Skip to content

fix(deps): update python-dependencies to v2 - #833

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-python-dependencies
Open

fix(deps): update python-dependencies to v2#833
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/major-python-dependencies

Conversation

@renovate

@renovate renovate Bot commented Oct 12, 2026

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
apprise >=1.11.0,<2 → >=2.0.1,<3 age confidence
pysigma >=1.4.0,<2 → >=2,<3 age confidence

Release Notes

caronc/apprise (apprise)

v2.0.1: Apprise v2.0.1

Compare Source

What's Changed

Since the release of v2.0.0 there were some issues raised that I feel were major enough to to warrant a small update release. The big one is the handlng of markdown text.

I had merged a few enhancements too; so they're thrown in this mini release as well.

🐞 Bugfixes
💡 Features
  • Rewrite spush:// for the new Simplepush API with tasks, attachments, ... by @​tymm in #​1759
  • feat: support Nextcloud Talk bot authentication by @​beemines in #​1758
  • Telegram photo and video album support in #​1762
❤️ Life-Cycle Support

Installation

Apprise is available on PyPI through pip:

# Install Apprise v2.0.1 from PyPI
pip install apprise==2.0.1

If you use uv:

# Install the apprise command
uv tool install apprise==2.0.1

New Contributors

Full Changelog: caronc/apprise@v2.0.0...v2.0.1

v2.0.0: Apprise v2.0.0

Compare Source

What's Changed

🎉 Welcome to Apprise v2.0.0! 🎉

This is the first official release of Apprise v2. It's a big one. Much of how Apprise works under the hood was rebuilt, and many features people have asked for over the years are finally here:

  • template variables to keep secrets out of your config files
  • tag priorities and escalation
  • smarter retries
  • timeouts
  • a detailed AppriseResult object returned from every notify() call
  • ...and much more

Note: ⚠️ This is a breaking release for anyone using Apprise v1.x. If you are a developer embedding Apprise in your own project, please read the Breaking Changes section below before upgrading. If you are not ready to move yet, pin your pyproject.toml or requirements.txt to apprise >=1.0.0, <2.0.0. The v1 codebase lives on in the apprise-v1-release branch. I will keep patching it for security issues and bugs where practical for a year or two, but v2.x is the way forward.

⚠️ Breaking Changes
  • notify() now returns an AppriseResult object instead of True/False/None
    • bool(result) still gives you True/False, so most existing if apobj.notify(...): checks keep working. None can't come back from bool(), so a "nothing matched" result now reads as False.
    • The object also holds the logs for each individual service called, plus a status for each one, so your application can report exactly what worked and what didn't.
    • The status values line up with the CLI exit codes:
      • SUCCESS (0) - every service was notified successfully (the old True)
      • FAILURE (1) - the notification failed (the old False)
      • NOMATCH (3) - nothing matched the tags given, or no services were loaded (the old None)
      • PARTIAL (4) - some services succeeded but at least one failed (v1 returned False here)
      • TIMEOUT (5) - a service didn't finish before its time limit (new in v2)
  • Multiple body formats per service
    • In v1 each service supported a single body format. Services can now support more than one when the upstream service allows it (Telegram, for example, accepts both Markdown and HTML).
    • Apprise picks the best matching format automatically based on the format you send with, so it no longer rewrites your content when the service can already accept it as-is.
    • You can also choose the format yourself in the URL with ?format=.
  • Consistent error handling
    • Every error Apprise raises now comes from a single AppriseException family, so developers can catch everything in one place.
    • Each error still behaves like the plain Python error it used to be (a bad setting is still a ValueError, a disk problem is still an OSError), so existing try/except blocks keep working.
  • Deprecations removed - Apprise v2 starts with a clean slate:
    • The APPRISE_CONFIG environment variable is now APPRISE_CONFIG_PATH. The old name still works for now, but prints a deprecation warning.
    • The Email options use_pgp= and ?pgpkey= (deprecated back in v1) have been removed. Use pgp_mode= and ?pgppub= instead.
    • Bad settings in a URL (such as an unknown ?format=) now fail with a clear error message instead of quietly doing something unexpected.
📣 New Notification Services:
🐞 Bugfixes
  • DingTalk Markdown messages now set msgtype to markdown so they actually get delivered by @​xtqxk in #​1733
  • OneSignal now honors language= and keeps it in url() by @​MaxFreedomPollard in #​1720
  • SIGNL4 now keeps its query parameters in url() by @​MaxFreedomPollard in #​1732
  • VAPID now delivers to the subscription endpoint instead of a per-mode base URL by @​RT530 in #​1728
  • Fluxer now works with self-hosted servers by using the correct URL by @​LaaZa in #​1740
  • ntfy attach= filename detection fixed, and filename= is kept in url() by @​SulimanAbdulrazzaq in #​1744
  • Compressed IPv6 addresses are now handled properly in #​1734
  • Fixed an issue with YAML/config parsing in #​1743
  • Fixed a crash when reading certain responses back from Amazon SES/SNS in #​1666
  • Markdown that gets cut in half by a message split is now repaired, so you no longer see broken links and stray * characters, in #​1666
  • Fixed a test suite issue that made tests run far longer than needed (a full coverage run went from about 26 min to under 15 min) in #​1666
  • ...and many more small bugfixes, cleanups and internal consistency improvements
  • Keep CC display names in url() for mailgun, ses, smtp2go and sparkpost by @​SulimanAbdulrazzaq in #​1749
  • Fixed o365:// inline attachment contentType sent as a literal string by @​Rodrigo-Palma in #​1747
💡 Features
  • Template Variables - YAML configurations can now use ${NAME} placeholders to keep secrets (API keys, passwords) out of your config file. Declare the names you use in a new template: section, then supply the values any of these ways:
    • on the command line: --template-var api_key=abc123 (or -tv)
    • from the environment: APPRISE_TEMPLATE_API_KEY=abc123
    • as a default written directly in the template: section
    • through the API: apobj.notify(body='test', template={'api_key': 'abc123'})
  • Tag Priorities & Escalation - tags can now carry a priority, such as 2:alerts. Using --tag alerts notifies your first priority group, and only moves on to the next group if something failed. Handy for "text me only if the email didn't go through". You can still target one group exactly with --tag "2:alerts".
  • Smarter Retries - ?retry= now keeps track of what already went out. If you're sending to 3 people and only 1 fails, the retry only re-sends to the one that failed instead of spamming everyone again. Retries can also be set on the fly with --tag "alerts:3".
  • Timeouts - you can now cap how long a notification is allowed to take instead of waiting forever on a hung server:
    • --limit 10 caps the entire run
    • --service-limit 5 caps each service on its own (defaults to 60 seconds)
  • Parallel delivery by default - notifications are now sent at the same time, so one slow service no longer holds up the rest. Use --disable-async if you prefer the old one-at-a-time behavior.
  • Native async support - developers embedding Apprise into their own async applications can now use await apobj.async_notify().
  • Message overflow/split handling was reworked and improved
  • HTML to Markdown conversion was reworked and improved
  • The apprise:// service (for talking to an Apprise API server) no longer puts your configuration ID in the web address, which keeps it out of server access logs
  • Improved secure logging so sensitive values are kept out of logs (CWE-312) in #​1736
  • Matrix: added opt-in automatic SAS verification by @​vampywiz17 in #​1718
  • macOS: support for macOS v26 terminal-notifier in #​1724
    • More improvements to the macOS terminal-notifier wrapper followed in #​1742
❤️ Life-Cycle Support
  • Apprise v2 Release in #​1666
    • The v1 codebase was branched off as apprise-v1-release for anyone who needs to stay on v1
  • Apprise can now be installed and managed with uv (see Installation below)
  • Multi-language support was added to line up with Apprise Mobile

Installation

Apprise is available on PyPI through pip:

# Install Apprise v2.0.0 from PyPI
pip install apprise==2.0.0

If you use uv, you can install the apprise command in its own isolated environment, or add Apprise to your uv project:

# Install the apprise command
uv tool install apprise==2.0.0

# Or add it to your own project
uv add "apprise>=2.0.0,<3.0.0"

Not ready for v2 yet? Stay on the v1 series with:

pip install "apprise>=1.0.0,<2.0.0"

New Contributors

Full Changelog: caronc/apprise@v1.13.1...v2.0.0

SigmaHQ/pySigma (pysigma)

v2.0.0

Compare Source

pySigma 2.0 Introduction
Breaking Changes: SigmaPolicy as Central Security Control Point

pySigma 2.0 introduces SigmaPolicy — a unified security configuration framework that replaces scattered method parameters across the codebase. This is a breaking change but brings significant security and usability improvements.

What Changed:

  • Security-related settings (allow_template_vars, allow_external_sources, vars_allowed_paths, regex_engine) are no longer individual method parameters
  • All security settings now flow through the centralized SigmaPolicy dataclass
  • Pipeline loading methods (ProcessingPipeline.from_yaml(), from_dict()) now accept a policy parameter instead of individual flags
  • YAML and dictionary keys for security settings are explicitly stripped before instantiation — this prevents runtime opt-ins through untrusted pipeline definitions

Why This Matters:
pySigma operates in two fundamentally different trust models:

  • Private CI/CD pipelines: You control both rules and conversions — enable powerful features like template vars and external sources
  • Public web applications: Users upload rules — features that could be exploited are disabled by default

SigmaPolicy declares your trust model once, and those settings propagate through the entire pipeline automatically.

Predefined profiles available:

  • SafePolicy — RE2 engine, all security features disabled
  • TrustedPolicy — Python engine, for fully trusted rule sources

Check out the documentation for further details.

Hardened Defaults: DoS-Safe Regex Engine

Default regex engine is now RE2RegexEngine (backed by Google RE2):

  • ✅ Prevents catastrophic backtracking — no exponential time complexity from regex patterns
  • ✅ Eliminates ReDoS vulnerabilities from untrusted Sigma rules
  • ⚠️ Trade-off: RE2 doesn't support all advanced regex features that Python's re module does

If you need full regex compatibility, explicitly use PythonRegexEngine:

from sigma.policy import SigmaPolicy
from sigma.policy.regex_engine import PythonRegexEngine

policy = SigmaPolicy(regex_engine=PythonRegexEngine())  # Use with trusted rules only
Breaking API Changes

Method signatures have been updated across the codebase:

Before (v1.5.1):

pipeline = ProcessingPipeline.from_yaml(
    yaml_string,
    allow_template_vars=True,
    allow_external_sources=False,
    vars_allowed_paths=["/trusted/dir"]
)

After (v2.0.0):

from sigma.policy import SigmaPolicy

policy = SigmaPolicy(
    allow_template_vars=True,
    allow_external_sources=False,
    vars_allowed_paths=("/trusted/dir",)
)

pipeline = ProcessingPipeline.from_yaml(yaml_string, policy=policy)
Security Hardening Details
  • Top-level pipeline validation is strict: Unknown keys (including security settings) in YAML are rejected rather than silently passed through
  • Nested transformation sanitization: Security-related keys in transformation YAML are explicitly stripped before instantiation
  • Environment variable fallback: Legacy PYSIGMA_ALLOW_VARS_EXECUTION and PYSIGMA_ALLOW_EXTERNAL_SOURCES environment variables are respected as final fallback
  • Template sandboxing: Methods of arbitrary objects in templates are blocked; only safe built-in types (str, int, dict, list, etc.) can have methods called
Migration Guide

If upgrading from v1.5.1:

  1. Audit security settings in your pipeline definitions
  2. Replace method parameters with SigmaPolicy instances
  3. Explicit opt-in required for previously-enabled features (they now default to disabled)
  4. Update YAML pipelines — ensure security settings are passed as policy parameter, not as top-level keys
  5. Test thoroughly — the defaults are more restrictive for security
What's Changed
New Contributors

Full Changelog: SigmaHQ/pySigma@v1.5.1...v2.0.0

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Dependency updates. label Oct 12, 2026
@renovate

renovate Bot commented Oct 12, 2026

Copy link
Copy Markdown
Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: pyproject.toml
Artifact update for pysigma resolved to version 2.0.1, which is a pending version that has not yet passed the Minimum Release Age threshold.
Renovate was attempting to update to 2.0.0
This is (likely) not a bug in Renovate, but due to the way your project pins dependencies, _and_ how Renovate calls your package manager to update them.
Until Renovate supports specifying an exact update to your package manager (https://github.com/renovatebot/renovate/issues/41624), it is recommended to directly pin your dependencies (with `rangeStrategy=pin` for apps, or `rangeStrategy=widen` for libraries)
See also: https://docs.renovatebot.com/dependency-pinning/

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Dependency updates.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants