dependabot[bot] opened a new pull request, #39773: URL: https://github.com/apache/beam/pull/39773
Updates the requirements on [wheel](https://github.com/pypa/wheel) to permit the latest version. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/wheel/releases";>wheel's releases</a>.</em></p> <blockquote> <h2>0.48.0</h2> <ul> <li>Added a <code>--local-version</code> option to <code>wheel pack</code> to add, replace, or remove a PEP 440 local version identifier from a wheel (<a href="https://redirect.github.com/pypa/wheel/issues/570";>#570</a>)</li> <li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible core metadata versions (<a href="https://redirect.github.com/pypa/wheel/issues/643";>#643</a>)</li> <li>Fixed <code>wheel tags</code> producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (<a href="https://redirect.github.com/pypa/wheel/issues/692";>#692</a>)</li> <li>Fixed <code>wheel convert</code> writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (<a href="https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw";>GHSA-vgq5-9859-3mmw</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/wheel/blob/main/docs/news.rst";>wheel's changelog</a>.</em></p> <blockquote> <h1>Release Notes</h1> <p><strong>UNRELEASED</strong></p> <ul> <li>Fixed the macOS platform-tag warning always using the plural "these files" wording, even when only a single library required a higher deployment target (<code>[#697](https://github.com/pypa/wheel/issues/697) <https://github.com/pypa/wheel/pull/697></code>_)</li> </ul> <p><strong>0.48.0 (2026-08-12)</strong></p> <ul> <li>Added a <code>--local-version</code> option to <code>wheel pack</code> to add, replace, or remove a PEP 440 local version identifier from a wheel (<code>[#570](https://github.com/pypa/wheel/issues/570) <https://github.com/pypa/wheel/issues/570></code>_)</li> <li>Fixed <code>wheel convert</code> unnecessarily upgrading compatible core metadata versions (<code>[#643](https://github.com/pypa/wheel/issues/643) <https://github.com/pypa/wheel/issues/643></code>_)</li> <li>Fixed <code>wheel tags</code> producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header (<code>[#692](https://github.com/pypa/wheel/issues/692) <https://github.com/pypa/wheel/issues/692></code>_)</li> <li>Fixed <code>wheel convert</code> writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (<code>GHSA-vgq5-9859-3mmw <https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw></code>_)</li> </ul> <p><strong>0.47.0 (2026-04-22)</strong></p> <ul> <li>Added the <code>wheel info</code> subcommand to display metadata about wheel files without unpacking them (<code>[#639](https://github.com/pypa/wheel/issues/639) <https://github.com/pypa/wheel/issues/639></code>_)</li> <li>Fixed <code>WheelFile</code> raising <code>Missing RECORD file</code> when the wheel filename contains uppercase characters (e.g. <code>Django-3.2.5.whl</code>) but the <code>.dist-info</code> directory inside uses normalized lowercase naming (<code>[#411](https://github.com/pypa/wheel/issues/411) <https://github.com/pypa/wheel/issues/411></code>_)</li> </ul> <p><strong>0.46.3 (2026-01-22)</strong></p> <ul> <li>Fixed <code>ImportError: cannot import name '_setuptools_logging' from 'wheel'</code> when installed alongside an old version of setuptools and running the <code>bdist_wheel</code> command (<code>[#676](https://github.com/pypa/wheel/issues/676) <https://github.com/pypa/wheel/issues/676></code>_)</li> </ul> <p><strong>0.46.2 (2026-01-22)</strong></p> <ul> <li>Restored the <code>bdist_wheel</code> command for compatibility with <code>setuptools</code> older than v70.1</li> <li>Importing <code>wheel.bdist_wheel</code> now emits a <code>FutureWarning</code> instead of a <code>DeprecationWarning</code></li> <li>Fixed <code>wheel unpack</code> potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)</li> </ul> <p><strong>0.46.1 (2025-04-08)</strong></p> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/wheel/commit/21c4da4c54c3b354cc22dc7f6f6374ffcd560e84";><code>21c4da4</code></a> Fixed the release heading format</li> <li><a href="https://github.com/pypa/wheel/commit/f06d4db093e097eedfa909c1ea0fa123ae0dafc2";><code>f06d4db</code></a> Flit no longer supports --setup-py</li> <li><a href="https://github.com/pypa/wheel/commit/1a96c3e8c2df651a3883767b207540af131b6f1c";><code>1a96c3e</code></a> Created a new release</li> <li><a href="https://github.com/pypa/wheel/commit/d7d625d40d323d44646d39f2224bde7a1c16005b";><code>d7d625d</code></a> Fixed wheel convert writing outside the target directory on malicious input (...</li> <li><a href="https://github.com/pypa/wheel/commit/986a440c3aacc45fb8486d2d01ae86bf3ddf3465";><code>986a440</code></a> Strip ZIP64 extra field when retagging wheels (<a href="https://redirect.github.com/pypa/wheel/issues/692";>#692</a>) (<a href="https://redirect.github.com/pypa/wheel/issues/695";>#695</a>)</li> <li><a href="https://github.com/pypa/wheel/commit/0ca6f24ed0f7045cf72b792653c237341dfbd15d";><code>0ca6f24</code></a> feat: add --local-version option to wheel pack (<a href="https://redirect.github.com/pypa/wheel/issues/694";>#694</a>)</li> <li><a href="https://github.com/pypa/wheel/commit/4a63cafb301141d44a2fcae487f17bf255a50bdb";><code>4a63caf</code></a> Preserve compatible metadata versions in convert (<a href="https://redirect.github.com/pypa/wheel/issues/690";>#690</a>)</li> <li><a href="https://github.com/pypa/wheel/commit/33650c6707eea20310733e7a3fe0bc5f1573666a";><code>33650c6</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pypa/wheel/issues/691";>#691</a>)</li> <li><a href="https://github.com/pypa/wheel/commit/197012dcb8a9da10570d6486bc1a70305861e7f2";><code>197012d</code></a> Increased the upper bound for flit-core as a build requirement</li> <li><a href="https://github.com/pypa/wheel/commit/efd83a750f07a33462ea2eed365fd8dac9e51442";><code>efd83a7</code></a> Created a new release</li> <li>Additional commits viewable in <a href="https://github.com/pypa/wheel/compare/0.36.0...0.48.0";>compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
