Skip to content

Bump pip from 24.3.1 to 25.0#10365

Merged
github-actions[bot] merged 1 commit into3.12from
dependabot/pip/3.12/pip-25.0
Jan 28, 2025
Merged

Bump pip from 24.3.1 to 25.0#10365
github-actions[bot] merged 1 commit into3.12from
dependabot/pip/3.12/pip-25.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Jan 28, 2025

Bumps pip from 24.3.1 to 25.0.

Changelog

Sourced from pip's changelog.

25.0 (2025-01-26)

Deprecations and Removals

  • Deprecate the no-python-version-warning flag as it has long done nothing since Python 2 support was removed in pip 21.0. ([#13154](https://github.com/pypa/pip/issues/13154) <https://github.com/pypa/pip/issues/13154>_)

Features

  • Prefer to display :pep:639 License-Expression in pip show if metadata version is at least 2.4. ([#13112](https://github.com/pypa/pip/issues/13112) <https://github.com/pypa/pip/issues/13112>_)
  • Support :pep:639 License-Expression and License-File metadata fields in JSON output. pip inspect and pip install --report now emit license_expression and license_file fields in the metadata object, if the corresponding fields are present in the installed METADATA file. ([#13134](https://github.com/pypa/pip/issues/13134) <https://github.com/pypa/pip/issues/13134>_)
  • Files in the network cache will inherit the read/write permissions of pip's cache directory (in addition to the current user retaining read/write access). This enables a single cache to be shared among multiple users. ([#11012](https://github.com/pypa/pip/issues/11012) <https://github.com/pypa/pip/issues/11012>_)
  • Return the size, along with the number, of files cleared on pip cache purge and pip cache remove ([#12176](https://github.com/pypa/pip/issues/12176) <https://github.com/pypa/pip/issues/12176>_)
  • Cache python-requires checks while filtering potential installation candidates. ([#13128](https://github.com/pypa/pip/issues/13128) <https://github.com/pypa/pip/issues/13128>_)
  • Optimize package collection by avoiding unnecessary URL parsing and other processing. ([#13132](https://github.com/pypa/pip/issues/13132) <https://github.com/pypa/pip/issues/13132>_)

Bug Fixes

  • Reorder the encoding detection when decoding a requirements file, relying on UTF-8 over the locale encoding by default, matching the documented behaviour. ([#12771](https://github.com/pypa/pip/issues/12771) <https://github.com/pypa/pip/issues/12771>_)
  • The pip version self check is disabled on EXTERNALLY-MANAGED environments. ([#11820](https://github.com/pypa/pip/issues/11820) <https://github.com/pypa/pip/issues/11820>_)
  • Fix a security bug allowing a specially crafted wheel to execute code during installation. ([#13079](https://github.com/pypa/pip/issues/13079) <https://github.com/pypa/pip/issues/13079>_)
  • The inclusion of packaging 24.2 changes how pre-release specifiers with < and > behave. Including a pre-release version with these specifiers now implies accepting pre-releases (e.g., <2.0dev can include 1.0rc1). To avoid implying pre-releases, avoid specifying them (e.g., use <2.0). The exception is !=, which never implies pre-releases. ([#13163](https://github.com/pypa/pip/issues/13163) <https://github.com/pypa/pip/issues/13163>_)
  • The --cert and --client-cert command-line options are now respected while installing build dependencies. Consequently, the private _PIP_STANDALONE_CERT environment variable is no longer used. ([#5502](https://github.com/pypa/pip/issues/5502) <https://github.com/pypa/pip/issues/5502>_)
  • The --proxy command-line option is now respected while installing build dependencies. ([#6018](https://github.com/pypa/pip/issues/6018) <https://github.com/pypa/pip/issues/6018>_)

Vendored Libraries

  • Upgrade CacheControl to 0.14.1
  • Upgrade idna to 3.10
  • Upgrade msgpack to 1.1.0
  • Upgrade packaging to 24.2

... (truncated)

Commits
  • f47b587 Bump for release
  • 74a7f33 Update AUTHORS.txt
  • a008888 Merge pull request #13171 from pypa/dependabot/github_actions/github-actions-...
  • d265fb7 Merge pull request #13174 from ichard26/changelog
  • d35384e Copyedit news entries before 25.0
  • adc4f99 Reorder requirements file decoding (#12795)
  • 40c4214 Bump pypa/gh-action-pypi-publish in the github-actions group
  • 6b0fb90 Merge pull request #13048 from sbidoul/trusted-publisher-sbi
  • c7fb1e1 Merge pull request #13145 from befeleme/pip-show-pep639
  • 41c807c Show License-Expression if present in package metadata
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [pip](https://github.com/pypa/pip) from 24.3.1 to 25.0.
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](pypa/pip@24.3.1...25.0)

---
updated-dependencies:
- dependency-name: pip
  dependency-type: indirect
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot bot added the dependencies Pull requests that update a dependency file label Jan 28, 2025
@github-actions github-actions bot enabled auto-merge (squash) January 28, 2025 10:33
@codspeed-hq
Copy link
Copy Markdown

codspeed-hq bot commented Jan 28, 2025

CodSpeed Performance Report

Merging #10365 will not alter performance

Comparing dependabot/pip/3.12/pip-25.0 (b6650ae) with 3.12 (a120800)

Summary

✅ 47 untouched benchmarks

@codecov
Copy link
Copy Markdown

codecov bot commented Jan 28, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.09%. Comparing base (a120800) to head (b6650ae).
Report is 220 commits behind head on 3.12.

✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff             @@
##             3.12   #10365      +/-   ##
==========================================
+ Coverage   97.01%   98.09%   +1.08%     
==========================================
  Files         123      123              
  Lines       37232    37237       +5     
  Branches     2111     2111              
==========================================
+ Hits        36119    36528     +409     
+ Misses        919      540     -379     
+ Partials      194      169      -25     
Flag Coverage Δ
CI-GHA 97.98% <ø> (+1.04%) ⬆️
OS-Linux 97.68% <ø> (+0.74%) ⬆️
OS-Windows 94.73% <ø> (?)
OS-macOS 96.81% <ø> (?)
Py-3.10.11 96.70% <ø> (?)
Py-3.10.16 97.26% <ø> (+0.67%) ⬆️
Py-3.11.11 97.33% <ø> (?)
Py-3.11.9 96.80% <ø> (?)
Py-3.12.8 97.77% <ø> (+0.96%) ⬆️
Py-3.13.1 97.76% <ø> (+0.96%) ⬆️
Py-3.9.13 96.61% <ø> (?)
Py-3.9.21 97.16% <ø> (?)
Py-pypy7.3.16 96.75% <ø> (?)
VM-macos 96.81% <ø> (?)
VM-ubuntu 97.68% <ø> (+0.74%) ⬆️
VM-windows 94.73% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@github-actions github-actions bot merged commit b5c1415 into 3.12 Jan 28, 2025
@github-actions github-actions bot deleted the dependabot/pip/3.12/pip-25.0 branch January 28, 2025 10:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants