Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pip exception parsing last_check datetime #12338

Closed
1 task done
belm0 opened this issue Oct 11, 2023 · 12 comments
Closed
1 task done

pip exception parsing last_check datetime #12338

belm0 opened this issue Oct 11, 2023 · 12 comments
Labels
S: needs triage Issues/PRs that need to be triaged type: bug A confirmed bug or unintended behavior
Milestone

Comments

@belm0
Copy link

belm0 commented Oct 11, 2023

Description

pip wheel fails when parsing last_check due to lack of Z suffix support by datetime.fromisoformat().

It looks like the fromisoformat() call was added recently, and indeed there was concern in the PR about handling Z. @pfmoore @pgan

Expected behavior

pip install does not having an error parsing last_check

pip version

23.3.dev0

Python version

3.8

OS

linux

How to Reproduce

  1. git clone https://github.com/pypa/pip.git
  2. cd pip
  3. python3.8 -m venv venv
  4. source venv/bin/activate
  5. pip install -e .
  6. pip wheel -vv scipy==1.10.1

Output

WARNING: There was an error checking the latest version of pip.
See below for error
Traceback (most recent call last):
  File "/Users/john/tmp/pip/src/pip/_internal/self_outdated_check.py", line 227, in pip_self_version_check
    upgrade_prompt = _self_version_check_logic(
  File "/Users/john/tmp/pip/src/pip/_internal/self_outdated_check.py", line 188, in _self_version_check_logic
    remote_version_str = state.get(current_time)
  File "/Users/john/tmp/pip/src/pip/_internal/self_outdated_check.py", line 76, in get
    last_check = datetime.datetime.fromisoformat(self._state["last_check"])
ValueError: Invalid isoformat string: '2023-10-11T17:07:57Z'

(aside: an error should be logged as ERROR, not WARNING)

Code of Conduct

@belm0 belm0 added S: needs triage Issues/PRs that need to be triaged type: bug A confirmed bug or unintended behavior labels Oct 11, 2023
@belm0
Copy link
Author

belm0 commented Oct 11, 2023

my workaround

last_check = datetime.datetime.fromisoformat(self._state["last_check"].replace('Z', '+00:00'))

@pfmoore
Copy link
Member

pfmoore commented Oct 16, 2023

@pganssle any thoughts?

@pganssle
Copy link
Member

The problem to me seems to be that somehow this is bubbling up to become a user-visible exception? In the original PR, it seems I was under the impression that if it failed to parse the old state file, it would raise a warning to that effect but otherwise it wouldn't effect anything (I don't remember what these state files do, but I'm guessing they are some kind of cache, and this was just going to cause one cache miss the first time you run pip after upgrading from the version without .isoformat() to the version with .isoformat(), which seems like a very small cost to pay in exchange for not indefinitely keeping around code to parse both formats.

It seemed like we all agreed that that was the case before the merge, so why is the assumption invalid? Is it that pip wheel isn't properly catching errors somewhere?

@sbidoul sbidoul added this to the 23.3 milestone Oct 16, 2023
@sbidoul
Copy link
Member

sbidoul commented Oct 16, 2023

@pganssle per #12357 it seems the problem surfaces as a warning. So I understand it is not blocking but noisy. Handling parse errors as suggested in #12006 (comment) sounds like a an easy solution (I've not investigated in detail).

@belm0
Copy link
Author

belm0 commented Oct 16, 2023

it seems the problem surfaces as a warning. So I understand it is not blocking but noisy.

It's an exception that stops the build. See repro steps where pip wheel ... fails.

@sbidoul
Copy link
Member

sbidoul commented Oct 16, 2023

Ah, ok, thanks @belm0. Then we'll need a patch release.

@pganssle
Copy link
Member

If it's an exception, I think the issue is that you are not catching it, because it's supposed to be a warning.

If it's a warning, then I don't have any strong opinion about this. If you consider it valuable information for users to have that the state information is being discarded because it was created with a version of pip that is too old, then I would say keep warning about it, otherwise just silently swallow the parse error and consider it a cache miss or whatever.

@notatallshaw
Copy link
Member

notatallshaw commented Oct 16, 2023

Also I'm fairly sure that a secondary issue with the current state, is users needing to downgrade Pip are stuck figuring out how to delete this version cache, with it probably not being obvious to most users that would fix it.

Today I upgraded Pip in my work environment, discovered an error, and needed to downgrade Pip to understand if Pip was the issue or not. Then I got the error message about Pip not being able to check for new versions.

Would this not also affect pip wheel?

@pfmoore
Copy link
Member

pfmoore commented Oct 16, 2023

I think that this comment where I said "So we can simply return None (saying that we need to refresh the state) if we hit a parse error" was never addressed, because it looks like we never did change the code to return None in that case.

Although honestly, I don't see why we shouldn't replace Z with +00:00 as suggested above. That seems perfectly reasonable to me.

hswong3i added a commit to alvistack/pypa-pip that referenced this issue Oct 17, 2023
    git clean -xdf
    tar zcvf ../python-pip_23.3.orig.tar.gz --exclude=.git .
    debuild -uc -us
    cp python-pip.spec ../python-pip_23.3-1.spec
    mv ../python*-pip*23.3*.{gz,xz,spec,dsc} /osc/home\:alvistack/pypa-pip-23.3/
    rm -rf ../python*-pip_23.3*.*

See pypa#12338 (comment)

Signed-off-by: Wong Hoi Sing Edison <hswong3i@pantarei-design.com>
@pradyunsg
Copy link
Member

I'd be happy to review a PR for either of those changes (from another maintainer or a contributor) -- I personally won't have the bandwidth to make the PR for this, for some time.

@pfmoore
Copy link
Member

pfmoore commented Oct 17, 2023

I've created #12363. I don't have the time to make a test for this. If someone wants to include a test, they'll have to write one themselves, I'm afraid. I do sort of think it needs a test, but as I say, I don't have the time right now.

@sbidoul sbidoul closed this as completed Oct 19, 2023
@sbidoul
Copy link
Member

sbidoul commented Oct 21, 2023

pip 23.3.1 has been released with the fix for this.

kai687 pushed a commit to kai687/sphinxawesome-theme that referenced this issue Oct 22, 2023
Bumps [pip](https://github.com/pypa/pip) from 23.2.1 to 23.3.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's
changelog</a>.</em></p>
<blockquote>
<h1>23.3.1 (2023-10-21)</h1>
<h2>Bug Fixes</h2>
<ul>
<li>Handle a timezone indicator of Z when parsing dates in the self
check. (<code>[#12338](pypa/pip#12338)
&lt;https://github.com/pypa/pip/issues/12338&gt;</code>_)</li>
<li>Fix bug where installing the same package at the same time with
multiple pip processes could fail.
(<code>[#12361](pypa/pip#12361)
&lt;https://github.com/pypa/pip/issues/12361&gt;</code>_)</li>
</ul>
<h1>23.3 (2023-10-15)</h1>
<h2>Process</h2>
<ul>
<li>Added reference to <code>vulnerability reporting guidelines
&lt;https://www.python.org/dev/security/&gt;</code>_ to pip's security
policy.</li>
</ul>
<h2>Deprecations and Removals</h2>
<ul>
<li>Drop a fallback to using SecureTransport on macOS. It was useful
when pip detected OpenSSL older than 1.0.1, but the current pip does not
support any Python version supporting such old OpenSSL versions.
(<code>[#12175](pypa/pip#12175)
&lt;https://github.com/pypa/pip/issues/12175&gt;</code>_)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Improve extras resolution for multiple constraints on same base
package. (<code>[#11924](pypa/pip#11924)
&lt;https://github.com/pypa/pip/issues/11924&gt;</code>_)</li>
<li>Improve use of datastructures to make candidate selection 1.6x
faster. (<code>[#12204](pypa/pip#12204)
&lt;https://github.com/pypa/pip/issues/12204&gt;</code>_)</li>
<li>Allow <code>pip install --dry-run</code> to use platform and ABI
overriding options.
(<code>[#12215](pypa/pip#12215)
&lt;https://github.com/pypa/pip/issues/12215&gt;</code>_)</li>
<li>Add <code>is_yanked</code> boolean entry to the installation report
(<code>--report</code>) to indicate whether the requirement was yanked
from the index, but was still selected by pip conform to
:pep:<code>592</code>.
(<code>[#12224](pypa/pip#12224)
&lt;https://github.com/pypa/pip/issues/12224&gt;</code>_)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li>Ignore errors in temporary directory cleanup (show a warning
instead). (<code>[#11394](pypa/pip#11394)
&lt;https://github.com/pypa/pip/issues/11394&gt;</code>_)</li>
<li>Normalize extras according to :pep:<code>685</code> from package
metadata in the resolver
for comparison. This ensures extras are correctly compared and merged as
long
as the package providing the extra(s) is built with values normalized
according
to the standard. Note, however, that this <em>does not</em> solve cases
where the
package itself contains unnormalized extra values in the metadata.
(<code>[#11649](pypa/pip#11649)
&lt;https://github.com/pypa/pip/issues/11649&gt;</code>_)</li>
<li>Prevent downloading sdists twice when :pep:<code>658</code> metadata
is present. (<code>[#11847](pypa/pip#11847)
&lt;https://github.com/pypa/pip/issues/11847&gt;</code>_)</li>
<li>Include all requested extras in the install report
(<code>--report</code>).
(<code>[#11924](pypa/pip#11924)
&lt;https://github.com/pypa/pip/issues/11924&gt;</code>_)</li>
<li>Removed uses of <code>datetime.datetime.utcnow</code> from
non-vendored code.
(<code>[#12005](pypa/pip#12005)
&lt;https://github.com/pypa/pip/issues/12005&gt;</code>_)</li>
<li>Consistently report whether a dependency comes from an extra.
(<code>[#12095](pypa/pip#12095)
&lt;https://github.com/pypa/pip/issues/12095&gt;</code>_)</li>
<li>Fix completion script for zsh
(<code>[#12166](pypa/pip#12166)
&lt;https://github.com/pypa/pip/issues/12166&gt;</code>_)</li>
<li>Fix improper handling of the new onexc argument of
<code>shutil.rmtree()</code> in Python 3.12.
(<code>[#12187](pypa/pip#12187)
&lt;https://github.com/pypa/pip/issues/12187&gt;</code>_)</li>
<li>Filter out yanked links from the available versions error message:
&quot;(from versions: 1.0, 2.0, 3.0)&quot; will not contain yanked
versions conform PEP 592. The yanked versions (if any) will be mentioned
in a separate error message.
(<code>[#12225](pypa/pip#12225)
&lt;https://github.com/pypa/pip/issues/12225&gt;</code>_)</li>
<li>Fix crash when the git version number contains something else than
digits and dots.
(<code>[#12280](pypa/pip#12280)
&lt;https://github.com/pypa/pip/issues/12280&gt;</code>_)</li>
<li>Use <code>-r=...</code> instead of <code>-r ...</code> to specify
references with Mercurial.
(<code>[#12306](pypa/pip#12306)
&lt;https://github.com/pypa/pip/issues/12306&gt;</code>_)</li>
<li>Redact password from URLs in some additional places.
(<code>[#12350](pypa/pip#12350)
&lt;https://github.com/pypa/pip/issues/12350&gt;</code>_)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/pip/commit/5364f26f9631dc07ed1bdfc88e1bec1bead2bce3"><code>5364f26</code></a>
Bump for release</li>
<li><a
href="https://github.com/pypa/pip/commit/5e7cc16c3b4442055a4a9892e9231758b6714e28"><code>5e7cc16</code></a>
Fix parallel pip cache downloads causing crash (<a
href="https://github.com/pypa/pip/issues/12364">#12364</a>)</li>
<li><a
href="https://github.com/pypa/pip/commit/8a0f77c171d60344e6a3bf6e95ad5740c21575fd"><code>8a0f77c</code></a>
Merge pull request <a
href="https://github.com/pypa/pip/issues/12355">#12355</a> from
sbidoul/build-using-build</li>
<li><a
href="https://github.com/pypa/pip/commit/f3620cdb5be06cee223a3606a1525ee45372085b"><code>f3620cd</code></a>
Merge pull request <a
href="https://github.com/pypa/pip/issues/12363">#12363</a> from
pfmoore/safe_isoformat</li>
<li><a
href="https://github.com/pypa/pip/commit/fb06d12d5a32581ae531fc26143c14ac6c8ea8fe"><code>fb06d12</code></a>
Handle ISO formats with a trailing Z</li>
<li><a
href="https://github.com/pypa/pip/commit/9f213bf69ac32c60c84055261c862ff169389e43"><code>9f213bf</code></a>
Merge pull request <a
href="https://github.com/pypa/pip/issues/12356">#12356</a> from
sbidoul/clarify-changelog</li>
<li><a
href="https://github.com/pypa/pip/commit/a982c7bc3550afb27a3a792d84fe91bf7c3254ca"><code>a982c7b</code></a>
Add a few PEP links in the changelog</li>
<li><a
href="https://github.com/pypa/pip/commit/e1e227d7d6b5ae04ae3a2104bf8185622201f5f6"><code>e1e227d</code></a>
Clarify changelog</li>
<li><a
href="https://github.com/pypa/pip/commit/9b0abc8c40459dd16a9c1205e15f6d3363bf202e"><code>9b0abc8</code></a>
Build using <code>build</code></li>
<li><a
href="https://github.com/pypa/pip/commit/9d4be7802f45790bdb994f943c8d8731927cf25c"><code>9d4be78</code></a>
Merge pull request <a
href="https://github.com/pypa/pip/issues/12353">#12353</a> from
sbidoul/release/23.3</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/pip/compare/23.2.1...23.3.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pip&package-manager=pip&previous-version=23.2.1&new-version=23.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
inmantaci pushed a commit to inmanta/inmanta-core that referenced this issue Oct 23, 2023
Bumps [pip](https://github.com/pypa/pip) from 23.3 to 23.3.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's changelog</a>.</em></p>
<blockquote>
<h1>23.3.1 (2023-10-21)</h1>
<h2>Bug Fixes</h2>
<ul>
<li>Handle a timezone indicator of Z when parsing dates in the self check. (<code>[#12338](pypa/pip#12338) &lt;https://github.com/pypa/pip/issues/12338&gt;</code>_)</li>
<li>Fix bug where installing the same package at the same time with multiple pip processes could fail. (<code>[#12361](pypa/pip#12361) &lt;https://github.com/pypa/pip/issues/12361&gt;</code>_)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pypa/pip/commit/5364f26f9631dc07ed1bdfc88e1bec1bead2bce3"><code>5364f26</code></a> Bump for release</li>
<li><a href="https://github.com/pypa/pip/commit/5e7cc16c3b4442055a4a9892e9231758b6714e28"><code>5e7cc16</code></a> Fix parallel pip cache downloads causing crash (<a href="https://github.com/pypa/pip/issues/12364">#12364</a>)</li>
<li><a href="https://github.com/pypa/pip/commit/8a0f77c171d60344e6a3bf6e95ad5740c21575fd"><code>8a0f77c</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12355">#12355</a> from sbidoul/build-using-build</li>
<li><a href="https://github.com/pypa/pip/commit/f3620cdb5be06cee223a3606a1525ee45372085b"><code>f3620cd</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12363">#12363</a> from pfmoore/safe_isoformat</li>
<li><a href="https://github.com/pypa/pip/commit/fb06d12d5a32581ae531fc26143c14ac6c8ea8fe"><code>fb06d12</code></a> Handle ISO formats with a trailing Z</li>
<li><a href="https://github.com/pypa/pip/commit/9f213bf69ac32c60c84055261c862ff169389e43"><code>9f213bf</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12356">#12356</a> from sbidoul/clarify-changelog</li>
<li><a href="https://github.com/pypa/pip/commit/a982c7bc3550afb27a3a792d84fe91bf7c3254ca"><code>a982c7b</code></a> Add a few PEP links in the changelog</li>
<li><a href="https://github.com/pypa/pip/commit/e1e227d7d6b5ae04ae3a2104bf8185622201f5f6"><code>e1e227d</code></a> Clarify changelog</li>
<li><a href="https://github.com/pypa/pip/commit/9b0abc8c40459dd16a9c1205e15f6d3363bf202e"><code>9b0abc8</code></a> Build using <code>build</code></li>
<li><a href="https://github.com/pypa/pip/commit/9d4be7802f45790bdb994f943c8d8731927cf25c"><code>9d4be78</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12353">#12353</a> from sbidoul/release/23.3</li>
<li>Additional commits viewable in <a href="https://github.com/pypa/pip/compare/23.3...23.3.1">compare view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pip&package-manager=pip&previous-version=23.3&new-version=23.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

</details>
inmantaci pushed a commit to inmanta/inmanta-core that referenced this issue Oct 23, 2023
Bumps [pip](https://github.com/pypa/pip) from 23.3 to 23.3.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's changelog</a>.</em></p>
<blockquote>
<h1>23.3.1 (2023-10-21)</h1>
<h2>Bug Fixes</h2>
<ul>
<li>Handle a timezone indicator of Z when parsing dates in the self check. (<code>[#12338](pypa/pip#12338) &lt;https://github.com/pypa/pip/issues/12338&gt;</code>_)</li>
<li>Fix bug where installing the same package at the same time with multiple pip processes could fail. (<code>[#12361](pypa/pip#12361) &lt;https://github.com/pypa/pip/issues/12361&gt;</code>_)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pypa/pip/commit/5364f26f9631dc07ed1bdfc88e1bec1bead2bce3"><code>5364f26</code></a> Bump for release</li>
<li><a href="https://github.com/pypa/pip/commit/5e7cc16c3b4442055a4a9892e9231758b6714e28"><code>5e7cc16</code></a> Fix parallel pip cache downloads causing crash (<a href="https://github.com/pypa/pip/issues/12364">#12364</a>)</li>
<li><a href="https://github.com/pypa/pip/commit/8a0f77c171d60344e6a3bf6e95ad5740c21575fd"><code>8a0f77c</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12355">#12355</a> from sbidoul/build-using-build</li>
<li><a href="https://github.com/pypa/pip/commit/f3620cdb5be06cee223a3606a1525ee45372085b"><code>f3620cd</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12363">#12363</a> from pfmoore/safe_isoformat</li>
<li><a href="https://github.com/pypa/pip/commit/fb06d12d5a32581ae531fc26143c14ac6c8ea8fe"><code>fb06d12</code></a> Handle ISO formats with a trailing Z</li>
<li><a href="https://github.com/pypa/pip/commit/9f213bf69ac32c60c84055261c862ff169389e43"><code>9f213bf</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12356">#12356</a> from sbidoul/clarify-changelog</li>
<li><a href="https://github.com/pypa/pip/commit/a982c7bc3550afb27a3a792d84fe91bf7c3254ca"><code>a982c7b</code></a> Add a few PEP links in the changelog</li>
<li><a href="https://github.com/pypa/pip/commit/e1e227d7d6b5ae04ae3a2104bf8185622201f5f6"><code>e1e227d</code></a> Clarify changelog</li>
<li><a href="https://github.com/pypa/pip/commit/9b0abc8c40459dd16a9c1205e15f6d3363bf202e"><code>9b0abc8</code></a> Build using <code>build</code></li>
<li><a href="https://github.com/pypa/pip/commit/9d4be7802f45790bdb994f943c8d8731927cf25c"><code>9d4be78</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12353">#12353</a> from sbidoul/release/23.3</li>
<li>Additional commits viewable in <a href="https://github.com/pypa/pip/compare/23.3...23.3.1">compare view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pip&package-manager=pip&previous-version=23.3&new-version=23.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

</details>
kai687 pushed a commit to kai687/sphinxawesome-theme that referenced this issue Nov 5, 2023
Bumps [pip](https://github.com/pypa/pip) from 23.2.1 to 23.3.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's
changelog</a>.</em></p>
<blockquote>
<h1>23.3.1 (2023-10-21)</h1>
<h2>Bug Fixes</h2>
<ul>
<li>Handle a timezone indicator of Z when parsing dates in the self
check. (<code>[#12338](pypa/pip#12338)
&lt;https://github.com/pypa/pip/issues/12338&gt;</code>_)</li>
<li>Fix bug where installing the same package at the same time with
multiple pip processes could fail.
(<code>[#12361](pypa/pip#12361)
&lt;https://github.com/pypa/pip/issues/12361&gt;</code>_)</li>
</ul>
<h1>23.3 (2023-10-15)</h1>
<h2>Process</h2>
<ul>
<li>Added reference to <code>vulnerability reporting guidelines
&lt;https://www.python.org/dev/security/&gt;</code>_ to pip's security
policy.</li>
</ul>
<h2>Deprecations and Removals</h2>
<ul>
<li>Drop a fallback to using SecureTransport on macOS. It was useful
when pip detected OpenSSL older than 1.0.1, but the current pip does not
support any Python version supporting such old OpenSSL versions.
(<code>[#12175](pypa/pip#12175)
&lt;https://github.com/pypa/pip/issues/12175&gt;</code>_)</li>
</ul>
<h2>Features</h2>
<ul>
<li>Improve extras resolution for multiple constraints on same base
package. (<code>[#11924](pypa/pip#11924)
&lt;https://github.com/pypa/pip/issues/11924&gt;</code>_)</li>
<li>Improve use of datastructures to make candidate selection 1.6x
faster. (<code>[#12204](pypa/pip#12204)
&lt;https://github.com/pypa/pip/issues/12204&gt;</code>_)</li>
<li>Allow <code>pip install --dry-run</code> to use platform and ABI
overriding options.
(<code>[#12215](pypa/pip#12215)
&lt;https://github.com/pypa/pip/issues/12215&gt;</code>_)</li>
<li>Add <code>is_yanked</code> boolean entry to the installation report
(<code>--report</code>) to indicate whether the requirement was yanked
from the index, but was still selected by pip conform to
:pep:<code>592</code>.
(<code>[#12224](pypa/pip#12224)
&lt;https://github.com/pypa/pip/issues/12224&gt;</code>_)</li>
</ul>
<h2>Bug Fixes</h2>
<ul>
<li>Ignore errors in temporary directory cleanup (show a warning
instead). (<code>[#11394](pypa/pip#11394)
&lt;https://github.com/pypa/pip/issues/11394&gt;</code>_)</li>
<li>Normalize extras according to :pep:<code>685</code> from package
metadata in the resolver
for comparison. This ensures extras are correctly compared and merged as
long
as the package providing the extra(s) is built with values normalized
according
to the standard. Note, however, that this <em>does not</em> solve cases
where the
package itself contains unnormalized extra values in the metadata.
(<code>[#11649](pypa/pip#11649)
&lt;https://github.com/pypa/pip/issues/11649&gt;</code>_)</li>
<li>Prevent downloading sdists twice when :pep:<code>658</code> metadata
is present. (<code>[#11847](pypa/pip#11847)
&lt;https://github.com/pypa/pip/issues/11847&gt;</code>_)</li>
<li>Include all requested extras in the install report
(<code>--report</code>).
(<code>[#11924](pypa/pip#11924)
&lt;https://github.com/pypa/pip/issues/11924&gt;</code>_)</li>
<li>Removed uses of <code>datetime.datetime.utcnow</code> from
non-vendored code.
(<code>[#12005](pypa/pip#12005)
&lt;https://github.com/pypa/pip/issues/12005&gt;</code>_)</li>
<li>Consistently report whether a dependency comes from an extra.
(<code>[#12095](pypa/pip#12095)
&lt;https://github.com/pypa/pip/issues/12095&gt;</code>_)</li>
<li>Fix completion script for zsh
(<code>[#12166](pypa/pip#12166)
&lt;https://github.com/pypa/pip/issues/12166&gt;</code>_)</li>
<li>Fix improper handling of the new onexc argument of
<code>shutil.rmtree()</code> in Python 3.12.
(<code>[#12187](pypa/pip#12187)
&lt;https://github.com/pypa/pip/issues/12187&gt;</code>_)</li>
<li>Filter out yanked links from the available versions error message:
&quot;(from versions: 1.0, 2.0, 3.0)&quot; will not contain yanked
versions conform PEP 592. The yanked versions (if any) will be mentioned
in a separate error message.
(<code>[#12225](pypa/pip#12225)
&lt;https://github.com/pypa/pip/issues/12225&gt;</code>_)</li>
<li>Fix crash when the git version number contains something else than
digits and dots.
(<code>[#12280](pypa/pip#12280)
&lt;https://github.com/pypa/pip/issues/12280&gt;</code>_)</li>
<li>Use <code>-r=...</code> instead of <code>-r ...</code> to specify
references with Mercurial.
(<code>[#12306](pypa/pip#12306)
&lt;https://github.com/pypa/pip/issues/12306&gt;</code>_)</li>
<li>Redact password from URLs in some additional places.
(<code>[#12350](pypa/pip#12350)
&lt;https://github.com/pypa/pip/issues/12350&gt;</code>_)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/pypa/pip/commit/5364f26f9631dc07ed1bdfc88e1bec1bead2bce3"><code>5364f26</code></a>
Bump for release</li>
<li><a
href="https://github.com/pypa/pip/commit/5e7cc16c3b4442055a4a9892e9231758b6714e28"><code>5e7cc16</code></a>
Fix parallel pip cache downloads causing crash (<a
href="https://github.com/pypa/pip/issues/12364">#12364</a>)</li>
<li><a
href="https://github.com/pypa/pip/commit/8a0f77c171d60344e6a3bf6e95ad5740c21575fd"><code>8a0f77c</code></a>
Merge pull request <a
href="https://github.com/pypa/pip/issues/12355">#12355</a> from
sbidoul/build-using-build</li>
<li><a
href="https://github.com/pypa/pip/commit/f3620cdb5be06cee223a3606a1525ee45372085b"><code>f3620cd</code></a>
Merge pull request <a
href="https://github.com/pypa/pip/issues/12363">#12363</a> from
pfmoore/safe_isoformat</li>
<li><a
href="https://github.com/pypa/pip/commit/fb06d12d5a32581ae531fc26143c14ac6c8ea8fe"><code>fb06d12</code></a>
Handle ISO formats with a trailing Z</li>
<li><a
href="https://github.com/pypa/pip/commit/9f213bf69ac32c60c84055261c862ff169389e43"><code>9f213bf</code></a>
Merge pull request <a
href="https://github.com/pypa/pip/issues/12356">#12356</a> from
sbidoul/clarify-changelog</li>
<li><a
href="https://github.com/pypa/pip/commit/a982c7bc3550afb27a3a792d84fe91bf7c3254ca"><code>a982c7b</code></a>
Add a few PEP links in the changelog</li>
<li><a
href="https://github.com/pypa/pip/commit/e1e227d7d6b5ae04ae3a2104bf8185622201f5f6"><code>e1e227d</code></a>
Clarify changelog</li>
<li><a
href="https://github.com/pypa/pip/commit/9b0abc8c40459dd16a9c1205e15f6d3363bf202e"><code>9b0abc8</code></a>
Build using <code>build</code></li>
<li><a
href="https://github.com/pypa/pip/commit/9d4be7802f45790bdb994f943c8d8731927cf25c"><code>9d4be78</code></a>
Merge pull request <a
href="https://github.com/pypa/pip/issues/12353">#12353</a> from
sbidoul/release/23.3</li>
<li>Additional commits viewable in <a
href="https://github.com/pypa/pip/compare/23.2.1...23.3.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pip&package-manager=pip&previous-version=23.2.1&new-version=23.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Hugo-Inmanta pushed a commit to inmanta/inmanta-core that referenced this issue Nov 6, 2023
Bumps [pip](https://github.com/pypa/pip) from 23.3 to 23.3.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's changelog</a>.</em></p>
<blockquote>
<h1>23.3.1 (2023-10-21)</h1>
<h2>Bug Fixes</h2>
<ul>
<li>Handle a timezone indicator of Z when parsing dates in the self check. (<code>[#12338](pypa/pip#12338) &lt;https://github.com/pypa/pip/issues/12338&gt;</code>_)</li>
<li>Fix bug where installing the same package at the same time with multiple pip processes could fail. (<code>[#12361](pypa/pip#12361) &lt;https://github.com/pypa/pip/issues/12361&gt;</code>_)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pypa/pip/commit/5364f26f9631dc07ed1bdfc88e1bec1bead2bce3"><code>5364f26</code></a> Bump for release</li>
<li><a href="https://github.com/pypa/pip/commit/5e7cc16c3b4442055a4a9892e9231758b6714e28"><code>5e7cc16</code></a> Fix parallel pip cache downloads causing crash (<a href="https://github.com/pypa/pip/issues/12364">#12364</a>)</li>
<li><a href="https://github.com/pypa/pip/commit/8a0f77c171d60344e6a3bf6e95ad5740c21575fd"><code>8a0f77c</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12355">#12355</a> from sbidoul/build-using-build</li>
<li><a href="https://github.com/pypa/pip/commit/f3620cdb5be06cee223a3606a1525ee45372085b"><code>f3620cd</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12363">#12363</a> from pfmoore/safe_isoformat</li>
<li><a href="https://github.com/pypa/pip/commit/fb06d12d5a32581ae531fc26143c14ac6c8ea8fe"><code>fb06d12</code></a> Handle ISO formats with a trailing Z</li>
<li><a href="https://github.com/pypa/pip/commit/9f213bf69ac32c60c84055261c862ff169389e43"><code>9f213bf</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12356">#12356</a> from sbidoul/clarify-changelog</li>
<li><a href="https://github.com/pypa/pip/commit/a982c7bc3550afb27a3a792d84fe91bf7c3254ca"><code>a982c7b</code></a> Add a few PEP links in the changelog</li>
<li><a href="https://github.com/pypa/pip/commit/e1e227d7d6b5ae04ae3a2104bf8185622201f5f6"><code>e1e227d</code></a> Clarify changelog</li>
<li><a href="https://github.com/pypa/pip/commit/9b0abc8c40459dd16a9c1205e15f6d3363bf202e"><code>9b0abc8</code></a> Build using <code>build</code></li>
<li><a href="https://github.com/pypa/pip/commit/9d4be7802f45790bdb994f943c8d8731927cf25c"><code>9d4be78</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12353">#12353</a> from sbidoul/release/23.3</li>
<li>Additional commits viewable in <a href="https://github.com/pypa/pip/compare/23.3...23.3.1">compare view</a></li>
</ul>
</details>
<br />

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pip&package-manager=pip&previous-version=23.3&new-version=23.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

</details>
mergify bot pushed a commit to aws/jsii that referenced this issue Nov 14, 2023
…k/test/generated-code (#4306)

Bumps [pip](https://github.com/pypa/pip) from 23.3 to 23.3.1.
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's changelog</a>.</em></p>
<blockquote>
<h1>23.3.1 (2023-10-21)</h1>
<h2>Bug Fixes</h2>
<ul>
<li>Handle a timezone indicator of Z when parsing dates in the self check. (<code>[#12338](pypa/pip#12338) &lt;https://github.com/pypa/pip/issues/12338&gt;</code>_)</li>
<li>Fix bug where installing the same package at the same time with multiple pip processes could fail. (<code>[#12361](pypa/pip#12361) &lt;https://github.com/pypa/pip/issues/12361&gt;</code>_)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/pypa/pip/commit/5364f26f9631dc07ed1bdfc88e1bec1bead2bce3"><code>5364f26</code></a> Bump for release</li>
<li><a href="https://github.com/pypa/pip/commit/5e7cc16c3b4442055a4a9892e9231758b6714e28"><code>5e7cc16</code></a> Fix parallel pip cache downloads causing crash (<a href="https://github.com/pypa/pip/issues/12364">#12364</a>)</li>
<li><a href="https://github.com/pypa/pip/commit/8a0f77c171d60344e6a3bf6e95ad5740c21575fd"><code>8a0f77c</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12355">#12355</a> from sbidoul/build-using-build</li>
<li><a href="https://github.com/pypa/pip/commit/f3620cdb5be06cee223a3606a1525ee45372085b"><code>f3620cd</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12363">#12363</a> from pfmoore/safe_isoformat</li>
<li><a href="https://github.com/pypa/pip/commit/fb06d12d5a32581ae531fc26143c14ac6c8ea8fe"><code>fb06d12</code></a> Handle ISO formats with a trailing Z</li>
<li><a href="https://github.com/pypa/pip/commit/9f213bf69ac32c60c84055261c862ff169389e43"><code>9f213bf</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12356">#12356</a> from sbidoul/clarify-changelog</li>
<li><a href="https://github.com/pypa/pip/commit/a982c7bc3550afb27a3a792d84fe91bf7c3254ca"><code>a982c7b</code></a> Add a few PEP links in the changelog</li>
<li><a href="https://github.com/pypa/pip/commit/e1e227d7d6b5ae04ae3a2104bf8185622201f5f6"><code>e1e227d</code></a> Clarify changelog</li>
<li><a href="https://github.com/pypa/pip/commit/9b0abc8c40459dd16a9c1205e15f6d3363bf202e"><code>9b0abc8</code></a> Build using <code>build</code></li>
<li><a href="https://github.com/pypa/pip/commit/9d4be7802f45790bdb994f943c8d8731927cf25c"><code>9d4be78</code></a> Merge pull request <a href="https://github.com/pypa/pip/issues/12353">#12353</a> from sbidoul/release/23.3</li>
<li>Additional commits viewable in <a href="https://github.com/pypa/pip/compare/23.3...23.3.1">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pip&package-manager=pip&previous-version=23.3&new-version=23.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>
@github-actions github-actions bot locked as resolved and limited conversation to collaborators Nov 21, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
S: needs triage Issues/PRs that need to be triaged type: bug A confirmed bug or unintended behavior
Projects
None yet
Development

No branches or pull requests

7 participants
@sbidoul @pfmoore @pganssle @belm0 @pradyunsg @notatallshaw and others