Bump python-gitlab from 4.13.0 to 5.0.0

[dependabot]

Bumps python-gitlab from 4.13.0 to 5.0.0.

Release notes

Sourced from python-gitlab's releases.

v5.0.0 (2024-10-28)

Breaking

• feat: remove support for Python 3.8, require 3.9 or higher (#3005)

Python 3.8 is End-of-Life (EOL) as of 2024-10 as stated in https://devguide.python.org/versions/ and https://peps.python.org/pep-0569/#lifespan

By dropping support for Python 3.8 and requiring Python 3.9 or higher it allows python-gitlab to take advantage of new features in Python 3.9, which are documented at: https://docs.python.org/3/whatsnew/3.9.html

Closes: #2968

BREAKING CHANGE: As of python-gitlab 5.0.0, Python 3.8 is no longer supported. Python 3.9 or higher is required. (9734ad4)

Bug Fixes

• fix(api): set _repr_attr for project approval rules to name attr (#3011)

Co-authored-by: Patrick Evans [email protected] (1a68f1c)

Chores

• chore: add testing of Python 3.14

Also fix annotations not working in Python 3.14 by using the annotation on the 'class' instead of on the 'instance'

Closes: #3013 (14d2a82)

• chore(deps): update dependency ubuntu to v24 (6fda15d)

• chore(deps): update all non-major dependencies (1e4326b)

• chore(deps): update gitlab/gitlab-ee docker tag to v17.5.0-ee.0 (c02a392)

• chore: add Python 3.13 as supported (#3012)

Mark that Python 3.13 is supported.

Use Python 3.13 for the Mac and Windows tests.

Also remove the 'py38' tox environment. We no longer support Python 3.8. (b565e78)

• chore: remove "v3" question from issue template (#3017)

... (truncated)

Changelog

Sourced from python-gitlab's changelog.

v5.0.0 (2024-10-28)

Breaking

• feat: remove support for Python 3.8, require 3.9 or higher (#3005)

Python 3.8 is End-of-Life (EOL) as of 2024-10 as stated in https://devguide.python.org/versions/ and https://peps.python.org/pep-0569/#lifespan

By dropping support for Python 3.8 and requiring Python 3.9 or higher it allows python-gitlab to take advantage of new features in Python 3.9, which are documented at: https://docs.python.org/3/whatsnew/3.9.html

Closes: #2968

BREAKING CHANGE: As of python-gitlab 5.0.0, Python 3.8 is no longer supported. Python 3.9 or higher is required. (9734ad4)

Bug Fixes

• fix(api): set _repr_attr for project approval rules to name attr (#3011)

Co-authored-by: Patrick Evans [email protected] (1a68f1c)

Chores

• chore: add testing of Python 3.14

Also fix annotations not working in Python 3.14 by using the annotation on the 'class' instead of on the 'instance'

Closes: #3013 (14d2a82)

• chore(deps): update dependency ubuntu to v24 (6fda15d)

• chore(deps): update all non-major dependencies (1e4326b)

• chore(deps): update gitlab/gitlab-ee docker tag to v17.5.0-ee.0 (c02a392)

• chore: add Python 3.13 as supported (#3012)

Mark that Python 3.13 is supported.

Use Python 3.13 for the Mac and Windows tests.

Also remove the 'py38' tox environment. We no longer support Python 3.8. (b565e78)

• chore: remove "v3" question from issue template (#3017)

... (truncated)

Commits

• 90c72d8 chore: release v5.0.0
• f4bfe19 test: add test for to_json() method
• 14d2a82 chore: add testing of Python 3.14
• 3739b5d docs(users): update Gitlab docs links (#3022)
• 6fda15d chore(deps): update dependency ubuntu to v24
• 1e4326b chore(deps): update all non-major dependencies
• c02a392 chore(deps): update gitlab/gitlab-ee docker tag to v17.5.0-ee.0
• b565e78 chore: add Python 3.13 as supported (#3012)
• 482f2fe chore: remove "v3" question from issue template (#3017)
• b3834dc chore(deps): update all non-major dependencies
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dryrunsecurity]

DryRun Security Summary

The provided code change updates the requirements.txt file for the DefectDojo application, with the primary focus being a major version update of the python-gitlab library from 4.13.0 to 5.0.0, which requires thorough testing to ensure no regressions or security issues.

Expand for full summary

Summary:

The provided code change is an update to the requirements.txt file, which specifies the Python dependencies required for the DefectDojo application. The key change is the update of the python-gitlab library from version 4.13.0 to 5.0.0, which is a major version update. Major version updates can sometimes introduce breaking changes or new features, and it's important to review the release notes and changelog to ensure there are no known security issues.

From an application security perspective, the update to the python-gitlab library should be the primary focus of the review. It's crucial to thoroughly test the application to ensure that the new version of the library does not introduce any regressions or unexpected behavior. The rest of the changes in the requirements.txt file appear to be minor version updates or additions of new dependencies, which are generally less concerning from a security perspective, but should still be reviewed to ensure that the new dependencies do not introduce any known vulnerabilities.

Files Changed:

• requirements.txt: This file has been updated to include a major version update of the python-gitlab library from 4.13.0 to 5.0.0. This change should be carefully reviewed to ensure that there are no known security issues or breaking changes introduced by the new version of the library. The rest of the changes in the requirements.txt file appear to be minor version updates or additions of new dependencies, which should also be reviewed for potential security implications.

Code Analysis

We ran 9 analyzers against 1 file and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Approved