Bump the python-packages group across 1 directory with 7 updates

[dependabot]

Bumps the python-packages group with 7 updates in the / directory:

Package	From	To
certifi	2024.8.30	2024.12.14
click	8.1.7	8.1.8
jinja2	3.1.4	3.1.5
starlette	0.41.3	0.42.0
urllib3	2.2.3	2.3.0
uvicorn	0.32.1	0.34.0
watchfiles	1.0.0	1.0.3

Updates certifi from 2024.8.30 to 2024.12.14

Commits

• 4ba3900 2024.12.14 (#329)
• 9164660 Bump pypa/gh-action-pypi-publish from 1.12.2 to 1.12.3 (#331)
• 3dc3651 Bump pypa/gh-action-pypi-publish from 1.11.0 to 1.12.2 (#328)
• c5bf18d Bump pypa/gh-action-pypi-publish from 1.10.3 to 1.11.0 (#327)
• b908391 Bump actions/setup-python from 5.2.0 to 5.3.0 (#326)
• bc26b41 Bump actions/checkout from 4.2.1 to 4.2.2 (#325)
• 57afc22 Bump actions/upload-artifact from 4.4.1 to 4.4.3 (#323)
• a495091 test against 3.13 final
• 62f8144 Added 3.13 classifier (#322)
• 94d23a0 Bump pypa/gh-action-pypi-publish from 1.10.2 to 1.10.3 (#321)
• Additional commits viewable in compare view

Updates click from 8.1.7 to 8.1.8

Release notes

Sourced from click's releases.

8.1.8

This is the Click 8.1.8 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.1.8/ Changes: https://click.palletsprojects.com/en/stable/changes/#version-8-1-8 Milestone https://github.com/pallets/click/milestones/23?closed=1

• Fix an issue with type hints for click.open_file(). #2717
• Fix issue where error message for invalid click.Path displays on multiple lines. #2697
• Fixed issue that prevented a default value of "" from being displayed in the help for an option. #2500
• The test runner handles stripping color consistently on Windows. #2705
• Show correct value for flag default when using default_map. #2632
• Fix click.echo(color=...) passing color to coloroma so it can be forced on Windows. #2606.
• More robust bash version check, fixing problem on Windows with git-bash. #2638
• Cache the help option generated by the help_option_names setting to respect its eagerness. #2811
• Replace uses of os.system with subprocess.Popen. #1476
• Exceptions generated during a command will use the context's color setting when being displayed. #2193
• Error message when defining option with invalid name is more descriptive. #2452
• Refactor code generating default --help option to deduplicate code. #2563
• Test CLIRunner resets patched _compat.should_strip_ansi. #2732

Changelog

Sourced from click's changelog.

Version 8.1.8

Unreleased

• Fix an issue with type hints for click.open_file(). :issue:2717
• Fix issue where error message for invalid click.Path displays on multiple lines. :issue:2697
• Fixed issue that prevented a default value of "" from being displayed in the help for an option. :issue:2500
• The test runner handles stripping color consistently on Windows. :issue:2705
• Show correct value for flag default when using default_map. :issue:2632
• Fix click.echo(color=...) passing color to coloroma so it can be forced on Windows. :issue:2606.

Commits

• 934813e release version 8.1.8
• c23223b Add links to third-party projects enhancing Click (#2815)
• 822d4fd Add links to third-party projects
• 8e7bed0 Break up arguments section (#2586)
• 3241541 Remove some typing hints.
• bed0377 remove test pypi
• 6534590 update dev dependencies
• b1e392e fix typos
• fdc6b02 Fix missing reset in isolation function (#2733)
• ffd43e9 Fixed missing reset on _compat.should_strip_ansi.
• Additional commits viewable in compare view

Updates jinja2 from 3.1.4 to 3.1.5

Release notes

Sourced from jinja2's releases.

3.1.5

This is the Jinja 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Jinja2/3.1.5/ Changes: https://jinja.palletsprojects.com/changes/#version-3-1-5 Milestone: https://github.com/pallets/jinja/milestone/16?closed=1

• The sandboxed environment handles indirect calls to str.format, such as by passing a stored reference to a filter that calls its argument. GHSA-q2x7-8rv6-6q7h
• Escape template name before formatting it into error messages, to avoid issues with names that contain f-string syntax. #1792, GHSA-gmj6-6f8f-6699
• Sandbox does not allow clear and pop on known mutable sequence types. #2032
• Calling sync render for an async template uses asyncio.run. #1952
• Avoid unclosed auto_aiter warnings. #1960
• Return an aclose-able AsyncGenerator from Template.generate_async. #1960
• Avoid leaving root_render_func() unclosed in Template.generate_async. #1960
• Avoid leaving async generators unclosed in blocks, includes and extends. #1960
• The runtime uses the correct concat function for the current environment when calling block references. #1701
• Make |unique async-aware, allowing it to be used after another async-aware filter. #1781
• |int filter handles OverflowError from scientific notation. #1921
• Make compiling deterministic for tuple unpacking in a {% set ... %} call. #2021
• Fix dunder protocol (copy/pickle/etc) interaction with Undefined objects. #2025
• Fix copy/pickle support for the internal missing object. #2027
• Environment.overlay(enable_async) is applied correctly. #2061
• The error message from FileSystemLoader includes the paths that were searched. #1661
• PackageLoader shows a clearer error message when the package does not contain the templates directory. #1705
• Improve annotations for methods returning copies. #1880
• urlize does not add mailto: to values like @a@b. #1870
• Tests decorated with @pass_context can be used with the |select filter. #1624
• Using set for multiple assignment (a, b = 1, 2) does not fail when the target is a namespace attribute. #1413
• Using set in all branches of {% if %}{% elif %}{% else %} blocks does not cause the variable to be considered initially undefined. #1253

Changelog

Sourced from jinja2's changelog.

Version 3.1.5

Released 2024-12-21

• The sandboxed environment handles indirect calls to str.format, such as by passing a stored reference to a filter that calls its argument. :ghsa:q2x7-8rv6-6q7h
• Escape template name before formatting it into error messages, to avoid issues with names that contain f-string syntax. :issue:1792, :ghsa:gmj6-6f8f-6699
• Sandbox does not allow clear and pop on known mutable sequence types. :issue:2032
• Calling sync render for an async template uses asyncio.run. :pr:1952
• Avoid unclosed auto_aiter warnings. :pr:1960
• Return an aclose-able AsyncGenerator from Template.generate_async. :pr:1960
• Avoid leaving root_render_func() unclosed in Template.generate_async. :pr:1960
• Avoid leaving async generators unclosed in blocks, includes and extends. :pr:1960
• The runtime uses the correct concat function for the current environment when calling block references. :issue:1701
• Make |unique async-aware, allowing it to be used after another async-aware filter. :issue:1781
• |int filter handles OverflowError from scientific notation. :issue:1921
• Make compiling deterministic for tuple unpacking in a {% set ... %} call. :issue:2021
• Fix dunder protocol (copy/pickle/etc) interaction with Undefined objects. :issue:2025
• Fix copy/pickle support for the internal missing object. :issue:2027
• Environment.overlay(enable_async) is applied correctly. :pr:2061
• The error message from FileSystemLoader includes the paths that were searched. :issue:1661
• PackageLoader shows a clearer error message when the package does not contain the templates directory. :issue:1705
• Improve annotations for methods returning copies. :pr:1880
• urlize does not add mailto: to values like @a@b. :pr:1870
• Tests decorated with @pass_context`` can be used with the ``|select`` filter. :issue:1624`
• Using set for multiple assignment (a, b = 1, 2) does not fail when the target is a namespace attribute. :issue:1413
• Using set in all branches of {% if %}{% elif %}{% else %} blocks does not cause the variable to be considered initially undefined. :issue:1253

Commits

• 877f6e5 release version 3.1.5
• 8d58859 remove test pypi
• eda8fe8 update dev dependencies
• c8fdce1 Fix bug involving calling set on a template parameter within all branches of ...
• 66587ce Fix bug where set would sometimes fail within if
• fbc3a69 Add support for namespaces in tuple parsing (#1664)
• b8f4831 more comments about nsref assignment
• ee83219 Add support for namespaces in tuple assignment
• 1d55cdd Triple quotes in docs (#2064)
• 8a8eafc edit block assignment section
• Additional commits viewable in compare view

Updates starlette from 0.41.3 to 0.42.0

Release notes

Sourced from starlette's releases.

0.42.0

Added

• Raise ClientDisconnect on StreamingResponse #2732.

Fixed

• Use ETag from headers when parsing If-Range in FileResponse #2761.
• Follow directory symlinks in StaticFiles when follow_symlinks=True #2711.
• Bump minimum python-multipart version to 0.0.18 0ba8395.
• Bump minimum httpx version to 0.27.0 #2773.

---

New Contributors

• @​logan-connolly made their first contribution in encode/starlette#2763
• @​eltoder made their first contribution in encode/starlette#2768
• @​hanxi made their first contribution in encode/starlette#2711
• @​viccie30 made their first contribution in encode/starlette#2761
• @​dbowring made their first contribution in encode/starlette#2782
• @​lealre made their first contribution in encode/starlette#2793

Full Changelog: encode/starlette@0.41.3...0.42.0

Changelog

Sourced from starlette's changelog.

0.42.0 (December 14, 2024)

Added

• Raise ClientDisconnect on StreamingResponse #2732.

Fixed

• Use ETag from headers when parsing If-Range in FileResponse #2761.
• Follow directory symlinks in StaticFiles when follow_symlinks=True #2711.
• Bump minimum python-multipart version to 0.0.18 0ba8395.
• Bump minimum httpx version to 0.27.0 #2773.

Commits

• 28991b7 Version 0.42.0 (#2786)
• 672cd42 Add pragma: no branch in middleware/exceptions.py
• 5000c9f tests: Add skipped coverages for websockets.py and templating.py using `b...
• f57b083 docs: Update description for third-party package Apitally (#2794)
• 8a99adf docs: use transport instead of directly pass the app to AsyncClient (#2784)
• d40bc9e Update documentation link for python-multipart (#2782)
• db5063c Bump the python-packages group with 5 updates (#2779)
• ca1f45d Use ETag from headers when parsing If-Range in FileResponse (#2761)
• eee4cdc Fix: Resolve the issue where the directory itself being a symlink does not wo...
• b68a142 Replace mkautodoc by mkdocstrings (#2776)
• Additional commits viewable in compare view

Updates urllib3 from 2.2.3 to 2.3.0

Release notes

Sourced from urllib3's releases.

2.3.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Features

• Added HTTPResponse.shutdown() to stop any ongoing or future reads for a specific response. It calls shutdown(SHUT_RD) on the underlying socket. This feature was sponsored by LaunchDarkly. (urllib3/urllib3#2868)
• Added support for JavaScript Promise Integration on Emscripten. This enables more efficient WebAssembly requests and streaming, and makes it possible to use in Node.js if you launch it as node --experimental-wasm-stack-switching. (urllib3/urllib3#3400)
• Added the proxy_is_tunneling property to HTTPConnection and HTTPSConnection. (urllib3/urllib3#3285)
• Added pickling support to NewConnectionError and NameResolutionError. (urllib3/urllib3#3480)

Bugfixes

• Fixed an issue in debug logs where the HTTP version was rendering as "HTTP/11" instead of "HTTP/1.1". (urllib3/urllib3#3489)

Deprecations and Removals

• Removed support for Python 3.8. (urllib3/urllib3#3492)

Full Changelog: urllib3/urllib3@2.2.3...2.3.0

Changelog

Sourced from urllib3's changelog.

2.3.0 (2024-12-22)

Features

• Added HTTPResponse.shutdown() to stop any ongoing or future reads for a specific response. It calls shutdown(SHUT_RD) on the underlying socket. This feature was sponsored by LaunchDarkly <https://opencollective.com/urllib3/contributions/815307>. ([#2868](https://github.com/urllib3/urllib3/issues/2868) <https://github.com/urllib3/urllib3/issues/2868>)
• Added support for JavaScript Promise Integration on Emscripten. This enables more efficient WebAssembly requests and streaming, and makes it possible to use in Node.js if you launch it as node --experimental-wasm-stack-switching. ([#3400](https://github.com/urllib3/urllib3/issues/3400) <https://github.com/urllib3/urllib3/issues/3400>__)
• Added the proxy_is_tunneling property to HTTPConnection and HTTPSConnection. ([#3285](https://github.com/urllib3/urllib3/issues/3285) <https://github.com/urllib3/urllib3/issues/3285>__)
• Added pickling support to NewConnectionError and NameResolutionError. ([#3480](https://github.com/urllib3/urllib3/issues/3480) <https://github.com/urllib3/urllib3/issues/3480>__)

Bugfixes

• Fixed an issue in debug logs where the HTTP version was rendering as "HTTP/11" instead of "HTTP/1.1". ([#3489](https://github.com/urllib3/urllib3/issues/3489) <https://github.com/urllib3/urllib3/issues/3489>__)

Deprecations and Removals

• Removed support for Python 3.8. ([#3492](https://github.com/urllib3/urllib3/issues/3492) <https://github.com/urllib3/urllib3/issues/3492>__)

Commits

• 2f68c53 Release 2.3.0
• f7bcf69 Add HTTPResponse.shutdown() to stop blocking reads (#3527)
• e942249 Update .readthedocs.yml addressing a deprecation (#3534)
• 905549d Upgrade Python pre-commit tools (#3529)
• 716d834 Fix PyPI publish with Core metadata 2.4 (#3531)
• 7ab935c Address zizmor issues
• 181357e Bump Quart to fix CI (#3524)
• 0e7e0df Start testing with Python 3.14
• d67d09b Bump mypy version
• 20032ec Drop unneeded dependency pins and a warning filter
• Additional commits viewable in compare view

Updates uvicorn from 0.32.1 to 0.34.0

Release notes

Sourced from uvicorn's releases.

Version 0.34.0

What's Changed

• Add content-length to 500 response in wsproto by @​Kludex in encode/uvicorn#2542
• Drop Python 3.8 by @​Kludex in encode/uvicorn#2543

---

Full Changelog: encode/uvicorn@0.33.0...0.34.0

Version 0.33.0

What's Changed

• Remove WatchGod by @​Kludex in encode/uvicorn#2536

New Contributors

• @​bwells made their first contribution in encode/uvicorn#2491
• @​tback made their first contribution in encode/uvicorn#2528

Full Changelog: encode/uvicorn@0.32.1...0.33.0

Changelog

Sourced from uvicorn's changelog.

0.34.0 (2024-12-15)

Added

• Add content-length to 500 response in wsproto implementation (#2542)

Removed

• Drop support for Python 3.8 (#2543)

0.33.0 (2024-12-14)

Removed

• Remove WatchGod support for --reload (#2536)

Commits

• 7983c1a Version 0.34.0 (#2546)
• 75d4402 Add alls-green job (#2544)
• 4156ccb Drop Python 3.8 (#2543)
• 3575cba Add content-length to 500 response in wsproto (#2542)
• a500513 Version 0.33.0 (#2539)
• 038f8ef Bump the python-packages group across 1 directory with 9 updates (#2538)
• 3aa1d01 Remove WatchGod (#2536)
• a3cc360 docs: add note about server behavior on exceptions (#2535)
• 6725ebb docs: add more mkdocs-material features (#2534)
• bfa754eencode/uvicorn#2527#2528)
• Additional commits viewable in compare view

Updates watchfiles from 1.0.0 to 1.0.3

Release notes

Sourced from watchfiles's releases.

v1.0.3 2024-12-10

try to fix docs deploy

946a29616ef555b313249b51038ff1b51e2e97ec

Full Changelog: samuelcolvin/watchfiles@v1.0.2...v1.0.3

v1.0.2 2024-12-10

Fix PyPI asset upload from v1.0.1.

Full Changelog: samuelcolvin/watchfiles@v1.0.1...v1.0.2

v1.0.1 2024-12-10

What's Changed

• Bump dawidd6/action-download-artifact from 2 to 6 in /.github/workflows by @​dependabot in samuelcolvin/watchfiles#311
• Bump pyo3 from 0.23.1 to 0.23.3 by @​dependabot in samuelcolvin/watchfiles#317
• bump to PyO3 0.23.3 by @​davidhewitt in samuelcolvin/watchfiles#316

New Contributors

• @​davidhewitt made their first contribution in samuelcolvin/watchfiles#316

Full Changelog: samuelcolvin/watchfiles@v1.0.0...v1.0.1

Commits

• 946a296 try to fix github-pages-deploy-action
• 03a9ae0 uprev to v1.0.2
• 82fe601 uprev pypa/gh-action-pypi-publish in ci
• 3377055 uprev to v1.0.1
• 320adda bump to PyO3 0.23.3 (#316)
• fea8ce2 Bump pyo3 from 0.23.1 to 0.23.3 (#317)
• 393a3ad Bump dawidd6/action-download-artifact from 2 to 6 in /.github/workflows (#311)
• cb0bcd8 uprev JamesIves/github-pages-deploy-action
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ❌ 2 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 93ded30.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

License Issues

poetry.lock

Package	Version	License	Issue Type
click	8.1.8	BSD-2-Clause AND BSD-3-Clause	Incompatible License
jinja2	3.1.5	BSD-2-Clause AND BSD-3-Clause	Incompatible License

Allowed Licenses: 0BSD, AGPL-3.0-or-later, Apache-2.0, BlueOak-1.0.0, BSD-2-Clause, BSD-3-Clause-Clear, BSD-3-Clause, BSL-1.0, CAL-1.0, CC-BY-3.0, CC-BY-4.0, CC-BY-SA-4.0, CC0-1.0, EPL-2.0, GPL-2.0-only, GPL-2.0-or-later, GPL-2.0, GPL-3.0-or-later, ISC, LGPL-2.0-only, LGPL-2.0-or-later, LGPL-2.1-only, LGPL-2.1-or-later, LGPL-2.1, LGPL-3.0-only, LGPL-3.0, LGPL-3.0-or-later, MIT, MIT-CMU, MPL-1.1, MPL-2.0, OFL-1.1, PSF-2.0, Python-2.0, Python-2.0.1, Unicode-DFS-2016, Unlicense

OpenSSF Scorecard

Package	Version	Score	Details
pip/certifi	2024.12.14	🟢 7.2	Details Check Score Reason Code-Review 🟢 6 Found 2/3 approved changesets -- score normalized to 6 Security-Policy 🟢 10 security policy file detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Maintained 🟢 10 15 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found License 🟢 9 license file detected Packaging 🟢 10 packaging workflow detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/click	8.1.8	🟢 7.1	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 14 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Code-Review 🟢 7 Found 17/24 approved changesets -- score normalized to 7 Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 Fuzzing 🟢 10 project is fuzzed Vulnerabilities 🟢 10 0 existing vulnerabilities detected Packaging ⚠️ -1 packaging workflow not detected License 🟢 10 license file detected Signed-Releases 🟢 10 4 out of the last 4 releases have a total of 4 signed artifacts. Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches Security-Policy 🟢 9 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/jinja2	3.1.5	🟢 6.8	Details Check Score Reason Maintained 🟢 10 5 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review ⚠️ 1 Found 3/18 approved changesets -- score normalized to 1 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected License 🟢 10 license file detected Fuzzing 🟢 10 project is fuzzed Signed-Releases 🟢 10 2 out of the last 2 releases have a total of 2 signed artifacts. Packaging 🟢 10 packaging workflow detected Security-Policy 🟢 9 security policy file detected Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/starlette	0.42.0	🟢 6	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 21 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Code-Review 🟢 5 Found 16/28 approved changesets -- score normalized to 5 Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Vulnerabilities 🟢 10 0 existing vulnerabilities detected Security-Policy 🟢 10 security policy file detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/urllib3	2.3.0	🟢 9.1	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Branch-Protection 🟢 5 branch protection is not maximal on development and all release branches CI-Tests 🟢 10 30 out of 30 merged PRs checked by a CI test -- score normalized to 10 CII-Best-Practices 🟢 5 badge detected: Passing Code-Review 🟢 10 all changesets reviewed Contributors 🟢 10 project has 125 contributing companies or organizations Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Dependency-Update-Tool 🟢 10 update tool detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Packaging 🟢 10 packaging workflow detected Pinned-Dependencies 🟢 5 dependency not pinned by hash detected -- score normalized to 5 SAST 🟢 10 SAST tool is run on all commits Security-Policy 🟢 10 security policy file detected Signed-Releases 🟢 8 4 out of the last 5 releases have a total of 4 signed artifacts. Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Vulnerabilities 🟢 10 0 existing vulnerabilities detected
pip/uvicorn	0.34.0	🟢 6.1	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 3 Found 9/27 approved changesets -- score normalized to 3 Maintained 🟢 10 30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Security-Policy 🟢 10 security policy file detected Vulnerabilities 🟢 10 0 existing vulnerabilities detected Packaging 🟢 10 packaging workflow detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
pip/watchfiles	1.0.3	🟢 5.4	Details Check Score Reason Maintained 🟢 10 12 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review 🟢 3 Found 9/24 approved changesets -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration Packaging 🟢 10 packaging workflow detected Vulnerabilities 🟢 9 1 existing vulnerabilities detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• poetry.lock