Repository navigation
ci: bump gitpython from 3.1.57 to 3.1.62 in /backend in the pip group across 1 directory - #23
dependabot[bot] wants to merge 1 commit into
Conversation
Bumps the pip group with 1 update in the /backend directory: [gitpython](https://github.com/gitpython-developers/GitPython). Updates `gitpython` from 3.1.57 to 3.1.62 - [Release notes](https://github.com/gitpython-developers/GitPython/releases) - [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES) - [Commits](gitpython-developers/GitPython@3.1.57...3.1.62) --- updated-dependencies: - dependency-name: gitpython dependency-version: 3.1.62 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
|
@dependabot rebase |
|
Looks like this PR is closed. If the branch still exists, you can re-open the PR and then use |
|
@dependabot rebase |
|
The dependabot.yml entry that created this PR has been deleted so this PR can't be rebased. Please close the PR so Dependabot can create a new one with the current dependabot.yml. |
|
@dependabot rebase |
|
The dependabot.yml entry that created this PR has been deleted so this PR can't be rebased. Please close the PR so Dependabot can create a new one with the current dependabot.yml. |
|
This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests. To ignore these dependencies, configure ignore rules in dependabot.yml |
The image shipped 3.1.57, which Dependabot flags with 14 advisories (1 critical, 9 high), all fixed by 3.1.62. Dependabot's own PR (#23) could not be rebased onto the CI fix because pip has no entry in dependabot.yml, so the bump is made here by hand. Only the gitpython pin and its hashes change in the lock; 3.1.62 has the same dependencies as 3.1.57. The floor in requirements.txt moves with it so the next `make lock` cannot resolve back to a vulnerable version.
Security updates were already opening pip PRs, but with no pip entry in dependabot.yml Dependabot refused to rebase them, which is why the GitPython fix (#23) had to be redone by hand. Add the entry with open-pull-requests-limit: 0: scheduled pip bumps stay off, security PRs keep coming and can now be rebased. Also record today's changes in the changelog: the GitPython security bump, this entry, and the types job moving onto the lock.
1 participant
Bumps the pip group with 1 update in the /backend directory: gitpython.
Updates
gitpythonfrom 3.1.57 to 3.1.62Release notes
Sourced from gitpython's releases.
... (truncated)
Commits
db47516prepare new release10ec385get better commit messages from agentsb754897test: cover subdirectory discovery and pathspec commands in bare-repo worktre...9ebf8b6Merge pull request #2227 from nkbeast/fix-config-backslash-continuationa15f791fix: parse joined config values as a whole60dd946fix: ignore continuation markers in config comments075a664fix: join backslash line continuations when reading config values62d1e2fMerge pull request #2226 from gitpython-developers/dependabot/pre_commit/pre-...23d0e92build(deps): bump https://github.com/astral-sh/ruff-pre-commit8a14adcMerge pull request #2225 from gitpython-developers/submodule-path-hardeningDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore <dependency name> major versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)@dependabot ignore <dependency name> minor versionwill close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)@dependabot ignore <dependency name>will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)@dependabot unignore <dependency name>will remove all of the ignore conditions of the specified dependency@dependabot unignore <dependency name> <ignore condition>will remove the ignore condition of the specified dependency and ignore conditionsYou can disable automated security fix PRs for this repo from the Security Alerts page.