Bump python-gitlab from 5.0.0 to 5.1.0

[dependabot]

Bumps python-gitlab from 5.0.0 to 5.1.0.

Release notes

Sourced from python-gitlab's releases.

v5.1.0 (2024-11-28)

Chores

• deps: Update all non-major dependencies (9061647)

• deps: Update gitlab/gitlab-ee docker tag to v17.6.0-ee.0 (#3044, 79113d9)

Co-authored-by: renovate[bot]

• deps: Update all non-major dependencies (62da12a)

• deps: Update gitlab/gitlab-ee docker tag to v17.5.2-ee.0 (#3041, d39129b)

Co-authored-by: renovate[bot]

• deps: Update pre-commit hook maxbrunet/pre-commit-renovate to v39 (11458e0)

• deps: Update all non-major dependencies (7e62136)

• deps: Update dependency pytest-cov to v6 (ffa88b3)

• deps: Update all non-major dependencies (d4b52e7)

• deps: Update all non-major dependencies (541a7e3)

• deps: Update gitlab/gitlab-ee docker tag to v17.5.1-ee.0 (8111f49)

Features

• api: Get single project approval rule (029695d)

• cli: Enable token rotation via CLI (0cb8171)

• const: Add new Planner role to access levels (bdc8852)

• api: Support list and delete for group service accounts (#2963, 499243b)

• files: Add support for more optional flags (f51cd52)

GitLab's Repository Files API supports additional flags that weren't implemented before. Notably, the "start_branch" flag is particularly useful, as previously one had to use the "project-branch" command alongside "project-file" to add a file on a separate branch.

[1] https://docs.gitlab.com/ee/api/repository_files.html

Changelog

Sourced from python-gitlab's changelog.

v5.1.0 (2024-11-28)

Chores

• deps: Update all non-major dependencies (9061647)

• deps: Update gitlab/gitlab-ee docker tag to v17.6.0-ee.0 (#3044, 79113d9)

Co-authored-by: renovate[bot]

• deps: Update all non-major dependencies (62da12a)

• deps: Update gitlab/gitlab-ee docker tag to v17.5.2-ee.0 (#3041, d39129b)

Co-authored-by: renovate[bot]

• deps: Update pre-commit hook maxbrunet/pre-commit-renovate to v39 (11458e0)

• deps: Update all non-major dependencies (7e62136)

• deps: Update dependency pytest-cov to v6 (ffa88b3)

• deps: Update all non-major dependencies (d4b52e7)

• deps: Update all non-major dependencies (541a7e3)

• deps: Update gitlab/gitlab-ee docker tag to v17.5.1-ee.0 (8111f49)

Features

• api: Get single project approval rule (029695d)

• cli: Enable token rotation via CLI (0cb8171)

• const: Add new Planner role to access levels (bdc8852)

... (truncated)

Commits

• 9877520 chore: release v5.1.0
• 029695d feat(api): get single project approval rule
• 0cb8171 feat(cli): enable token rotation via CLI
• bdc8852 feat(const): add new Planner role to access levels
• 9061647 chore(deps): update all non-major dependencies
• 79113d9 chore(deps): update gitlab/gitlab-ee docker tag to v17.6.0-ee.0 (#3044)
• 62da12a chore(deps): update all non-major dependencies
• d39129b chore(deps): update gitlab/gitlab-ee docker tag to v17.5.2-ee.0 (#3041)
• 11458e0 chore(deps): update pre-commit hook maxbrunet/pre-commit-renovate to v39
• 7e62136 chore(deps): update all non-major dependencies
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dryrunsecurity]

DryRun Security Summary

The provided requirements.txt file has been updated to include a new version of the python-gitlab library, and the file also includes a comprehensive list of dependencies and their versions, as well as several security-related dependencies, indicating that security is being considered in the project.

Expand for full summary

Summary:

The provided code changes in the requirements.txt file indicate an update to the python-gitlab library from version 5.0.0 to 5.1.0. From an application security perspective, this update is a positive step, as keeping dependencies up-to-date helps address known vulnerabilities in the used libraries. The file also includes a comprehensive list of dependencies and their versions, which is important for maintaining a consistent and secure development environment.

Additionally, the file includes several security-related dependencies, such as cryptography, argon2-cffi, and vulners, which is a good sign that security is being considered in the project. The file also includes a commented-out dependency for django-tagging, which is noted as being very outdated and only used for migration purposes. Removing unused dependencies is a recommended practice to minimize the attack surface and potential vulnerabilities.

Overall, the changes in the requirements.txt file appear to be routine updates and maintenance of the project's dependencies, and they seem to be managed with security in mind. However, it's always important to review the changes in the context of the entire application and its security requirements.

Files Changed:

• requirements.txt: This file has been updated to include a new version of the python-gitlab library, from 5.0.0 to 5.1.0. The file also includes a comprehensive list of dependencies and their versions, as well as several security-related dependencies. A commented-out dependency for django-tagging has been noted as being very outdated and only used for migration purposes.

Code Analysis

We ran 9 analyzers against 1 file and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

View PR in the DryRun Dashboard.

[mtesauro]

Approved