Bump the python group with 5 updates by dependabot[bot] · Pull Request #188 · trailofbits/graphtage

dependabot · 2026-09-09T23:15:47Z

Bumps the python group with 5 updates:

Package	From	To
fickling	`0.1.7`	`0.1.12`
tqdm	`4.67.1`	`4.70.0`
pytest	`9.0.2`	`9.1.1`
ruff	`0.16.5`	`0.16.6`
sphinx-rtd-theme	`3.0.2`	`3.1.0`

Updates fickling from 0.1.7 to 0.1.12

Release notes

Sourced from fickling's releases.

v0.1.12

Security

Fix MLAllowlist shadowing (trailofbits/fickling@41ce7cb). Thanks to @reapermunky for the report! (GHSA-cffv-grgg-g429)

This fix makes MLAllowlist functional again, and opt-in as originally intended. If you need to scan ML pickles with an import allowlist, update calls to check_safety() to pass MLAllowList in the analyzer parameter:
pickled = Pickled([ ... ])
analyzer = Analyzer([MLAllowlist()])
res = check_safety(pickled, analyzer=analyzer)
Detect dotted attribute names in STACK_GLOBAL (trailofbits/fickling@d985f89). Thanks to @seankohjs for the report! (GHSA-5j3x-jp52-966f)

General

Add ScannerDeactivation analysis to detect pickle scanner tampering in #249

Use a pre-generated TorchScript fixture to avoid torch.jit deprecation warnings in #254

Various Dependabot updates (too many to list)

Full Changelog: trailofbits/fickling@v0.1.11...v0.1.12

v0.1.11

What's Changed

Security

Expanded the unsafe modules blocklist with:

doctest, unittest, and test (trailofbits/fickling@bbeeb0c + trailofbits/fickling@21fa48a). Thanks to @Lyutoon for the report! (GHSA-pc6j-px3p-rrj4)

_posixsubprocess, site and atexit (trailofbits/fickling@e840861). Thanks to @reapermunky for the report! (GHSA-m6fh-58r7-x697)

General

Add DoS protection against expansion attacks (Billion Laughs style) by @dguido in trailofbits/fickling#211

Add HuggingFace Hub direct scanning support by @dguido in trailofbits/fickling#219

Add graceful degradation and scan API for robust scanning by @dguido in trailofbits/fickling#218

Uncomment passing test_legacy_pickle test by @thomas-chauchefoin-tob in trailofbits/fickling#250

Fix check_pickle to seek to file start and use correct opcode count API by @thomas-chauchefoin-tob in trailofbits/fickling#253

Various https://github.com/dependabot updates (too many to list)

Full Changelog: trailofbits/fickling@v0.1.10...v0.1.11

v0.1.10

What's Changed

Security

Expanded the unsafe modules blocklist with:

_frozen_importlib, _frozen_importlib_external, _imp to prevent access to references of blocked modules (trailofbits/fickling@b9e690c)

inspect to block a getattr equivalent (trailofbits/fickling@9a6d03f)

... (truncated)

Commits

c3c695c Bump version to 0.1.12 (#288)
596abd0 Add ScannerDeactivation analysis to detect scanner tampering (#249)
d985f89 Detect dotted attribute names in STACK_GLOBAL (GHSA-5j3x-jp52-966f) (#287)
2aaa5d1 Bump the all group with 6 updates (#286)
0196977 Bump actions/checkout from 6.0.3 to 7.0.0 in the all group (#285)
891d2a9 Use pre-generated TorchScript fixture to avoid torch.jit deprecation warnings...
41ce7cb Fix MLAllowlist shadowing (GHSA-cffv-grgg-g429) (#278)
91a40fc Bump py7zr from 1.1.0 to 1.1.3 (#284)
5fcd2b7 Bump the all group with 3 updates (#282)
0db3537 Bump the all group with 3 updates (#280)
Additional commits viewable in compare view

Updates tqdm from 4.67.1 to 4.70.0

Release notes

Sourced from tqdm's releases.

tqdm v4.70.0 stable

contrib.concurrent: major improvements

support process_map(mp_context, max_tasks_per_child), thread_map(thread_name_prefix) (#1265)

fix total based on shortest iterable length (#1473)

use default max_workers (#1543 <- #1530, #1518)

support timeout, buffersize (#1576)

improve ETA (#1708 <- #1161)

update as_completed (#1709 <- #1565)

add tqdm.concurrent.intepreter_map (#1777)

asyncio: support iterables with only __aiter__ (#1714 <- #1686)

support reset(float("inf")) (#1783 <- #1781, #651)

framework: test & reduce wheel size (#1782)

tqdm v4.69.1 stable

contrib.logging: preserve filters (#1775 <- #1581)

rich: misc fixes (#1773)

support generators (without len) (#1391)

fix potential AttributeError on exit (#1674)

fix total=float('inf') (#1781 <- #651)

fix potential AttributeError on exit (#1778 <- #1668, #1537, #261)

fix minor docs typos (#1780, #1746)

tqdm v4.69.0 stable

add tqdm.asyncio.gather(..., return_exceptions=False) (#1776, #1671 <- #1286)

misc minor framework updates

bump workflow actions & pre-commit hooks

tqdm v4.68.4 stable

trim to ncols even when '{bar}' not in bar_format (#1717, #1767 <- #1658)

fix tqdm.write when stdout=None (#1768 <- #1654)

tqdm v4.68.3 stable

utils: delay os.get_terminal_size (#1763 <- #1760)

autonotebook: support QtConsole, Spyder, JupyterLite (#1763, #1628, #1559 <- #1283, #1098, #512)

minor docs updates

fix typo (#1762)

use git-fame

misc minor framework updates

fix & update CI build

pre-commit: add docs & metadata generation

move tox.ini -> pyproject.toml, move tox-gh-actions -> tox-gh

add Python 3.14, drop 3.7 support

tqdm v4.68.2 stable

revert accidental change to ascii default (fixes #1760)

UnicodeEncodeError: 'charmap' codec can't encode characters in position 6-7: character maps to <undefined> can be fixed by installing tqdm!=4.68.0,!=4.68.1

misc docs updates

fix links

replace stray rst -> md syntax

consistent "progress bar" terminology (#1737)

... (truncated)

Commits

96f2e60 Merge pull request #1777 from shermansiu/feat/interpreter-pool
c27393e misc tidy
061c623 Disable tqdm.monitor_interval for subinterpreters because they do not have ...
9fc160b Update how we check for interpreter_map support in the tests
b42463a Ensure that subinterpreters can import tqdm while unpickling the initializer
16d5486 Add support for nested progress bars
9f5890f Add initial implementation for interpreter_map
321f920 Merge pull request #1783 from LuShadowX/reset-inf-total
4664b57 minor tidy
426a098 Treat inf total as unknown in reset() too
Additional commits viewable in compare view

Updates pytest from 9.0.2 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

#14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.

#14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".

#14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.

#14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

#14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

If this is undesirable, move the fixture definition to a conftest.py file if possible.

Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

#10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

See 10819 and 14011.

#12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

See dynamic-fixture-request-during-teardown for details.

#13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

See parametrize-iterators for details and suggestions.

#13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

See config-inicfg for more details.

#14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits

cf470ec Prepare release version 9.1.1
e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
501c4bc Merge pull request #14596 from bluetech/doc-classmethod
b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
9a567e0 [automated] Update plugin list (#14617) (#14618)
ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
Additional commits viewable in compare view

Updates ruff from 0.16.5 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

Move pytest-fixture-autouse to the restriction category (#28219)

[flake8-pytest-style] Add an autofix for PT020 (#27993)

[flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)

[isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

Validate unary expressions when parsing (#28233)

[flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)

[flake8-bugbear] Fix panic on match subjects (B031) (#27781)

[flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)

[flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)

[ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

[flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

Add another example and glob reference for lint.per-file-ignores (#28106)

Add duplicate work guidance (#28229)

[flake8-async] Document thread offloading (ASYNC240) (#28008)

[pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

@flying-sheep

@pikammmmm

@fly1d

@waterWang

@Pierre-Sassoulas

@ntBre

@jelle-openai

@ericbuehl

@tjkuson

@AbhinavMir

@Whning0513

@chirizxc

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

Move pytest-fixture-autouse to the restriction category (#28219)

[flake8-pytest-style] Add an autofix for PT020 (#27993)

[flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)

[isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

Validate unary expressions when parsing (#28233)

[flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)

[flake8-bugbear] Fix panic on match subjects (B031) (#27781)

[flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)

[flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)

[ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

[flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

Add another example and glob reference for lint.per-file-ignores (#28106)

Add duplicate work guidance (#28229)

[flake8-async] Document thread offloading (ASYNC240) (#28008)

[pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

@flying-sheep

@pikammmmm

@fly1d

@waterWang

@Pierre-Sassoulas

@ntBre

@jelle-openai

@ericbuehl

@tjkuson

@AbhinavMir

@Whning0513

@chirizxc

Commits

22f65a2 Bump 0.16.6 (#28280)
7cc9f1e [ty] Document CallableTypeKind variants (#28277)
056ce07 Add UV_LOCKED to all workflows (#28261)
6d6e35d [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
80b4891 [ty] Temporarily disable tuple types in property tests (#28275)
3f7a54d [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
35656cf [ty] Preserve deprecations on decorated callables (#28256)
d2626c8 [ty] Reject missing attributes on type[] aliases (#28267)
ee6a6d1 [ty] Support ParamSpecs in ConstraintSet (#28028)
7f6a170 [ty] Move bound APIs to constraint owners (#28094)
Additional commits viewable in compare view

Updates sphinx-rtd-theme from 3.0.2 to 3.1.0

Changelog

Sourced from sphinx-rtd-theme's changelog.

3.1.0

Added support for docutils 0.22

Added support for Sphinx 9.x

.. _release-3.1.0rc2:

3.1.0rc2

Added support for docutils 0.22

.. _release-3.1.0rc1:

3.1.0rc1

Added support for Sphinx 9.x

.. _release-3.0.2:

Commits

795de79 Release 3.1.0 (#1676)
66d0fdd Add Python 3.14 to the test suite (#1668)
fbe5e60 3.1.0rc2 with support for docutils 0.22 (#1674)
a76174c Add support for docutils 0.22 (#1671)
20733c3 Add support for Sphinx 9.0.0 (#1666)
71aacd3 Update Code of Conduct URL (#1664)
5a26375 Run tests and build docs with Sphinx 8.2 (#1640)
8d4d394 Sidebar should not be floating on mobile (#1622)
See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the python group with 5 updates: | Package | From | To | | --- | --- | --- | | [fickling](https://github.com/trailofbits/fickling) | `0.1.7` | `0.1.12` | | [tqdm](https://github.com/tqdm/tqdm) | `4.67.1` | `4.70.0` | | [pytest](https://github.com/pytest-dev/pytest) | `9.0.2` | `9.1.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.16.5` | `0.16.6` | | [sphinx-rtd-theme](https://github.com/readthedocs/sphinx_rtd_theme) | `3.0.2` | `3.1.0` | Updates `fickling` from 0.1.7 to 0.1.12 - [Release notes](https://github.com/trailofbits/fickling/releases) - [Commits](trailofbits/fickling@v0.1.7...v0.1.12) Updates `tqdm` from 4.67.1 to 4.70.0 - [Release notes](https://github.com/tqdm/tqdm/releases) - [Commits](tqdm/tqdm@v4.67.1...v4.70.0) Updates `pytest` from 9.0.2 to 9.1.1 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.1.1) Updates `ruff` from 0.16.5 to 0.16.6 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.16.5...0.16.6) Updates `sphinx-rtd-theme` from 3.0.2 to 3.1.0 - [Changelog](https://github.com/readthedocs/sphinx_rtd_theme/blob/master/docs/changelog.rst) - [Commits](readthedocs/sphinx_rtd_theme@3.0.2...3.1.0) --- updated-dependencies: - dependency-name: fickling dependency-version: 0.1.12 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python - dependency-name: tqdm dependency-version: 4.70.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python - dependency-name: ruff dependency-version: 0.16.6 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: python - dependency-name: sphinx-rtd-theme dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: python ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 9, 2026

dependabot Bot requested a review from ESultanik as a code owner September 9, 2026 23:15

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 9, 2026

Navigation Menu

Uh oh!

Bump the python group with 5 updates - #188

Bump the python group with 5 updates#188
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/python-d9136d1837

dependabot Bot commented on behalf of github Sep 9, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.1.12

Security

General

v0.1.11

What's Changed

Security

General

v0.1.10

What's Changed

Security

tqdm v4.70.0 stable

tqdm v4.69.1 stable

tqdm v4.69.0 stable

tqdm v4.68.4 stable

tqdm v4.68.3 stable

tqdm v4.68.2 stable

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

Deprecations (removal in next major release)

0.16.6

Release Notes

Preview features

Bug fixes

Rule changes

Documentation

Other changes

Contributors

0.16.6

Preview features

Bug fixes

Rule changes

Documentation

Other changes

Contributors

3.1.0

3.1.0rc2

3.1.0rc1

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 9, 2026 •

edited

Loading