You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from bleach's changelog.

Version 3.1.4 (March 24th, 2020)

Security fixes

• bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS).

  Calls to bleach.clean with an allowed tag with an allowed style attribute were vulnerable to ReDoS. For example, bleach.clean(..., attributes={'a': ['style']}).

  This issue was confirmed in Bleach versions v3.1.3, v3.1.2, v3.1.1, v3.1.0, v3.0.0, v2.1.4, and v2.1.3. Earlier versions used a similar regular expression and should be considered vulnerable too.

  Anyone using Bleach <=v3.1.3 is encouraged to upgrade.

  https://bugzilla.mozilla.org/show_bug.cgi?id=1623633

Backwards incompatible changes

• Style attributes with dashes, or single or double quoted values are cleaned instead of passed through.

Features

None

Bug fixes

None

Version 3.1.3 (March 17th, 2020)

Security fixes

None

Backwards incompatible changes

None

Features

• Add relative link to code of conduct. (#442)

• Drop deprecated 'setup.py test' support. (#507)

... (truncated)

• 6e74a50 Update for v3.1.4 release
• d6018f2 fix bug 1623633
• fc77027 Merge branch 'v3.1.0-branch'
• e4b1c50 Update for v3.1.3 release
• 59cc502 Update for v3.1.2 release
• 3f39d48 add wheel to requirements-dev
• 175f677 fix bug 1621692
• 78a0672 Update for v3.1.2 release
• 7b625ff add wheel to requirements-dev
• e4e9e21 fix bug 1621692
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from joblib's changelog.

Release 1.2.0

• Fix a security issue where eval(pre_dispatch) could potentially run arbitrary code. Now only basic numerics are supported. joblib/joblib#1327

• Make sure that joblib works even when multiprocessing is not available, for instance with Pyodide joblib/joblib#1256

• Avoid unnecessary warnings when workers and main process delete the temporary memmap folder contents concurrently. joblib/joblib#1263

• Fix memory alignment bug for pickles containing numpy arrays. This is especially important when loading the pickle with mmap_mode != None as the resulting numpy.memmap object would not be able to correct the misalignment without performing a memory copy. This bug would cause invalid computation and segmentation faults with native code that would directly access the underlying data buffer of a numpy array, for instance C/C++/Cython code compiled with older GCC versions or some old OpenBLAS written in platform specific assembly. joblib/joblib#1254

• Vendor cloudpickle 2.2.0 which adds support for PyPy 3.8+.

• Vendor loky 3.3.0 which fixes several bugs including:

  • robustly forcibly terminating worker processes in case of a crash (joblib/joblib#1269);

  • avoiding leaking worker processes in case of nested loky parallel calls;

  • reliability spawn the correct number of reusable workers.

Release 1.1.0

• Fix byte order inconsistency issue during deserialization using joblib.load in cross-endian environment: the numpy arrays are now always loaded to use the system byte order, independently of the byte order of the system that serialized the pickle. joblib/joblib#1181

• Fix joblib.Memory bug with the ignore parameter when the cached function is a decorated function.

... (truncated)

• 5991350 Release 1.2.0
• 3fa2188 MAINT cleanup numpy warnings related to np.matrix in tests (#1340)
• cea26ff CI test the future loky-3.3.0 branch (#1338)
• 8aca6f4 MAINT: remove pytest.warns(None) warnings in pytest 7 (#1264)
• 067ed4f XFAIL test_child_raises_parent_exits_cleanly with multiprocessing (#1339)
• ac4ebd5 MAINT add back pytest warnings plugin (#1337)
• a23427d Test child raises parent exits cleanly more reliable on macos (#1335)
• ac09691 [MAINT] various test updates (#1334)
• 4a314b1 Vendor loky 3.2.0 (#1333)
• bdf47e9 Make test_parallel_with_interactively_defined_functions_default_backend timeo...
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

• cefe0bf Release 6.3.0
• a534fb9 Release 6.3.0b0
• 87920c5 Add changelog for 6.3.0 (#1669)
• dd6d9c7 add slide numbering (#1654)
• 5d2c5e2 Update state filter (#1664)
• 11ea593 fix: avoid closing the script tag early by escaping a forward slash (#1665)
• 968c5fb Fix HTML templates mentioned in help docs (#1653)
• 35c4d07 Add a new output filter that excludes widgets if there is no state (#1643)
• c663c75 6.2.0
• fd1dd15 6.2.0rc2
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from rsa's changelog.

Version 4.7 - released 2021-01-10

• Fix #165: CVE-2020-25658 - Bleichenbacher-style timing oracle in PKCS#1 v1.5 decryption code
• Add padding length check as described by PKCS#1 v1.5 (Fixes #164)
• Reuse of blinding factors to speed up blinding operations. Fixes #162.
• Declare & test support for Python 3.9

Version 4.4 & 4.6 - released 2020-06-12

Version 4.4 and 4.6 are almost a re-tagged release of version 4.2. It requires Python 3.5+. To avoid older Python installations from trying to upgrade to RSA 4.4, this is now made explicit in the python_requires argument in setup.py. There was a mistake releasing 4.4 as "3.5+ only", which made it necessary to retag 4.4 as 4.6 as well.

No functional changes compared to version 4.2.

Version 4.3 & 4.5 - released 2020-06-12

Version 4.3 and 4.5 are almost a re-tagged release of version 4.0. It is the last to support Python 2.7. This is now made explicit in the python_requires argument in setup.py. Python 3.4 is not supported by this release. There was a mistake releasing 4.4 as "3.5+ only", which made it necessary to retag 4.3 as 4.5 as well.

Two security fixes have also been backported, so 4.3 = 4.0 + these two fixes.

• Choose blinding factor relatively prime to N. Thanks Christian Heimes for pointing this out.
• Reject cyphertexts (when decrypting) and signatures (when verifying) that have been modified by prepending zero bytes. This resolves CVE-2020-13757. Thanks Carnil for pointing this out.

Version 4.2 - released 2020-06-10

• Rolled back the switch to Poetry, and reverted back to using Pipenv + setup.py for dependency management. There apparently is an issue no-binary installs of packages build with Poetry. This fixes #148
• Limited SHA3 support to those Python versions (3.6+) that support it natively. The third-party library that adds support for this to Python 3.5 is a binary package, and thus breaks the pure-Python nature of Python-RSA. This should fix #147.

• fa3282a Bumped version to 4.7
• a364e82 Marked version 4.7 as released
• 539c54a Fix #170: mistake in examples of documentation
• b81e317 Declare support for and test Python 3.9
• 06ec1ea Fix #162: Blinding uses slow algorithm
• 341e5c4 Directly raise DecryptionError when crypto length is bad
• f254895 Use bytes.find() instead of bytes.index()
• 240b0d8 Add link to changelog
• f878c37 Fix #164: Add padding length check as described by PKCS#1 v1.5
• dae8ce0 Fix #165: CVE-2020-25658 - Bleichenbacher-style timing oracle
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from pygments's releases.

2.7.4

• Updated lexers:

  • Apache configurations: Improve handling of malformed tags (#1656)

  • CSS: Add support for variables (#1633, #1666)

  • Crystal (#1650, #1670)

  • Coq (#1648)

  • Fortran: Add missing keywords (#1635, #1665)

  • Ini (#1624)

  • JavaScript and variants (#1647 -- missing regex flags, #1651)

  • Markdown (#1623, #1617)

  • Shell

    • Lex trailing whitespace as part of the prompt (#1645)
    • Add missing in keyword (#1652)

  • SQL - Fix keywords (#1668)

  • Typescript: Fix incorrect punctuation handling (#1510, #1511)

• Fix infinite loop in SML lexer (#1625)

• Fix backtracking string regexes in JavaScript/TypeScript, Modula2 and many other lexers (#1637)

• Limit recursion with nesting Ruby heredocs (#1638)

• Fix a few inefficient regexes for guessing lexers

• Fix the raw token lexer handling of Unicode (#1616)

• Revert a private API change in the HTML formatter (#1655) -- please note that private APIs remain subject to change!

• Fix several exponential/cubic-complexity regexes found by Ben Caller/Doyensec (#1675)

• Fix incorrect MATLAB example (#1582)

Thanks to Google's OSS-Fuzz project for finding many of these bugs.

2.7.3

• Updated lexers:

  • Ada (#1581)
  • HTML (#1615, #1614)
  • Java (#1594, #1586)
  • JavaScript (#1605, #1589, #1588)
  • JSON (#1569 -- this is a complete rewrite)
  • Lean (#1601)
  • LLVM (#1612)
  • Mason (#1592)
  • MySQL (#1555, #1551)
  • Rust (#1608)
  • Turtle (#1590, #1553)

• Deprecated JsonBareObjectLexer, which is now identical to JsonLexer (#1600)

• The ImgFormatter now calculates the exact character width, which fixes some issues with overlapping text (#1213, #1611)

... (truncated)

Sourced from pygments's changelog.

Version 2.7.4

(released January 12, 2021)

• Updated lexers:

  • Apache configurations: Improve handling of malformed tags (#1656)

  • CSS: Add support for variables (#1633, #1666)

  • Crystal (#1650, #1670)

  • Coq (#1648)

  • Fortran: Add missing keywords (#1635, #1665)

  • Ini (#1624)

  • JavaScript and variants (#1647 -- missing regex flags, #1651)

  • Markdown (#1623, #1617)

  • Shell

    • Lex trailing whitespace as part of the prompt (#1645)
    • Add missing in keyword (#1652)

  • SQL - Fix keywords (#1668)

  • Typescript: Fix incorrect punctuation handling (#1510, #1511)

• Fix infinite loop in SML lexer (#1625)

• Fix backtracking string regexes in JavaScript/TypeScript, Modula2 and many other lexers (#1637)

• Limit recursion with nesting Ruby heredocs (#1638)

• Fix a few inefficient regexes for guessing lexers

• Fix the raw token lexer handling of Unicode (#1616)

• Revert a private API change in the HTML formatter (#1655) -- please note that private APIs remain subject to change!

• Fix several exponential/cubic-complexity regexes found by Ben Caller/Doyensec (#1675)

• Fix incorrect MATLAB example (#1582)

Thanks to Google's OSS-Fuzz project for finding many of these bugs.

Version 2.7.3

(released December 6, 2020)

• Updated lexers:

  • Ada (#1581)
  • HTML (#1615, #1614)
  • Java (#1594, #1586)
  • JavaScript (#1605, #1589, #1588)
  • JSON (#1569 -- this is a complete rewrite)
  • Lean (#1601)
  • LLVM (#1612)
  • Mason (#1592)

... (truncated)

• 4d555d0 Bump version to 2.7.4.
• fc3b05d Update CHANGES.
• ad21935 Revert "Added dracula theme style (#1636)"
• e411506 Prepare for 2.7.4 release.
• 275e34d doc: remove Perl 6 ref
• 2e7e8c4 Fix several exponential/cubic complexity regexes found by Ben Caller/Doyensec
• eb39c43 xquery: fix pop from empty stack
• 2738778 fix coding style in test_analyzer_lexer
• 02e0f09 Added 'ERROR STOP' to fortran.py keywords. (#1665)
• c83fe48 support added for css variables (#1633)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from rsa's changelog.

Version 4.1 - released 2020-06-10

• Added support for Python 3.8.
• Dropped support for Python 2 and 3.4.
• Added type annotations to the source code. This will make Python-RSA easier to use in your IDE, and allows better type checking.
• Added static type checking via MyPy.
• Fix #129 Installing from source gives UnicodeDecodeError.
• Switched to using Poetry for package management.
• Added support for SHA3 hashing: SHA3-256, SHA3-384, SHA3-512. This is natively supported by Python 3.6+ and supported via a third-party library on Python 3.5.
• Choose blinding factor relatively prime to N. Thanks Christian Heimes for pointing this out.
• Reject cyphertexts (when decrypting) and signatures (when verifying) that have been modified by prepending zero bytes. This resolves CVE-2020-13757. Thanks Adelapie for pointing this out.

• c6731b1 Bumped version to 4.1
• 80f0e9d Marked version 4.1 as released
• 65ab5b5 Add support for Python 3.8
• 9ecf340 Fixed credit for report
• 93af6f2 Fix CVE-2020-13757: detect cyphertext modifications by prepending zero bytes
• ae1a906 Add more type hints
• 1473cb8 Drop character encoding markers for Python 2.x
• 8ed5071 Choose blinding factor relatively prime to N
• 1659432 Updated Code Climate badge in README.md
• 96e13dd Configured CodeClimate
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from jinja2's releases.

2.11.3

This contains a fix for a speed issue with the urlize filter. urlize is likely to be called on untrusted user input. For certain inputs some of the regular expressions used to parse the text could take a very long time due to backtracking. As part of the fix, the email matching became slightly stricter. The various speedups apply to urlize in general, not just the specific input cases.

• PyPI: https://pypi.org/project/Jinja2/2.11.3/
• Changes: https://jinja.palletsprojects.com/en/2.11.x/changelog/#version-2-11-3

2.11.2

• Changelog: https://jinja.palletsprojects.com/en/2.11.x/changelog/#version-2-11-2

Sourced from jinja2's changelog.

Version 2.11.3

Released 2021-01-31

• Improve the speed of the urlize filter by reducing regex backtracking. Email matching requires a word character at the start of the domain part, and only word characters in the TLD. :pr:1343

Version 2.11.2

Released 2020-04-13

• Fix a bug that caused callable objects with __getattr__, like :class:~unittest.mock.Mock to be treated as a :func:contextfunction. :issue:1145
• Update wordcount filter to trigger :class:Undefined methods by wrapping the input in :func:soft_str. :pr:1160
• Fix a hang when displaying tracebacks on Python 32-bit. :issue:1162
• Showing an undefined error for an object that raises AttributeError on access doesn't cause a recursion error. :issue:1177
• Revert changes to :class:~loaders.PackageLoader from 2.10 which removed the dependency on setuptools and pkg_resources, and added limited support for namespace packages. The changes caused issues when using Pytest. Due to the difficulty in supporting Python 2 and :pep:451 simultaneously, the changes are reverted until 3.0. :pr:1182
• Fix line numbers in error messages when newlines are stripped. :pr:1178
• The special namespace() assignment object in templates works in async environments. :issue:1180
• Fix whitespace being removed before tags in the middle of lines when lstrip_blocks is enabled. :issue:1138
• :class:~nativetypes.NativeEnvironment doesn't evaluate intermediate strings during rendering. This prevents early evaluation which could change the value of an expression. :issue:1186

• cf21539 release version 2.11.3
• 15ef8f0 Merge pull request #1343 from pallets/urlize-speedup
• ef658dc speed up urlize matching
• eeca0fe Merge pull request #1207 from mhansen/patch-1
• 2dd7691 Merge pull request #1209 from mhansen/patch-3
• 4892940 do_dictsort: update example ready to copy/paste
• 7db7d33 api.rst: bugfix in docs, import PackageLoader
• 9ec465b fix changelog header
• 737a4cd release version 2.11.2
• 179df6b Merge pull request #1190 from pallets/native-eval
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from httplib2's changelog.

0.19.0

auth: parse headers using pyparsing instead of regexp httplib2/httplib2#182

auth: WSSE token needs to be string not bytes httplib2/httplib2#179

0.18.1

explicit build-backend workaround for pip build isolation bug "AttributeError: 'module' object has no attribute 'legacy'" on pip install httplib2/httplib2#169

• 81e80d0 v0.19.0 release
• c3aed1e fix release script, interactive part
• bd9ee25 parse auth headers using pyparsing instead of regexp
• 33090ab initial fuzz testing integration with OSS-Fuzz
• 595e248 auth: WSSE token needs to be string not bytes
• 9bf300c v0.18.1 release
• cb2940a explicit build-backend workaround pip build isolation bug 6264
• 94f48ef check-manifest build tool
• 828c26d Security Policy
• See full diff in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from bleach's changelog.

Version 3.3.0 (February 1st, 2021)

Backwards incompatible changes

• clean escapes HTML comments even when strip_comments=False

Security fixes

• Fix bug 1621692 / GHSA-m6xf-fq7q-8743. See the advisory for details.

Features

None

Bug fixes

None

Version 3.2.3 (January 26th, 2021)

Security fixes

None

Features

None

Bug fixes

• fix clean and linkify raising ValueErrors for certain inputs. Thank you @Google-Autofuzz.

Version 3.2.2 (January 20th, 2021)

Security fixes

None

Features

• Migrate CI to Github Actions. Thank you @hugovk.

Bug fixes

• fix linkify raising an IndexError on certain inputs. Thank you @Google-Autofuzz.

Version 3.2.1 (September 18th, 2020)

... (truncated)

• 79b7a3c Merge pull request from GHSA-vv2x-vrpj-qqpq
• 842fcb4 Update for v3.3.0 release
• 1334134 sanitizer: escape HTML comments
• c045a8b Merge pull request #581 from mozilla/nit-fixes
• 491abb0 fix typo s/vnedoring/vendoring/
• 10b1c5d vendor: add html5lib-1.1.dist-info/REQUESTED
• cd838c3 Merge pull request #579 from mozilla/validate-convert-entity-code-points
• 612b808 Update for v3.2.3 release
• 6879f6a html5lib_shim: validate unicode points for convert_entity
• 90cb80b Update for v3.2.2 release
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

• 9e9e840 2022.12.07
• b81bdb2 2022.09.24
• 939a28f 2022.09.14
• aca828a 2022.06.15.2
• de0eae1 Only use importlib.resources's new files() / Traversable API on Python ≥3.11 ...
• b8eb5e9 2022.06.15.1
• 47fb7ab Fix deprecation warning on Python 3.11 (#199)
• b0b48e0 fixes #198 -- update link in license
• 9d514b4 2022.06.15
• 4151e88 Add py.typed to MANIFEST.in to package in sdist (#196)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from jupyter-core's releases.

4.11.1

What's Changed

• Fix inclusion of jupyter file and check in CI by @​blink1073 in jupyter/jupyter_core#276

Full Changelog: https://github.com/jupyter/jupyter_core/compare/4.11.0...4.11.1

4.11.0

What's Changed

• Use hatch backend by @​blink1073 in jupyter/jupyter_core#265
• is_hidden: Use normalized paths by @​martinRenou in jupyter/jupyter_core#271

New Contributors

• @​martinRenou made their first contribution in jupyter/jupyter_core#271

Full Changelog: https://github.com/jupyter/jupyter_core/compare/4.10.0...4.11.0

4.10.0

What's Changed

• Update changelog for 4.9.2 by @​blink1073 in jupyter/jupyter_core#252
• Include all files from jupyter_core by @​jonringer in jupyter/jupyter_core#253
• Add project URLs to setup.cfg by @​tlinhart in jupyter/jupyter_core#254
• Set up pre-commit by @​blink1073 in jupyter/jupyter_core#255
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in jupyter/jupyter_core#257
• Add flake8 and mypy settings by @​blink1073 in jupyter/jupyter_core#256
• Clean up CI by @​blink1073 in jupyter/jupyter_core#258
• Update changelog for 4.10 Release by @​blink1073 in jupyter/jupyter_core#259

New Contributors

• @​jonringer made their first contribution in jupyter/jupyter_core#253
• @​tlinhart made their first contribution in jupyter/jupyter_core#254
• @​pre-commit-ci made their first contribution in jupyter/jupyter_core#257

Full Changelog: https://github.com/jupyter/jupyter_core/compare/4.9.2...4.10.0

4.9.2

What's Changed

• set proper sys.argv[0] for subcommand by @​bnavigator in jupyter/jupyter_core#248
• Add explicit encoding in open calls by @​dlukes in jupyter/jupyter_core#249
• jupyter_config_dir - reorder home_dir initialization by @​dharmaquark in jupyter/jupyter_core#251

New Contributors

• @​bnavigator made their first contribution in jupyter/jupyter_core#248
• @​dlukes made their first contribution in jupyter/jupyter_core#249
• @​dharmaquark made their first contribution in jupyter/jupyter_core#251

Full Changelog: https://github.com/jupyter/jupyter_core/compare/4.9.1...4.9.2

Sourced from jupyter-core's changelog.

Changes in jupyter-core

5.0.0

(Full Changelog)

Major Changes

Prefer Environment Level Configuration

We now make the assumption that if we are running in a virtual environment, we should prioritize the environment-level sys.prefix over the user-level paths. Users can opt out of this behavior by setting JUPYTER_PREFER_ENV_PATH, which takes precedence over our autodetection.

Migrate to Standard Platform Directories

In version 5, we introduce a JUPYTER_PLATFORM_DIRS environment variable to opt in to using more appropriate platform-specific directories. We raise a deprecation warning if the variable is not set. In version 6, JUPYTER_PLATFORM_DIRS will be opt-out. In version 7, we will remove the environment variable checks and old directory logic.

Drop Support for Python 3.7

We are dropping support for Python 3.7 ahead of its official end of life, to reduce maintenance burden as we add support for Python 3.11.

Enhancements made

• Use platformdirs for path locations #292 (@​blink1073)
• Try to detect if we are in a virtual environment and change path precedence accordingly #286 (@​jasongrout)

Bugs fixed

• Add current working directory as first config path #291 (@​blink1073)
• Fix inclusion of jupyter file and check in CI #276 (@​blink1073)

Maintenance and upkeep improvements

• Bump github/codeql-action from 1 to 2 #308 (@​dependabot)
• Bump actions/checkout from 2 to 3 #307 (@​dependabot)
• Add dependabot #306 (@​blink1073)
• Adopt jupyter releaser #305 (@​blink1073)
• Add more typing #304 (@​blink1073)
• Require Python 3.8+ #302 (@​blink1073)
• Use hatch backend #265 (@​blink1073)
• Switch to flit build backend #262 (@​blink1073)
• is_hidden: Use normalized paths #271 (@​martinRenou)

Documentation

• Update broken link to Contributing guide #289 (@​jamesr66a)

Contributors to this release

... (truncated)

• a8eac8c Release 4.11.2
• 1118c8c Merge pull request from GHSA-m678-f26j-3hrp
• d3f61f3 Release 4.11.1
• e7eeb9e Fix inclusion of jupyter file and check in CI (#276)
• 035bf11 Release 4.11.0
• 45aa28b [pre-commit.ci] pre-commit autoupdate (#273)
• 73401cc [pre-commit.ci] pre-commit autoupdate (#272)
• bc6b771 is_hidden: Use normalized paths (#271)
• be38e52 [pre-commit.ci] pre-commit autoupdate (#270)
• 7b790d8 [pre-commit.ci] pre-commit autoupdate (#269)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from nbconvert's releases.

Release 6.5.1

No release notes provided.

6.5.0

What's Changed

• Drop dependency on testpath. by @​anntzer in jupyter/nbconvert#1723
• Adopt pre-commit by @​blink1073 in jupyter/nbconvert#1744
• Add pytest settings and handle warnings by @​blink1073 in jupyter/nbconvert#1745
• Apply Autoformatters by @​blink1073 in jupyter/nbconvert#1746
• Add git-blame-ignore-revs by @​blink1073 in jupyter/nbconvert#1748
• Update flake8 config by @​blink1073 in jupyter/nbconvert#1749
• support bleach 5, add packaging and tinycss2 dependencies by @​bollwyvl in jupyter/nbconvert#1755
• [pre-commit.ci] pre-commit autoupdate by @​pre-commit-ci in jupyter/nbconvert#1752
• update cli example by @​leahecole in jupyter/nbconvert#1753
• Clean up pre-commit by @​blink1073 in jupyter/nbconvert#1757
• Clean up workflows by @​blink1073 in jupyter/nbconvert#1750

New Contributors

• @​pre-commit-ci made their first contribution in jupyter/nbconvert#1752

Full Changelog: https://github.com/jupyter/nbconvert/compare/6.4.5...6.5

6.4.3

What's Changed

• Add section to customizing showing how to use template inheritance by @​stefanv in jupyter/nbconvert#1719
• Remove ipython genutils by @​rgs258 in jupyter/nbconvert#1727
• Update changelog for 6.4.3 by @​blink1073 in jupyter/nbconvert#1728

New Contributors

• @​stefanv made their first contribution in jupyter/nbconvert#1719
• @​rgs258 made their first contribution in jupyter/nbconvert#1727

Full Changelog: https://github.com/jupyter/nbconvert/compare/6.4.2...6.4.3

6.4.0

What's Changed

• Optionally speed up validation by @​gwincr11 in jupyter/nbconvert#1672
• Adding missing div compared to JupyterLab DOM structure by @​SylvainCorlay in jupyter/nbconvert#1678
• Allow passing extra args to code highlighter by @​yuvipanda in jupyter/nbconvert#1683
• Prevent page breaks in outputs when printing by @​SylvainCorlay in jupyter/nbconvert#1679
• Add collapsers to template by @​SylvainCorlay in jupyter/nbconvert#1689
• Fix recent pandoc latex tables by adding calc and array (#1536, #1566) by @​cgevans in jupyter/nbconvert#1686
• Add an invalid notebook error by @​gwincr11 in jupyter/nbconvert#1675
• Fix typos in execute.py by @​TylerAnderson22 in jupyter/nbconvert#1692
• Modernize latex greek math handling (partially fixes #1673) by @​cgevans in jupyter/nbconvert#1687
• Fix use of deprecated API and update test matrix by @​blink1073 in jupyter/nbconvert#1696
• Update nbconvert_library.ipynb by @​letterphile in jupyter/nbconvert#1695
• Changelog for 6.4 by @​blink1073 in jupyter/nbconvert#1697

New Contributors

... (truncated)

• 7471b75 Release 6.5.1
• c1943e0 Fix pre-commit
• 8685e93 Fix tests
• 0abf290 Run black and prettier
• 418d545 Run test on 6.x branch
• bef65d7 Convert input to string prior to escape HTML
• 0818628 Check input type before escaping
• b206470 GHSL-2021-1017, GHSL-2021-1020, GHSL-2021-1021
• a03cbb8 GHSL-2021-1026, GHSL-2021-1025
• 48fe71e GHSL-2021-1024
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from nltk's changelog.

Version 3.7 2022-02-09

• Improve and update the NLTK team page on nltk.org (#2855, #2941)
• Drop support for Python 3.6, support Python 3.10 (#2920)

Version 3.6.7 2021-12-28

• Resolve IndexError in sent_tokenize and word_tokenize (#2922)

Version 3.6.6 2021-12-21

• Refactor gensim.doctest to work for gensim 4.0.0 and up (#2914)
• Add Precision, Recall, F-measure, Confusion Matrix to Taggers (#2862)
• Added warnings if .zip files exist without any corresponding .csv files. (#2908)
• Fix FileNotFoundError when the download_dir is a non-existing nested folder (#2910)
• Rename omw to omw-1.4 (#2907)
• Resolve ReDoS opportunity by fixing incorrectly specified regex (#2906)
• Support OMW 1.4 (#2899)
• Deprecate Tree get and set node methods (#2900)
• Fix broken inaugural test case (#2903)
• Use Multilingual Wordnet Data from OMW with newer Wordnet versions (#2889)
• Keep NLTKs "tokenize" module working with pathlib (#2896)
• Make prettyprinter to be more readable (#2893)
• Update links to the nltk book (#2895)
• Add CITATION.cff to nltk (#2880)
• Resolve serious ReDoS in PunktSentenceTokenizer (#2869)
• Delete old CI config files (#2881)
• Improve Tokenize documentation + add TokenizerI as superclass for TweetTokenizer (#2878)
• Fix expected value for BLEU score doctest after changes from #2572
• Add multi Bleu functionality and tests (#2793)
• Deprecate 'return_str' parameter in NLTKWordTokenizer and TreebankWordTokenizer (#2883)
• Allow empty string in CFG's + more (#2888)
• Partition tree.py module into tree package + pickle fix (#2863)
• Fix several TreebankWordTokenizer and NLTKWordTokenizer bugs (#2877)
• Rewind Wordnet data file after each lookup (#2868)
• Correct init call for SyntaxCorpusReader subclasses (#2872)
• Documentation fixes (#2873)
• Fix levenstein distance for duplicated letters (#2849)
• Support alternative Wordnet versions (#2860)
• Remove hundreds of formatting warnings for nltk.org (#2859)
• Modernize nltk.org/howto pages (#2856)
• Fix Bleu Score smoothing function from taking log(0) (#2839)
• Update third party tools to newer versions and removing MaltParser fixed version (#2832)
• Fix TypeError: _pretty() takes 1 positional argument but 2 were given in sem/drt.py (#2854)
• Replace http with https in most URLs (#2852)

Thanks to the following contributors to 3.6.6 Adam Hawley, BatMrE, Danny Sepler, Eric Kafe, Gavish Poddar, Panagiotis Simakis, RnDevelover, Robby Horvath, Tom Aarsen, Yuta Nakamura, Mohaned Mashaly

... (truncated)

• 4862b09 updates for 3.6.6
• 6b60213 Refactor gensim.doctest to work for gensim 4.0.0 and up (#2914)
• 59aa3fb Fix decode error for bllip parser (#2897)
• a28d256 Add Precision, Recall, F-measure, Confusion Matrix to Taggers (#2862)
• 72d9885 Added warnings if .zip files exist without any corresponding .csv files. (#2908)
• dea7b44 Fix FileNotFoundError when the download_dir is a non-existing nested fold...
• abbe86b Undo #2909 due to unexpected test failure
• c075dab Allow commits with /nocache to not use the cache (#2909)
• d6d513d Renamed omw to omw-1.4 (#2907)
• 2a50a3e Resolve ReDoS opportunity by fixing incorrectly specified regex (#2906)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from mistune's releases.

Version 2.0.2

Fix escape_url via lepture/mistune#295

Version 2.0.1

Fix XSS for image link syntax.

Version 2.0.0

First release of Mistune v2.

Version 2.0.0 RC1

In this release, we have a Security Fix for harmful links.

Version 2.0.0 Alpha 1

This is the first release of v2. An alpha version for users to have a preview of the new mistune.

Sourced from mistune's changelog.

Changelog

Here is the full history of mistune v2.

Version 2.0.4

Released on Jul 15, 2022

Fix url plugin in <a> tag
Fix * formatting

Version 2.0.3

Released on Jun 27, 2022

• Fix table plugin
• Security fix for CVE-2022-34749

Version 2.0.2

Released on Jan 14, 2022
Fix escape_url
Version 2.0.1

Released on Dec 30, 2021

XSS fix for image link syntax.

Version 2.0.0

Released on Dec 5, 2021
This is the first non-alpha release of mistune v2.
Version 2.0.0rc1

Released on Feb 16, 2021

Version 2.0.0a6

</tr></table> 

... (truncated)

• 3f422f1 Version bump 2.0.3
• a6d4321 Fix asteris emphasis regex CVE-2022-34749
• 5638e46 Merge pull request #307 from jieter/patch-1
• 0eba471 Fix typo in guide.rst
• 61e9337 Fix table plugin
• 76dec68 Add documentation for renderer heading when TOC enabled
• 799cd11 Version bump 2.0.2
• babb0cf Merge pull request #295 from dairiki/bug.escape_url
• fc2cd53 Make mistune.util.escape_url less aggressive
• 3e8d352 Version bump 2.0.1
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

Sourced from numpy's releases.

v1.22.0

NumPy 1.22.0 Release Notes

NumPy 1.22.0 is a big release featuring the work of 153 contributors spread over 609 pull requests. There have been many improvements, highlights are:

• Annotations of the main namespace are essentially complete. Upstream is a moving target, so there will likely be further improvements, but the major work is done. This is probably the most user visible enhancement in this release.
• A preliminary version of the proposed Array-API is provided. This is a step in creating a standard collection of functions that can be used across application such as CuPy and JAX.
• NumPy now has a DLPack backend. DLPack provides a common interchange format for array (tensor) data.
• New methods for quantile, percentile, and related functions. The new methods provide a complete set of the methods commonly found in the literature.
• A new configurable allocator for use by downstream projects.

These are in addition to the ongoing work to provide SIMD support for commonly used functions, improvements to F2PY, and better documentation.

The Python versions supported in this release are 3.8-3.10, Python 3.7 has been dropped. Note that 32 bit wheels are only provided for Python 3.8 and 3.9 on Windows, all other wheels are 64 bits on account of Ubuntu, Fedora, and other Linux distributions dropping 32 bit support. All 64 bit wheels are also linked with 64 bit integer OpenBLAS, which should fix the occasional problems encountered by folks using truly huge arrays.

Expired deprecations

Deprecated numeric style dtype strings have been removed

Using the strings "Bytes0", "Datetime64", "Str0", "Uint32", and "Uint64" as a dtype will now raise a TypeError.

(gh-19539)

Expired deprecations for loads, ndfromtxt, and mafromtxt in npyio

numpy.loads was deprecated in v1.15, with the recommendation that users use pickle.loads instead. ndfromtxt and mafromtxt were both deprecated in v1.17 - users should use numpy.genfromtxt instead with the appropriate value for the usemask parameter.

(gh-19615)

... (truncated)

• 4adc87d Merge pull request #20685 from charris/prepare-for-1.22.0-release
• fd66547 REL: Prepare for the NumPy 1.22.0 release.
• 125304b wip
• c283859 Merge pull request #20682 from charris/backport-20416
• 5399c03 Merge pull request #20681 from charris/backport-20954
• f9c45f8 Merge pull request #20680 from charris/backport-20663
• 794b36f Update armccompiler.py
• d93b14e Update test_public_api.py
• 7662c07 Update init.py
• 311ab52 Update armccompiler.py
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.