build(deps): bump scrapy from 2.6.2 to 2.17.0 in /src/test/resources/msc/python

[dependabot]

Bumps scrapy from 2.6.2 to 2.17.0.

Release notes

Sourced from scrapy's releases.

2.17.0

• Security bug fixes
• HTTP/2 and SOCKS proxy support for HttpxDownloadHandler
• Improved settings for changing allowed TLS versions

Full Changelog

2.16.0

• Official support for Python 3.14
• Support for Twisted 26.4.0+

Full Changelog

2.15.2

What's Changed

• Fixed links in https://docs.scrapy.org/llms.txt (#7467)

Full Changelog: scrapy/scrapy@2.15.1...2.15.2

2.15.1

• Bug fixes

Full Changelog

2.15.0

• Experimental support for running without a Twisted reactor
• Experimental httpx-based download handler

Full Changelog

2.14.2

• Values from the Referrer-Policy header of HTTP responses are no longer executed as Python callables. See the cwxj-rr6w-m6w7 security advisory for details.
• In line with the standard, 301 redirects of POST requests are converted into GET requests.

Full Changelog

2.14.1

• Deprecate maybeDeferred_coro()
• Pass the spider arg to custom stat collectors {open,close}_spider()
• Replace deprecated Codecov CI action

Full Changelog

2.14.0

• More coroutine-based replacements for Deferred-based APIs
• The default priority queue is now DownloaderAwarePriorityQueue
• Dropped support for Python 3.9 and PyPy 3.10
• Improved and documented the API for custom download handlers

... (truncated)

Changelog

Sourced from scrapy's changelog.

Scrapy 2.17.0 (2026-07-07)

Highlights:

• Security bug fixes

• HTTP/2 and SOCKS proxy support for HttpxDownloadHandler

• Improved settings for changing allowed TLS versions

Security bug fixes

-   ``s3://`` requests now use HTTPS by default, instead of plaintext HTTP.
Previously, :class:`~scrapy.core.downloader.handlers.s3.S3DownloadHandler`
sent signed S3 requests over plaintext HTTP unless
``request.meta["is_secure"]`` was set to a true value, exposing the request
path, the AWS ``Authorization`` header, the ``X-Amz-Security-Token`` header
(when using temporary credentials), and the response contents to network
attackers, who could also tamper with responses. See the `76g3-c3x4-crvx`_
security advisory for details.
To restore the previous behavior for a given request, set

request.meta["is_secure"] to False.
.. _76g3-c3x4-crvx: https://github.com/scrapy/scrapy/security/advisories/GHSA-76g3-c3x4-crvx


Deprecations

-   The ``DOWNLOADER_CLIENT_TLS_METHOD`` setting is deprecated. You should use
    the :setting:`DOWNLOAD_TLS_MIN_VERSION` and/or
    :setting:`DOWNLOAD_TLS_MAX_VERSION` settings instead if you want to change
    the TLS method selection.
    (:gh:`3288`, :gh:`6546`)


The following spider attributes are deprecated in favor of settings:


http_user (use :setting:HTTPAUTH_USER)


http_pass (use :setting:HTTPAUTH_PASS)


http_auth_domain (use :setting:HTTPAUTH_DOMAIN)


(:gh:7590)


The scrapy.commands.ScrapyCommand.help() method is deprecated. It was

never called by Scrapy.

</tr></table>

</code></pre>

</blockquote>

<p>... (truncated)</p>

</details>

<details>

<summary>Commits</summary>


<ul>

<li><a href="https://github.com/scrapy/scrapy/commit/feb692f552e3ed4533cf4e3af4809908d84cd763&quot;&gt;&lt;code&gt;feb692f&lt;/code&gt;&lt;/a> Bump version: 2.16.0 → 2.17.0</li>

<li><a href="https://github.com/scrapy/scrapy/commit/9523e1ec8c41fde265a26d14563d178b6f1ad04b&quot;&gt;&lt;code&gt;9523e1e&lt;/code&gt;&lt;/a> Merge commit from fork</li>

<li><a href="https://github.com/scrapy/scrapy/commit/5ccc8dbe8a735b322bacca16848ab9dfed839b99&quot;&gt;&lt;code&gt;5ccc8db&lt;/code&gt;&lt;/a> Release notes for 2.17.0 (<a href="https://redirect.github.com/scrapy/scrapy/issues/7723&quot;&gt;#7723&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/scrapy/scrapy/commit/dd10cb8e9a982fe3d311078d6e1207596e272717&quot;&gt;&lt;code&gt;dd10cb8&lt;/code&gt;&lt;/a> LxmlLinkExtractor: add deny_attrs and deny_tags (<a href="https://redirect.github.com/scrapy/scrapy/issues/7679&quot;&gt;#7679&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/scrapy/scrapy/commit/870803b7fb1ed56c296eb6b51d0212f0460dfdda&quot;&gt;&lt;code&gt;870803b&lt;/code&gt;&lt;/a> fix-utf16-response-test-on-big-endian-systems (<a href="https://redirect.github.com/scrapy/scrapy/issues/7508&quot;&gt;#7508&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/scrapy/scrapy/commit/361f689df785959a59cf939b9efaefc72079f037&quot;&gt;&lt;code&gt;361f689&lt;/code&gt;&lt;/a> Improve test coverage for crawler.py (<a href="https://redirect.github.com/scrapy/scrapy/issues/7682&quot;&gt;#7682&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/scrapy/scrapy/commit/fc5216f15611e40d795f5ab566acff8f9ca0af1e&quot;&gt;&lt;code&gt;fc5216f&lt;/code&gt;&lt;/a> Clarify/cleanup Selector.type (<a href="https://redirect.github.com/scrapy/scrapy/issues/7704&quot;&gt;#7704&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/scrapy/scrapy/commit/a6d6a48aa600d1b4c3deb6409c17d0d7f55db312&quot;&gt;&lt;code&gt;a6d6a48&lt;/code&gt;&lt;/a> Keep Item fields in definition order (<a href="https://redirect.github.com/scrapy/scrapy/issues/7694&quot;&gt;#7694&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/scrapy/scrapy/commit/00098cb596d0d3957236ba1ba193b09172696bc5&quot;&gt;&lt;code&gt;00098cb&lt;/code&gt;&lt;/a> Assorted docstring fixes (<a href="https://redirect.github.com/scrapy/scrapy/issues/7698&quot;&gt;#7698&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/scrapy/scrapy/commit/deb7e2861e616bbfefb96433bd72e0d50055cd0e&quot;&gt;&lt;code&gt;deb7e28&lt;/code&gt;&lt;/a> Fix _get_tag_name() crash for non-string elem.tag (<a href="https://redirect.github.com/scrapy/scrapy/issues/7686&quot;&gt;#7686&lt;/a>) (<a href="https://redirect.github.com/scrapy/scrapy/issues/7687&quot;&gt;#7687&lt;/a&gt;)&lt;/li>

<li>Additional commits viewable in <a href="https://github.com/scrapy/scrapy/compare/2.6.2...2.17.0&quot;&gt;compare view</a></li>

</ul>

</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options


You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

You can disable automated security fix PRs for this repo from the Security Alerts page.

[github-actions]

Test Results

602 tests   602 ✅  1m 55s ⏱️
 37 suites    0 💤
 37 files      0 ❌

Results for commit a39117a.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@e1f3a82). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #581   +/-   ##
=======================================
  Coverage        ?   69.54%           
  Complexity      ?     1044           
=======================================
  Files           ?       66           
  Lines           ?     4371           
  Branches        ?      774           
=======================================
  Hits            ?     3040           
  Misses          ?      985           
  Partials        ?      346           

Flag	Coverage Δ
integration-tests	69.54% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.