Skip to content

deps(deps-dev): update pip-audit requirement from >=2.7 to >=2.10.0#50

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-audit-gte-2.10.0
Closed

deps(deps-dev): update pip-audit requirement from >=2.7 to >=2.10.0#50
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-audit-gte-2.10.0

Conversation

@dependabot
Copy link
Copy Markdown

@dependabot dependabot Bot commented on behalf of github Apr 13, 2026 •
edited
Loading

Updates the requirements on pip-audit to permit the latest version.

Release notes

Sourced from pip-audit's releases.

v2.10.0

Added

  • pip-audit now supports the --osv-url URL flag, which can be used to retrieve vulnerabilities from a custom OSV service. This is useful for organizations that host their own mirror of the OSV database, or that have custom OSV records (#810)

  • pip-audit now supports the Ecosyste.ms vulnerability service with --vulnerability-service=esms (#903).

Changed

  • The minimum version of Python is now 3.10 (#905)

Fixed

  • Fixed a bug where pip-audit would fail to parse pyproject.toml files containing TOML 1.0.0 features (#910)

  • CycloneDX JSON/XML output now correctly links vulnerabilities to their affected components via the affects field (#980)

Changelog

Sourced from pip-audit's changelog.

[2.10.0]

Added

  • pip-audit now supports the --osv-url URL flag, which can be used to retrieve vulnerabilities from a custom OSV service. This is useful for organizations that host their own mirror of the OSV database, or that have custom OSV records (#810)

  • pip-audit now supports the Ecosyste.ms vulnerability service with --vulnerability-service=esms (#903).

Changed

  • The minimum version of Python is now 3.10 (#905)

Fixed

  • Fixed a bug where pip-audit would fail to parse pyproject.toml files containing TOML 1.0.0 features (#910)

  • CycloneDX JSON/XML output now correctly links vulnerabilities to their affected components via the affects field (#980)

[2.9.0]

Added

  • pip-audit now supports PEP 751 lockfiles. These lockfiles can be audited in "project" mode by passing --locked to pip-audit (#888)

[2.8.0]

Added

  • pip-audit now allows some CLI flags to be configured via environment variables (#755)

Changed

  • The default cache locations on macOS and Linux now respect each platform's caching directory idioms (e.g. XDG) (#814)

... (truncated)

Commits
  • dec2165 chore: prep release v2.10.0 (#905)
  • d191a22 Fix CycloneDX vulnerability-component linking (#980) (#981)
  • a3f69b1 dependabot: add cooldowns (#978)
  • 42df1b2 build(deps): bump astral-sh/setup-uv from 7.1.3 to 7.1.4 (#976)
  • d4cbb66 build(deps): bump actions/checkout from 5.0.1 to 6.0.0 (#977)
  • 0f2889d build(deps): bump github/codeql-action from 4.31.3 to 4.31.4 (#975)
  • ad15644 build(deps): bump actions/checkout from 5.0.0 to 5.0.1 (#974)
  • 831ca98 build(deps): bump astral-sh/setup-uv from 7.1.2 to 7.1.3 (#972)
  • afeb9ea build(deps): bump github/codeql-action from 4.31.2 to 4.31.3 (#973)
  • 2969e7c build(deps): bump github/codeql-action from 4.31.0 to 4.31.2 (#971)
  • Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

@dependabot
deps(deps-dev): update pip-audit requirement from >=2.7 to >=2.10.0
73eb755 
Updates the requirements on [pip-audit](https://github.com/pypa/pip-audit) to permit the latest version.
- [Release notes](https://github.com/pypa/pip-audit/releases)
- [Changelog](https://github.com/pypa/pip-audit/blob/main/CHANGELOG.md)
- [Commits](pypa/pip-audit@v2.7.0...v2.10.0)

---
updated-dependencies:
- dependency-name: pip-audit
  dependency-version: 2.10.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github Apr 13, 2026

Labels

The following labels could not be found: dependencies, security. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@kutsenko kutsenko mentioned this pull request May 17, 2026
Merged
kutsenko added a commit that referenced this pull request May 17, 2026
@kutsenko @claude
chore(deps): batch dependency + CI-action bumps (Dependabot #43-#56) (#…
aa8a3e8 
…57)

Applies fourteen Dependabot bumps directly in one commit instead of
merging the PRs individually (they all touch pyproject.toml or
docker-publish.yml and would conflict-cascade; the Dependabot PRs also
fail build-and-push because Dependabot PRs get no registry-secret
access — a regular-branch PR does not).

pyproject.toml — `>=` version floors (no pinning):
- setuptools      >=69      -> >=82.0.1   (#55, build-system)
- ocrmypdf        >=16.12.0 -> >=17.4.1   (#47)
- pikepdf         >=9.0.0   -> >=10.5.1   (#49)
- uvicorn         >=0.32    -> >=0.44.0   (#54)
- img2pdf         >=0.5.0   -> >=0.6.3    (#52)
- httpx           >=0.28    -> >=0.28.1   (#48)
- ruff            >=0.9     -> >=0.15.10  (#53)
- pytest-asyncio  >=0.23.0  -> >=1.3.0    (#56)
- pytest-timeout  >=2.1.0   -> >=2.4.0    (#51)
- pip-audit       >=2.7     -> >=2.10.0   (#50)

.github/workflows/docker-publish.yml — CI action majors:
- docker/login-action        v3 -> v4    (#43)
- docker/metadata-action     v5 -> v6    (#44)
- docker/setup-buildx-action v3 -> v4    (#45)
- docker/build-push-action   v5 -> v7    (#46)

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
@kutsenko kutsenko closed this in #57 May 17, 2026
@dependabot @github
Copy link
Copy Markdown
Author

dependabot Bot commented on behalf of github May 17, 2026

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/pip/pip-audit-gte-2.10.0 branch May 17, 2026 11:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants