Skip to content

Bump pip from 24.3.1 to 25.0#10361

Merged
github-actions[bot] merged 1 commit intomasterfrom
dependabot/pip/pip-25.0
Jan 27, 2025
Merged

Bump pip from 24.3.1 to 25.0#10361
github-actions[bot] merged 1 commit intomasterfrom
dependabot/pip/pip-25.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Jan 27, 2025

Bumps pip from 24.3.1 to 25.0.

Changelog

Sourced from pip's changelog.

25.0 (2025-01-26)

Deprecations and Removals

  • Deprecate the no-python-version-warning flag as it has long done nothing since Python 2 support was removed in pip 21.0. ([#13154](https://github.com/pypa/pip/issues/13154) <https://github.com/pypa/pip/issues/13154>_)

Features

  • Prefer to display :pep:639 License-Expression in pip show if metadata version is at least 2.4. ([#13112](https://github.com/pypa/pip/issues/13112) <https://github.com/pypa/pip/issues/13112>_)
  • Support :pep:639 License-Expression and License-File metadata fields in JSON output. pip inspect and pip install --report now emit license_expression and license_file fields in the metadata object, if the corresponding fields are present in the installed METADATA file. ([#13134](https://github.com/pypa/pip/issues/13134) <https://github.com/pypa/pip/issues/13134>_)
  • Files in the network cache will inherit the read/write permissions of pip's cache directory (in addition to the current user retaining read/write access). This enables a single cache to be shared among multiple users. ([#11012](https://github.com/pypa/pip/issues/11012) <https://github.com/pypa/pip/issues/11012>_)
  • Return the size, along with the number, of files cleared on pip cache purge and pip cache remove ([#12176](https://github.com/pypa/pip/issues/12176) <https://github.com/pypa/pip/issues/12176>_)
  • Cache python-requires checks while filtering potential installation candidates. ([#13128](https://github.com/pypa/pip/issues/13128) <https://github.com/pypa/pip/issues/13128>_)
  • Optimize package collection by avoiding unnecessary URL parsing and other processing. ([#13132](https://github.com/pypa/pip/issues/13132) <https://github.com/pypa/pip/issues/13132>_)

Bug Fixes

  • Reorder the encoding detection when decoding a requirements file, relying on UTF-8 over the locale encoding by default, matching the documented behaviour. ([#12771](https://github.com/pypa/pip/issues/12771) <https://github.com/pypa/pip/issues/12771>_)
  • The pip version self check is disabled on EXTERNALLY-MANAGED environments. ([#11820](https://github.com/pypa/pip/issues/11820) <https://github.com/pypa/pip/issues/11820>_)
  • Fix a security bug allowing a specially crafted wheel to execute code during installation. ([#13079](https://github.com/pypa/pip/issues/13079) <https://github.com/pypa/pip/issues/13079>_)
  • The inclusion of packaging 24.2 changes how pre-release specifiers with < and > behave. Including a pre-release version with these specifiers now implies accepting pre-releases (e.g., <2.0dev can include 1.0rc1). To avoid implying pre-releases, avoid specifying them (e.g., use <2.0). The exception is !=, which never implies pre-releases. ([#13163](https://github.com/pypa/pip/issues/13163) <https://github.com/pypa/pip/issues/13163>_)
  • The --cert and --client-cert command-line options are now respected while installing build dependencies. Consequently, the private _PIP_STANDALONE_CERT environment variable is no longer used. ([#5502](https://github.com/pypa/pip/issues/5502) <https://github.com/pypa/pip/issues/5502>_)
  • The --proxy command-line option is now respected while installing build dependencies. ([#6018](https://github.com/pypa/pip/issues/6018) <https://github.com/pypa/pip/issues/6018>_)

Vendored Libraries

  • Upgrade CacheControl to 0.14.1
  • Upgrade idna to 3.10
  • Upgrade msgpack to 1.1.0
  • Upgrade packaging to 24.2

... (truncated)

Commits
  • f47b587 Bump for release
  • 74a7f33 Update AUTHORS.txt
  • a008888 Merge pull request #13171 from pypa/dependabot/github_actions/github-actions-...
  • d265fb7 Merge pull request #13174 from ichard26/changelog
  • d35384e Copyedit news entries before 25.0
  • adc4f99 Reorder requirements file decoding (#12795)
  • 40c4214 Bump pypa/gh-action-pypi-publish in the github-actions group
  • 6b0fb90 Merge pull request #13048 from sbidoul/trusted-publisher-sbi
  • c7fb1e1 Merge pull request #13145 from befeleme/pip-show-pep639
  • 41c807c Show License-Expression if present in package metadata
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [pip](https://github.com/pypa/pip) from 24.3.1 to 25.0.
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](pypa/pip@24.3.1...25.0)

---
updated-dependencies:
- dependency-name: pip
  dependency-type: indirect
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot requested a review from webknjaz as a code owner January 27, 2025 10:31
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jan 27, 2025
@dependabot dependabot bot requested a review from asvetlov as a code owner January 27, 2025 10:31
@github-actions github-actions bot enabled auto-merge (squash) January 27, 2025 10:31
@codspeed-hq
Copy link
Copy Markdown

codspeed-hq bot commented Jan 27, 2025

CodSpeed Performance Report

Merging #10361 will not alter performance

Comparing dependabot/pip/pip-25.0 (71aac17) with master (24913d7)

Summary

✅ 47 untouched benchmarks

@codecov
Copy link
Copy Markdown

codecov bot commented Jan 27, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.77%. Comparing base (24913d7) to head (71aac17).
Report is 430 commits behind head on master.

✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff             @@
##           master   #10361      +/-   ##
==========================================
- Coverage   98.78%   98.77%   -0.01%     
==========================================
  Files         122      122              
  Lines       37038    37038              
  Branches     2041     2041              
==========================================
- Hits        36588    36585       -3     
- Misses        311      314       +3     
  Partials      139      139              
Flag Coverage Δ
CI-GHA 98.66% <ø> (-0.01%) ⬇️
OS-Linux 98.35% <ø> (-0.01%) ⬇️
OS-Windows 96.25% <ø> (-0.01%) ⬇️
OS-macOS 97.46% <ø> (ø)
Py-3.10.11 97.35% <ø> (ø)
Py-3.10.16 97.92% <ø> (ø)
Py-3.11.11 98.01% <ø> (-0.01%) ⬇️
Py-3.11.9 97.43% <ø> (ø)
Py-3.12.8 98.44% <ø> (ø)
Py-3.13.1 98.43% <ø> (ø)
Py-3.9.13 97.25% <ø> (-0.01%) ⬇️
Py-3.9.21 97.80% <ø> (-0.01%) ⬇️
Py-pypy7.3.16 97.39% <ø> (-0.01%) ⬇️
VM-macos 97.46% <ø> (ø)
VM-ubuntu 98.35% <ø> (-0.01%) ⬇️
VM-windows 96.25% <ø> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@github-actions github-actions bot merged commit b1fd346 into master Jan 27, 2025
@github-actions github-actions bot deleted the dependabot/pip/pip-25.0 branch January 27, 2025 10:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants