Bump the pydeps group in /server with 4 updates

[dependabot]

Bumps the pydeps group in /server with 4 updates: outcome, werkzeug, hypercorn and boto3-stubs.

Updates outcome from 1.3.0 to 1.3.0.post0

Commits

• bf687c9 Bump version to 1.3.0.post0
• c803e74 Merge pull request #39 from A5rocks/post-release-fixes
• 1bcda1c Add typing classifier and changelog link
• e726f6d Fix up changelog
• 645758d Merge pull request #38 from A5rocks/release-1.3.0
• c3d55a5 Start new version cycle
• 1640926 Counteract CI bitrot
• ddcf47f Update RTD to v2 config
• See full diff in compare view

Updates werkzeug from 2.3.7 to 3.0.1

Release notes

Sourced from werkzeug's releases.

3.0.1

This is a security release for the 3.0.x feature branch.

• Changes: https://werkzeug.palletsprojects.com/en/3.0.x/changes/#version-3-0-1

3.0.0

This is a feature release, which includes new features, removes previously deprecated code, and adds new deprecations. The 3.0.x branch is now the supported fix branch, the 2.3.x branch will become a tag marking the end of support for that branch. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

• Changes: https://werkzeug.palletsprojects.com/en/3.0.x/changes/#version-3-0-0
• Milestone: https://github.com/pallets/werkzeug/milestone/21?closed=1

Changelog

Sourced from werkzeug's changelog.

Version 3.0.1

Released 2023-10-24

• Fix slow multipart parsing for large parts potentially enabling DoS attacks. :cwe:CWE-407

Version 3.0.0

Released 2023-09-30

• Remove previously deprecated code. :pr:2768
• Deprecate the __version__ attribute. Use feature detection, or importlib.metadata.version("werkzeug"), instead. :issue:2770
• generate_password_hash uses scrypt by default. :issue:2769
• Add the "werkzeug.profiler" item to the WSGI environ dictionary passed to ProfilerMiddleware's filename_format function. It contains the elapsed and time values for the profiled request. :issue:2775
• Explicitly marked the PathConverter as non path isolating. :pr:2784

Version 2.3.8

Unreleased

Commits

• ce4eff5 Release version 3.0.1
• b1916c0 Fix: slow multipart parsing for huge files with few CR/LF characters
• 726eaa2 Release version 3.0.0
• 6427542 Default the PathConverter (and descendants) to be non part isolating
• 4820d8c Provide elapsed and timestamp info to filename_format
• 599993d Bump pypa/gh-action-pypi-publish from 1.8.8 to 1.8.10 (#2780)
• a2394ed Bump slsa-framework/slsa-github-generator from 1.7.0 to 1.9.0 (#2779)
• 1efd6f3 Bump actions/checkout from 3.5.3 to 3.6.0 (#2778)
• 76a5419 Bump pypa/gh-action-pypi-publish from 1.8.8 to 1.8.10
• ce8cfe7 Bump slsa-framework/slsa-github-generator from 1.7.0 to 1.9.0
• Additional commits viewable in compare view

Updates hypercorn from 0.14.4 to 0.15.0

Changelog

Sourced from hypercorn's changelog.

0.15.0 2023-10-29

• Improve the NoAppError to help diagnose why the app has not been found.
• Log cancelled requests as well as successful to aid diagnositics of failures.
• Use more modern asyncio apis. This will hopefully fix reported memory leak issues.
• Bugfix only load the application in the main process if the reloader is being used.
• Bugfix Autoreload error because reausing old sockets.
• Bugfix scope client usage for sock binding.
• Bugfix disable multiprocessing if number of workers is 0 to support systems that don't support multiprocessing.

Commits

• 2724ad6 Bump and release 0.15.0
• 662ffa9 Disable multiprocessing if number of workers is 0
• 30e6f03 Bugfix scope client usage for sock binding
• 76bd00f Fix fomatting in 4854ffd89e8661213ff20828b7568a9f004803a9
• 8133958 Use more modern asyncio apis
• 3dc7908 Support Python 3.12 drop Python 3.7
• 4854ffd fix: Autoreload error because reausing old sockets
• 42ac5db Only load the application in the main process if the reloader is being used.
• 96e3fce Document keyfile_password configuration factor
• d7990fb Add some useful flow diagrams
• Additional commits viewable in compare view

Updates boto3-stubs from 1.28.69 to 1.28.73

Commits

• See full diff in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[mmmarcos]

@dependabot ignore werkzeug major version

[dependabot]

OK, I won't notify you about version 3.x.x of werkzeug again, unless you unignore it.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.