chore(deps): bump jwcrypto from 1.4.2 to 1.5.0 #66
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
dependabot
bot
added
the
dependencies
Bumps [jwcrypto](https://github.com/latchset/jwcrypto) from 1.4.2 to 1.5.0. - [Release notes](https://github.com/latchset/jwcrypto/releases) - [Commits](latchset/jwcrypto@v1.4.2...v1.5.0) --- updated-dependencies: - dependency-name: jwcrypto dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
force-pushed
the
dependabot/pip/jwcrypto-1.5.0
branch
from
ce6934a to
de3b146
Compare
There was a problem hiding this comment.
Install updates
Outside the devcontainer
Checkout this branch and rebuild the devcontainer
Inside the devcontainer
Confirm package updates (edited for brevity / relevant packages)
$ pip freeze
...
jwcrypto==1.5.0Run pytest
✅ All pytests passed locally
Inside the devcontainer
$ export PYTHONWARNINGS="default"
$ pytest
==================================================================== test session starts
platform linux -- Python 3.9.17, pytest-7.3.2, pluggy-1.0.0
rootdir: /home/calitp/src
plugins: mock-3.11.1, cov-4.1.0
collected 17 items
...
===================================================================== 17 passed in 0.43sAdditional manual tests
✅ Confirmed Agency Card verification (local benefits, local eligibility-server)
Configure server
Outside the devcontainer.
Replace the reference to eligibility-api in requirements.txt to point to this PR's commit:
git+https://github.com/cal-itp/eligibility-api.git@de3b146daef0f535e1a780e857f3c3290629e28b#egg=eligibility_api
Rebuild the image:
$ bin/build.shConfigure Benefits
Outside the devcontainer.
See the note on this related PR review: cal-itp/eligibility-server#259 (review)
Ensure Benefits compose.yml points to the newly built eligibility_server:latest image
server:
image: eligibility_server:latestUpdate the reference to eligibility-api in pyprojecy.toml using the PEP508 format:
dependencies = [
...
"eligibility_api @ git+https://github.com/cal-itp/eligibility-api.git@de3b146daef0f535e1a780e857f3c3290629e28b#egg=eligibility_api",
...
]
Rebuild the benefits image:
$ docker compose build clientStart the client and server:
$ docker compose up -d client serverAttach terminals to both running client and server to confirm they are using the updated package:
Confirm eligibility verification.
Bumps jwcrypto from 1.4.2 to 1.5.0.
Release notes
Sourced from jwcrypto's releases.
Commits
41fb08aVersion 1.5db1f9f4Add test to generate key with algorithme08cbf1Use separate input_keysize property2fec703Misc fixes and docstring corrections9f2cd3aFix CI to run on the correct branch for maindc21a78Fix test to actually do what it should381c5d1Fix codespell issue0c31ee0Make linter happier about dummy exception4f6cf30Python 3.6 is not available anymore in CI652afd9Fix error messageDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)