Skip to content

Bump the runtime group across 1 directory with 5 updates#3

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/runtime-bce860d035
Open

Bump the runtime group across 1 directory with 5 updates#3
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/runtime-bce860d035

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Apr 18, 2026 •
edited
Loading

Bumps the runtime group with 5 updates in the / directory:

Package From To
cryptography 43.0.0 47.0.0
keyring 25.3.0 25.7.0
paramiko 3.4.1 4.0.0
requests 2.32.3 2.33.1
tqdm 4.66.5 4.67.3

Updates cryptography from 43.0.0 to 47.0.0

Changelog

Sourced from cryptography's changelog.

47.0.0 - 2026-04-24


* Support for Python 3.8 is deprecated and will be removed in the next
  ``cryptography`` release.
* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves
  (``SECT*`` classes) has been removed. These curves are rarely used and
  have additional security considerations that make them undesirable.
* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.
  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC
  continue to be supported.
* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 4.1.
* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or
  keys with unsupported explicit curve encodings now raises
  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of
  ``ValueError``. This change affects
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,
  and :meth:`~cryptography.x509.Certificate.public_key` when called on
  certificates with unsupported public key algorithms.
* **BACKWARDS INCOMPATIBLE:** When parsing elliptic curve private keys, we now
  reject keys that incorrectly encode a private key of the wrong length because
  such keys are impossible to process in a constant-time manner. We do not
  believe keys with this problem are in wide use, however we may revert this
  change based on the feedback we receive.
* Deprecated passing 64-bit (8-byte) and 128-bit (16-byte) keys to
  :class:`~cryptography.hazmat.decrepit.ciphers.algorithms.TripleDES`. In a
  future release, only 192-bit (24-byte) keys will be accepted. Users should
  expand shorter keys themselves (e.g., for single DES: ``key + key + key``,
  for two-key: ``key + key[:8]``).
* Updated the minimum supported Rust version (MSRV) to 1.83.0, from 1.74.0.
* Support for ``x86_64`` macOS (including publishing wheels) is deprecated
  and will be removed in the next release. We will switch to publishing an
  ``arm64`` only wheel for macOS.
* Support for 32-bit Windows (including publishing wheels) is deprecated
  and will be removed in the next release. Users should move to a 64-bit
  Python installation.
* ``public_bytes`` and ``private_bytes`` methods on keys now raise
  ``TypeError`` (instead of ``ValueError``) if an invalid encoding is provided
  for the given ``format``.
* Moved :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB`,
  :class:`~cryptography.hazmat.decrepit.ciphers.modes.OFB`, and
  :class:`~cryptography.hazmat.decrepit.ciphers.modes.CFB8` into
  :doc:`/hazmat/decrepit/index` and deprecated them in the ``modes`` module.
  They will be removed from the ``modes`` module in 49.0.0.
* Moved :class:`~cryptography.hazmat.primitives.ciphers.algorithms.Camellia`
  into  :doc:`/hazmat/decrepit/index` and deprecated it in the ``cipher`` module.
  It will be removed from the ``cipher`` module in 49.0.0.
</tr></table>

... (truncated)

Commits

Updates keyring from 25.3.0 to 25.7.0

Changelog

Sourced from keyring's changelog.

v25.7.0

Features

  • Improved support for KWallet 6. (#728)

Bugfixes

  • Removed cruft from Python 3.8. (#722)

v25.6.0

Features

  • Avoid logging a warning when config does not specify a backend. (#682)

v25.5.0

Features

  • When parsing keyring_path from the config, the home directory is now expanded from ~. (#696)

Bugfixes

  • In get_credential, now returns None when the indicated username is not found. (#698)

v25.4.1

Bugfixes

  • Fixed ValueError for AnonymousCredentials in CLI. (#694)

v25.4.0

... (truncated)

Commits

Updates paramiko from 3.4.1 to 4.0.0

Commits
  • aad0370 Cut 4.0.0 in changelog
  • 76f2406 Speling
  • 8c4277c Fix syntax-warning-throwing unittest method call
  • d3a9617 Test existence of root module dunder version
  • 9579700 Nuke mentions of specific Python 3.x versions from docs etc
  • dbfd52c Administrivia update: Python>=3.9, pyproject.toml, etc
  • c2ba378 Remove outdated version check in GSS module
  • 2af0dd7 I'm good at my job, honest
  • e534b1a Fixes #973: remove DSA/DSS support
  • 3523feb Tweak .gitignore to more safely ignore top level docs/
  • Additional commits viewable in compare view

Updates requests from 2.32.3 to 2.33.1

Release notes

Sourced from requests's releases.

v2.33.1

2.33.1 (2026-03-30)

Bugfixes

  • Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (#7305)
  • Fixed Content-Type header parsing for malformed values. (#7309)
  • Improved error consistency for malformed header values. (#7308)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2331-2026-03-30

v2.33.0

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

... (truncated)

Changelog

Sourced from requests's changelog.

2.33.1 (2026-03-30)

Bugfixes

  • Fixed test cleanup for CVE-2026-25645 to avoid leaving unnecessary files in the tmp directory. (#7305)
  • Fixed Content-Type header parsing for malformed values. (#7309)
  • Improved error consistency for malformed header values. (#7308)

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

  • The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

  • Added support for Python 3.14.

... (truncated)

Commits

Updates tqdm from 4.66.5 to 4.67.3

Release notes

Sourced from tqdm's releases.

tqdm v4.67.3 stable

tqdm v4.67.2 stable

  • support pandas>=3 (#1703 <- #1701, #1650, #1700)
  • fix format_interval for negative numbers (#1703)
  • misc linting
  • framework updates (#1704)
    • bump CI workflow & pre-commit dependencies
    • add pyupgrade
    • add py3.13 support
    • fix py3.7 tests
    • update setuptools-scm usage
    • support auto-dedented docstrings when building docs in py3.13
  • tests: relax flaky benchmarks

tqdm v4.67.1 stable

  • fix gui (matplotlib syntax) (#1629)
  • misc test & framework updates
    • bump pytest-asyncio (#1630)
    • fix codecov rate limit
    • fix pybuild
    • sync dependencies

tqdm v4.67.0 stable

  • contrib.discord: replace disco-py with requests (#1536)

tqdm v4.66.6 stable

  • cli: zip-safe --manpath, --comppath (#1627)
  • misc framework updates (#1627)
    • fix pytest DeprecationWarning
    • fix snapcraft build
    • fix nbval DeprecationWarning
    • update & tidy workflows
    • bump pre-commit
    • docs: update URLs
Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Apr 18, 2026
@dependabot dependabot Bot requested a review from SP1R4 as a code owner April 18, 2026 21:11
@dependabot dependabot Bot added the python Pull requests that update python code label Apr 18, 2026
@dependabot dependabot Bot changed the title Bump the runtime group with 5 updates Bump the runtime group across 1 directory with 5 updates Apr 20, 2026
@dependabot dependabot Bot force-pushed the dependabot/pip/runtime-bce860d035 branch from 9a99ab8 to 7271244 Compare April 20, 2026 06:34
@dependabot
Bump the runtime group across 1 directory with 5 updates
3721d92 
Bumps the runtime group with 5 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [cryptography](https://github.com/pyca/cryptography) | `43.0.0` | `47.0.0` |
| [keyring](https://github.com/jaraco/keyring) | `25.3.0` | `25.7.0` |
| [paramiko](https://github.com/paramiko/paramiko) | `3.4.1` | `4.0.0` |
| [requests](https://github.com/psf/requests) | `2.32.3` | `2.33.1` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.66.5` | `4.67.3` |



Updates `cryptography` from 43.0.0 to 47.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@43.0.0...47.0.0)

Updates `keyring` from 25.3.0 to 25.7.0
- [Release notes](https://github.com/jaraco/keyring/releases)
- [Changelog](https://github.com/jaraco/keyring/blob/main/NEWS.rst)
- [Commits](jaraco/keyring@v25.3.0...v25.7.0)

Updates `paramiko` from 3.4.1 to 4.0.0
- [Commits](paramiko/paramiko@3.4.1...4.0.0)

Updates `requests` from 2.32.3 to 2.33.1
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.3...v2.33.1)

Updates `tqdm` from 4.66.5 to 4.67.3
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.66.5...v4.67.3)

---
updated-dependencies:
- dependency-name: cryptography
  dependency-version: 46.0.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: runtime
- dependency-name: keyring
  dependency-version: 25.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
- dependency-name: paramiko
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: runtime
- dependency-name: requests
  dependency-version: 2.33.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
- dependency-name: tqdm
  dependency-version: 4.67.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/pip/runtime-bce860d035 branch from 7271244 to 3721d92 Compare May 4, 2026 06:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@SP1R4 SP1R4 Awaiting requested review from SP1R4 SP1R4 is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants