Merge branch '3.1.x'

Author: davidism

.github/dependabot.yml

@@ -23,7 +23,7 @@ jobs:
       - name: generate hash
         id: hash
         run: cd dist && echo "hash=$(sha256sum * | base64 -w0)" >> $GITHUB_OUTPUT
-      - uses: actions/upload-artifact@0b2256b8c012f0828dc542b3febcab082c67f72b # v4.3.4
+      - uses: actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a # v4.3.6
         with:
           path: ./dist
   provenance:

.github/workflows/publish.yaml

@@ -2,7 +2,7 @@ ci:
   autoupdate_schedule: monthly
 repos:
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.5.6
+    rev: v0.6.2
     hooks:
       - id: ruff
       - id: ruff-format

.pre-commit-config.yaml

@@ -94,8 +94,12 @@ select = [
     "UP",  # pyupgrade
     "W",  # pycodestyle warning
 ]
-ignore-init-module-imports = true
 
 [tool.ruff.lint.isort]
 force-single-line = true
 order-by-type = false
+
+[tool.gha-update]
+tag-only = [
+    "slsa-framework/slsa-github-generator",
+]

pyproject.toml

@@ -1,12 +1,18 @@
 #
-# This file is autogenerated by pip-compile with Python 3.12
+# This file is autogenerated by pip-compile with Python 3.8
 # by the following command:
 #
 #    pip-compile build.in
 #
 build==1.2.1
     # via -r build.in
-packaging==24.0
+importlib-metadata==8.4.0
+    # via build
+packaging==24.1
     # via build
 pyproject-hooks==1.1.0
     # via build
+tomli==2.0.1
+    # via build
+zipp==3.20.0
+    # via importlib-metadata

requirements/build.txt

@@ -1,179 +1,168 @@
 #
-# This file is autogenerated by pip-compile with Python 3.12
+# This file is autogenerated by pip-compile with Python 3.8
 # by the following command:
 #
 #    pip-compile dev.in
 #
-alabaster==0.7.16
+alabaster==0.7.13
+    # via sphinx
+attrs==24.2.0
     # via
-    #   -r docs.txt
-    #   sphinx
-attrs==23.2.0
-    # via
-    #   -r tests.txt
     #   outcome
     #   trio
-babel==2.15.0
-    # via
-    #   -r docs.txt
-    #   sphinx
-cachetools==5.3.3
+babel==2.16.0
+    # via sphinx
+build==1.2.1
+    # via pip-tools
+cachetools==5.5.0
     # via tox
-certifi==2024.2.2
-    # via
-    #   -r docs.txt
-    #   requests
+certifi==2024.7.4
+    # via requests
 cfgv==3.4.0
     # via pre-commit
 chardet==5.2.0
     # via tox
 charset-normalizer==3.3.2
+    # via requests
+click==8.1.7
     # via
-    #   -r docs.txt
-    #   requests
+    #   pip-compile-multi
+    #   pip-tools
 colorama==0.4.6
     # via tox
 distlib==0.3.8
     # via virtualenv
-docutils==0.21.2
+docutils==0.20.1
+    # via sphinx
+exceptiongroup==1.2.2
     # via
-    #   -r docs.txt
-    #   sphinx
-filelock==3.14.0
+    #   pytest
+    #   trio
+filelock==3.15.4
     # via
     #   tox
     #   virtualenv
-identify==2.5.36
+identify==2.6.0
     # via pre-commit
-idna==3.7
+idna==3.8
     # via
-    #   -r docs.txt
-    #   -r tests.txt
     #   requests
     #   trio
 imagesize==1.4.1
+    # via sphinx
+importlib-metadata==8.4.0
     # via
-    #   -r docs.txt
+    #   build
     #   sphinx
 iniconfig==2.0.0
-    # via
-    #   -r tests.txt
-    #   pytest
+    # via pytest
 jinja2==3.1.4
-    # via
-    #   -r docs.txt
-    #   sphinx
+    # via sphinx
 markupsafe==2.1.5
-    # via
-    #   -r docs.txt
-    #   jinja2
-mypy==1.10.0
-    # via -r typing.txt
+    # via jinja2
+mypy==1.11.1
+    # via -r typing.in
 mypy-extensions==1.0.0
-    # via
-    #   -r typing.txt
-    #   mypy
-nodeenv==1.8.0
+    # via mypy
+nodeenv==1.9.1
     # via pre-commit
 outcome==1.3.0.post0
+    # via trio
+packaging==24.1
     # via
-    #   -r tests.txt
-    #   trio
-packaging==24.0
-    # via
-    #   -r docs.txt
-    #   -r tests.txt
+    #   build
     #   pallets-sphinx-themes
     #   pyproject-api
     #   pytest
     #   sphinx
     #   tox
 pallets-sphinx-themes==2.1.3
-    # via -r docs.txt
-platformdirs==4.2.1
+    # via -r docs.in
+pip-compile-multi==2.6.4
+    # via -r dev.in
+pip-tools==7.4.1
+    # via pip-compile-multi
+platformdirs==4.2.2
     # via
     #   tox
     #   virtualenv
 pluggy==1.5.0
     # via
-    #   -r tests.txt
     #   pytest
     #   tox
-pre-commit==3.8.0
+pre-commit==3.5.0
     # via -r dev.in
 pygments==2.18.0
-    # via
-    #   -r docs.txt
-    #   sphinx
-pyproject-api==1.6.1
+    # via sphinx
+pyproject-api==1.7.1
     # via tox
-pytest==8.2.0
-    # via -r tests.txt
-pyyaml==6.0.1
+pyproject-hooks==1.1.0
+    # via
+    #   build
+    #   pip-tools
+pytest==8.3.2
+    # via -r tests.in
+pytz==2024.1
+    # via babel
+pyyaml==6.0.2
     # via pre-commit
-requests==2.31.0
-    # via
-    #   -r docs.txt
-    #   sphinx
+requests==2.32.3
+    # via sphinx
 sniffio==1.3.1
-    # via
-    #   -r tests.txt
-    #   trio
+    # via trio
 snowballstemmer==2.2.0
-    # via
-    #   -r docs.txt
-    #   sphinx
+    # via sphinx
 sortedcontainers==2.4.0
+    # via trio
+sphinx==7.1.2
     # via
-    #   -r tests.txt
-    #   trio
-sphinx==8.0.2
-    # via
-    #   -r docs.txt
+    #   -r docs.in
     #   pallets-sphinx-themes
+    #   sphinx-issues
     #   sphinxcontrib-log-cabinet
-sphinxcontrib-applehelp==1.0.8
-    # via
-    #   -r docs.txt
-    #   sphinx
-sphinxcontrib-devhelp==1.0.6
-    # via
-    #   -r docs.txt
-    #   sphinx
-sphinxcontrib-htmlhelp==2.0.5
-    # via
-    #   -r docs.txt
-    #   sphinx
+sphinx-issues==4.1.0
+    # via -r docs.in
+sphinxcontrib-applehelp==1.0.4
+    # via sphinx
+sphinxcontrib-devhelp==1.0.2
+    # via sphinx
+sphinxcontrib-htmlhelp==2.0.1
+    # via sphinx
 sphinxcontrib-jsmath==1.0.1
-    # via
-    #   -r docs.txt
-    #   sphinx
+    # via sphinx
 sphinxcontrib-log-cabinet==1.0.1
-    # via -r docs.txt
-sphinxcontrib-qthelp==1.0.7
-    # via
-    #   -r docs.txt
-    #   sphinx
-sphinxcontrib-serializinghtml==1.1.10
-    # via
-    #   -r docs.txt
-    #   sphinx
-tox==4.15.1
-    # via -r dev.in
-trio==0.26.0
-    # via -r tests.txt
-typing-extensions==4.11.0
-    # via
-    #   -r typing.txt
+    # via -r docs.in
+sphinxcontrib-qthelp==1.0.3
+    # via sphinx
+sphinxcontrib-serializinghtml==1.1.5
+    # via sphinx
+tomli==2.0.1
+    # via
+    #   build
     #   mypy
-urllib3==2.2.1
-    # via
-    #   -r docs.txt
-    #   requests
-virtualenv==20.26.1
+    #   pip-tools
+    #   pyproject-api
+    #   pytest
+    #   tox
+toposort==1.10
+    # via pip-compile-multi
+tox==4.18.0
+    # via -r dev.in
+trio==0.26.2
+    # via -r tests.in
+typing-extensions==4.12.2
+    # via mypy
+urllib3==2.2.2
+    # via requests
+virtualenv==20.26.3
     # via
     #   pre-commit
     #   tox
+wheel==0.44.0
+    # via pip-tools
+zipp==3.20.0
+    # via importlib-metadata
 
 # The following packages are considered to be unsafe in a requirements file:
+# pip
 # setuptools