patch for the first time.

  • @​vahidmech +
  • Alex Herbert +
  • Charles Harris
  • Giovanni Del Monte +
  • Leo Singer
  • Lysandros Nikolaou
  • Matti Picus
  • Nathan Goldbaum
  • Patrick J. Roddy +
  • Raghuveer Devulapalli
  • Ralf Gommers
  • Rostan Tabet +
  • Sebastian Berg
  • Tyler Reddy
  • Yannik Wicke +

Pull requests merged

A total of 24 pull requests were merged for this release.

  • #26711: MAINT: prepare 2.0.x for further development
  • #26792: TYP: fix incorrect import in ma/extras.pyi stub
  • #26793: DOC: Mention '1.25' legacy printing mode in set_printoptions
  • #26794: DOC: Remove mention of NaN and NAN aliases from constants

... (truncated)

Commits
  • 4c9f431 Merge pull request #27000 from charris/prepare-2.0.1
  • 0e70e00 REL: Prepare for the NumPy 2.0.1 release [wheel build]
  • 4d10ffc Merge pull request #26995 from charris/backport-26985
  • 764b667 BUG: Add object cast to avoid warning with limited API
  • 9be6ad6 Merge pull request #26971 from charris/backport-26935
  • 6d950e9 BUG: fix f2py tests to work with v2 API
  • 89630c0 Merge pull request #26962 from charris/backport-26919
  • 88fa840 TST: Apply test suggestion by Nathan for rlstrip fixes
  • a9da01e BUG,MAINT: Fix utf-8 character stripping memory access
  • 6afbbf8 Merge pull request #26963 from charris/backport-26930
  • Additional commits viewable in compare view

Updates pyphen from 0.15.0 to 0.16.0

Release notes

Sourced from pyphen's releases.

0.16.0

  • Close file when reading encoding
  • Update dictionary repository
Changelog

Sourced from pyphen's changelog.

Version 0.16.0

Released on 2024-07-30.

  • Close file when reading encoding
  • Update dictionary repository
Commits

Updates shapely from 2.0.4 to 2.0.5

Release notes

Sourced from shapely's releases.

2.0.5

Binary wheels on PyPI include GEOS 3.11.4 from 2024-06-05. Furthermore, universal2 wheels are removed for macOS since both x86_64 and arm64 wheels are provided.

Bug fixes:

  • Fix Point x/y/z attributes to return Python floats (#2074).
  • Fix affinity for Apple silicon with NumPy 2.0 by reverting matmul, and use direct matrix multiplication instead (#2085).

For a full changelog, see https://shapely.readthedocs.io/en/latest/release/2.x.html#version-2-0-5

Changelog

Sourced from shapely's changelog.

2.0.5 (2024-07-13)

Binary wheels on PyPI include GEOS 3.11.4 from 2024-06-05. Furthermore, universal2 wheels are removed for macOS since both x86_64 and arm64 wheels are provided.

Bug fixes:

  • Fix Point x/y/z attributes to return Python floats (#2074).
  • Fix affinity for Apple silicon with NumPy 2.0 by reverting matmul, and use direct matrix multiplication instead (#2085).
Commits
  • a4fe42f RLS: 2.0.5
  • 0bfcf3a DOC/RLS: starts changelog for 2.0.5 (#2088)
  • b186704 RLS/CI: upgrade GEOS versions to latest minor, add more to CI matrix (#2086)
  • 1ede9b2 FIX: replace matmul with manual matrix multiplication for affinity (#2085)
  • 0748c40 BUG: fix Point x/y/z/m attribtues to return Python floats (#2074)
  • 7903b2d Bump pypa/cibuildwheel from 2.19.1 to 2.19.2 (#2083)
  • e75c3a2 RLS/BLD: use native Apple Silicon macOS for arm64 wheels; remove universal2 (...
  • 13eb644 BLD: replace pkg_resources, prepend numpy include dirs (#2071)
  • ac283c3 CI: Update macos-11 image to macos-13 (#2072)
  • 473c202 Bump pypa/cibuildwheel from 2.18.1 to 2.19.1 (#2068)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the production-dependencies group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [asteval](https://github.com/lmfit/asteval) | `1.0.0` | `1.0.2` |
| [cachetools](https://github.com/tkem/cachetools) | `5.3.3` | `5.4.0` |
| [numpy](https://github.com/numpy/numpy) | `2.0.0` | `2.0.1` |
| [pyphen](https://github.com/Kozea/Pyphen) | `0.15.0` | `0.16.0` |
| [shapely](https://github.com/shapely/shapely) | `2.0.4` | `2.0.5` |



Updates `asteval` from 1.0.0 to 1.0.2
- [Release notes](https://github.com/lmfit/asteval/releases)
- [Commits](lmfit/asteval@1.0.0...1.0.2)

Updates `cachetools` from 5.3.3 to 5.4.0
- [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst)
- [Commits](tkem/cachetools@v5.3.3...v5.4.0)

Updates `numpy` from 2.0.0 to 2.0.1
- [Release notes](https://github.com/numpy/numpy/releases)
- [Changelog](https://github.com/numpy/numpy/blob/main/doc/RELEASE_WALKTHROUGH.rst)
- [Commits](numpy/numpy@v2.0.0...v2.0.1)

Updates `pyphen` from 0.15.0 to 0.16.0
- [Release notes](https://github.com/Kozea/Pyphen/releases)
- [Changelog](https://github.com/Kozea/Pyphen/blob/main/docs/changelog.rst)
- [Commits](Kozea/Pyphen@0.15.0...0.16.0)

Updates `shapely` from 2.0.4 to 2.0.5
- [Release notes](https://github.com/shapely/shapely/releases)
- [Changelog](https://github.com/shapely/shapely/blob/main/CHANGES.txt)
- [Commits](shapely/shapely@2.0.4...2.0.5)

---
updated-dependencies:
- dependency-name: asteval
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: cachetools
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: numpy
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: pyphen
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: shapely
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Aug 5, 2024
Copy link

sonarcloud bot commented Aug 5, 2024

Copy link
Contributor Author

dependabot bot commented on behalf of github Aug 12, 2024

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Aug 12, 2024
@dependabot dependabot bot deleted the dependabot/pip/production-dependencies-a0b8fcb9b3 branch August 12, 2024 14:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants