Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update itsdangerous requirement from ~=1.1 to >=1.1,<3.0 #1325

Merged
merged 1 commit into from
May 22, 2021

Conversation

dependabot[bot]
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github May 12, 2021

Updates the requirements on itsdangerous to permit the latest version.

Release notes

Sourced from itsdangerous's releases.

2.0.0

New major versions of all the core Pallets libraries, including ItsDangerous 2.0, have been released! 🎉

This represents a significant amount of work, and there are quite a few changes. Be sure to carefully read the changelog, and use tools such as pip-compile and Dependabot to pin your dependencies and control your updates.

Changelog

Sourced from itsdangerous's changelog.

Version 2.0.0

Released 2021-05-11

  • Drop support for Python 2 and 3.5.
  • JWS support (JSONWebSignatureSerializer, TimedJSONWebSignatureSerializer) is deprecated. Use a dedicated JWS/JWT library such as authlib instead. :issue:129
  • Importing itsdangerous.json is deprecated. Import Python's json module instead. :pr:152
  • Simplejson is no longer used if it is installed. To use a different library, pass it as Serializer(serializer=...). :issue:146
  • datetime values are timezone-aware with timezone.utc. Code using TimestampSigner.unsign(return_timestamp=True) or BadTimeSignature.date_signed may need to change. :issue:150
  • If a signature has an age less than 0, it will raise SignatureExpired rather than appearing valid. This can happen if the timestamp offset is changed. :issue:126
  • BadTimeSignature.date_signed is always a datetime object rather than an int in some cases. :issue:124
  • Added support for key rotation. A list of keys can be passed as secret_key, oldest to newest. The newest key is used for signing, all keys are tried for unsigning. :pr:141
  • Removed the default SHA-512 fallback signer from default_fallback_signers. :issue:155
  • Add type information for static typing tools. :pr:186

Version 1.1.0

Released 2018-10-26

  • Change default signing algorithm back to SHA-1. :pr:113
  • Added a default SHA-512 fallback for users who used the yanked 1.0.0 release which defaulted to SHA-512. :pr:114
  • Add support for fallback algorithms during deserialization to support changing the default in the future without breaking existing signatures. :pr:113
  • Changed capitalization of packages back to lowercase as the change in capitalization broke some tooling. :pr:113

Version 1.0.0

Released 2018-10-18

YANKED

... (truncated)

Commits
  • d101100 Merge pull request #235 from pallets/release-2.0.0
  • ca0f59a release version 2.0.0
  • d1ed89f update requirements
  • d1722ea Merge pull request #234 from pallets/pre-commit-ci-schedule
  • d1eb7aa update pre-commit monthly
  • acbc456 Merge pull request #233 from pallets/pre-commit-ci-update-config
  • 04e485a [pre-commit.ci] pre-commit autoupdate
  • c0e6b48 Merge pull request #232 from pallets/pre-commit-ci-update-config
  • 6a9df83 [pre-commit.ci] pre-commit autoupdate
  • 477f42c Merge pull request #231 from pallets/dependabot/pip/pre-commit-2.12.1
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label May 12, 2021
@codecov
Copy link

codecov bot commented May 12, 2021

Codecov Report

Merging #1325 (4dea180) into main (1b69753) will increase coverage by 0.02%.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##             main    #1325      +/-   ##
==========================================
+ Coverage   91.51%   91.53%   +0.02%     
==========================================
  Files          34       34              
  Lines        4255     4255              
==========================================
+ Hits         3894     3895       +1     
+ Misses        361      360       -1     
Impacted Files Coverage Δ
datasette/utils/__init__.py 94.31% <0.00%> (+0.17%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1b69753...4dea180. Read the comment docs.

@stonebig
Copy link

would be nice to have

@simonw simonw merged commit b64d872 into main May 22, 2021
@simonw simonw deleted the dependabot/pip/itsdangerous-gte-1.1-and-lt-3.0 branch May 22, 2021 23:54
simonw added a commit that referenced this pull request May 23, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants