chore(deps): bump the pip group with 5 updates

[dependabot]

Updates the requirements on fast-depends, mkdocs-git-revision-date-localized-plugin, ruff, semgrep and fastapi to permit the latest version.
Updates fast-depends to 3.0.0a0

Commits

• See full diff in compare view

Updates mkdocs-git-revision-date-localized-plugin from 1.2.7 to 1.2.8

Release notes

Sourced from mkdocs-git-revision-date-localized-plugin's releases.

revision-date-localized v1.2.8

What's Changed

• Fixed the bug that the configuration option theme.language in mkdocs.yml was not fetched correctly under the mkdocs-material theme by @​Xiaokang2022 in timvink/mkdocs-git-revision-date-localized-plugin#143

New Contributors

• @​Xiaokang2022 made their first contribution in timvink/mkdocs-git-revision-date-localized-plugin#143

Full Changelog: timvink/mkdocs-git-revision-date-localized-plugin@v1.2.6...v1.2.8

Commits

• a31b4bb Use pyproject.toml, update gh actions
• d424ed9 Add test for language and locale param set in mkdocs material
• 2953442 update gh actions
• ad78b99 Merge pull request #143 from Xiaokang2022/master
• 2f7ef02 Update plugin.py
• See full diff in compare view

Updates ruff from 0.6.3 to 0.6.4

Release notes

Sourced from ruff's releases.

0.6.4

Release Notes

Preview features

• [flake8-builtins] Use dynamic builtins list based on Python version (#13172)
• [pydoclint] Permit yielding None in DOC402 and DOC403 (#13148)
• [pylint] Update diagnostic message for PLW3201 (#13194)
• [ruff] Implement post-init-default (RUF033) (#13192)
• [ruff] Implement useless if-else (RUF034) (#13218)

Rule changes

• [flake8-pyi] Respect pep8_naming.classmethod-decorators settings when determining if a method is a classmethod in custom-type-var-return-type (PYI019) (#13162)
• [flake8-pyi] Teach various rules that annotations might be stringized (#12951)
• [pylint] Avoid no-self-use for attrs-style validators (#13166)
• [pylint] Recurse into subscript subexpressions when searching for list/dict lookups (PLR1733, PLR1736) (#13186)
• [pyupgrade] Detect aiofiles.open calls in UP015 (#13173)
• [pyupgrade] Mark sys.version_info[0] < 3 and similar comparisons as outdated (UP036) (#13175)

CLI

• Enrich messages of SARIF results (#13180)
• Handle singular case for incompatible rules warning in ruff format output (#13212)

Bug fixes

• [pydocstyle] Improve heuristics for detecting Google-style docstrings (#13142)
• [refurb] Treat sep arguments with effects as unsafe removals (FURB105) (#13165)

Contributors

• @​AlexWaygood
• @​Jinior
• @​MichaReiser
• @​RubenVanEldik
• @​RussellLuo
• @​Slyces
• @​carljm
• @​charliermarsh
• @​chriskrycho
• @​dhruvmanila
• @​dylwil3
• @​github-actions
• @​iamlucasvieira
• @​jamesbraza
• @​renovate
• @​tjkuson
• @​zhoufanjin

Install ruff 0.6.4

... (truncated)

Changelog

Sourced from ruff's changelog.

0.6.4

Preview features

• [flake8-builtins] Use dynamic builtins list based on Python version (#13172)
• [pydoclint] Permit yielding None in DOC402 and DOC403 (#13148)
• [pylint] Update diagnostic message for PLW3201 (#13194)
• [ruff] Implement post-init-default (RUF033) (#13192)
• [ruff] Implement useless if-else (RUF034) (#13218)

Rule changes

• [flake8-pyi] Respect pep8_naming.classmethod-decorators settings when determining if a method is a classmethod in custom-type-var-return-type (PYI019) (#13162)
• [flake8-pyi] Teach various rules that annotations might be stringized (#12951)
• [pylint] Avoid no-self-use for attrs-style validators (#13166)
• [pylint] Recurse into subscript subexpressions when searching for list/dict lookups (PLR1733, PLR1736) (#13186)
• [pyupgrade] Detect aiofiles.open calls in UP015 (#13173)
• [pyupgrade] Mark sys.version_info[0] < 3 and similar comparisons as outdated (UP036) (#13175)

CLI

• Enrich messages of SARIF results (#13180)
• Handle singular case for incompatible rules warning in ruff format output (#13212)

Bug fixes

• [pydocstyle] Improve heuristics for detecting Google-style docstrings (#13142)
• [refurb] Treat sep arguments with effects as unsafe removals (FURB105) (#13165)

Commits

• 65cc6ec Bump version to 0.6.4 (#13253)
• 66fe226 [red-knot] fix lookup of nonlocal names in deferred annotations (#13236)
• e965f9c [red-knot] Infer Unknown for the loop var in async for loops (#13243)
• 0512428 [red-knot] Emit a diagnostic if the value of a starred expression or a `yield...
• 46a4573 [red-knot] Add type inference for basic for loops (#13195)
• 5728909 Make mypy pass on black in knot_benchmark (#13235)
• 9d1bd7a [pylint] removed dunder methods in Python 3 (PLW3201) (#13194)
• e37bde4 [ruff] implement useless if-else (RUF034) (#13218)
• 862bd0c [red-knot] Add debug assert to check for duplicate definitions (#13214)
• e1e9143 [red-knot] Handle multiple comprehension targets (#13213)
• Additional commits viewable in compare view

Updates semgrep from 1.85.0 to 1.86.0

Release notes

Sourced from semgrep's releases.

Release v1.86.0

1.86.0 - 2024-09-04

Added

• The taint analysis can now track method invocations on variables of an interface type, when there is a single implementation. For example, the tainted input vulnerability can now be detected in the following code:

  public interface MovieService {
    String vulnerableInjection(String input);
  }
  @​Service
  public class MovieServiceImpl implements MovieService {
  @​Override
  public String vulnerableInjection(String input) {
  return sink(input);
  }
  }
  @​RestController("/")
  public class SpringController {
  @​Autowired
  private MovieService movieService;
  @​GetMapping("/pwn")
  public String pwnTest(@​RequestParam("input") String taintedInput) {
  return movieService.vulnerableInjection(taintedInput);
  }
  }

  When there are multiple implementations, the taint analysis will not follow any of them. We will add handling of cases with multiple implementations in upcoming updates. (code-7434)

• Uses of values imported via ECMAScript default imports (e.g., import example from 'mod';) can now be matched by qualified name patterns (e.g., mod.default). (code-7463)

• Pro: taint-mode: Allow (experimental) control taint to propagate through returns.

  Now this taint rule:

  pattern-sources:
  - control: true
    pattern: taint()
  

... (truncated)

Changelog

Sourced from semgrep's changelog.

1.86.0 - 2024-09-04

Added

• The taint analysis can now track method invocations on variables of an interface type, when there is a single implementation. For example, the tainted input vulnerability can now be detected in the following code:

  public interface MovieService {
    String vulnerableInjection(String input);
  }
  @​Service
  public class MovieServiceImpl implements MovieService {
  @​Override
  public String vulnerableInjection(String input) {
  return sink(input);
  }
  }
  @​RestController("/")
  public class SpringController {
  @​Autowired
  private MovieService movieService;
  @​GetMapping("/pwn")
  public String pwnTest(@​RequestParam("input") String taintedInput) {
  return movieService.vulnerableInjection(taintedInput);
  }
  }

  When there are multiple implementations, the taint analysis will not follow any of them. We will add handling of cases with multiple implementations in upcoming updates. (code-7434)

• Uses of values imported via ECMAScript default imports (e.g., import example from 'mod';) can now be matched by qualified name patterns (e.g., mod.default). (code-7463)

• Pro: taint-mode: Allow (experimental) control taint to propagate through returns.

  Now this taint rule:

  pattern-sources:
  - control: true
    pattern: taint()
  pattern-sinks:
  

... (truncated)

Commits

• 8fbe3a9 chore: Bump version to 1.86.0
• d23f4a5 Do not fallback to buildx in build-test-docker in OSS (semgrep/semgrep-propri...
• 7731408 fix no-logs-in-libs in Memory_limit for sync-with-OSS (semgrep/semgrep-propri...
• b178c24semgrep/semgrep-proprietary#2172
• be48509 Fix jsonnet parse error in bump-version.jsonnet (semgrep/semgrep-proprietary#...
• 0b09517 Add special error report for Stack_overflow in Core_scan iter_targets (semgre...
• 3401054semgrep/semgrep-proprietary#2169
• 4a4dfb2 Implement method name resolution for interface methods with a single implemen...
• 2349685 chore: Temporarily gate Python libdefs behind an environment variable (semgre...
• 2f5f797 Factorize iter_targets in Deep_scan with Core_scan (semgrep/semgrep-proprieta...
• Additional commits viewable in compare view

Updates fastapi from 0.113.0 to 0.114.0

Release notes

Sourced from fastapi's releases.

0.114.0

You can restrict form fields to only include those declared in a Pydantic model and forbid any extra field sent in the request using Pydantic's model_config = {"extra": "forbid"}:

from typing import Annotated
from fastapi import FastAPI, Form
from pydantic import BaseModel
app = FastAPI()
class FormData(BaseModel):
username: str
password: str
model_config = {"extra": "forbid"}
@​app.post("/login/")
async def login(data: Annotated[FormData, Form()]):
return data

Read the new docs: Form Models - Forbid Extra Form Fields.

Features

• ✨ Add support for forbidding extra form fields with Pydantic models. PR #12134 by @​tiangolo.

Docs

• 📝 Update docs, Form Models section title, to match config name. PR #12152 by @​tiangolo.

Internal

• ✅ Update internal tests for latest Pydantic, including CI tweaks to install the latest Pydantic. PR #12147 by @​tiangolo.

Commits

• bde12fa 🔖 Release version 0.114.0
• 74842f0 📝 Update release notes
• e68d8c6 📝 Update release notes
• 4ff22a0 📝 Update docs, Form Models section title, to match config name (#12152)
• a11e392 📝 Update release notes
• 4633b1b ✨ Add support for forbidding extra form fields with Pydantic models (#12134)
• 1b06b53 📝 Update release notes
• c411b81 ✅ Update internal tests for latest Pydantic, including CI tweaks to install t...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions