Bump werkzeug from 2.3.7 to 3.0.0 #1422
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
dependabot
bot
added
dependencies
Codecov ReportAll modified lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #1422 +/- ##
=======================================
Coverage 90.30% 90.30%
=======================================
Files 232 232
Lines 29828 29828
Branches 6808 6808
=======================================
Hits 26937 26937
Misses 1847 1847
Partials 1044 1044
☔ View full report in Codecov by Sentry. |
| @@ -153,7 +153,7 @@ def _check_redirect(target: str) -> Tuple[bool, str]: | |||
| we extract the URL path and forbid redirecting to external | |||
| hosts. | |||
| """ | |||
| redirect_url: BaseURL = url_parse(target) | |||
| redirect_url = urlsplit(target) | |||
There was a problem hiding this comment.
The deprecation message for url_parse recommended to replace it with a call to urllib.parse.urlsplit
| @@ -25,10 +26,12 @@ def __call__(self, collection, book, path=None): | |||
| redirect_url = flask.request.url | |||
| if collection: | |||
| redirect_url = redirect_url.replace( | |||
| collection, url_quote_plus(collection) | |||
| collection, quote_plus(collection, safe="()") | |||
There was a problem hiding this comment.
The deprecation message for url_quote_plus recommended to replace it with a call to quote_plus.
This causes our tests to fail because we assume that this function doesn't quote (), so I added in the safe parameter to make sure that brackets are not escaped.
| ) | ||
| if book: | ||
| redirect_url = redirect_url.replace(book, url_quote_plus(book)) | ||
| redirect_url = redirect_url.replace( | ||
| book, quote_plus(book, safe="()") |
| @@ -465,7 +465,7 @@ def authenticated_patron( | |||
| ProblemDetail if an error occurs. | |||
| """ | |||
| provider: AuthenticationProvider | None = None | |||
| provider_token: Dict[str, str] | str | None = None | |||
| provider_token: Dict[str, str | None] | str | None = None | |||
There was a problem hiding this comment.
Werkzeug modified their type hints to allow a None to be returned, so we also need to update our hints.
| @@ -148,7 +148,9 @@ def test_feed( | |||
| last_item.sort_author, | |||
| last_item.id, | |||
| ] | |||
| expect = "key=%s" % url_quote_plus(json.dumps(expected_pagination_key)) | |||
| expect = "key=%s" % quote_plus( | |||
| json.dumps(expected_pagination_key), safe="," | |||
There was a problem hiding this comment.
url_quote_plus does not escape , while quote_plus does. So I add the safe="," parameter so that , are not escaped. This does not change the CM behaviour, just makes sure that the test creates the correct expected key.
|
@tdilauro tagging you for a review on this one, since I had to push a couple extra commits to the base dependabot one in order to remove some deprecated functions we call to get the tests passing here. |
Bumps [werkzeug](https://github.com/pallets/werkzeug) from 2.3.7 to 3.0.0. - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@2.3.7...3.0.0) --- updated-dependencies: - dependency-name: werkzeug dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
jonathangreen
force-pushed
the
dependabot/pip/werkzeug-3.0.0
branch
from
5d8c092 to
b87aaf8
Compare
|
@dependabot squash and merge |
|
One of your CI runs failed on this pull request, so Dependabot won't merge it. Dependabot will still automatically merge this pull request if you amend it and your tests pass. |
Bumps werkzeug from 2.3.7 to 3.0.0.
Release notes
Sourced from werkzeug's releases.
Changelog
Sourced from werkzeug's changelog.
Commits
aa5088fRelease version 3.0.06427542Default the PathConverter (and descendants) to be non part isolating4820d8cProvide elapsed and timestamp info to filename_format599993dBump pypa/gh-action-pypi-publish from 1.8.8 to 1.8.10 (#2780)a2394edBump slsa-framework/slsa-github-generator from 1.7.0 to 1.9.0 (#2779)1efd6f3Bump actions/checkout from 3.5.3 to 3.6.0 (#2778)76a5419Bump pypa/gh-action-pypi-publish from 1.8.8 to 1.8.10ce8cfe7Bump slsa-framework/slsa-github-generator from 1.7.0 to 1.9.02b172cbBump actions/checkout from 3.5.3 to 3.6.03f9c1beUpdate helpful error message about AirPlay collision on macOS (#2776)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot will merge this PR once CI passes on it, as requested by @jonathangreen.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)