Bump gitpython from 3.1.35 to 3.1.37
Bumps gitpython from 3.1.35 to 3.1.37.
Release notes
Sourced from gitpython's releases.
3.1.37 - a proper fix
CVE-2023-41040
What's Changed
Improve Python version and OS compatibility, fixing deprecations by @EliahKagan in
gitpython-developers/GitPython#1654
Better document env_case test/fixture and cwd by @EliahKagan in
gitpython-developers/GitPython#1657
Remove spurious executable permissions by @EliahKagan in
gitpython-developers/GitPython#1658
Fix up checks in Makefile and make them portable by @EliahKagan in
gitpython-developers/GitPython#1661
Fix URLs that were redirecting to another license by @EliahKagan in
gitpython-developers/GitPython#1662
Assorted small fixes/improvements to root dir docs by @EliahKagan in
gitpython-developers/GitPython#1663
Use venv instead of virtualenv in test_installation by @EliahKagan in
gitpython-developers/GitPython#1664
Omit py_modules in setup by @EliahKagan in
gitpython-developers/GitPython#1665
Don't track code coverage temporary files by @EliahKagan in
gitpython-developers/GitPython#1666
Configure tox by @EliahKagan in
gitpython-developers/GitPython#1667
Format tests with black and auto-exclude untracked paths by @EliahKagan in
gitpython-developers/GitPython#1668
Upgrade and broaden flake8, fixing style problems and bugs by @EliahKagan in
gitpython-developers/GitPython#1673
Fix rollback bug in SymbolicReference.set_reference by @EliahKagan in
gitpython-developers/GitPython#1675
Remove
@NoEffect annotations by @EliahKagan in
gitpython-developers/GitPython#1677
Add more checks for the validity of refnames by @facutuesca in
gitpython-developers/GitPython#1672
Full Changelog: gitpython-developers/GitPython@3.1.36...3.1.37
Commits
b27a89f fix makefile to compare commit hashes only
0bd2890 prepare next release
832b6ee remove unnecessary list comprehension to fix CI
e98f57b Merge pull request #1672 from trail-of-forks/robust-refname-checks
1774f1e Merge pull request #1677 from EliahKagan/no-noeffect
a4701a0 Remove
@NoEffect annotations
d40320b Merge pull request #1675 from EliahKagan/rollback
d1c1f31 Merge pull request #1673 from EliahKagan/flake8
e480985 Tweak rollback logic in log.to_file
ff84b26 Refactor try-finally cleanup in git/
Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.
Reviewed-by: Vladimir Vshivkov
Fixes #1670
Fixes #1671
I've upgraded flake8 in the pre-commit configuration, which automatically upgrades its pycodestyle dependency. This makes it compatible with Python 3.12 (or at least we seem unaffected by any remaining incompatibilities). I've also upgraded its non-default plugins, which are listed there as additional dependencies. I have fixed a warning that was for some reason specific to 3.12 about spacing around +, as well as some new warnings that came in the new version of pycodestyle and new versions of the non-default packages. This included changing == to is and != to is not when comparing type objects, since in all cases it appeared exact type matching was intended (rather than what an issubclass or, under simplification of the surrounding code, isinstance would check). See #1670.
I've also broadened flake8 to check the whole project (except the doc/ directory). That is, it now checks the test suite. It issued a number of warnings, and I fixed the code accordingly. Most of these are style changes, but it revealed #1671, which I fixed as described there (by using unittest.mock.patch.dict, which as noted there is okay because it is only in the tests). I then looked for bugs in finally cleanup logic throughout the project, in case anything else like that was present that I could identify and fix. I found no further serious bugs inside test/ while doing this, but I did find some areas I could simplify or otherwise improve, including one place where a throwaway environment variable FOO was never unpatched.
I included those changes in this PR, but not any changes to code in git/ other than to fix what flake8 found. One place in git/ that should be changed is a bug that merits fixing in some way, which I opened #1669 for. Other areas of improvement in git/ related to the use of finally are less important, and some of them subjective. I could include them in a fix for #1669 (if I end up fixing it) or in a separate PR, but I've omitted those further changes in git/ from this PR to keep its scope from creeping too large.
An area that I think deserves special attention in review is changes I made in parts of the test code that are reflected in built documentation that will be published on readthedocs:
In most cases I have retained existing noqa comments, and I suspect a number of them could be removed. That could be done at any time, and it was also only to limit scope that I have not tried to do it here. Besides that, however, there is a different reason I have deliberately avoided going further with flake8--for example, by adding it and its extra plugins as development dependencies of the project (they are still only installed by and for pre-commit), running it on CI, enabling more checks, or attempting to get the flake8-type-checking plugin listed in requirements-dev.txt working. The reason is that I think it would be beneficial to replace flake8 in this project with ruff, which is modern, versatile, and extremely fast. (This is also why I have not proposed that we also adopt isort, even though isort is one of my favorite tools: ruff might take care of that, too.)