chore(deps): bump vulners from 3.1.11 to 3.2.0

[dependabot]

Bumps vulners from 3.1.11 to 3.2.0.

Release notes

Sourced from vulners's releases.

v3.2.0

Added

• Added max_response_bytes constructor argument to cap raw and decompressed response size (guards against decompression bombs; None = no limit, default behavior unchanged)
• Added vulners.version re-export and all on the package root
• Added PEP 561 py.typed marker for inline type annotations
• Added typing-extensions and typing-inspection as direct dependencies
• Added VulnersApiError.retry_after, populated from the Retry-After header
• Added VulnersApiError.message / .error_code parsing across v3, v4 and plain-text error shapes
• Added VulnersDeprecationWarning and PEP 702 deprecated markers on deprecated methods
• Added close() and context-manager support (with VulnersApi(key) as api:) to VulnersApi / VScannerApi
• Added SPDX GPL-3.0-only license and project URLs to package metadata

Changed

• import vulners no longer flips the global DeprecationWarning filter (scoped to VulnersDeprecationWarning)
• Rate-limit buckets are now per-instance instead of shared at class level
• Request bodies are serialized with orjson (on-wire bytes unchanged)
• Pinned ruff target-version to py310
• Reworked samples/ into task-oriented, live-tested scenarios reading VULNERS_API_KEY
• Documented SubscriptionV4Api.update() as a full-replace (not partial) operation

Fixed

• search_bulletins / search_exploits with offset >= 10000 now raises a clear ValueError instead of a confusing ValidationError
• Audit / subscription field enums accept server-confirmed and arbitrary string values (| str), fixing false ValidationError
• SubscriptionV4Api.get now sends subscription_id (was id, which returned 400)
• import vulners no longer raises PackageNotFoundError when distribution metadata is absent (falls back to "unknown")
• HTTP >= 400 responses with a {"data": ...} body now raise VulnersApiError instead of returning as success
• Gateway error pages (502/503/504) are wrapped in VulnersApiError instead of a raw JSON decode error
• Empty ZIP archives raise RuntimeError instead of IndexError; file handles are closed on every path
• Path parameters are percent-quoted before URL substitution
• RateLimitBucket fixes: no longer hangs on limits below 60 req/min, ignores invalid rate headers, uses a monotonic clock and a lock
• Documented retry_count honestly (retries connection failures only, not HTTP errors / read timeouts)
• Various codegen fixes: inspect.signature, get_type_hints(), sys._getframe-free import, FieldInfo selection
• Deprecation warnings now report the caller's call site and warn exactly once

Changelog

Sourced from vulners's changelog.

[3.2.0] - 2026-07-19

This is a bug-fix release that keeps the observable behavior of successful calls unchanged; the changes below repair broken paths (crashes, hangs, resource leaks, "garbage returned as success") and add small additive surfaces.

Added

• Optional max_response_bytes constructor argument (default None = no limit, behavior unchanged). When set, both the raw response body and the output of gzip/zip decompression are bounded by it and a VulnersApiError is raised on overflow, so a decompression bomb or an unbounded response from a compromised upstream cannot exhaust memory. Left unset, large archive downloads (which can reach several gigabytes) keep working exactly as before.
• vulners.__version__ is now re-exported from the package root.
• __all__ on the package root pins the public surface to VulnersApi, VScannerApi and VulnersApiError.
• PEP 561 py.typed marker so type checkers read the inline annotations; note that strict-mode consumers may now surface real type errors that were previously hidden.
• typing-extensions (>=4.12) and typing-inspection (>=0.4) are declared as direct dependencies instead of being relied on transitively through pydantic.
• VulnersApiError.retry_after is populated from a Retry-After response header when present; the two-argument constructor stays valid.
• VulnersApiError now parses the server's problem description into .message and .error_code (and keeps the full redacted payload on .data) across the v3 (error/errorCode), v4 (errors/detail) and plain-text error shapes, without echoing the request input a validation item carries. str(err) shows the human-readable message.
• VulnersDeprecationWarning category and PEP 702-style __deprecated__ runtime markers on deprecated methods.
• VulnersApi / VScannerApi now support close() and the context-manager protocol (with VulnersApi(key) as api: ...), which release the underlying httpx connection pool; the transport wrapper delegates close() to the inner transport so the pool is actually torn down.
• Package metadata now declares an SPDX GPL-3.0-only license and Homepage, Repository, Documentation and Changelog project URLs.

Changed

• import vulners no longer flips the process-global DeprecationWarning filter. The SDK's own notices are shown via a filter scoped to VulnersDeprecationWarning, so a host application's -W / PYTHONWARNINGS policy for other libraries is preserved.
• Rate-limit buckets are now per-instance rather than shared at class level, so separate instances / API keys no longer couple their limits; N instances with the same key may now issue up to N times the request rate (the server remains authoritative through its rate-limit header).
• POST/PUT/PATCH request bodies are serialized with orjson; the bytes on the wire are unchanged.

... (truncated)

Commits

• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)