build(deps): bump the pip group across 1 directory with 6 updates by dependabot[bot] · Pull Request #5103 · google/or-tools

dependabot · 2026-03-26T15:03:52Z

Bumps the pip group with 6 updates in the /bazel directory:

Package	From	To
filelock	`3.20.1`	`3.20.3`
protobuf	`6.32.0`	`6.33.5`
requests	`2.32.4`	`2.33.0`
virtualenv	`20.35.4`	`20.36.1`
nbconvert	`7.16.6`	`7.17.0`
tornado	`6.5.0`	`6.5.5`

Updates filelock from 3.20.1 to 3.20.3

Release notes

Sourced from filelock's releases.

3.20.3

What's Changed

Fix TOCTOU symlink vulnerability in SoftFileLock by @gaborbernat in tox-dev/filelock#465

Full Changelog: tox-dev/filelock@3.20.2...3.20.3

3.20.2

What's Changed

Support Unix systems without O_NOFOLLOW by @mwilliamson in tox-dev/filelock#463

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in tox-dev/filelock#464

New Contributors

@mwilliamson made their first contribution in tox-dev/filelock#463

Full Changelog: tox-dev/filelock@3.20.1...3.20.2

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

3.25.2 (2026-03-11)

🐛 fix(unix): suppress EIO on close in Docker bind mounts :pr:513

3.25.1 (2026-03-09)

[pre-commit.ci] pre-commit autoupdate :pr:510 - by :user:pre-commit-ci[bot]

🐛 fix(win): restore best-effort lock file cleanup on release :pr:511

[pre-commit.ci] pre-commit autoupdate :pr:508 - by :user:pre-commit-ci[bot]

📝 docs(logo): add branded project logo :pr:507

3.25.0 (2026-03-01)

✨ feat(async): add AsyncReadWriteLock :pr:506

Standardize .github files to .yaml suffix

build(deps): bump actions/download-artifact from 7 to 8 :pr:503 - by :user:dependabot[bot]

build(deps): bump actions/upload-artifact from 6 to 7 :pr:502 - by :user:dependabot[bot]

Move SECURITY.md to .github/SECURITY.md

Add security policy

Add permissions to check workflow :pr:500

[pre-commit.ci] pre-commit autoupdate :pr:499 - by :user:pre-commit-ci[bot]

3.24.3 (2026-02-19)

🐛 fix(unix): handle ENOENT race on FUSE/NFS during acquire :pr:495

🐛 fix(ci): add trailing blank line after changelog entries :pr:492

3.24.2 (2026-02-16)

🐛 fix(rw): close sqlite3 cursors and skip SoftFileLock Windows race :pr:491

🐛 fix(test): resolve flaky write non-starvation test :pr:490

📝 docs: restructure using Diataxis framework :pr:489

3.24.1 (2026-02-15)

... (truncated)

Commits

41b42dd Fix TOCTOU symlink vulnerability in SoftFileLock (#465)
f2e7d40 [pre-commit.ci] pre-commit autoupdate (#464)
5088854 Support Unix systems without O_NOFOLLOW (#463)
See full diff in compare view

Updates protobuf from 6.32.0 to 6.33.5

Release notes

Sourced from protobuf's releases.

Protocol Buffers v34.0-rc1

Announcements

This version includes breaking changes to: C++, Objective-C, PHP, Python.

[Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

[C++] Make generator headers private (protocolbuffers/protobuf@3a2af35)

[C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (protocolbuffers/protobuf@7a75898)

[C++] Add [[nodiscard]] to many APIs. (protocolbuffers/protobuf@a70115f)

[C++] Make the arena-enabled constructors of RepeatedField, RepeatedPtrField, and Map private. (protocolbuffers/protobuf@ef890c3)

[C++] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[C++] Removes proto2::util::MessageDifferencer::AddIgnoreCriteria that takes a raw pointer as an argument in favor of the overload that takes a unique_ptr. Remove macro PROTOBUF_FUTURE_REMOVE_ADD_IGNORE_CRITERIA (protocolbuffers/protobuf@b115358)

[C++] Remove deprecated FieldDescriptor::has_optional_keyword() in OSS. Use is_repeated() or has_presence() instead (protocolbuffers/protobuf@68346ec)

[C++] Remove AddUnusedImportTrackFile() and ClearUnusedImportTrackFiles(). Remove PROTOBUF_FUTURE_RENAME_ADD_UNUSED_IMPORT (protocolbuffers/protobuf@837a2cd)

[C++] Remove deprecated FieldDescriptor::is_optional() in OSS. Use (!is_required() && !is_repeated()) instead (protocolbuffers/protobuf@9dbc5d4)

[C++] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

[C++] All entity names have length limit (2afb0dc)

[ObjC] Remove generate_minimal_imports generation option warning (protocolbuffers/protobuf@45b1297)

[ObjC] Fix nullability annotations on some GPB*Dictionary types. (protocolbuffers/protobuf@ea67d6d)

[ObjC] Remove -[GPBFieldDescriptor optional] (protocolbuffers/protobuf@3414dc1)

[Other] Remove deprecated flag for enabling MSVC support (protocolbuffers/protobuf@97c979b)

[PHP] Remove deprecated PHP APIs (protocolbuffers/protobuf@9c45014)

[PHP] Remove deprecated PHP APIs FieldDescriptor getLabel, use IsRepeated or isRequired instead. (protocolbuffers/protobuf@4208121, protocolbuffers/protobuf@cd76e67, protocolbuffers/protobuf@4208121)

[PHP] Add PHP typehints for setters and remove redundant GPBUtil checks (protocolbuffers/protobuf#25296) (protocolbuffers/protobuf@aee03b7)

[PHP] support default values for editions/proto2 (protocolbuffers/protobuf#25161) (protocolbuffers/protobuf@b01099d)

[Python] Raise errors in OSS when assign bool to int/enum field in Python Proto. (protocolbuffers/protobuf@5b116fe)

[Python] Remove float_format/double_format from python proto text_format (protocolbuffers/protobuf@e4854a1)

[Python] Raise TypeError when convert non-timedelta to Duration, or convert non-datetime to Timestamp in python proto. (Original code may raise ArributeError) (protocolbuffers/protobuf@00aaca1)

[Python] Remove float_precision from python proto json_format (protocolbuffers/protobuf@f027f1f)

[Python] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[Python] Remove deprecated FieldDescriptor.label (protocolbuffers/protobuf@0a8ff55)

[Python] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

Protobuf News may include additional announcements or pre-announcements for upcoming changes.

Migration Guide may include additional guidance for breaking changes.

Bazel

Fix: cc_toolchain should prefer protoc when prebuilt flag is flipped. (#25168) (protocolbuffers/protobuf@8c857c3)

Breaking change: Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

Feat(bazel): wire up prebuilt protoc toolchain (#24115) (protocolbuffers/protobuf@cc23698)

Migrate proto_descriptor_set (#23369) (protocolbuffers/protobuf@8d4dfdd)

Compiler

Ruby codegen: support generation of rbs files (#15633) (protocolbuffers/protobuf@6ebdf85)

Avoid collision name problems between a message named Xyz and a direct sibling enum named XyzView (protocolbuffers/protobuf@eba53e8)

Generalizing and implementing ValidateFeatureSupport for both Options and Features during proto parsing (protocolbuffers/protobuf@ed3c571)

Fix a bug with custom features outside of the pb package. (protocolbuffers/protobuf@872d3ce)

Fix import option handling when include_imports isn't set. (protocolbuffers/protobuf@9ef9e80)

Fix a bug in STRICT check of namespaced enums to properly check for 'reserved 1 to max' (protocolbuffers/protobuf@1229d4a)

Prevent accidental stripping of debug_redact options via import option. (protocolbuffers/protobuf@f58b098)

C++

Add EnumerateEnumValues function. (protocolbuffers/protobuf@397d5d9)

... (truncated)

Commits

See full diff in compare view

Updates requests from 2.32.4 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.

Dropped support for Python 3.8 following its end of support.

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.

Dropped support for Python 3.8 following its end of support.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates virtualenv from 20.35.4 to 20.36.1

Release notes

Sourced from virtualenv's releases.

20.36.0

What's Changed

release 20.35.3 by @gaborbernat in pypa/virtualenv#2981

fix: Prevent NameError when accessing _DISTUTILS_PATCH during file ov… by @gracetyy in pypa/virtualenv#2982

Upgrade pip and fix 3.15 picking old wheel by @gaborbernat in pypa/virtualenv#2989

release 20.35.4 by @gaborbernat in pypa/virtualenv#2990

fix: wrong path on migrated venv by @sk1234567891 in pypa/virtualenv#2996

test_too_many_open_files: assert on errno.EMFILE instead of strerror by @pltrz in pypa/virtualenv#3001

fix: update filelock dependency version to 3.20.1 to fix CVE CVE-2025-68146 by @pythonhubdev in pypa/virtualenv#3002

fix: resolve EncodingWarning in tox upgrade environment by @gaborbernat in pypa/virtualenv#3007

Fix Interpreter discovery bug wrt. Microsoft Store shortcut using Latin-1 by @rahuldevikar in pypa/virtualenv#3006

Add support for PEP 440 version specifiers in the --python flag. by @rahuldevikar in pypa/virtualenv#3008

New Contributors

@gracetyy made their first contribution in pypa/virtualenv#2982

@sk1234567891 made their first contribution in pypa/virtualenv#2996

@pltrz made their first contribution in pypa/virtualenv#3001

@pythonhubdev made their first contribution in pypa/virtualenv#3002

@rahuldevikar made their first contribution in pypa/virtualenv#3006

Full Changelog: pypa/virtualenv@20.35.3...20.36.0

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 20.36.1

Fix TOCTOU vulnerabilities in app_data and lock directory creation that could be exploited via symlink attacks - reported by :user:tsigouris007, fixed by :user:gaborbernat. (:issue:3013)

v20.36.0 (2026-01-07)

Features - 20.36.0

Add support for PEP 440 version specifiers in the --python flag. Users can now specify Python versions using operators like >=, <=, ~=, etc. For example: virtualenv --python=">=3.12" myenv . (:issue:2994`)

v20.35.4 (2025-10-28)

Commits

d0ad11d release 20.36.1
dec4cec Merge pull request #3013 from gaborbernat/fix-sec
5fe5d38 release 20.36.0 (#3011)
9719376 release 20.36.0
0276db6 Add support for PEP 440 version specifiers in the --python flag. (#3008)
4f900c2 Fix Interpreter discovery bug wrt. Microsoft Store shortcut using Latin-1 (#3...
13afcc6 fix: resolve EncodingWarning in tox upgrade environment (#3007)
31b5d31 [pre-commit.ci] pre-commit autoupdate (#2997)
7c28422 fix: update filelock dependency version to 3.20.1 to fix CVE CVE-2025-68146 (...
365628c test_too_many_open_files: assert on errno.EMFILE instead of strerror (#3001)
Additional commits viewable in compare view

Updates nbconvert from 7.16.6 to 7.17.0

Release notes

Sourced from nbconvert's releases.

v7.17.0

7.17.0

(Full Changelog)

Enhancements made

Add support for arbitrary browser arguments #2227 (@shreve, @Carreau, @krassowski)

Bugs fixed

Fix QtPNGExporter returning empty bytes on macOS #2264 (@h3pdesign, @Carreau, @QuLogic)

Fix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD) #2261 (@h3pdesign, @krassowski, @mberlanda, @minrk, @salmankadaya, @th3gowtham)

Fix get_export_names and get_exporter default args #2228 (@shreve, @krassowski)

PyPA-Compliant Summary #2226 (@hackowitz-af, @Carreau)

Maintenance and upkeep improvements

avoid cov environment on free-threaded Pythons #2267 (@minrk)

update pre-commit, and fix all issues. #2238 (@Carreau)

Drop test on 3.9, test on 3.13, 3.14, 3.14t #2237 (@Carreau)

Bump the actions group across 1 directory with 2 updates #2231 (@Carreau, @krassowski)

Replace @flaky.flaky decorate with pytest marker #2229 (@mgorny, @Carreau)

update to mermaid 11.10.0 #2224 (@bollwyvl, @krassowski)

Drop support for Python 3.8, fix the CI tests #2221 (@shreve, @minrk)

Documentation improvements

Use intersphinx_registry #2232 (@Carreau, @krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@bollwyvl (activity) | @Carreau (activity) | @h3pdesign (activity) | @hackowitz-af (activity) | @krassowski (activity) | @mberlanda (activity) | @mgorny (activity) | @minrk (activity) | @MSeal (activity) | @QuLogic (activity) | @salmankadaya (activity) | @shreve (activity) | @th3gowtham (activity)

Changelog

Sourced from nbconvert's changelog.

7.17.0

(Full Changelog)

Enhancements made

Add support for arbitrary browser arguments #2227 (@shreve, @Carreau, @krassowski)

Bugs fixed

Fix QtPNGExporter returning empty bytes on macOS #2264 (@h3pdesign, @Carreau, @QuLogic)

Fix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD) #2261 (@h3pdesign, @krassowski, @mberlanda, @minrk, @salmankadaya, @th3gowtham)

Fix get_export_names and get_exporter default args #2228 (@shreve, @krassowski)

PyPA-Compliant Summary #2226 (@hackowitz-af, @Carreau)

Maintenance and upkeep improvements

avoid cov environment on free-threaded Pythons #2267 (@minrk)

update pre-commit, and fix all issues. #2238 (@Carreau)

Drop test on 3.9, test on 3.13, 3.14, 3.14t #2237 (@Carreau)

Bump the actions group across 1 directory with 2 updates #2231 (@Carreau, @krassowski)

Replace @flaky.flaky decorate with pytest marker #2229 (@mgorny, @Carreau)

update to mermaid 11.10.0 #2224 (@bollwyvl, @krassowski)

Drop support for Python 3.8, fix the CI tests #2221 (@shreve, @minrk)

Documentation improvements

Use intersphinx_registry #2232 (@Carreau, @krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@bollwyvl (activity) | @Carreau (activity) | @h3pdesign (activity) | @hackowitz-af (activity) | @krassowski (activity) | @mberlanda (activity) | @mgorny (activity) | @minrk (activity) | @MSeal (activity) | @QuLogic (activity) | @salmankadaya (activity) | @shreve (activity) | @th3gowtham (activity)

Commits

21b35d8 Publish 7.17.0
c9ac1d1 Fix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD)...
b13276d avoid cov environment on free-threaded Pythons (#2267)
7c7055f [pre-commit.ci] auto fixes from pre-commit.com hooks
74f3ddd Fix QtPNGExporter returning empty bytes on macOS
216550b fix links
39777ac try to comment fialing test
7b591ca ruff-check
6ec7638 parent
59414b3 fix mypy
Additional commits viewable in compare view

Updates tornado from 6.5.0 to 6.5.5

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1 releases/v3.2.0 releases/v3.1.1

... (truncated)

Commits

7d64650 Merge pull request #3586 from bdarnell/update-cibw
d05d59b build: Bump cibuildwheel to 3.4.0
c2f4673 Merge pull request #3585 from bdarnell/release-655
e5f1aa4 Release notes and version bump for v6.5.5
78a046f httputil: Add CRLF to _FORBIDDEN_HEADER_CHARS_RE
24a2d96 web: Validate characters in all cookie attributes.
119a195 httputil: Add limits on multipart form data parsing
63d4df4 Merge pull request #3564 from bdarnell/release-654
eadbf9a Release notes and version bump for 6.5.4
bbc2b14 Make sure that the in-operator on HTTPHeaders is case insensitive
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the pip group with 6 updates in the /bazel directory: | Package | From | To | | --- | --- | --- | | [filelock](https://github.com/tox-dev/py-filelock) | `3.20.1` | `3.20.3` | | [protobuf](https://github.com/protocolbuffers/protobuf) | `6.32.0` | `6.33.5` | | [requests](https://github.com/psf/requests) | `2.32.4` | `2.33.0` | | [virtualenv](https://github.com/pypa/virtualenv) | `20.35.4` | `20.36.1` | | [nbconvert](https://github.com/jupyter/nbconvert) | `7.16.6` | `7.17.0` | | [tornado](https://github.com/tornadoweb/tornado) | `6.5.0` | `6.5.5` | Updates `filelock` from 3.20.1 to 3.20.3 - [Release notes](https://github.com/tox-dev/py-filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](tox-dev/filelock@3.20.1...3.20.3) Updates `protobuf` from 6.32.0 to 6.33.5 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `requests` from 2.32.4 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.4...v2.33.0) Updates `virtualenv` from 20.35.4 to 20.36.1 - [Release notes](https://github.com/pypa/virtualenv/releases) - [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst) - [Commits](pypa/virtualenv@20.35.4...20.36.1) Updates `nbconvert` from 7.16.6 to 7.17.0 - [Release notes](https://github.com/jupyter/nbconvert/releases) - [Changelog](https://github.com/jupyter/nbconvert/blob/main/CHANGELOG.md) - [Commits](jupyter/nbconvert@v7.16.6...v7.17.0) Updates `tornado` from 6.5.0 to 6.5.5 - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.0...v6.5.5) --- updated-dependencies: - dependency-name: filelock dependency-version: 3.20.3 dependency-type: indirect dependency-group: pip - dependency-name: protobuf dependency-version: 6.33.5 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: virtualenv dependency-version: 20.36.1 dependency-type: direct:production dependency-group: pip - dependency-name: nbconvert dependency-version: 7.17.0 dependency-type: indirect dependency-group: pip - dependency-name: tornado dependency-version: 6.5.5 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <[email protected]>

Mizux · 2026-03-26T15:10:51Z

wrong branch

dependabot · 2026-03-26T15:10:54Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot bot added Dependencies Pull requests that update a dependency file python Pull requests that update python code labels Mar 26, 2026

Mizux closed this Mar 26, 2026

dependabot bot deleted the dependabot/pip/bazel/pip-d159dab25a branch March 26, 2026 15:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

build(deps): bump the pip group across 1 directory with 6 updates#5103

build(deps): bump the pip group across 1 directory with 6 updates#5103
dependabot[bot] wants to merge 1 commit intostablefrom
dependabot/pip/bazel/pip-d159dab25a

dependabot bot commented on behalf of github Mar 26, 2026

Uh oh!

Mizux commented Mar 26, 2026

Uh oh!

dependabot bot commented on behalf of github Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

dependabot bot commented on behalf of github Mar 26, 2026

3.20.3

What's Changed

3.20.2

What's Changed

New Contributors

Protocol Buffers v34.0-rc1

Announcements

Bazel

Compiler

C++

v2.33.0

2.33.0 (2026-03-25)

New Contributors

v2.32.5

2.32.5 (2025-08-18)

2.33.0 (2026-03-25)

2.32.5 (2025-08-18)

20.36.0

What's Changed

New Contributors

Bugfixes - 20.36.1

Features - 20.36.0

v7.17.0

7.17.0

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

7.17.0

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

Release notes

Uh oh!

Mizux commented Mar 26, 2026

Uh oh!

dependabot bot commented on behalf of github Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant