Skip to content

build(deps): bump the dependencies group across 1 directory with 5 updates #1029

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 1 commit into from
Closed

build(deps): bump the dependencies group across 1 directory with 5 updates #1029

wants to merge 1 commit into from

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Sep 23, 2025 •
edited
Loading

Updates the requirements on cryptography, cffi, pycparser, boto3 and botocore to permit the latest version.
Updates cryptography from 45.0.7 to 46.0.1

Changelog

Sourced from cryptography's changelog.

46.0.1 - 2025-09-16


* Fixed an issue where users installing via ``pip`` on Python 3.14 development
  versions would not properly install a dependency.
* Fixed an issue building the free-threaded macOS 3.14 wheels.

.. _v46-0-0:


46.0.0 - 2025-09-16

  • BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been removed.
  • Support for OpenSSL < 3.0 is deprecated and will be removed in the next release.
  • Support for x86_64 macOS (including publishing wheels) is deprecated and will be removed in two releases. We will switch to publishing an arm64 only wheel for macOS.
  • Support for 32-bit Windows (including publishing wheels) is deprecated and will be removed in two releases. Users should move to a 64-bit Python installation.
  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.3.
  • We now build ppc64le manylinux wheels and publish them to PyPI.
  • We now build win_arm64 (Windows on Arm) wheels and publish them to PyPI.
  • Added support for free-threaded Python 3.14.
  • Removed the deprecated get_attribute_for_oid method on :class:~cryptography.x509.CertificateSigningRequest. Users should use :meth:~cryptography.x509.Attributes.get_attribute_for_oid instead.
  • Removed the deprecated CAST5, SEED, IDEA, and Blowfish classes from the cipher module. These are still available in :doc:/hazmat/decrepit/index.
  • In X.509, when performing a PSS signature with a SHA-3 hash, it is now encoded with the official NIST SHA3 OID.

.. _v45-0-7:

Commits

Updates cffi from 1.17.1 to 2.0.0

Release notes

Sourced from cffi's releases.

v2.0.0

What's Changed

  • Add Python 3.14 support.
  • Add CPython free-threaded support (3.14t+ only) - huge thanks to the folks at Quansight Labs for all the work to get this one sorted!
  • Drop Python <= 3.8 support.
  • Fix order dependency affecting nested type size calculation (#148).

Full Changelog: python-cffi/cffi@v1.17.1...v2.0.0

v2.0.0b1

What's Changed

  • Add Python 3.14 support.
  • Add CPython free-threaded support (3.14t+ only).
  • Drop Python <= 3.8 support.
  • Fix order dependency affecting nested type size calculation (#148).

Full Changelog: python-cffi/cffi@v1.17.1...v2.0.0b1

Commits
  • 6366c01 release 2.0.0 (#196)
  • 95c8476 2.0.0 post beta backports (#195)
  • 195cbda Release 2.0.0b1 (#183)
  • b4bbe79 fix version test to support beta
  • 7ed073d Add support for the free-threaded build (#178)
  • 67a170d Change the license from MIT to MIT-no-attribution, which is the same without ...
  • 92645ec Add Python 3.14 support/testing (#177)
  • 2b81170 doc: update test commands in Section Testing/development tips (#158)
  • 25172b8 doc: update year (#153)
  • b57a92c issue 147: force-compute nested structs before parent structs. Occurs mainly...
  • Additional commits viewable in compare view

Updates pycparser from 2.22 to 2.23

Release notes

Sourced from pycparser's releases.

release_v2.23

What's Changed

New Contributors

Full Changelog: eliben/pycparser@release_v2.22...release_v2.23

Commits

Updates boto3 to 1.40.36

Commits
  • 02ae095 Merge branch 'release-1.40.36'
  • 5f59e53 Bumping version to 1.40.36
  • 5a8e929 Add changelog entries from botocore
  • 22fa3d5 Merge branch 'release-1.40.35'
  • 22e132e Merge branch 'release-1.40.35' into develop
  • 021298e Bumping version to 1.40.35
  • 02961e6 Add changelog entries from botocore
  • 1564e42 Merge branch 'release-1.40.34'
  • b5c8399 Merge branch 'release-1.40.34' into develop
  • dd6d06b Bumping version to 1.40.34
  • Additional commits viewable in compare view

Updates botocore to 1.40.36

Commits
  • 28c3ae2 Merge branch 'release-1.40.36'
  • 95bd009 Bumping version to 1.40.36
  • 674f0d1 Update endpoints model
  • 0b599b5 Update to latest models
  • 331de65 Merge branch 'release-1.40.35'
  • 7871b95 Merge branch 'release-1.40.35' into develop
  • 4451f93 Bumping version to 1.40.35
  • 387a2a4 Update endpoints model
  • fd4916f Update to latest models
  • de187f3 Update sms-voice models and endpoint tests to latest version. (#3553)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Sep 23, 2025
@jku
Copy link
Collaborator

jku commented Sep 23, 2025

ah, I told dependabot to ignore the sigstore release but of course that does not help since the previous sigstore release is also incompatible with cryptography... I will try to do a new sigstore-python release by next week, maybe we also need to come up with some other strategy there as this is quite annoying.

@dependabot dependabot bot force-pushed the dependabot/pip/dependencies-75ebdf151a branch from 7eb6a69 to c8a6376 Compare September 30, 2025 01:15
@dependabot
build(deps): bump the dependencies group across 1 directory with 5 up…
c72c3e9 
…dates

Updates the requirements on [cryptography](https://github.com/pyca/cryptography), [cffi](https://github.com/python-cffi/cffi), [pycparser](https://github.com/eliben/pycparser), [boto3](https://github.com/boto/boto3) and [botocore](https://github.com/boto/botocore) to permit the latest version.

Updates `cryptography` from 45.0.7 to 46.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@45.0.7...46.0.1)

Updates `cffi` from 1.17.1 to 2.0.0
- [Release notes](https://github.com/python-cffi/cffi/releases)
- [Commits](python-cffi/cffi@v1.17.1...v2.0.0)

Updates `pycparser` from 2.22 to 2.23
- [Release notes](https://github.com/eliben/pycparser/releases)
- [Changelog](https://github.com/eliben/pycparser/blob/main/CHANGES)
- [Commits](eliben/pycparser@release_v2.22...release_v2.23)

Updates `boto3` to 1.40.36
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.40.26...1.40.36)

Updates `botocore` to 1.40.36
- [Commits](boto/botocore@1.40.26...1.40.36)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: cffi
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: pycparser
  dependency-version: '2.23'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: boto3
  dependency-version: 1.40.36
  dependency-type: direct:production
  dependency-group: dependencies
- dependency-name: botocore
  dependency-version: 1.40.36
  dependency-type: direct:production
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot force-pushed the dependabot/pip/dependencies-75ebdf151a branch from c8a6376 to c72c3e9 Compare October 6, 2025 22:02
@jku
Copy link
Collaborator

jku commented Oct 10, 2025

@dependabot recreate

@dependabot Dependabot
Copy link
Contributor Author

dependabot bot commented on behalf of github Oct 10, 2025

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot bot closed this Oct 10, 2025
@dependabot dependabot bot deleted the dependabot/pip/dependencies-75ebdf151a branch October 10, 2025 09:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jku