dependabot[bot] opened a new pull request, #1204: URL: https://github.com/apache/ranger/pull/1204
Bumps [pip](https://github.com/pypa/pip) from 26.0 to 26.2. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/pip/blob/main/NEWS.rst";>pip's changelog</a>.</em></p> <blockquote> <h1>26.2 (2026-07-29)</h1> <h2>Deprecations and Removals</h2> <ul> <li> <p>Newly published packages will no longer be immediately visible to pip if the index uses caching. To install a newly published package, use <code>--refresh-package</code>. (<code>[#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680></code>_)</p> </li> <li> <p>Drop support for detecting legacy, non-:pep:<code>405</code>, <code>virtualenv</code> (< 20) environments. (<code>[#14062](https://github.com/pypa/pip/issues/14062) <https://github.com/pypa/pip/issues/14062></code>_)</p> </li> <li> <p>Constraints files, including <code>PIP_CONSTRAINT</code>, no longer affect isolated build environments. Use <code>--build-constraint</code> or the <code>PIP_BUILD_CONSTRAINT</code> environment variable to constrain build dependencies instead.</p> <p>The <code>--use-feature=build-constraint</code> flag is now always enabled and has no effect. (<code>[#14094](https://github.com/pypa/pip/issues/14094) <https://github.com/pypa/pip/issues/14094></code>_)</p> </li> </ul> <h2>Features</h2> <ul> <li> <p>Declare support for Python 3.15 (<code>[#14208](https://github.com/pypa/pip/issues/14208) <https://github.com/pypa/pip/issues/14208></code>_)</p> </li> <li> <p>Support self-referential extras officially. pip has supported this by accident since version 21.2. (<code>[#11296](https://github.com/pypa/pip/issues/11296) <https://github.com/pypa/pip/issues/11296></code>_)</p> </li> <li> <p>Add <code>--only-deps</code> flag to instruct pip to select only the dependencies of supplied packages. It cannot be used with <code>--no-deps</code>, <code>-r</code>, <code>--group</code>, or <code>--requirements-from-script</code>. (<code>[#11440](https://github.com/pypa/pip/issues/11440) <https://github.com/pypa/pip/issues/11440></code>_)</p> </li> <li> <p>Cache simple responses in accordance to their <code>Cache-Control</code> header instead of always revalidating on every request. To refresh cached package index responses and ensure newly published packages are found, use <code>--refresh-package <package></code>. (<code>[#13680](https://github.com/pypa/pip/issues/13680) <https://github.com/pypa/pip/issues/13680></code>_)</p> </li> <li> <p>Add <code>--no-require-hashes</code> to disable automatic enablement of <code>--require-hashes</code> when encountering a requirement with hashes. (<code>[#14169](https://github.com/pypa/pip/issues/14169) <https://github.com/pypa/pip/issues/14169></code>_)</p> </li> <li> <p>Honor <code>--only-final</code> when sourcing requirements with <code>-r pylock.toml</code>. (<code>[#13950](https://github.com/pypa/pip/issues/13950) <https://github.com/pypa/pip/issues/13950></code>_)</p> </li> <li> <p>Add support for <code>pylock.toml</code> <code>upload-time</code> field, so <code>--uploaded-prior-to</code> works with <code>-r pylock.toml</code>. (<code>[#14168](https://github.com/pypa/pip/issues/14168) <https://github.com/pypa/pip/issues/14168></code>_)</p> </li> <li> <p>Better error messages in case of conflicts with requirements from <code>-r pylock.toml</code>. (<code>[#13963](https://github.com/pypa/pip/issues/13963) <https://github.com/pypa/pip/issues/13963></code>_)</p> </li> <li> <p>Add experimental support for isolating build subprocesses by creating standard virtual environments. This will fix most (if not all) subtle isolation issues that can lead to broken builds exclusive to pip. The feature can be enabled via <code>--use-feature=venv-isolation</code> and will be enabled by default in a future release.</p> <p>Note that the feature has limited compatibility with <code>--use-feature=inprocess-build-deps</code>. While most builds should work with both features enabled, there are known edge cases. <code>inprocess-build-deps</code> will not be enabled by default until they are fixed. (<code>[#14070](https://github.com/pypa/pip/issues/14070) <https://github.com/pypa/pip/issues/14070></code>_)</p> </li> <li> <p>Present more informative diagnostic errors on uncaught network errors. (<code>[#14115](https://github.com/pypa/pip/issues/14115) <https://github.com/pypa/pip/issues/14115></code>_)</p> </li> <li> <p>Allow opting out of Git partial clones with <code>PIP_NO_PARTIAL_CLONE_FOR_BROKEN_GIT_SERVER</code>. (<code>[#11043](https://github.com/pypa/pip/issues/11043) <https://github.com/pypa/pip/issues/11043></code>_)</p> </li> <li> <p>Add a <code>--no-proxy-env</code> (or <code>--proxy ""</code>) option to ignore proxies configured via non-pip environment variables or configuration files. A proxy set with <code>--proxy</code> is still used. (<code>[#5378](https://github.com/pypa/pip/issues/5378) <https://github.com/pypa/pip/issues/5378></code>_)</p> </li> <li> <p>Add support for pulling username from keyring subprocess provider (<code>[#12543](https://github.com/pypa/pip/issues/12543) <https://github.com/pypa/pip/issues/12543></code>_)</p> </li> <li> <p>Speedup tab autocompletion by lazy-importing certain modules. (<code>[#4768](https://github.com/pypa/pip/issues/4768) <https://github.com/pypa/pip/issues/4768></code>_)</p> </li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/pip/commit/4b6ae5c4d7d63a61a99fbecbead8dbc35cc8b357";><code>4b6ae5c</code></a> Bump for release</li> <li><a href="https://github.com/pypa/pip/commit/50b6d3cf998e141d106e72ba17380c39f979188d";><code>50b6d3c</code></a> Update AUTHORS.txt</li> <li><a href="https://github.com/pypa/pip/commit/dbddfbde3a2f57401c9ad1b910aee6d195af7b8d";><code>dbddfbd</code></a> Tweak news entries for pip 26.2 (<a href="https://redirect.github.com/pypa/pip/issues/14212";>#14212</a>)</li> <li><a href="https://github.com/pypa/pip/commit/6576b7596c97bb95ce02098303d25bf82dd44943";><code>6576b75</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/14165";>#14165</a> from sbidoul/refactor-pylock-hanling-sbi</li> <li><a href="https://github.com/pypa/pip/commit/0090e0065ae0087d5d6c171a4eb1821e127aa120";><code>0090e00</code></a> Address a variety of typos detected in code review</li> <li><a href="https://github.com/pypa/pip/commit/e12ddd958df6878f38f2a6f777e4653613eb4821";><code>e12ddd9</code></a> Add support for --uploaded-prior-to with -r pylock.toml</li> <li><a href="https://github.com/pypa/pip/commit/5eefdbcb09ab9783ab89f33fb85c48abf45eb7be";><code>5eefdbc</code></a> Better conflict report for requirements from -r pylock.toml</li> <li><a href="https://github.com/pypa/pip/commit/6d71ff83d64b36504761990911e797c0f5d259d1";><code>6d71ff8</code></a> Test --only-final with -r pylock.toml</li> <li><a href="https://github.com/pypa/pip/commit/e7d6eb9983980a6380a12e0822da2c1c560e1bb4";><code>e7d6eb9</code></a> Refactor -r pylock.toml</li> <li><a href="https://github.com/pypa/pip/commit/756506d154a5b5b5746e9c66bc6e52d6ae3803a9";><code>756506d</code></a> Add TODO about pylock.select and --no-binary</li> <li>Additional commits viewable in <a href="https://github.com/pypa/pip/compare/26.0...26.2";>compare view</a></li> </ul> </details> <br /> [](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/apache/ranger/network/alerts). </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
