Bump the pip group across 1 directory with 5 updates by dependabot[bot] · Pull Request #215 · ian-young/API_Scripts

dependabot · 2025-12-01T21:53:03Z

Bumps the pip group with 5 updates in the / directory:

Package	From	To
flask	`3.1.0`	`3.1.1`
fonttools	`4.56.0`	`4.61.0`
requests	`2.32.3`	`2.32.4`
setuptools	`75.8.0`	`78.1.1`
urllib3	`2.3.0`	`2.5.0`

Updates flask from 3.1.0 to 3.1.1

Release notes

Sourced from flask's releases.

3.1.1

This is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.1/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1 Milestone https://github.com/pallets/flask/milestone/36?closed=1

Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g

Fix type hint for cli_runner.invoke. #5645

flask --help loads the app and plugins first to make sure all commands are shown. #5673

Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. #5659

Changelog

Sourced from flask's changelog.

Version 3.1.1

Released 2025-05-13

Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g

Fix type hint for cli_runner.invoke. :issue:5645

flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673

Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659

Commits

7fff56f release version 3.1.1
73d6504 Merge commit from fork
cbb6c36 update docs about fallback order
fb54159 secret key rotation: fix key list ordering
941efd4 use uv (#5727)
0109e49 use uv
e785166 Async Iterable Response (#5659)
410e5ab Accept AsyncIterable for responses
bfffe87 add ghsa links
73ce26c remove tests about deprecated pkgutil.get_loader (#5702)
Additional commits viewable in compare view

Updates fonttools from 4.56.0 to 4.61.0

Release notes

Sourced from fonttools's releases.

4.61.0

[varLib.main]: SECURITY Only use basename(vf.filename) to prevent path traversal attacks when running fonttools varLib command-line script, or code which invokes fonttools.varLib.main(). Fixes CVE-2025-66034, see: GHSA-768j-98cg-p3fv.

[feaLib] Sort BaseLangSysRecords by tag (#3986).

Drop support for EOL Python 3.9 (#3982).

[instancer] Support --remove-overlaps for fonts with CFF2 table (#3975).

[CFF2ToCFF] Add --remove-overlaps option (#3976).

[feaLib] Raise an error for rsub with NULL target (#3979).

[bezierTools] Fix logic bug in curveCurveIntersections (#3963).

[feaLib] Error when condition sets have the same name (#3958).

[cu2qu.ufo] skip processing empty glyphs to support sparse kerning masters (#3956).

[unicodedata] Update to Unicode 17. Require unicodedata2 >= 17.0.0 when installed with 'unicode' extra.

4.60.1

[ufoLib] Reverted accidental method name change in UFOReader.getKerningGroupConversionRenameMaps that broke compatibility with downstream projects like defcon (#3948, #3947, robotools/defcon#478).

[ufoLib] Added test coverage for getKerningGroupConversionRenameMaps method (#3950).

[subset] Don't try to subset BASE table; pass it through by default instead (#3949).

[subset] Remove empty BaseRecord entries in MarkBasePos lookups (#3897, #3892).

[subset] Add pruning for MarkLigPos and MarkMarkPos lookups (#3946).

[subset] Remove duplicate features when subsetting (#3945).

[Docs] Added documentation for the visitor module (#3944).

4.60.0

[pointPen] Allow reverseFlipped parameter of DecomposingPointPen to take a ReverseFlipped enum value to control whether/how to reverse contour direction of flipped components, in addition to the existing True/False. This allows to set ReverseFlipped.ON_CURVE_FIRST to ensure that the decomposed outline starts with an on-curve point before being reversed, for better consistency with other segment-oriented contour transformations. The change is backward compatible, and the default behavior hasn't changed (#3934).

[filterPen] Added ContourFilterPointPen, base pen for buffered contour operations, and OnCurveStartPointPen filter to ensure contours start with an on-curve point (#3934).

[cu2qu] Fixed difference in cython vs pure-python complex division by real number (#3930).

[varLib.avar] Refactored and added some new sub-modules and scripts (#3926).

varLib.avar.build module to build avar (and a missing fvar) binaries into a possibly empty TTFont,

varLib.avar.unbuild module to print a .designspace snippet that would generate the same avar binary,

varLib.avar.map module to take TTFont and do the mapping, in user/normalized space,

varLib.avar.plan module moved from varLib.avarPlanner.

The bare fonttools varLib.avar script is deprecated, in favour of fonttools varLib.avar.build (or unbuild).

[interpolatable] Clarify linear_sum_assignment backend options and minimal dependency usage (#3927).

[post] Speed up build_psNameMapping (#3923).

[ufoLib] Added typing annotations to fontTools.ufoLib (#3875).

4.59.2

[varLib] Clear USE_MY_METRICS component flags when inconsistent across masters (#3912).

[varLib.instancer] Avoid negative advance width/height values when instatiating HVAR/VVAR, (unlikely in well-behaved fonts) (#3918).

[subset] Fix shaping behaviour when pruning empty mark sets (#3915, harfbuzz/harfbuzz#5499).

[cu2qu] Fixed dot() product of perpendicular vectors not always returning exactly 0.0 in all Python implementations (#3911)

[varLib.instancer] Implemented fully-instantiating avar2 fonts (#3909).

[feaLib] Allow float values in VariableScalar's axis locations (#3906, #3907).

[cu2qu] Handle special case in calc_intersect for degenerate cubic curves where 3 to 4 control points are equal (#3904).

4.59.1

[featureVars] Update OS/2.usMaxContext if possible after addFeatureVariationsRaw (#3894).

[vhmtx] raise TTLibError('not enough data...') when hmtx/vmtx are truncated (#3843, #3901).

[feaLib] Combine duplicate features that have the same set of lookups regardless of the order in which those lookups are added to the feature (#3895).

... (truncated)

Changelog

Sourced from fonttools's changelog.

4.61.0 (released 2025-11-28)

[varLib.main]: SECURITY Only use basename(vf.filename) to prevent path traversal attacks when running fonttools varLib command, or code which invokes fonttools.varLib.main(). Fixes CVE-2025-66034, see: GHSA-768j-98cg-p3fv.

[feaLib] Sort BaseLangSysRecords by tag (#3986).

Drop support for EOL Python 3.9 (#3982).

[instancer] Support --remove-overlaps for fonts with CFF2 table (#3975).

[CFF2ToCFF] Add --remove-overlaps option (#3976).

[feaLib] Raise an error for rsub with NULL target (#3979).

[bezierTools] Fix logic bug in curveCurveIntersections (#3963).

[feaLib] Error when condition sets have the same name (#3958).

[cu2qu.ufo] skip processing empty glyphs to support sparse kerning masters (#3956).

[unicodedata] Update to Unicode 17. Require unicodedata2 >= 17.0.0 when installed with 'unicode' extra.

4.60.1 (released 2025-09-29)

[ufoLib] Reverted accidental method name change in UFOReader.getKerningGroupConversionRenameMaps that broke compatibility with downstream projects like defcon (#3948, #3947, robotools/defcon#478).

[ufoLib] Added test coverage for getKerningGroupConversionRenameMaps method (#3950).

[subset] Don't try to subset BASE table; pass it through by default instead (#3949).

[subset] Remove empty BaseRecord entries in MarkBasePos lookups (#3897, #3892).

[subset] Add pruning for MarkLigPos and MarkMarkPos lookups (#3946).

[subset] Remove duplicate features when subsetting (#3945).

[Docs] Added documentation for the visitor module (#3944).

4.60.0 (released 2025-09-17)

[pointPen] Allow reverseFlipped parameter of DecomposingPointPen to take a ReverseFlipped enum value to control whether/how to reverse contour direction of flipped components, in addition to the existing True/False. This allows to set ReverseFlipped.ON_CURVE_FIRST to ensure that the decomposed outline starts with an on-curve point before being reversed, for better consistency with other segment-oriented contour transformations. The change is backward compatible, and the default behavior hasn't changed (#3934).

[filterPen] Added ContourFilterPointPen, base pen for buffered contour operations, and OnCurveStartPointPen filter to ensure contours start with an on-curve point (#3934).

[cu2qu] Fixed difference in cython vs pure-python complex division by real number (#3930).

[varLib.avar] Refactored and added some new sub-modules and scripts (#3926).

varLib.avar.build module to build avar (and a missing fvar) binaries into a possibly empty TTFont,

varLib.avar.unbuild module to print a .designspace snippet that would generate the same avar binary,

varLib.avar.map module to take TTFont and do the mapping, in user/normalized space,

varLib.avar.plan module moved from varLib.avarPlanner. The bare fonttools varLib.avar script is deprecated, in favour of fonttools varLib.avar.build (or unbuild).

[interpolatable] Clarify linear_sum_assignment backend options and minimal dependency usage (#3927).

[post] Speed up build_psNameMapping (#3923).

... (truncated)

Commits

e691e3b Release 4.61.0
c2d540f Update NEWS.rst
3859753 Update NEWS.rst
26eb070 black
5ff73af Merge commit from fork
a696d5b varLib: only use the basename(vf.filename)
b00bc45 varLib_test: test path traversal in variable-font filename
066512e Merge pull request #3986 from cmyr/base-minmax-sorting
ce78973 [feaLib] Sort BasLangSysRecords by tag
5bb37dc Merge pull request #3983 from fonttools/dependabot/pip/brotli-1.2.0
Additional commits viewable in compare view

Updates requests from 2.32.3 to 2.32.4

Release notes

Sourced from requests's releases.

v2.32.4

2.32.4 (2025-06-10)

Security

CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file. (#6965)

Improvements

Numerous documentation improvements

Deprecations

Added support for pypy 3.11 for Linux and macOS. (#6926)

Dropped support for pypy 3.9 following its end of support. (#6926)

Changelog

Sourced from requests's changelog.

2.32.4 (2025-06-10)

Security

CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file.

Improvements

Numerous documentation improvements

Deprecations

Added support for pypy 3.11 for Linux and macOS.

Dropped support for pypy 3.9 following its end of support.

Commits

021dc72 Polish up release tooling for last manual release
821770e Bump version and add release notes for v2.32.4
59f8aa2 Add netrc file search information to authentication documentation (#6876)
5b4b64c Add more tests to prevent regression of CVE 2024 47081
7bc4587 Add new test to check netrc auth leak (#6962)
96ba401 Only use hostname to do netrc lookup instead of netloc
7341690 Merge pull request #6951 from tswast/patch-1
6716d7c remove links
a7e1c74 Update docs/conf.py
c799b81 docs: fix dead links to kenreitz.org
Additional commits viewable in compare view

Updates setuptools from 75.8.0 to 78.1.1

Changelog

Sourced from setuptools's changelog.

v78.1.1

Bugfixes

More fully sanitized the filename in PackageIndex._download. (#4946)

v78.1.0

Features

Restore access to _get_vc_env with a warning. (#4874)

v78.0.2

Bugfixes

Postponed removals of deprecated dash-separated and uppercase fields in setup.cfg. All packages with deprecated configurations are advised to move before 2026. (#4911)

v78.0.1

Misc

#4909

v78.0.0

Bugfixes

Reverted distutils changes that broke the monkey patching of command classes. (#4902)

Deprecations and Removals

Setuptools no longer accepts options containing uppercase or dash characters in setup.cfg.

... (truncated)

Commits

8e4868a Bump version: 78.1.0 → 78.1.1
100e9a6 Merge pull request #4951
8faf1d7 Add news fragment.
2ca4a9f Rely on re.sub to perform the decision in one expression.
e409e80 Extract _sanitize method for sanitizing the filename.
250a6d1 Add a check to ensure the name resolves relative to the tmpdir.
d8390fe Extract _resolve_download_filename with test.
4e1e893 Merge https://github.com/jaraco/skeleton
3a3144f Fix typo: pyproject.license -> project.license (#4931)
d751068 Fix typo: pyproject.license -> project.license
Additional commits viewable in compare view

Updates urllib3 from 2.3.0 to 2.5.0

Release notes

Sourced from urllib3's releases.

2.5.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security issues

urllib3 2.5.0 fixes two moderate security issues:

Pool managers now properly control redirects when retries is passed — CVE-2025-50181 reported by @sandumjacob (5.3 Medium, GHSA-pq67-6m6q-mj2v)

Redirects are now controlled by urllib3 in the Node.js runtime — CVE-2025-50182 (5.3 Medium, GHSA-48p4-8xcf-vxj5)

Features

Added support for the compression.zstd module that is new in Python 3.14. See PEP 784 for more information. (#3610)

Added support for version 0.5 of hatch-vcs (#3612)

Bugfixes

Raised exception for HTTPResponse.shutdown on a connection already released to the pool. (#3581)

Fixed incorrect CONNECT statement when using an IPv6 proxy with connection_from_host. Previously would not be wrapped in []. (#3615)

2.4.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Features

Applied PEP 639 by specifying the license fields in pyproject.toml. (#3522)

Updated exceptions to save and restore more properties during the pickle/serialization process. (#3567)

Added verify_flags option to create_urllib3_context with a default of VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT for Python 3.13+. (#3571)

Bugfixes

Fixed a bug with partial reads of streaming data in Emscripten. (#3555)

Misc

Switched to uv for installing development dependecies. (#3550)

Removed the multiple.intoto.jsonl asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. (#3566)

Changelog

Sourced from urllib3's changelog.

2.5.0 (2025-06-18)

Features

Added support for the compression.zstd module that is new in Python 3.14. See PEP 784 <https://peps.python.org/pep-0784/>_ for more information. ([#3610](https://github.com/urllib3/urllib3/issues/3610) <https://github.com/urllib3/urllib3/issues/3610>__)

Added support for version 0.5 of hatch-vcs ([#3612](https://github.com/urllib3/urllib3/issues/3612) <https://github.com/urllib3/urllib3/issues/3612>__)

Bugfixes

Fixed a security issue where restricting the maximum number of followed redirects at the urllib3.PoolManager level via the retries parameter did not work.

Made the Node.js runtime respect redirect parameters such as retries and redirects.

Raised exception for HTTPResponse.shutdown on a connection already released to the pool. ([#3581](https://github.com/urllib3/urllib3/issues/3581) <https://github.com/urllib3/urllib3/issues/3581>__)

Fixed incorrect CONNECT statement when using an IPv6 proxy with connection_from_host. Previously would not be wrapped in []. ([#3615](https://github.com/urllib3/urllib3/issues/3615) <https://github.com/urllib3/urllib3/issues/3615>__)

2.4.0 (2025-04-10)

Features

Applied PEP 639 by specifying the license fields in pyproject.toml. ([#3522](https://github.com/urllib3/urllib3/issues/3522) <https://github.com/urllib3/urllib3/issues/3522>__)

Updated exceptions to save and restore more properties during the pickle/serialization process. ([#3567](https://github.com/urllib3/urllib3/issues/3567) <https://github.com/urllib3/urllib3/issues/3567>__)

Added verify_flags option to create_urllib3_context with a default of VERIFY_X509_PARTIAL_CHAIN and VERIFY_X509_STRICT for Python 3.13+. ([#3571](https://github.com/urllib3/urllib3/issues/3571) <https://github.com/urllib3/urllib3/issues/3571>__)

Bugfixes

Fixed a bug with partial reads of streaming data in Emscripten. ([#3555](https://github.com/urllib3/urllib3/issues/3555) <https://github.com/urllib3/urllib3/issues/3555>__)

Misc

Switched to uv for installing development dependecies. ([#3550](https://github.com/urllib3/urllib3/issues/3550) <https://github.com/urllib3/urllib3/issues/3550>__)

Removed the multiple.intoto.jsonl asset from GitHub releases. Attestation of release files since v2.3.0 can be found on PyPI. ([#3566](https://github.com/urllib3/urllib3/issues/3566) <https://github.com/urllib3/urllib3/issues/3566>__)

Commits

aaab4ec Release 2.5.0
7eb4a2a Merge commit from fork
f05b132 Merge commit from fork
d03fe32 Fix HTTP tunneling with IPv6 in older Python versions
11661e9 Bump github/codeql-action from 3.28.0 to 3.29.0 (#3624)
6a0ecc6 Update v2 migration guide to 2.4.0 (#3621)
8e32e60 Raise exception for shutdown on a connection already released to the pool (#3...
9996e0f Fix emscripten CI for Chrome 137+ (#3599)
4fd1a99 Bump RECENT_DATE (#3617)
c4b5917 Add support for the new compression.zstd module in Python 3.14 (#3611)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the pip group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [flask](https://github.com/pallets/flask) | `3.1.0` | `3.1.1` | | [fonttools](https://github.com/fonttools/fonttools) | `4.56.0` | `4.61.0` | | [requests](https://github.com/psf/requests) | `2.32.3` | `2.32.4` | | [setuptools](https://github.com/pypa/setuptools) | `75.8.0` | `78.1.1` | | [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.5.0` | Updates `flask` from 3.1.0 to 3.1.1 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@3.1.0...3.1.1) Updates `fonttools` from 4.56.0 to 4.61.0 - [Release notes](https://github.com/fonttools/fonttools/releases) - [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst) - [Commits](fonttools/fonttools@4.56.0...4.61.0) Updates `requests` from 2.32.3 to 2.32.4 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.3...v2.32.4) Updates `setuptools` from 75.8.0 to 78.1.1 - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](pypa/setuptools@v75.8.0...v78.1.1) Updates `urllib3` from 2.3.0 to 2.5.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.3.0...2.5.0) --- updated-dependencies: - dependency-name: flask dependency-version: 3.1.1 dependency-type: direct:production dependency-group: pip - dependency-name: fonttools dependency-version: 4.61.0 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.32.4 dependency-type: direct:production dependency-group: pip - dependency-name: setuptools dependency-version: 78.1.1 dependency-type: direct:production dependency-group: pip - dependency-name: urllib3 dependency-version: 2.5.0 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Dec 1, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the pip group across 1 directory with 5 updates#215

Bump the pip group across 1 directory with 5 updates#215
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/pip-3c34335056

dependabot bot commented on behalf of github Dec 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Dec 1, 2025

3.1.1

Version 3.1.1

4.61.0

4.60.1

4.60.0

4.59.2

4.59.1

4.61.0 (released 2025-11-28)

4.60.1 (released 2025-09-29)

4.60.0 (released 2025-09-17)

v2.32.4

2.32.4 (2025-06-10)

2.32.4 (2025-06-10)

v78.1.1

Bugfixes

v78.1.0

Features

v78.0.2

Bugfixes

v78.0.1

Misc

v78.0.0

Bugfixes

Deprecations and Removals

2.5.0

🚀 urllib3 is fundraising for HTTP/2 support

Security issues

Features

Bugfixes

2.4.0

🚀 urllib3 is fundraising for HTTP/2 support

Features

Bugfixes

Misc

2.5.0 (2025-06-18)

Features

Bugfixes

2.4.0 (2025-04-10)

Features

Bugfixes

Misc

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants