Skip to content

chore(deps): bump the python-minor-and-patch group across 1 directory with 4 updates - #630

Open
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/pip/develop/python-minor-and-patch-343e6bd970
Open

chore(deps): bump the python-minor-and-patch group across 1 directory with 4 updates#630
dependabot[bot] wants to merge 1 commit into
developfrom
dependabot/pip/develop/python-minor-and-patch-343e6bd970

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 4 updates in the / directory: gitpython, markdown, bleach and stix2-validator.

Updates gitpython from 3.1.54 to 3.1.57

Release notes

Sourced from gitpython's releases.

3.1.57 - Security and Fixes

What's Changed

New Contributors

Full Changelog: gitpython-developers/GitPython@3.1.56...3.1.57

3.1.56 - SECURITY

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.55...3.1.56

3.1.55 - Security

What's Changed

Full Changelog: gitpython-developers/GitPython@3.1.54...3.1.55

Commits
  • ccbd573 prepare for new release
  • d1a631d Merge pull request #2193 from gitpython-developers/more-unsafe-options
  • ab33e33 Merge pull request #2194 from gitpython-developers/fix-basedpyright
  • 52199b3 address review comments
  • 60dec71 Adopt basedpyright with a legacy baseline
  • 7a4f5dc Block unsafe archive additions and bundle URI
  • 3af0c25 Block unsafe checkout-index and tag file options
  • fb5d584 Merge pull request #2187 from pick7/codex/remote-progress-return-type
  • 951cc44 Merge pull request #2188 from pick7/codex/redact-http-extraheader
  • 2e5b13f Merge pull request #2189 from pick7/codex/output-stream-timeout
  • Additional commits viewable in compare view

Updates markdown from 3.10.2 to 3.10.3

Release notes

Sourced from markdown's releases.

Release 3.10.3

Fixed

  • Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
  • Add AI Policy to Contributing Guide.
  • Officially document all included extensions as being in maintenance mode.
  • Link the Extension API documentation to the API Reference (#1612).
Changelog

Sourced from markdown's changelog.

[3.10.3] - 2026-07-30

Fixed

  • Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
  • Add AI Policy to Contributing Guide.
  • Officially document all included extensions as being in maintenance mode.
  • Link the Extension API documentation to the API Reference (#1612).
Commits
  • bb50627 Bump version to 3.10.3
  • 8453df0 Update Extension API documentation
  • 93ac448 Document that all extensions are in maintenance mode
  • d38fd4a Create AI Policy
  • ddead47 Prevent mixed =/- chars in Setext-style headings
  • See full diff in compare view

Updates bleach from 6.3.0 to 6.4.0

Changelog

Sourced from bleach's changelog.

Version 6.4.0 (June 5th, 2026)

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

  • Dropped support for pypy 3.10. (#764)

Security fixes

  • Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

    Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.

    For example::

    import bleach payload1 = 'Click' result1 = bleach.clean(payload1) print(repr(result1))

    outputs::

    'Click'

    See the advisory for details.

  • Fix GHSA-gj48-438w-jh9v.

    Fix issue where URI sanitization wasn't happening in formaction attributes.

    See the advisory for details.

Bug fixes

  • Add support for pypy 3.11. (#764)

  • Drop version max in tinycss2 pin. (#772)

    This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.

Commits
  • f0355a7 fix: fix last release date in CHANGES
  • ae4e8a2 chore: bleach 6.4.0 and final release
  • 970df58 fix: uri-sanitization in formaction attributes
  • 7c4867c fix: xss bypass in allowed protocol test using unicode invisible characters
  • 913ab75 fix: reduce redundancy in workflow jobs
  • 218c15a fix: rework pip caching
  • 4f0b097 fix: fix tox platform restrictions
  • e95a79d chore: update pytest
  • 91539d4 Bump actions/cache from 5.0.3 to 5.0.4
  • cd47b4c fix: handle left-angle-bracket that's not a tag (#733)
  • Additional commits viewable in compare view

Updates stix2-validator from 3.2.0 to 3.3.1

Release notes

Sourced from stix2-validator's releases.

cti-stix-validator v3.3.1 released

What's Changed

Full Changelog: oasis-open/cti-stix-validator@v3.3.0...v3.3.1

cti-stix-validator v3.3.0 Release Notes

Release date: 2026-05-12

Overview

cti-stix-validator v3.3.0 updates the supported Python versions, refreshes schema support, improves validation behavior around timestamp comparisons, and includes several test and documentation improvements.

This release also includes performance improvements for schema lookup caching and additional fixes around STIX object reference validation.

Highlights

  • Updated supported Python versions, including support for Python 3.14.
  • Added the required minimum Python version metadata.
  • Improved timestamp comparison handling to avoid validation errors when malformed timestamp values are encountered.
  • Updated schema pinning to the latest STIX 2.1 schema commit.
  • Improved schema lookup performance through caching.
  • Fixed object reference validation to prevent invalid SDO usage in SCO object reference properties.
  • Updated maintainers list and ReadTheDocs configuration.
  • Added and improved tests for timestamp handling, campaign objects, STIX 2.0 Course of Action objects, and object reference validation.

Changes

Python Support

  • Bumped the latest supported version.
  • Added the required minimum Python version.
  • Updated the list of supported Python versions.
  • Added Python 3.14 support.

Validation Fixes

  • Fixed timestamp field comparison to avoid exceptions when comparing invalid or improperly formatted timestamp values.
  • Added checks to ensure both timestamp values are valid datetime objects before comparison.
  • Improved handling of cases where one timestamp may still be a string due to invalid formatting.
  • Fixed additional datetime comparison issues that could previously lead to incorrect negative validation results.

STIX Schema and Object Reference Validation

  • Updated schema pinning to the latest STIX 2.1 schema commit.
  • Improved validation for object_refs.
  • Added schema allow/deny patterns to limit object_refs to SCO and SRO where appropriate.

... (truncated)

Changelog

Sourced from stix2-validator's changelog.

CHANGELOG

Commits
  • d3ef2a5 Merge branch 'master' of github.com:oasis-open/cti-stix-validator
  • 3059025 chg: [release] version v3.3.1
  • d9266a9 Merge pull request #247 from chrisr3d/master
  • 7d4af31 fix: [tests] Trying with a better assertion for error message raised with inv...
  • b767784 Merge branch 'master' of github.com:oasis-open/cti-stix-validator
  • ae71357 fix: Using latest pattern validator version
  • 9e4a1ea Merge pull request #246 from chrisr3d/master
  • 1885714 chg: Bumped latest version and added required minimum python version
  • 503daa7 Merge branch 'master' of github.com:chrisr3d/cti-stix-validator
  • fbcf543 Merge branch 'master' of github.com:oasis-open/cti-stix-validator
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the python-minor-and-patch group across 1 directory…
38741a1 
… with 4 updates

Bumps the python-minor-and-patch group with 4 updates in the / directory: [gitpython](https://github.com/gitpython-developers/GitPython), [markdown](https://github.com/Python-Markdown/markdown), [bleach](https://github.com/mozilla/bleach) and [stix2-validator](https://github.com/oasis-open/cti-stix-validator).


Updates `gitpython` from 3.1.54 to 3.1.57
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](gitpython-developers/GitPython@3.1.54...3.1.57)

Updates `markdown` from 3.10.2 to 3.10.3
- [Release notes](https://github.com/Python-Markdown/markdown/releases)
- [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md)
- [Commits](Python-Markdown/markdown@3.10.2...3.10.3)

Updates `bleach` from 6.3.0 to 6.4.0
- [Changelog](https://github.com/mozilla/bleach/blob/main/CHANGES)
- [Commits](mozilla/bleach@v6.3.0...v6.4.0)

Updates `stix2-validator` from 3.2.0 to 3.3.1
- [Release notes](https://github.com/oasis-open/cti-stix-validator/releases)
- [Changelog](https://github.com/oasis-open/cti-stix-validator/blob/master/CHANGELOG)
- [Commits](oasis-open/cti-stix-validator@v3.2.0...v3.3.1)

---
updated-dependencies:
- dependency-name: gitpython
  dependency-version: 3.1.57
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: markdown
  dependency-version: 3.10.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: bleach
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: stix2-validator
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 5, 2026
@sonarqubecloud

sonarqubecloud Bot commented Aug 5, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

@dependabot @github

dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown
Contributor Author

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot recreate.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants