chore(deps): update requests requirement from <3.0.0,>=2.31.0 to >=2.34.2,<3.0.0 in /tests - #70
Closed
dependabot[bot] wants to merge 2 commits into
Closed
Conversation
…rewrite Version bumped to IRIS-NG-v1.1.0; Helm chart 0.5.0 (appVersion follows, which is what the rendered image tags derive from). IRIS-NG-v1.0.3 was staged on main but never tagged or released, so nothing shipped under that number. Its changes are included here and its CHANGELOG entry is annotated accordingly. [IMP] correlation: weigh shared indicators instead of counting them Cluster confidence was a function of the shared-IOC count alone, which treats a public DNS resolver and a unique C2 hash as equal evidence. It now weighs each indicator by rarity across the cases in scope and by credibility (admiralty-scale tags, extractor noise flags), then discounts the total by graph cohesion — single-linkage clustering means A-B plus B-C forms one cluster even when A and C share nothing. Confidence also no longer responds to the "Min shared IOCs" control, which is a view filter; a measure of evidence should not move when you change how you are looking at it. Expect lower figures than earlier releases, markedly so on instances with few cases, where little is statistically distinctive. Decay: tags now scale the type half-life rather than the score, so the result cannot exceed 100% however many tags apply — previously a fresh indicator with one galaxy tag rendered as "140%". Age is measured from the most recent case containing the indicator rather than the oldest, since re-observation is evidence something is still live. TLP no longer participates: it expresses a sharing restriction, not fidelity or longevity. [FIX] correlation: cluster count contradicted its own threshold A cluster's shared-IOC count included only indicators found exclusively inside it, so a pair of cases linked because they share three indicators reported "1 shared IOC". The Shared IOCs table ignored the threshold entirely. Both now derive from one rule, so they cannot disagree. [FIX] updater: version comparison crashed on the current scheme IRIS-NG-v<x.y.z> is not valid PEP 440. packaging 21.3 tolerated this by returning a LegacyVersion; version 22 removed that class, so parse() raises InvalidVersion. parse_iris_version() strips the product prefix first, making the comparison genuine PEP 440 ordering, and tolerates an absent release name — which previously raised. [FIX] ai: suggesters timed out, and every failure looked identical Per-surface timeouts assumed a local model answering in seconds; a backend reaching a hosted API takes an order of magnitude longer — a measured 28-34s against a 60s ceiling. Raised to 180s for the tag, ATT&CK, evidence-type and case-template suggesters and the IOC extractor. These are ceilings, so fast backends are unaffected. Five orchestrators logged what the backend said and then discarded it, raising only the JSON decode error. A model declining a request, an unrecognised model name and an empty response were indistinguishable — all displayed "Expecting value: line 1 column 1". The backend's message is now included in the error the analyst sees. [CHORE] deps: 22 Python and 11 UI packages updated SQLAlchemy 2.0.51, alembic 1.18.5, celery 5.6.3, Flask-WTF 1.3.0, graphene 3.4.3, cryptography>=50, qrcode 8.2, packaging 26.2, pyintelowl>=5.1.0; UI includes ace-builds 1.44.0 and Vite 8.2.0. Base images and CI: nginx 1.31, actions/checkout v7, setup-node v7, action-gh-release v3, devcontainer aligned to python:3.12-trixie. flask-marshmallow is held at 1.4.0: 1.5.0 requires marshmallow>=4.0.0 while this project pins marshmallow 3.x, so the bump does not resolve at all. dependabot.yml records what is held back and why — PostgreSQL majors (a data migration, not a bump), jQuery 4 (~86 removed-API call sites, and Bootstrap 4 forbids it), Node majors (odd releases never get an LTS phase), and the marshmallow pair. [FIX] ui: sidebar printed the product name twice
Updates the requirements on [requests](https://github.com/psf/requests) to permit the latest version. - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.31.0...v2.34.2) --- updated-dependencies: - dependency-name: requests dependency-version: 2.34.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Author
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
dependabot
Bot
deleted the
dependabot/pip/tests/requests-gte-2.34.2-and-lt-3.0.0
branch
August 5, 2026 04:07
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates the requirements on requests to permit the latest version.
Release notes
Sourced from requests's releases.
Changelog
Sourced from requests's changelog.
... (truncated)
Commits
6e83187v2.34.284d10f0Move Request.headers back to Mapping (#7441)b7b549bv2.34.1e511bc7Fix mutability issues with headers input types (#7431)5691f59Update JsonType containers to read-based collections (#7436)2144213Constrain Response.reason to str (#7437)6404f34Fixprepare_bodystream detection for__getattr__-based file wrappers (#7...0b401c7v2.34.086b378dAlign Session.get parameters with requests.get (#7429)a4f9a59Port bpo-39057 to Requests (#7427)You can trigger a rebase of this PR by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)