Skip to content

chore(python): bump the pip-minor-patch group across 1 directory with 2 updates - #238

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dot-github/pip-minor-patch-386b8f8eb4
Open

chore(python): bump the pip-minor-patch group across 1 directory with 2 updates#238
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/dot-github/pip-minor-patch-386b8f8eb4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 14, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the pip-minor-patch group with 2 updates in the /.github directory: dnspython and onnx.

Updates dnspython from 2.8.0 to 2.9.0

Release notes

Sourced from dnspython's releases.

dnspython 2.9.0

This release fixes a potential excessive CPU consumption issue. Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos, for discovering and reporting this issue.

See What's New for details.

The minimum supported version of Python is 3.11.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

Changelog

Sourced from dnspython's changelog.

2.9.0

  • Decompression chain length is limited to 16. Prior to this change, a maliciously crafted DNS message could cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications which processed untrusted DNS wire form messages with dnspython could be degraded or DoS'd by the extra CPU use required.

    Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos for finding and reporting this issue.

    See GHSA-45c3-73f7-pv4m

  • Httpx2 has replaced httpx for HTTPS TCP connections.

  • The minimum supported Python version is now 3.11.

  • DNSSEC now supports ML-DSA-44, a post-quantum signature algorithm.

  • The NSEC3 Next Hashed Owner Name in presentation format is now decoded as base32hex (RFC 5155 Section 1.3, RFC 4648 Extended Hex Alphabet). The letters W, X, Y, and Z are not in that alphabet; they used to be accepted and silently decoded to a different owner name, so to_text of the result did not match the input. They are now rejected.

  • The NID and L64 node/locator ids in presentation format are now rejected when a group contains anything other than hex digits. A sign or underscore, which int() silently accepts, produced a record whose text form did not parse back the same way (RFC 6742).

  • Rdata of a known type in the generic \# syntax, such as an NS record in a zone file, no longer fails to parse when it contains a name under the origin. Its names are relativized as in the type's own text form.

  • The SVCB and HTTPS ech parameter value must now be an ECHConfigList with a correct length prefix and at least 4 octets of content (RFC 9848, RFC 9849). The individual ECHConfig structures are not checked.

  • SVCB and HTTPS SvcParamKeys in presentation format, including those listed in mandatory, must now be spelled as RFC 9460 requires: 1-63 lowercase letters, digits, or hyphens. Uppercase keys such as ALPN and keys with underscores such as no_default_alpn are rejected.

  • SVCB and HTTPS presentation format parsing now follows the escaping rules of RFC 9460. SvcParamKeys may not contain escapes (e.g. \097lpn=h2), and in comma-separated values (alpn, docpath) only \, and \\ are valid escapes after character-string decoding (e.g. alpn="h2\\x" is rejected).

... (truncated)

Commits

Updates onnx from 1.23.0 to 1.23.2

Release notes

Sourced from onnx's releases.

Release 1.23.2

Bug fix Release 1.23.2

What's Changed

Other Changes

Full Changelog: onnx/onnx@v1.23.1...v1.23.2

Release 1.23.1

This patch release includes important bug fixes to ONNX build.

What's Changed

Full Changelog: onnx/onnx@v1.23.0...v1.23.1

Commits

@dependabot @github

dependabot Bot commented on behalf of github Oct 14, 2026

Copy link
Copy Markdown
Contributor Author

Labels

The following labels could not be found: automated-dep-update. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

@github-actions github-actions Bot added the pr-validation-passed The pr-review workflow's validator passed. Other status checks report separately. label Oct 14, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/dot-github/pip-minor-patch-386b8f8eb4 branch from 1fc1c67 to 58aec17 Compare October 20, 2026 08:08
@github-actions github-actions Bot added pr-validation-passed The pr-review workflow's validator passed. Other status checks report separately. and removed pr-validation-passed The pr-review workflow's validator passed. Other status checks report separately. labels Oct 20, 2026
@faranm-stack

faranm-stack commented Oct 21, 2026

Copy link
Copy Markdown
Contributor

Dependabot (@dependabot) rebase

@dependabot
dependabot Bot force-pushed the dependabot/pip/dot-github/pip-minor-patch-386b8f8eb4 branch from 58aec17 to 6d065c8 Compare October 21, 2026 00:54
@github-actions github-actions Bot added pr-validation-passed The pr-review workflow's validator passed. Other status checks report separately. and removed pr-validation-passed The pr-review workflow's validator passed. Other status checks report separately. labels Oct 21, 2026
yousefi-msft
yousefi-msft approved these changes Oct 26, 2026
View reviewed changes

@yousefi-msft yousefi-msft left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@dependabot
chore(python): bump the pip-minor-patch group across 1 directory with…
ba2d8ea 
… 2 updates

Bumps the pip-minor-patch group with 2 updates in the /.github directory: [dnspython](https://github.com/rthalley/dnspython) and [onnx](https://github.com/onnx/onnx).


Updates `dnspython` from 2.8.0 to 2.9.0
- [Release notes](https://github.com/rthalley/dnspython/releases)
- [Changelog](https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst)
- [Commits](rthalley/dnspython@v2.8.0...v2.9.0)

Updates `onnx` from 1.23.0 to 1.23.2
- [Release notes](https://github.com/onnx/onnx/releases)
- [Changelog](https://github.com/onnx/onnx/blob/main/docs/Changelog-ml.md)
- [Commits](onnx/onnx@v1.23.0...v1.23.2)

---
updated-dependencies:
- dependency-name: dnspython
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-patch
- dependency-name: onnx
  dependency-version: 1.23.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/dot-github/pip-minor-patch-386b8f8eb4 branch from 6d065c8 to ba2d8ea Compare October 27, 2026 08:10
@dependabot
dependabot Bot requested a review from a team as a code owner October 27, 2026 08:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@yousefi-msft yousefi-msft yousefi-msft approved these changes

Assignees

No one assigned

Labels

pr-validation-passed The pr-review workflow's validator passed. Other status checks report separately.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@faranm-stack @yousefi-msft