Skip to content

chore(deps): bump the python-minor-and-patch group across 1 directory with 6 updates - #636

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/pip/develop/python-minor-and-patch-0a912a637f
Open

chore(deps): bump the python-minor-and-patch group across 1 directory with 6 updates#636
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/pip/develop/python-minor-and-patch-0a912a637f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 6 updates in the / directory:

Package From To
gitpython 3.1.54 3.2.0
markdown 3.10.2 3.11
bleach 6.3.0 6.4.0
python-dotenv 1.2.2 1.2.4
stix2-validator 3.2.0 3.3.1
typer 0.27.0 0.27.3

Updates gitpython from 3.1.54 to 3.2.0

Release notes

Sourced from gitpython's releases.

3.2.0 - Security

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.62...3.2.0

3.1.62

What's Changed

New Contributors

... (truncated)

Changelog

Sourced from gitpython's changelog.

3.2.0

Drops support for Python 3.7 (5 years after its EOL).

Security fixes for

If you can, also try and provide feedback on the upcoming v4 branch gitpython-developers/GitPython#2274 - patches welcome.

See the following for all changes. https://github.com/gitpython-developers/GitPython/releases/tag/3.2.0

3.1.62

Security fixes for

If you can, also try and provide feedback on the upcoming v4 branch gitpython-developers/GitPython#2274 - patches welcome.

See the following for all changes. https://github.com/gitpython-developers/GitPython/releases/tag/3.1.62

3.1.61

A fixup release to avoid accidental removal of public class regex on Actor. It's now deprecated instead.

If you can, also try and provide feedback on the upcoming v4 branch gitpython-developers/GitPython#2274 - patches welcome.

See the following for all changes. https://github.com/gitpython-developers/GitPython/releases/tag/3.1.61

... (truncated)

Commits
  • 6a7180a prepare for next release, v3.2
  • 0b64501 refactor(db): deprecate the pure-Python GitDB backend
  • 9349ff5 fix(repo): preserve literal separate Git directory paths
  • 8290c98 fix: bound actor and date parsing
  • 9ad28cc fix: complete safety checks in Git command wrappers
  • ce2093b bump minor version to indicate drop of python 3.7 support
  • dafafff Merge pull request #2247 from gitpython-developers/pos-arg-sanitization
  • 790bb31 fix(remote): reject option-shaped pull operands
  • 7b26b6d Drop Python 3.7
  • 8da6508 fix: validate checkout positional reference options
  • Additional commits viewable in compare view

Updates markdown from 3.10.2 to 3.11

Release notes

Sourced from markdown's releases.

Release 3.11.0

Changed

  • Inline processors now resume searching after the previous match, improving performance for repeated inline patterns (#1619).
  • Officially support Python 3.15 and drop support for Python 3.10
  • Walk backtick runs in BacktickInlineProcessor without a regex (#1620).
  • Switch static site generator for documentation from MkDocs to Zensical (#1627, #1635, #1637, and #1638).

Fixed

  • Ensure removing Abbreviations does not raise an error (#1634).
  • Fix an issue with excessive backtracking when matching inline code blocks (#1617).
  • md_in_html now honors tags added to Markdown.block_level_elements after the extension is loaded (#1246).
  • Fix quadratic-time regex backtracking in ReferenceProcessor when a link reference definition has no URL, e.g. a line consisting only of [id]: followed by many trailing spaces (#798).
  • Document attr_list usage for def_list (#1123).

Release 3.10.3

Fixed

  • Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
  • Add AI Policy to Contributing Guide.
  • Officially document all included extensions as being in maintenance mode.
  • Link the Extension API documentation to the API Reference (#1612).
Changelog

Sourced from markdown's changelog.

title: Changelog toc_depth: 2

Python-Markdown Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to the Python Version Specification. See the Contributing Guide for details.

[3.11.1] - 2026-10-13

Fixed

  • Update serializer to be non-recursive (#1644).
  • Improve ancestor handling in the inline Treeprocessor (#1646).
  • Keep a raw HTML comment inside an inline HTML element that closes in the same paragraph, instead of splitting the paragraph around it (#1643).
  • Fix issue where inline HTML attributes were rejected if they had < or > in the attribute (#1647).
  • Fix issue where an unterminated end tag (</foo) could cause all remaining content to be dropped (#1651).
  • Complete rework of emphasis handling to improve nested emphasis handling better (#1632).

[3.11.0] - 2026-09-25

Changed

  • Inline processors now resume searching after the previous match, improving performance for repeated inline patterns (#1619).
  • Officially support Python 3.15 and drop support for Python 3.10
  • Walk backtick runs in BacktickInlineProcessor without a regex (#1620).
  • Switch static site generator for documentation from MkDocs to Zensical (#1627, #1635, #1637, and #1638).

Fixed

  • Ensure removing Abbreviations does not raise an error (#1634).
  • Fix an issue with excessive backtracking when matching inline code blocks (#1617).
  • md_in_html now honors tags added to Markdown.block_level_elements after the extension is loaded (#1246).
  • Fix quadratic-time regex backtracking in ReferenceProcessor when a link reference definition has no URL, e.g. a line consisting only of [id]: followed by many trailing spaces (#798).
  • Document attr_list usage for def_list (#1123).

[3.10.3] - 2026-07-30

... (truncated)

Commits
  • 0ffbf00 Bump version to 3.11.0
  • 547a934 Show adminitions as rendered examples in contrbuting guide
  • 571f050 Cleanup archived changelog
  • a5176b0 Ensure py-render codeblock title in properly escaped.
  • 819fff9 Document the use of attr_list with def_list.
  • 36cdbd3 Final cleanup for Zensical transition
  • 8a96db5 Add py-render custom code block formater
  • 5d1363c Fix quadratic-time backtracking when a reference link has no URL
  • 0d6afd1 Add Markdown renderer as superfences formatter
  • 175fb5a Ensure removing Abbreviations does not raise an error.
  • Additional commits viewable in compare view

Updates bleach from 6.3.0 to 6.4.0

Changelog

Sourced from bleach's changelog.

Version 6.4.0 (June 5th, 2026)

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

  • Dropped support for pypy 3.10. (#764)

Security fixes

  • Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

    Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.

    For example::

    import bleach payload1 = 'Click' result1 = bleach.clean(payload1) print(repr(result1))

    outputs::

    'Click'

    See the advisory for details.

  • Fix GHSA-gj48-438w-jh9v.

    Fix issue where URI sanitization wasn't happening in formaction attributes.

    See the advisory for details.

Bug fixes

  • Add support for pypy 3.11. (#764)

  • Drop version max in tinycss2 pin. (#772)

    This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.

Commits
  • f0355a7 fix: fix last release date in CHANGES
  • ae4e8a2 chore: bleach 6.4.0 and final release
  • 970df58 fix: uri-sanitization in formaction attributes
  • 7c4867c fix: xss bypass in allowed protocol test using unicode invisible characters
  • 913ab75 fix: reduce redundancy in workflow jobs
  • 218c15a fix: rework pip caching
  • 4f0b097 fix: fix tox platform restrictions
  • e95a79d chore: update pytest
  • 91539d4 Bump actions/cache from 5.0.3 to 5.0.4
  • cd47b4c fix: handle left-angle-bracket that's not a tag (#733)
  • Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.4

Release notes

Sourced from python-dotenv's releases.

v1.2.4

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698

v1.2.3

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Changelog

Sourced from python-dotenv's changelog.

[1.2.4] - 2026-10-01

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698

[1.2.3] - 2026-08-16

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Commits
  • a565c2c Bump version: 1.2.3 → 1.2.4
  • 4a7abd0 docs: add 1.2.4 release notes (#663, #698, #700)
  • f215c02 fix: dotenv get exits 0 for empty string values (#700)
  • 58f2d7c test: make test_run_with_command_flags portable and meaningful (#709)
  • e0310e5 fix: honor --no-override when expanding variables in dotenv run (#698)
  • a00cb2e docs: add CHANGELOG entry for #663 (fix #600)
  • f5485a6 fix: parse empty unquoted value with inline comment as empty string
  • 49515af Bump version: 1.2.2 → 1.2.3
  • 8ac846f chore: add release runbook (RELEASING.md) and make release target
  • bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
  • Additional commits viewable in compare view

Updates stix2-validator from 3.2.0 to 3.3.1

Release notes

Sourced from stix2-validator's releases.

cti-stix-validator v3.3.1 released

What's Changed

Full Changelog: oasis-open/cti-stix-validator@v3.3.0...v3.3.1

cti-stix-validator v3.3.0 Release Notes

Release date: 2026-05-12

Overview

cti-stix-validator v3.3.0 updates the supported Python versions, refreshes schema support, improves validation behavior around timestamp comparisons, and includes several test and documentation improvements.

This release also includes performance improvements for schema lookup caching and additional fixes around STIX object reference validation.

Highlights

  • Updated supported Python versions, including support for Python 3.14.
  • Added the required minimum Python version metadata.
  • Improved timestamp comparison handling to avoid validation errors when malformed timestamp values are encountered.
  • Updated schema pinning to the latest STIX 2.1 schema commit.
  • Improved schema lookup performance through caching.
  • Fixed object reference validation to prevent invalid SDO usage in SCO object reference properties.
  • Updated maintainers list and ReadTheDocs configuration.
  • Added and improved tests for timestamp handling, campaign objects, STIX 2.0 Course of Action objects, and object reference validation.

Changes

Python Support

  • Bumped the latest supported version.
  • Added the required minimum Python version.
  • Updated the list of supported Python versions.
  • Added Python 3.14 support.

Validation Fixes

  • Fixed timestamp field comparison to avoid exceptions when comparing invalid or improperly formatted timestamp values.
  • Added checks to ensure both timestamp values are valid datetime objects before comparison.
  • Improved handling of cases where one timestamp may still be a string due to invalid formatting.
  • Fixed additional datetime comparison issues that could previously lead to incorrect negative validation results.

STIX Schema and Object Reference Validation

  • Updated schema pinning to the latest STIX 2.1 schema commit.
  • Improved validation for object_refs.
  • Added schema allow/deny patterns to limit object_refs to SCO and SRO where appropriate.

... (truncated)

Changelog

Sourced from stix2-validator's changelog.

CHANGELOG

Commits
  • d3ef2a5 Merge branch 'master' of github.com:oasis-open/cti-stix-validator
  • 3059025 chg: [release] version v3.3.1
  • d9266a9 Merge pull request #247 from chrisr3d/master
  • 7d4af31 fix: [tests] Trying with a better assertion for error message raised with inv...
  • b767784 Merge branch 'master' of github.com:oasis-open/cti-stix-validator
  • ae71357 fix: Using latest pattern validator version
  • 9e4a1ea Merge pull request #246 from chrisr3d/master
  • 1885714 chg: Bumped latest version and added required minimum python version
  • 503daa7 Merge branch 'master' of github.com:chrisr3d/cti-stix-validator
  • fbcf543 Merge branch 'master' of github.com:oasis-open/cti-stix-validator
  • Additional commits viewable in compare view

Updates typer from 0.27.0 to 0.27.3

Release notes

Sourced from typer's releases.

0.27.3

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

0.27.2

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

0.27.1

Features

  • ✨ Make epilog formatting consistent with other parts of the help string. PR #1405 by @​svlandeg.

... (truncated)

Changelog

Sourced from typer's changelog.

0.27.3 (2026-10-06)

Fixes

  • 🐛 Escape terminal control characters in error messages. PR #1972 by @​tiangolo.

Internal

0.27.2 (2026-08-28)

Refactors

  • ♻️ Create exceptions module and TyperException base class. PR #1942 by @​svlandeg.

Docs

  • 🐛 Fix showing fast button as external link in animated terminals in docs. PR #1912 by @​phalberg.

Internal

0.27.1 (2026-08-03)

Features

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 20, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/develop/python-minor-and-patch-0a912a637f branch from 895b3e8 to a1d4131 Compare August 27, 2026 18:53
@dependabot
dependabot Bot force-pushed the dependabot/pip/develop/python-minor-and-patch-0a912a637f branch from a1d4131 to 59311d5 Compare September 3, 2026 18:53
@dependabot
dependabot Bot force-pushed the dependabot/pip/develop/python-minor-and-patch-0a912a637f branch 2 times, most recently from 29138e9 to aaf9307 Compare September 24, 2026 18:53
@dependabot
dependabot Bot force-pushed the dependabot/pip/develop/python-minor-and-patch-0a912a637f branch 2 times, most recently from 4344f15 to 8cd227e Compare October 8, 2026 18:53
@dependabot
chore(deps): bump the python-minor-and-patch group across 1 directory…
30ee492 
… with 6 updates

Bumps the python-minor-and-patch group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.54` | `3.2.0` |
| [markdown](https://github.com/Python-Markdown/markdown) | `3.10.2` | `3.11` |
| [bleach](https://github.com/mozilla/bleach) | `6.3.0` | `6.4.0` |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.4` |
| [stix2-validator](https://github.com/oasis-open/cti-stix-validator) | `3.2.0` | `3.3.1` |
| [typer](https://github.com/fastapi/typer) | `0.27.0` | `0.27.3` |



Updates `gitpython` from 3.1.54 to 3.2.0
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/doc/source/changes.rst)
- [Commits](gitpython-developers/GitPython@3.1.54...3.2.0)

Updates `markdown` from 3.10.2 to 3.11
- [Release notes](https://github.com/Python-Markdown/markdown/releases)
- [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md)
- [Commits](Python-Markdown/markdown@3.10.2...3.11.0)

Updates `bleach` from 6.3.0 to 6.4.0
- [Changelog](https://github.com/mozilla/bleach/blob/main/CHANGES)
- [Commits](mozilla/bleach@v6.3.0...v6.4.0)

Updates `python-dotenv` from 1.2.2 to 1.2.4
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.4)

Updates `stix2-validator` from 3.2.0 to 3.3.1
- [Release notes](https://github.com/oasis-open/cti-stix-validator/releases)
- [Changelog](https://github.com/oasis-open/cti-stix-validator/blob/master/CHANGELOG)
- [Commits](oasis-open/cti-stix-validator@v3.2.0...v3.3.1)

Updates `typer` from 0.27.0 to 0.27.3
- [Release notes](https://github.com/fastapi/typer/releases)
- [Changelog](https://github.com/fastapi/typer/blob/master/docs/release-notes.md)
- [Commits](fastapi/typer@0.27.0...0.27.3)

---
updated-dependencies:
- dependency-name: bleach
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: gitpython
  dependency-version: 3.1.59
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: markdown
  dependency-version: 3.10.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: stix2-validator
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: typer
  dependency-version: 0.27.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/develop/python-minor-and-patch-0a912a637f branch from 8cd227e to 30ee492 Compare October 15, 2026 18:53
@sonarqubecloud

sonarqubecloud Bot commented Oct 15, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants