dependabot[bot]
5db71e8fe5
Bump idna from 3.6 to 3.7 in /github_tools ( #3881 )
...
Bumps [idna](https://github.com/kjd/idna ) from 3.6 to 3.7.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/kjd/idna/releases ">idna's
releases</a>.</em></p>
<blockquote>
<h2>v3.7</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix issue where specially crafted inputs to encode() could take
exceptionally long amount of time to process. [CVE-2024-3651]</li>
</ul>
<p>Thanks to Guido Vranken for reporting the issue.</p>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/kjd/idna/compare/v3.6...v3.7 ">https://github.com/kjd/idna/compare/v3.6...v3.7 </a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/kjd/idna/blob/master/HISTORY.rst ">idna's
changelog</a>.</em></p>
<blockquote>
<p>3.7 (2024-04-11)
++++++++++++++++</p>
<ul>
<li>Fix issue where specially crafted inputs to encode() could
take exceptionally long amount of time to process. [CVE-2024-3651]</li>
</ul>
<p>Thanks to Guido Vranken for reporting the issue.</p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/kjd/idna/commit/1d365e17e10d72d0b7876316fc7b9ca0eebdd38d "><code>1d365e1</code></a>
Release v3.7</li>
<li><a
href="https://github.com/kjd/idna/commit/c1b3154939907fab67c5754346afaebe165ce8e6 "><code>c1b3154</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/172 ">#172</a> from
kjd/optimize-contextj</li>
<li><a
href="https://github.com/kjd/idna/commit/0394ec76ff022813e770ba1fd89658790ea35623 "><code>0394ec7</code></a>
Merge branch 'master' into optimize-contextj</li>
<li><a
href="https://github.com/kjd/idna/commit/cd58a23173d2b0a40b95ee680baf3e59e8d33966 "><code>cd58a23</code></a>
Merge pull request <a
href="https://redirect.github.com/kjd/idna/issues/152 ">#152</a> from
elliotwutingfeng/dev</li>
<li><a
href="https://github.com/kjd/idna/commit/5beb28b9dd77912c0dd656d8b0fdba3eb80222e7 "><code>5beb28b</code></a>
More efficient resolution of joiner contexts</li>
<li><a
href="https://github.com/kjd/idna/commit/1b121483ed04d9576a1291758f537e1318cddc8b "><code>1b12148</code></a>
Update ossf/scorecard-action to v2.3.1</li>
<li><a
href="https://github.com/kjd/idna/commit/d516b874c3388047934938a500c7488d52c4e067 "><code>d516b87</code></a>
Update Github actions/checkout to v4</li>
<li><a
href="https://github.com/kjd/idna/commit/c095c75943413c75ebf8ac74179757031b7f80b7 "><code>c095c75</code></a>
Merge branch 'master' into dev</li>
<li><a
href="https://github.com/kjd/idna/commit/60a0a4cb61ec6834d74306bd8a1fa46daac94c98 "><code>60a0a4c</code></a>
Fix typo in GitHub Actions workflow key</li>
<li><a
href="https://github.com/kjd/idna/commit/5918a0ef8034379c2e409ae93ee11d24295bb201 "><code>5918a0e</code></a>
Merge branch 'master' into dev</li>
<li>Additional commits viewable in <a
href="https://github.com/kjd/idna/compare/v3.6...v3.7 ">compare
view</a></li>
</ul>
</details>
<br />
[](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores )
Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
<details>
<summary>Dependabot commands and options</summary>
<br />
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts
page](https://github.com/carbon-language/carbon-lang/network/alerts ).
</details>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-12 10:28:29 +00:00
Jon Ross-Perkins
3822c1b526
Split github_tools into its own bazel repo. ( #3632 )
...
The pip dependencies in github_tools are the reason the
MODULE.bazel.lock is platform-dependent. Following complaints about the
platform-dependence, split apart github_tools from the rest of the bazel
repo and make it not track the lockfile: while there's an incremental
safety risk due to not tracking checksums, it's unlikely the tools there
would ever be part of a Carbon release process. If we eventually add
Python tools that need pip to the release, it might be desirable to go
back to re-unify the bazezl repos.
This does make running pr_comments incrementally more inconvenient
because a "bazel run" needs to be run from the github_tools subdir.
As a consequence of separating the dependency, this means tests will not
be continuously run in github_tools. They're now a separate repo, and we
cannot add a dependency without restoring the platform-dependent issue.
I think pr_comments is sufficiently low value and unchanging that it is
not worth building separate CI for it.
Cleans up some legacy references to third_party/llvm-project, since now
github_tools needs to be added to the main bazelignore.
2024-01-22 21:34:02 +00:00
Chandler Carruth
5a098089c5
Upgrade to latest rules_python. ( #3423 )
...
Also requires switching to using `pip_parse` and providing a fully
resolved requirements lock file. This moves the input requirements to
the `requirements.in` file, and processes it with:
```console
$ bazel run //github_tools:requirements.update
```
This will regenerate the `requirements.txt` file that is checked into
the repository. The advice in the documentation is specifically to keep
this file checked into the repository for hermetic builds with stable
Python dependency versions.
This should fix builds on systems where the Python version is 3.12 and
newer and the older version of `rules_python` stops working with errors
due to removal of long-deprecated interfaces.
2023-11-28 00:49:17 +00:00
Jon Ross-Perkins
360f905755
Remove update_label_access, which is obsolete ( #2184 )
...
The PyGithub import is causing problems for me in test execution, but TBH I don't think we need it anymore. I should probably update groups.md though.
2022-09-15 13:57:50 -07:00
Jon Meow
ad08148304
Specify gql version ( #1039 )
...
3.0.0 is incompatible, this is a quick fix
2022-01-24 14:05:35 -08:00
Jon Meow
b4593f5133
Add pip_install to the build. ( #435 )
...
Updates corresponding tool instructions.
2021-04-07 09:08:02 -07:00
dependabot[bot]
Jon Ross-Perkins
Chandler Carruth
Jon Meow