build(deps): bump the general group with 3 updates #230

dependabot · 2024-10-15T22:55:51Z

Bumps the general group with 3 updates: pillow, pyinstaller and pyinstaller-hooks-contrib.

Updates pillow from 10.4.0 to 11.0.0

Release notes

11.0.0

https://pillow.readthedocs.io/en/stable/releasenotes/11.0.0.html

Changes

Do not create core image in TIFF seek() #8392 [@radarhere]

Removed custom build_openjpeg #8365 [@radarhere]

Support writing LONG8 offsets in AppendingTiffWriter #8417 [@radarhere]

Use ImageFile.MAXBLOCK when saving TIFF images #8461 [@radarhere]

Always raise warnings for deprecated feature checks #8459 [@radarhere]

Do not close provided file handles with libtiff when saving #8458 [@radarhere]

Revert "Skip QEMU-emulated wheels on workflow dispatch event" #8455 [@radarhere]

Support ImageFilter.BuiltinFilter for I;16* images #8438 [@radarhere]

[pre-commit.ci] pre-commit autoupdate #8448 [@pre-commit-ci]

Use ImagingCore.ptr instead of ImagingCore.id #8341 [@homm]

Simplified code #8445 [@radarhere]

Removed unused code #8447 [@radarhere]

Updated EPS mode when opening images without transparency #8281 [@Yay295]

Use transparency when combining P frames from APNGs #8443 [@radarhere]

Generate and upload attestations to PyPI #8441 [@hugovk]

Do not convert images unnecessarily in ImageEnhance #8431 [@radarhere]

Raise an error if path is compacted during mapping #8416 [@radarhere]

Support all resampling filters when resizing I;16* images #8422 [@radarhere]

Free memory on early return #8413 [@radarhere]

Cast int before potentially exceeding INT_MAX #8402 [@radarhere]

Prevent division by zero #8408 [@radarhere]

Check image value before use #8400 [@radarhere]

Use ruff check #8423 [@radarhere]

Change harfbuzz versions in wheels #8421 [@radarhere]

Use Capsule for WebP saving #8386 [@homm]

Fixed writing multiple StripOffsets to TIFF #8317 [@Yay295]

Updated macOS deployment target for PyPy on Intel to 10.15 #8414 [@radarhere]

Fix dereference before checking for NULL in ImagingTransformAffine #8398 [@PavlNekrasov]

Use transposed size after opening for TIFF images #8390 [@radarhere]

Improve ImageFont error messages #8338 [@yngvem]

Mention MAX_TEXT_CHUNK limit in PNG error message #8391 [@radarhere]

Cast Dib handle to int #8385 [@radarhere]

Updated macOS deployment target for Python >= 3.12 on Intel to 10.13 #8379 [@radarhere]

Removed unused ImagePath variable #8377 [@radarhere]

Change macos-14 to macos-latest #8376 [@radarhere]

Accept float stroke widths #8369 [@radarhere]

Remove comments #8370 [@radarhere]

Removed libffi-dev #8368 [@radarhere]

Improved handling of RGBA palettes when saving GIF images #8366 [@radarhere]

Support converting more modes to LAB by converting to RGBA first #8358 [@radarhere]

Optimize getbbox() and getextrema() routines #8194 [@homm]

Removed unused TiffImagePlugin IFD_LEGACY_API #8355 [@radarhere]

Handle duplicate EXIF header #8350 [@zakajd]

Use (void) for empty function parameters #8002 [@Yay295]

Return early from BoxBlur if either width or height is zero #8347 [@radarhere]

... (truncated)

Changelog

Sourced from pillow's changelog.

11.0.0 (2024-10-15)

Update licence to MIT-CMU #8460 [hugovk]

Conditionally define ImageCms type hint to avoid requiring core #8197 [radarhere]

Support writing LONG8 offsets in AppendingTiffWriter #8417 [radarhere]

Use ImageFile.MAXBLOCK when saving TIFF images #8461 [radarhere]

Do not close provided file handles with libtiff when saving #8458 [radarhere]

Support ImageFilter.BuiltinFilter for I;16* images #8438 [radarhere]

Use ImagingCore.ptr instead of ImagingCore.id #8341 [homm, radarhere, hugovk]

Updated EPS mode when opening images without transparency #8281 [Yay295, radarhere]

Use transparency when combining P frames from APNGs #8443 [radarhere]

Support all resampling filters when resizing I;16* images #8422 [radarhere]

Free memory on early return #8413 [radarhere]

Cast int before potentially exceeding INT_MAX #8402 [radarhere]

Check image value before use #8400 [radarhere]

Improved copying imagequant libraries #8420 [radarhere]

Use Capsule for WebP saving #8386 [homm, radarhere]

Fixed writing multiple StripOffsets to TIFF #8317 [Yay295, radarhere]

... (truncated)

Commits

204aae6 11.0.0 version bump
f2cc87b Update CHANGES.rst [ci skip]
c855e8e Merge pull request #8464 from radarhere/imagemath_type_hint
dc37515 Merge pull request #8463 from hugovk/update-3.13-date
c3d81d6 Update Python 3.13 release date
a60610c Added type hints
a5c58f2 Merge pull request #8460 from hugovk/mit-cmu
e74994e Update licence to MIT-CMU
b5e1115 Update CHANGES.rst [ci skip]
686b5e2 Merge pull request #8392 from radarhere/tiff_seek
Additional commits viewable in compare view

Updates pyinstaller from 6.10.0 to 6.11.0

Release notes

Sourced from pyinstaller's releases.

v6.11.0

Please see the v6.11.0 section of the changelog for a list of the changes since v6.10.0.

Changelog

Sourced from pyinstaller's changelog.

6.11.0 (2024-10-15)

Features


* Implement a mechanism that allows hooks to inform PyInstaller's binary
  dependency analysis that it should not create symbolic links to top-level
  application directory for certain shared libraries (applicable to platforms
  where such symbolic links are created in the first place). This mechanism
  is intended as a work around for corner cases when such symbolic links
  disrupt run-time discovery of other shared libraries that are stored in
  the linked library's true location. (:issue:`8761`)
Bugfix

* (Windows) Allow PyInstaller to be launched from SYSTEM user's home
  directory (``%WINDIR%\system32\config\systemprofile``) and its
  sub-directories, as an exception to general prohibition of running
  from Windows directory and its sub-directories (which was introduced
  in :issue:`8570`). (:issue:`8816`)
* (Windows) Attempt to mitigate timing issues that prevented console
  hiding/minimization mechanism (:issue:`7735`) from taking effect when
  Windows Terminal is used as the default terminal app. (:issue:`8798`)
* (Windows) Fix binary dependency analysis for files found under
  SYSTEM user's home directory (``%WINDIR%\system32\config\systemprofile``)
  when running PyInstaller as SYSTEM user. (:issue:`8810`)
* (Windows) Fix regression with PyInstaller 6.x and ``numpy`` &lt; 1.26
  that resulted in duplicated shared libraries bundled with ``numpy``
  PyPI wheels. (:issue:`8736`)
* (Windows) Fix the leak of ``VCRUNTIME140.dll`` in ``onefile`` applications
  with splash screen enabled, this time in scenarios with full application
  restart (regression introduced by :issue:`8650`). (:issue:`8701`)
* Fix a regression when trying to use ``runpy.run_path`` to run a python
  script bundled with the frozen application. (:issue:`8767`)
Hooks

* Add hook for ``PySide6.QtGraphsWidgets``, which was introduced with
  ``PySide6`` v6.8.0. (:issue:`8828`)
* Tweak the ``setuptools`` hook to minimize collection of vendored
  packages/modules and their (meta)data when using ``setuptools`` &amp;gt;= 71.0;
  the aim is to have the run-time behavior of collected vendored package
  closely match the behavior of its non-vendored counterpart. (:issue:`8737`)
* Update ``babel`` hook to collect all submodules that are needed to
  unpickle the bundled locale data files. (:issue:`8750`)
&amp;lt;/tr&amp;gt;&amp;lt;/table&amp;gt; 
&lt;/code&gt;&lt;/pre&gt;
&lt;/blockquote&gt;
&lt;p&gt;... (truncated)&lt;/p&gt;
&lt;/details&gt;
&lt;details&gt;
&lt;summary&gt;Commits&lt;/summary&gt;

&lt;ul&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/pyinstaller/pyinstaller/commit/2996af6ba7615b2b5b822252b51e4d39d1c76f2e&quot;&gt;&lt;code&gt;2996af6&lt;/code&gt;&lt;/a&gt; Release v2024.8. [skip ci]&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/pyinstaller/pyinstaller/commit/a52f9b60ec8a21ffb1066b347a1e4b893c98ddd6&quot;&gt;&lt;code&gt;a52f9b6&lt;/code&gt;&lt;/a&gt; tests: have signal-forward/ignore test use a single program build&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/pyinstaller/pyinstaller/commit/71abbcc91992e97fed859504e7fd57d286fd630a&quot;&gt;&lt;code&gt;71abbcc&lt;/code&gt;&lt;/a&gt; tests: rewrite the onefile signal-forward/ignore test&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/pyinstaller/pyinstaller/commit/67157e4aac509b801f4896eb982b9a2361a488a5&quot;&gt;&lt;code&gt;67157e4&lt;/code&gt;&lt;/a&gt; Tests: Requirements: Scheduled weekly dependency update for week 41 (&lt;a href=&quot;https://github.com/pyinstaller/pyinstaller/issues/8827&quot;&gt;#8827&lt;/a&gt;)&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/pyinstaller/pyinstaller/commit/b346ec3c5983ad068c1a994bc9f2d4893b7235a3&quot;&gt;&lt;code&gt;b346ec3&lt;/code&gt;&lt;/a&gt; hooks: add hook for PySide6.QtGraphsWidgets&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/pyinstaller/pyinstaller/commit/9c2bba57bfbd97268f1023ffc394eb6b261c4cf8&quot;&gt;&lt;code&gt;9c2bba5&lt;/code&gt;&lt;/a&gt; setup: Fix too-soon check for available bootloaders&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/pyinstaller/pyinstaller/commit/2ebca31568e4d84371845a9358245aa4b2de0337&quot;&gt;&lt;code&gt;2ebca31&lt;/code&gt;&lt;/a&gt; ci: split macOS test workflows between macos-13 and macos-14 runners&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/pyinstaller/pyinstaller/commit/fcc9526cd77735ba70ecb4d10639f10d20c1f407&quot;&gt;&lt;code&gt;fcc9526&lt;/code&gt;&lt;/a&gt; tests: apple events: use UUID for unique URL scheme and file extension&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/pyinstaller/pyinstaller/commit/1d7fcb32959ae76112456c78ca9a460da47a554f&quot;&gt;&lt;code&gt;1d7fcb3&lt;/code&gt;&lt;/a&gt; tests: apple events: fix path to Carbon.framework&lt;/li&gt;
&lt;li&gt;&lt;a href=&quot;https://github.com/pyinstaller/pyinstaller/commit/d5f56ba37291add6139f624cdf1ca3c97be86cd7&quot;&gt;&lt;code&gt;d5f56ba&lt;/code&gt;&lt;/a&gt; tests: remove keyring pin for old python + macOS combination&lt;/li&gt;
&lt;li&gt;Additional commits viewable in &lt;a href=&quot;https://github.com/pyinstaller/pyinstaller/compare/v6.10.0...v6.11.0&quot;&gt;compare view&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;
&lt;/details&gt;

&lt;br /&gt;
</code></pre>

Updates `pyinstaller-hooks-contrib` from 2024.8 to 2024.9
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/releases">pyinstaller-hooks-contrib's releases</a>.</em></p>
<blockquote>
<h2>v2024.9</h2>
<p>Please see the <a href="https://www.github.com/pyinstaller/pyinstaller-hooks-contrib/tree/v2024.9/CHANGELOG.rst">changelog</a> for more details</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/blob/master/CHANGELOG.rst">pyinstaller-hooks-contrib's changelog</a>.</em></p>
<blockquote>
<h2>2024.9 (2024-10-15)</h2>
<p>New hooks</p>
<pre><code>
* Add a hook for comtypes to ensure compatibility with comtypes &gt;= 1.4.5.
  (`[#807](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/807)
  &lt;https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/807&gt;`_)
* Add analysis hook for ``slixmpp`` library (`[#784](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/784)
  &lt;https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/784&gt;`_)
* Add hook for ``capstone`` package. (`[#787](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/787)
  &lt;https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/787&gt;`_)
* Add hook for ``grapheme`` to collect its data files. (`[#793](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/793)
  &lt;https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/793&gt;`_)
* Add hook for ``onnxruntime`` to ensure that provider plugins are
  collected. (`[#817](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/817)
  &lt;https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/817&gt;`_)
* Add hook for ``saml2`` package which has XSD files and hidden imports. (`[#798](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/798)
  &lt;https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/798&gt;`_)
* Add hook for ``setuptools_scm`` that collects metadata of ``setuptools``
  dist in order to avoid run-time warning about unknown/incompatible
  ``setuptools`` version. (`[#805](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/805)
  &lt;https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/805&gt;`_)
* Add hook for ``ultralytics`` package. (`[#786](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/786)
  &lt;https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/786&gt;`_)
* Add hook for ``xmlschema`` package which has XSD files. (`[#797](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/797)
  &lt;https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/797&gt;`_)
* Add hook for ``yapf_third_party`` (part of ``yapf``) to collect its
  data files. (`[#792](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/792)
  &lt;https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/792&gt;`_)
* Add hooks for ``toga`` widget toolkit and its backends. (`[#804](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/804)
  &lt;https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/804&gt;`_)
* Add run-time hook for ``findlibs`` that overrides the ``findlibs.find``
  function with custom implementation in order to ensure that the top-level
  application directory is searched first. This prevents a system-wide
  copy of the library being found and loaded instead of the bundled copy
  when the system-wide copy happens to be available in one of fixed
  locations that is scanned by the original implementation of ``findlibs.find``
  (for example, Homebrew directory on macOS). (`[#799](https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/799)
  &lt;https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/799&gt;`_)
<p>Updated hooks
</code></pre></p>
<ul>
<li>(Linux) Update <code>tensorflow</code> hook to suppress creation of symbolic links
to the top-level application directory for the following shared libraries
discovered during binary dependency analysis: <code>libtensorflow_cc.so.2</code>,
<code>libtensorflow_framework.so.2</code>, and <code>_pywrap_tensorflow_internal.so</code>.</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/commit/5bcaf52e302d2adeaf4457c435ffa07f5b4b1f53"><code>5bcaf52</code></a> Release v2024.9</li>
<li><a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/commit/5177ccbe491dc8d38ebddf01031ae192d11862e4"><code>5177ccb</code></a> Scheduled weekly dependency update for week 41 (<a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/816">#816</a>)</li>
<li><a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/commit/bf3d57233f2af4823e438c491d908e293228a630"><code>bf3d572</code></a> hooks: add hook for onnxruntime</li>
<li><a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/commit/f9f6e7e7a25b694fd033ca8c637907518b186dc9"><code>f9f6e7e</code></a> ci: use python from actions/setup-python</li>
<li><a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/commit/85984500f39319103f363f19d67202cb44443204"><code>8598450</code></a> hooks: update av hook for compatibility with av 13.1.0</li>
<li><a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/commit/374fb3100ab2d64472f64dcce964e56530573404"><code>374fb31</code></a> Scheduled weekly dependency update for week 40, part 2 (<a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/815">#815</a>)</li>
<li><a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/commit/f33229b50dd6ad7699d1084495efc54fa1519d38"><code>f33229b</code></a> Scheduled weekly dependency update for week 40 (<a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/813">#813</a>)</li>
<li><a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/commit/aad8cadb261208ca462a87159d0f8a498f0081cc"><code>aad8cad</code></a> Scheduled weekly dependency update for week 39, part 2 (<a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/812">#812</a>)</li>
<li><a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/commit/463bf72b24ef83a6a4cf92fcc5a74018c6b29677"><code>463bf72</code></a> Scheduled weekly dependency update for week 39 (<a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/issues/811">#811</a>)</li>
<li><a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/commit/d53616c1e207903a7ce86bed1460dd3747f4a0ca"><code>d53616c</code></a> Add hiddenimports for comtypes.client</li>
<li>Additional commits viewable in <a href="https://github.com/pyinstaller/pyinstaller-hooks-contrib/compare/v2024.8...v2024.9">compare view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions


</details>

Bumps the general group with 3 updates: [pillow](https://github.com/python-pillow/Pillow), [pyinstaller](https://github.com/pyinstaller/pyinstaller) and [pyinstaller-hooks-contrib](https://github.com/pyinstaller/pyinstaller-hooks-contrib). Updates `pillow` from 10.4.0 to 11.0.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@10.4.0...11.0.0) Updates `pyinstaller` from 6.10.0 to 6.11.0 - [Release notes](https://github.com/pyinstaller/pyinstaller/releases) - [Changelog](https://github.com/pyinstaller/pyinstaller/blob/develop/doc/CHANGES.rst) - [Commits](pyinstaller/pyinstaller@v6.10.0...v6.11.0) Updates `pyinstaller-hooks-contrib` from 2024.8 to 2024.9 - [Release notes](https://github.com/pyinstaller/pyinstaller-hooks-contrib/releases) - [Changelog](https://github.com/pyinstaller/pyinstaller-hooks-contrib/blob/master/CHANGELOG.rst) - [Commits](pyinstaller/pyinstaller-hooks-contrib@v2024.8...v2024.9) --- updated-dependencies: - dependency-name: pillow dependency-type: direct:production update-type: version-update:semver-major dependency-group: general - dependency-name: pyinstaller dependency-type: direct:production update-type: version-update:semver-minor dependency-group: general - dependency-name: pyinstaller-hooks-contrib dependency-type: direct:production update-type: version-update:semver-minor dependency-group: general ... Signed-off-by: dependabot[bot] <support@github.com>

github-actions · 2024-10-15T22:56:22Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
✅ 0 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
⚠️ 3 package(s) with unknown licenses.

See the Details below.

License Issues

requirements.txt

Package	Version	License	Issue Type
pillow	11.0.0	Null	Unknown License
pyinstaller	6.11.0	Null	Unknown License
pyinstaller-hooks-contrib	2024.9	Null	Unknown License

OpenSSF Scorecard

Package

Version

Score

Details

pip/pillow

11.0.0

🟢 7.5

Details

Check	Score	Reason
Code-Review	🟢 8	Found 14/17 approved changesets -- score normalized to 8
Maintained	🟢 10	30 commit(s) and 27 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 2	badge detected: InProgress
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Branch-Protection	⚠️ 0	branch protection not enabled on development/release branches
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	🟢 10	GitHub workflow tokens follow principle of least privilege
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	🟢 10	project is fuzzed
Packaging	🟢 10	packaging workflow detected
Vulnerabilities	🟢 10	0 existing vulnerabilities detected
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0

pip/pyinstaller

6.11.0

🟢 5.5

Details

Check	Score	Reason
Code-Review	🟢 10	all changesets reviewed
Maintained	🟢 10	30 commit(s) and 26 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Security-Policy	🟢 10	security policy file detected
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Packaging	⚠️ -1	packaging workflow not detected
Binary-Artifacts	⚠️ 0	binaries present in source code
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Vulnerabilities	🟢 10	0 existing vulnerabilities detected

pip/pyinstaller-hooks-contrib

2024.9

🟢 5.7

Details

Check	Score	Reason
Code-Review	🟢 9	Found 22/24 approved changesets -- score normalized to 9
Maintained	🟢 10	30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Signed-Releases	⚠️ -1	no releases found
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Packaging	⚠️ -1	packaging workflow not detected
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
Security-Policy	⚠️ 0	security policy file not detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Fuzzing	⚠️ 0	project is not fuzzed
Pinned-Dependencies	⚠️ 0	dependency not pinned by hash detected -- score normalized to 0
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0
Vulnerabilities	🟢 10	0 existing vulnerabilities detected

Scanned Manifest Files

requirements.txt

pillow@11.0.0
pyinstaller@6.11.0
pyinstaller-hooks-contrib@2024.9
pillow@10.4.0
pyinstaller@6.10.0
pyinstaller-hooks-contrib@2024.8

sonarcloud · 2024-10-15T22:56:47Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Oct 15, 2024

Nick2bad4u merged commit f41a011 into main Oct 16, 2024
46 checks passed

dependabot bot deleted the dependabot/pip/general-d3037a0607 branch October 16, 2024 00:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the general group with 3 updates #230

build(deps): bump the general group with 3 updates #230

dependabot bot commented on behalf of github Oct 15, 2024

github-actions bot commented Oct 15, 2024

sonarcloud bot commented Oct 15, 2024

build(deps): bump the general group with 3 updates #230

build(deps): bump the general group with 3 updates #230

Conversation

dependabot bot commented on behalf of github Oct 15, 2024

11.0.0

Changes

11.0.0 (2024-10-15)

v6.11.0

6.11.0 (2024-10-15)

github-actions bot commented Oct 15, 2024

Dependency Review

License Issues

requirements.txt

OpenSSF Scorecard

Scanned Manifest Files

sonarcloud bot commented Oct 15, 2024

Quality Gate passed