Skip to content

chore(deps): bump the python-dependencies group across 1 directory with 4 updates#73

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-bc74f3dc2e
Open

chore(deps): bump the python-dependencies group across 1 directory with 4 updates#73
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-bc74f3dc2e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 10, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 4 updates in the / directory: flask-cors, google-cloud-kms, google-auth and google-api-python-client.

Updates flask-cors from 6.0.0 to 6.0.1

Release notes

Sourced from flask-cors's releases.

6.0.1

What's Changed

New Contributors

Full Changelog: corydolphin/flask-cors@6.0.0...6.0.1

6.0.1.dev

What's Changed

New Contributors

Full Changelog: corydolphin/flask-cors@6.0.0...6.0.1.dev

Commits

Updates google-cloud-kms from 3.6.0 to 3.7.0

Changelog

Sourced from google-cloud-kms's changelog.

3.7.0 (2025-10-16)

Documentation

Features

Bug Fixes

Commits

Updates google-auth from 2.41.1 to 2.43.0

Release notes

Sourced from google-auth's releases.

google-auth 2.43.0

2.43.0 (2025-11-05)

Features

  • Add public wrapper for _mtls_helper.check_use_client_cert which enables mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the MWID/X.509 cert sources detected (#1859) (1535eccb)

  • Enable mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, if the MWID/X.509 cert sources detected (#1848) (395e405b)

  • onboard google-auth to librarian (#1838) (c503eaa5)

v2.42.1

2.42.1 (2025-10-30)

Bug Fixes

v2.42.0

2.42.0 (2025-10-24)

Features

  • Add trust boundary support for external accounts. (#1809) (36ecb1d)

Bug Fixes

  • Read scopes from ADC json for impersoanted cred (#1820) (62c0fc8)
Changelog

Sourced from google-auth's changelog.

2.43.0 (2025-11-05)

Features

  • Add public wrapper for _mtls_helper.check_use_client_cert which enables mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the MWID/X.509 cert sources detected (#1859) Add public wrapper for check_use_client_cert which enables mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, when the MWID/X.509 cert sources detected. Also, fix check_use_client_cert to return boolean value. Change #1848 added the check_use_client_cert method that helps know if client cert should be used for mTLS connection. However, that was in a private class, thus, created a public wrapper of the same function so that it can be used by python Client Libraries. Also, updated check_use_client_cert to return a boolean value instead of existing string value for better readability and future scope. --------- (1535eccbff0ad8f3fd6a9775316ac8b77dca66ba)
  • Enable mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, if the MWID/X.509 cert sources detected (#1848) The Python SDK will use a hybrid approach for mTLS enablement:
  • If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is set (either true or false), the SDK will respect that setting. This is necessary for test scenarios and users who need to explicitly control mTLS behavior.
  • If the GOOGLE_API_USE_CLIENT_CERTIFICATE environment variable is not set, the SDK will automatically enable mTLS only if it detects Managed Workload Identity (MWID) or X.509 Workforce Identity Federation (WIF) certificate sources. In other cases where the variable is not set, mTLS will remain disabled. ** This change also adds the helper method check_use_client_cert and it's unit test, which will be used for checking the criteria for setting the mTLS to true ** This change is only for Auth-Library, other changes will be created for Client-Library use-cases. --------- (395e405b64b56ddb82ee639958c2e8056ad2e82b)

2.42.1 (2025-10-30)

Bug Fixes

2.42.0 (2025-10-24)

Features

  • Add trust boundary support for external accounts. (#1809) (36ecb1d)

... (truncated)

Commits
  • 89a8838 chore: librarian release pull request: 20251105T230735Z (#1863)
  • 79564e2 chore: update prev version in state (#1862)
  • 1535ecc feat: Add public wrapper for _mtls_helper.check_use_client_cert which enables...
  • 54502a7 chore: update secret (#1860)
  • 395e405 feat: Enable mTLS if GOOGLE_API_USE_CLIENT_CERTIFICATE is not set, if the MW...
  • f2708b2 chore: secret upadte (#1857)
  • c503eaa feat: onboard google-auth to librarian (#1838)
  • 5d1b862 chore(main): release 2.42.1 (#1853)
  • b074cad fix: catch ValueError for json.loads() (#1842)
  • cb62f57 chore: secret update (#1851)
  • Additional commits viewable in compare view

Updates google-api-python-client from 2.184.0 to 2.187.0

Release notes

Sourced from google-api-python-client's releases.

v2.187.0

2.187.0 (2025-11-04)

Features

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the python-dependencies group across 1 directory wi…
e0e3fe8 
…th 4 updates

Bumps the python-dependencies group with 4 updates in the / directory: [flask-cors](https://github.com/corydolphin/flask-cors), [google-cloud-kms](https://github.com/googleapis/google-cloud-python), [google-auth](https://github.com/googleapis/google-auth-library-python) and [google-api-python-client](https://github.com/googleapis/google-api-python-client).


Updates `flask-cors` from 6.0.0 to 6.0.1
- [Release notes](https://github.com/corydolphin/flask-cors/releases)
- [Changelog](https://github.com/corydolphin/flask-cors/blob/main/CHANGELOG.md)
- [Commits](corydolphin/flask-cors@6.0.0...6.0.1)

Updates `google-cloud-kms` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-kms-v3.6.0...google-cloud-kms-v3.7.0)

Updates `google-auth` from 2.41.1 to 2.43.0
- [Release notes](https://github.com/googleapis/google-auth-library-python/releases)
- [Changelog](https://github.com/googleapis/google-auth-library-python/blob/main/CHANGELOG.md)
- [Commits](googleapis/google-auth-library-python@v2.41.1...v2.43.0)

Updates `google-api-python-client` from 2.184.0 to 2.187.0
- [Release notes](https://github.com/googleapis/google-api-python-client/releases)
- [Commits](googleapis/google-api-python-client@v2.184.0...v2.187.0)

---
updated-dependencies:
- dependency-name: flask-cors
  dependency-version: 6.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: google-cloud-kms
  dependency-version: 3.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: google-auth
  dependency-version: 2.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: google-api-python-client
  dependency-version: 2.187.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@github-actions

github-actions Bot commented Nov 10, 2025

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

PackageVersionScoreDetails
pip/Flask-CORS 6.0.1 🟢 4.4
Details
CheckScoreReason
Code-Review🟢 6Found 17/28 approved changesets -- score normalized to 6
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
Vulnerabilities🟢 100 existing vulnerabilities detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/google-api-python-client 2.187.0 🟢 7.2
Details
CheckScoreReason
Maintained🟢 1023 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Code-Review🟢 10all changesets reviewed
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy🟢 10security policy file detected
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Vulnerabilities🟢 100 existing vulnerabilities detected
Binary-Artifacts🟢 10no binaries found in the repo
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
pip/google-auth 2.43.0 🟢 7
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow⚠️ -1no workflows found
Security-Policy🟢 10security policy file detected
Maintained🟢 1023 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions⚠️ -1No tokens found
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
License🟢 10license file detected
Fuzzing🟢 10project is fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Vulnerabilities⚠️ 019 existing vulnerabilities detected
SAST🟢 7SAST tool is not run on all commits -- score normalized to 7
pip/google-cloud-kms 3.7.0 🟢 8.1
Details
CheckScoreReason
Code-Review🟢 10all changesets reviewed
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Token-Permissions🟢 10GitHub workflow tokens follow principle of least privilege
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
License🟢 10license file detected
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: githubv4.Query: Resource not accessible by integration
Signed-Releases⚠️ -1no releases found
Vulnerabilities🟢 37 existing vulnerabilities detected
SAST⚠️ -1internal error: internal error: Client.Checks.ListCheckRunsForRef: error during graphqlHandler.setupCheckRuns: non-200 OK status code: 504 Gateway Timeout body: "{\"message\": \"We couldn't respond to your request in time. Sorry about that. Please try resubmitting your request and contact us if the problem persists.\"}\r\n"
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing🟢 10project is fuzzed
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0

Scanned Files

  • requirements.txt

@shawntz

shawntz commented Jan 1, 2026

Copy link
Copy Markdown
Owner

fizzy

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies python

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@shawntz