Skip to content

Bump the uv group across 1 directory with 9 updates - #157

Merged
jeffmaki merged 1 commit into
mainfrom
dependabot/uv/uv-e7f6bc12fe
Oct 28, 2026
Merged

Bump the uv group across 1 directory with 9 updates#157
jeffmaki merged 1 commit into
mainfrom
dependabot/uv/uv-e7f6bc12fe

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv group with 9 updates in the / directory:

Package From To
black 26.3.1 26.10.1
pyjwt 2.13.0 2.15.0
anyio 4.7.0 4.14.2
certifi 2024.8.30 2026.10.18
cryptography 48.0.1 50.0.0
dnspython 2.7.0 2.9.0
mako 1.3.12 1.4.2
urllib3 2.7.0 2.8.0
virtualenv 20.36.1 21.14.13

Updates black from 26.3.1 to 26.10.1

Release notes

Sourced from black's releases.

26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

  • Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
  • Keep repeated lines outside the selected --line-ranges unchanged (#5436)
  • Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
  • Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
  • Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
  • Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)

Preview style

  • Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
  • Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
  • Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
  • Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
  • Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
  • Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
  • Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

Configuration

  • Add --cache-dir to configure the cache directory from the command line (#5433)
  • Don't cache a file as formatted after formatting or checking it with --line-ranges,

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.10.1

Highlights

This release fixes a security issue in Black's bundled GitHub Action. Repositories that use the action are encouraged to update to the latest version of Black immediately. This update is received automatically when using psf/black@stable, and is independent of the version of Black installed by the action.

When the GitHub Action reads version specifiers from tool.black.required-version, it now only accepts released versions of Black, as it already did for black requirements in dependency lists. Other values, such as URL references, are now rejected. This issue has been registered as GHSA-cg8m-r9f2-5wm2; a CVE identifier is pending.

Stable style

  • Fix a long Jupyter notebook assignment magic (for example x = !ls -la) being wrapped in parentheses, which IPython can no longer run; such cells are now left unchanged (#5481)
  • Keep repeated lines outside the selected --line-ranges unchanged (#5436)
  • Fix --line-ranges formatting lines that follow a statement when formatting joins or re-indents that statement (#5484)
  • Fix --line-ranges crashing with an internal error when an unselected statement has a # fmt: skip comment on the last line before a closing bracket (#5477)
  • Prevent moving an encoding declaration (for example # -*- coding: latin-1 -*-) onto the first two lines of a file (#5487)
  • Fix adding an extra trailing blank line inside a multi-line module docstring when its last line is near the line length limit (#5494)
  • Keep the parentheses around a walrus that is the only item in a set (for example {(x := f())}) when targeting Python 3.9 or older, since Python 3.8 and 3.9.0 can't parse it without them (#5502)

Preview style

  • Do not split short expressions on delimiters (such as binary operators, comparisons, or comprehensions) inside brackets when preceded by a standalone comment (#5455)
  • Fix the unstable string_processing feature removing backslash-newline sequences from raw strings, which changed their value (#5482)
  • Avoid adding unnecessary parentheses around unbreakable right-hand side expressions in assignments (such as annotated assignments or subscript targets) (#5473)
  • Parenthesize expressions with parameter comments when they exceed the line length under --preview (#5442)
  • Fix wrap_long_dict_values_in_parens dropping the parentheses around a right-hand side that contains a dictionary, leaving a line over the length limit (#5492)
  • Fix the unstable string_processing feature adding a space after * or ** in a PEP 695 type parameter (* Ts = ...) when it splits a string in the parameter's default (#5504)
  • Avoid unnecessary line splits of trailers (such as indexing/subscripts) when an earlier bracket split exceeds the line length only due to a trailing comment (#5498)

... (truncated)

Commits
  • 258e7db Prepare release 26.10.1 (#5511)
  • ac1f715 Action: validate required-version better (#5510)
  • fe241cc Avoid splitting trailers when earlier bracket split exceeds length due to com...
  • 4fb2897 Bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5500)
  • 6d0f557 Bump actions/download-artifact from 8.0.1 to 8.0.2 (#5501)
  • c45f21d Handle PEP 695 type parameter whitespace in whitespace() (#5504)
  • 8ec61a7 Skip UTF-8 BOM when reading .gitignore (#5497)
  • c9b1148 Fix module docstring last_line_length when docstring ends with newline (#5494)
  • eb88358 Parenthesize expressions with parameter comments in preview (#3113) (#5442)
  • 939fa93 Keep the parentheses around a right-hand side when a dict value's parentheses...
  • Additional commits viewable in compare view

Updates pyjwt from 2.13.0 to 2.15.0

Release notes

Sourced from pyjwt's releases.

2.15.0

See the 2.15.0 changelog for complete release details.

2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

Changelog

Sourced from pyjwt's changelog.

v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0>__

Security


- Wrap recursion errors from deeply nested JWT payloads in ``DecodeError``
  instead of exposing a raw ``RecursionError``.

Added



- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) &lt;https://github.com/jpadilla/pyjwt/pull/1202&gt;`__

Changed




    

  • JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS
payload, so a cache hit no longer re-parses every key. JWKSetCache.put()
accepts either form and raises PyJWKSetError for anything else. As a
result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance
for as long as it stays cached, rather than a freshly built one per call in
[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;__
    • 

  • PyJWKClient.fetch_data() now raises
PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;) when
the endpoint response is not a JSON object, instead of returning it for
get_jwk_set() to reject. Callers reaching the JWKS through
get_jwk_set() see the same error as before in
[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;__
    • 



Fixed



- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError(&quot;The JWKS endpoint did not return a JSON
  object&quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) &lt;https://github.com/jpadilla/pyjwt/issues/914&gt;`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
  ``fetch_data()`` override that filters or transforms the JWKS is no longer
  undone by the next cache hit in
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
  ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
  non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
  match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
  ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not
&lt;/tr&gt;&lt;/table&gt; 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>

<ul>

<li><a href="https://github.com/jpadilla/pyjwt/commit/1d41a6478e1562e68ff667fcd703356acf085f68&quot;&gt;&lt;code&gt;1d41a64&lt;/code&gt;&lt;/a> chore: prepare 2.15.0 release</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/9bc06658f875b9b40091539140bbbdc4639161c3&quot;&gt;&lt;code&gt;9bc0665&lt;/code&gt;&lt;/a> fix: make recursive payload tests deterministic</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b&quot;&gt;&lt;code&gt;5fde08a&lt;/code&gt;&lt;/a> fix: normalize recursive JWT payload errors</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/171062d2d734315272a901100aa4b109f2fc3c19&quot;&gt;&lt;code&gt;171062d&lt;/code&gt;&lt;/a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173&quot;&gt;#1173&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/c9d4d5375bf464ef363506fed9eb6e7f33217ab6&quot;&gt;&lt;code&gt;c9d4d53&lt;/code&gt;&lt;/a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174&quot;&gt;#1174&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/2763752196113e1473b0ed7905aa6034aedfbe53&quot;&gt;&lt;code&gt;2763752&lt;/code&gt;&lt;/a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202&quot;&gt;#1202&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/4adcd02722f5011c60079d3978dfc167b9a8eaa5&quot;&gt;&lt;code&gt;4adcd02&lt;/code&gt;&lt;/a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201&quot;&gt;#1201&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/9e501d993b4d3e7dba14bdb1722b1d993ac75097&quot;&gt;&lt;code&gt;9e501d9&lt;/code&gt;&lt;/a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179&quot;&gt;#1179&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/4047c44d51950ffda15f40054508d3f17c43b1e2&quot;&gt;&lt;code&gt;4047c44&lt;/code&gt;&lt;/a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212&quot;&gt;#1212&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/f4e2b59f543cc82d46d9d69922bba59e804216b9&quot;&gt;&lt;code&gt;f4e2b59&lt;/code&gt;&lt;/a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210&quot;&gt;#1210&lt;/a&gt;)&lt;/li>

<li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.13.0...2.15.0&quot;&gt;compare view</a></li>

</ul>

</details>


<br />


Updates anyio from 4.7.0 to 4.14.2



Release notes

Sourced from anyio's releases.




4.14.2


    

  • Changed ByteReceiveStream.receive() implementations to raise a ValueError when max_bytes is not a positive integer (#1191)
    • 

  • Fixed CapacityLimiter.total_tokens rejecting float("inf") when the limiter was instantiated outside of an event loop. The adapter setter checked for infinity by identity (value is math.inf), so only the exact math.inf singleton was accepted, while every backend setter (using math.isinf()) accepts any positive infinity (#1189; PR by @​greymoth-jp).
    • 

  • Fixed to_process.run_sync() deadlocking when the worker function writes enough data to sys.stderr to fill the (undrained) pipe buffer. The worker process now redirects sys.stderr to os.devnull as well, matching the documented behavior
    • 

  • Fixed TLSStream.wrap() matching an internationalized (unicode) host name against the peer certificate using IDNA 2003 (via the standard library) instead of IDNA 2008, which could cause the host name to be matched against the wrong certificate (#1208)
    • 

  • Fixed anyio.open_process() (and run_process()) ignoring the extra_groups argument, as it mistakenly passed the value of the group argument instead (#1209)
    • 

  • Fixed CapacityLimiter.acquire_nowait() and CapacityLimiter.acquire_nowait_on_behalf_of() raising trio.WouldBlock instead of anyio.WouldBlock on the trio backend when there are no tokens available (#1218)
    • 

  • Fixed CapacityLimiter on the asyncio backend over-granting tokens (borrowed_tokens exceeding total_tokens and available_tokens going negative) when a non-blocking acquire was made in the window between a token being released and the notified waiter resuming. The freed token is now reserved for the woken waiter right away, so the non-blocking acquire correctly raises WouldBlock (#1170; PR by @​gaoflow)
    • 

  • Fixed unnecessary CPU spin when delivering cancellation from CancelScope on asyncio under certain conditions, including improper cancel scope nesting (#1111)
    • 



4.14.1


    

  • Fixed teardown of higher-scoped async fixtures failing on asyncio with RuntimeError: Attempted to exit cancel scope in a different task than it was entered in when an async test raise an outcome exception (e.g., pytest.skip(), pytest.xfail(), or pytest.fail()) (#1179; PR by @​EmmanuelNiyonshuti)
    • 

  • Fixed CapacityLimiter.total_tokens rejecting a value of 0 when the limiter was instantiated outside of an event loop, contradicting the documented behavior of allowing 0 total tokens (#1183; PR by @​nyxst4ck)
    • 



4.14.0


    

  • 

    Added support for Python 3.15
    

    • 

  • 

    Added an asynchronous implementation of the itertools module (#998; PR by @​11kkw)
    

    • 

  • 

    Added the local_port parameter to connect_tcp() to allow binding to a specific local port before connecting (#1067; PR by @​nullwiz)
    

    • 

  • 

    Added support for custom capacity limiters in async path and file I/O functions and classes
    

    • 

  • 

    Added the create_task() task group method for easier asyncio migration (returns a TaskHandle) (#1098)
    

    • 

  • 

    Changed TaskGroup.start_soon() to return a TaskHandle
    

    • 

  • 

    Added an option for TaskGroup.start() to return a TaskHandle (which then contains the start value in the start_value property)
    

    • 

  • 

    Added the cancel() convenience method to TaskGroup as a shortcut for cancelling the task group's cancel scope
    

    • 

  • 

    Improved the error message when a known backend is not installed to suggest the install command (#1115; PR by @​EmmanuelNiyonshuti)
    

    • 

  • 

    Improved anyio.Path to preserve subclass types by returning Self in methods that return path objects (#1130; PR by @​EmmanuelNiyonshuti)
    

    • 

  • 

    Changed the parameter type annotation in anyio.Path.write_bytes() to accept any ReadableBuffer, thus allowing it to accept bytearray and memoryview to match pathlib.Path.write_bytes() (#1135; PR by @​SAY-5)
    

    • 

  • 

    Changed several type annotations to only accept callables returning coroutine-like objects instead of arbitrary awaitables:
    

      

    • TaskGroup.start_soon()
      • 

    • TaskGroup.start()
      • 

    • anyio.from_thread.run()
      • 

    

    This reverts an earlier change from v3.7.0 which was made in error. (#1153)
    

    • 

  • 

    Changed anyio.run to support callables returning arbitrary awaitables at runtime on all backends. Previously, this only worked on asyncio (#1171; PR by @​gschaffner)
    

    • 

  • 

    Changed several classes (and their subclasses) to have __slots__ (with __weakref__):
    

      

    • anyio.CancelScope
      • 

    

    • 






... (truncated)





Commits

    

  • c384f99 Bumped up the version
    • 

  • dbba29d Fixed 100% CPU spin on cancel scope misuse (#1217)
    • 

  • 6bbc6c3 Fix CapacityLimiter over-granting tokens on asyncio (#1172)
    • 

  • 6f82b25 Refactored TestTLSStream.test_receive_invalid_max_bytes() to be less flaky
    • 

  • be24b04 Relaxed timeouts to fix test flakiness
    • 

  • 8113506 Fix test flakiness caused by slow callback duration logging
    • 

  • 1e988b6 Fixed CapacityLimiter raising trio.WouldBlock instead of anyio.WouldBlock (#1...
    • 

  • 44713f3 Pin setup-uv to a commit sha across downstream jobs (#1213)
    • 

  • f1b7301 Fixed stderr writes in a worker subprocess causing a deadlock (#1207)
    • 

  • 212be93 Fix flaky test_tcp_listener_same_port using a hardcoded port (#1206)
    • 

  • Additional commits viewable in compare view
    • 







Updates certifi from 2024.8.30 to 2026.10.18



Commits






Updates cryptography from 48.0.1 to 50.0.0



Changelog

Sourced from cryptography's changelog.




50.0.0 - 2026-07-31



* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table> 





... (truncated)





Commits






Updates dnspython from 2.7.0 to 2.9.0



Release notes

Sourced from dnspython's releases.




dnspython 2.9.0


This release fixes a potential excessive CPU consumption issue.   Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos, for discovering and reporting this issue.


See What's New for details.


The minimum supported version of Python is 3.11.


My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.


This release was published to PyPI using Trusted Publishing.


dnspython 2.8.0


See What's New for details.


The minimum supported version of Python is 3.10.


My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Tomáš Křížek, Petr Špaček, and Brian Wellington.


This release was published to PyPI using Trusted Publishing.







Changelog

Sourced from dnspython's changelog.




2.9.0


    

  • 

    Decompression chain length is limited to 16.  Prior to this change,
a maliciously crafted DNS message could cause
dns.name.from_wire_parser() to use excessive CPU for DNS name
decompression. Applications which processed untrusted DNS wire form
messages with dnspython could be degraded or DoS'd by the extra CPU
use required.
    

    Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos
for finding and reporting this issue.
    

    See https://github.com/rthalley/dnspython/security/advisories/GHSA-45c3-73f7-pv4m
    

    • 

  • 

    Httpx2 has replaced httpx for HTTPS TCP connections.
    

    • 

  • 

    The minimum supported Python version is now 3.11.
    

    • 

  • 

    DNSSEC now supports ML-DSA-44, a post-quantum signature algorithm.
    

    • 

  • 

    The NSEC3 Next Hashed Owner Name in presentation format is now decoded as
base32hex (RFC 5155 Section 1.3, RFC 4648 Extended Hex Alphabet).  The letters
W, X, Y, and Z are not in that alphabet; they used to be accepted and silently
decoded to a different owner name, so to_text of the result did not match
the input.  They are now rejected.
    

    • 

  • 

    The NID and L64 node/locator ids in presentation format are now rejected when
a group contains anything other than hex digits. A sign or underscore, which
int() silently accepts, produced a record whose text form did not parse
back the same way (RFC 6742).
    

    • 

  • 

    Rdata of a known type in the generic \# syntax, such as an NS record in a
zone file, no longer fails to parse when it contains a name under the origin.
Its names are relativized as in the type's own text form.
    

    • 

  • 

    The SVCB and HTTPS ech parameter value must now be an ECHConfigList with a
correct length prefix and at least 4 octets of content (RFC 9848, RFC 9849).
The individual ECHConfig structures are not checked.
    

    • 

  • 

    SVCB and HTTPS SvcParamKeys in presentation format, including those listed in
mandatory, must now be spelled as RFC 9460 requires: 1-63 lowercase
letters, digits, or hyphens.  Uppercase keys such as ALPN and keys with
underscores such as no_default_alpn are rejected.
    

    • 

  • 

    SVCB and HTTPS presentation format parsing now follows the escaping rules of
RFC 9460.  SvcParamKeys may not contain escapes (e.g. \097lpn=h2), and in
comma-separated values (alpn, docpath) only \, and \\ are
valid escapes after character-string decoding (e.g. alpn="h2\\x" is
rejected).
    

    • 






... (truncated)





Commits






Updates mako from 1.3.12 to 1.4.2



Release notes

Sourced from mako's releases.




1.4.2


Released: Tue Sep 22 2026


bug


    

  • 

    [bug] [tests] Adjusted the test suite to accommodate for a change in Pygments 2.21.0
where the HtmlFormatter now renders " and ' characters
literally rather than as HTML entities, which caused failures in tests
that assert against the rendered output of
html_error_template().
    

    References: #440
    

    • 

  • 

    [bug] [template] Fixed issue in TemplateLookup where a URI beginning with a drive
designator (e.g. C:/../../secret.txt) could bypass the directory
traversal check on Windows, allowing reads of arbitrary files outside of
the template directory.  The check in Template normalized the URI
using os.path, which on Windows is ntpath; as ntpath splits the
drive designator off and treats the remainder as rooted, the ..
segments were absorbed before the check could inspect them.  Normalization
is now performed with posixpath, which is the same module used by
TemplateLookup.get_template() to resolve the URI to a file.
    

    References: #441
    

    • 



1.4.1


Released: Wed Aug 5 2026


bug


    

  • 

    [bug] [installation] Fixed issue in the 1.4.0 packaging where the repository's internal
tools/ directory was detected by setuptools package discovery and
installed as a top-level tools package into site-packages, shadowing
unrelated tools packages belonging to other applications.  Package
discovery is now limited to the mako package explicitly.
    

    References: #438
    

    • 



1.4.0


Released: Tue Aug 4 2026


changed


    

  • [changed] [examples] The examples/bench folder has been removed as it used mostly
    • 






... (truncated)





Commits






Updates urllib3 from 2.7.0 to 2.8.0



Release notes

Sourced from urllib3's releases.




2.8.0


🚀 urllib3 is fundraising for HTTP/2 support


urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.


Thank you for your support.


Security


Fixed the following security issues:


    

  • The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)
    • 

  • HTTPResponse.stream() and read_chunked() could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)
    • 

  • Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)
    • 





[!IMPORTANT]
urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.


Configure proxy CA certificates and client certificates in proxy_ssl_context, and proxy identity checks with proxy_assert_hostname or proxy_assert_fingerprint. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.






[!NOTE]
CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.




Deprecations & Removals


    

  • Deprecated using an empty collection as the Retry option allowed_methods to retry any verb. (#5044)
    • 



Features


    

  • Added Url.auth_decoded and Url.auth_decoded_joined convenience properties to the result of parse_url(). (#4945)
    • 

  • Added basic_auth_encoding and proxy_basic_auth_encoding parameters to urllib3.util.make_headers(). (#5092)
    • 



Bugfixes


    

  • 

    Fixed response header handling to replace obsolete folded header lines (obs-fold) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as Set-Cookie. (#1362)
    

    • 

  • 

    Fixed usage of proxy_ssl_context with ProxyManager when use_forwarding_for_https=True. Passing ssl_context instead of proxy_ssl_context for HTTPS proxies in this configuration now emits a FutureWarning and will raise an error in v3.0. (#2577)
    

    • 

  • 

    Changed behavior of the default ConnectionPool.pool initialization. LifoQueue is now resolved from the queue module after the ConnectionPool is instantiated instead of using the default cached QueueCls class property. This is done because sometimes the queue.LifoQueue is monkey-patched late in the program, such as by gevent. (#3289)
    

    • 

  • 

    Raised UnrewindableBodyError instead of ValueError when retrying a request whose body had tell() but not seek(). (#3779)
    

    • 

  • 

    Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (#3785)
    

    • 

  • 

    Fixed HTTPResponse.drain_conn() to discard unread response data in 64 KiB chunks (same as the default amt when doing HTTPResponse.stream(...)). (#5019)
    

    • 

  • 

    Fixed is_ipaddress() to detect non-standard IPv4 forms accepted by socket.connect, such as hex (0x7f000001), octal (0177.0.0.1), and decimal integers (2130706433), ensuring SSL certificate verification uses the correct mode for these addresses. (#5029)
    

    • 

  • 

    Fixed HTTPConnectionPool.urlopen raising a misleading FullPoolError instead of ValueError when called with an invalid timeout argument on a pool created with block=True. (#5059)
    

    • 

  • 

    Fixed port-zero handling to preserve explicit :0 values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, connection_from_url(), and HTTP/2 request authority. (#5071, #5101)
    

    • 

  • 

    Fixed a bug where PoolManager passed the assert_hostname and assert_fingerprint parameters to HTTP connection pools. (#5077)
    

    • 

  • 

    Fixed HTTPConnectionPool.urlopen() and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (#5079)
    

    • 

  • 

    Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (#5091)
    

    • 

  • 

    Fixed HTTPSConnection.connect() overriding ProxyConfig.ssl_context's certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.
    

    HTTPSConnection no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its ssl_context as a fallback when an HTTPS proxy forwards an HTTP target. (#5093)
    

    • 

  • 

    Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (#5095)
    

    • 






... (truncated)





Changelog

Sourced from urllib3's changelog.




2.8.0 (2026-09-15)


Security


Fixed the following security issues:


    

  • The TLS configuration for HTTPS proxies could be ignored or overridden.
(High severity, GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77>__)
    • 

  • HTTPResponse.stream() and read_chunked() could buffer a chunk-size
line of unbounded length in memory. (High severity,
GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw>__)
    • 

  • Chunked Deflate streaming could enter an infinite loop. (Medium severity,
GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g>__)
    • 



.. caution::


urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.

Configure proxy CA certificates and client certificates in
proxy_ssl_context, and proxy identity checks with
proxy_assert_hostname or proxy_assert_fingerprint.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.



Deprecations & Removals


    

  • Deprecated using an empty collection as the Retry option
allowed_methods to retry any verb.
([#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044>__)
    • 



Features


    

  • Added Url.auth_decoded and Url.auth_decoded_joined convenience
properties to the result of parse_url().
([#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945>__)
    • 

  • Added basic_auth_encoding and proxy_basic_auth_encoding parameters to
urllib3.util.make_headers().
([#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092>__)
    • 



Bugfixes





... (truncated)





Commits

    

  • b1d30ab Release 2.8.0
    • 

  • 9016d7e Skip test_read_chunked_with_trailing_data_does_not_hang for brotlicffi (#5258)
    • 

  • 9101f58 Fix nox -s docs warning (#5256)
    • 

  • cd770b0 Merge commit from fork
    • 

  • ea2ad7b Merge commit from fork
    • 

  • 0716e31 Fix loading unencrypted client keys with a password in pyOpenSSL (#5255)
    • 

  • 43c68c8 Test pickling of InvalidChunkLength (#5247)
    • 

  • 308b279 Share security policy between GitHub and Read the Docs (#5253)
    • 

  • 53fa073 Add policy on duplicate pull requests (#5252)
    • 

  • 5f2a6a8 Assert on the ALPN extension in test_tunnel_sets_http_11_alpn (#5232)
    • 

  • Additional commits viewable in compare view
    • 







Updates virtualenv from 20.36.1 to 21.14.13



Release notes

Sourced from virtualenv's releases.




21.14.13




Security


    

  • Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by @​rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax. (#3466) by @​gaborbernat.
    • 

  • Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, replace a read-only .venv redirect that points at a virtualenv. (#3466) by @​gaborbernat.
    • 



🐍 PyPI release


📜 Full Changelog


21.14.12




Packaging


    

  • Upgrade the embedded setuptools wheel from 84.0.0 to 84.2.1 and the embedded pip wheel from 26.2.1 to 26.2.2. (#3452)
    • 



New Contributors



🐍 PyPI release


📜 Full Changelog


21.14.11




Bug fixes


    

  • Search all directories supplied by repeated --extra-search-dir options instead of keeping only the last group. (#3440) by @​repzakske.
    • 

  • On Windows, the app data is now migrated into the nested cache directory instead of the migration failing with a warning on every run. (#3441) by @​gaborbernat and @​XXXXXQ-0206.
    • 



🐍 PyPI release


📜 Full Changelog


21.14.10




Bug fixes


    

  • Always copy seed packages when app-data is temporary, including when symlink seeding is enabled through an environment variable or configuration file. Seeded packages remain available after temporary cache cleanup. (#3437) by @​gaborbernat.
    • 



🐍 PyPI release


📜 Full Changelog





... (truncated)





Changelog

Sourced from virtualenv's changelog.




#################
Release History
#################


.. towncrier-draft-entries:: [UNRELEASED DRAFT]


.. towncrier release notes start


.. _release-21-15-1:




21.15.1 (2026-10-28)




.. _release-21-15-1-fixed:


Fixed


    

  • Keep the name of a seeded console_scripts entry that contains digits but does not end in a version, such as
python3-config or 2to3, instead of truncating it at the first digit; python3-config overwrote the
environment's python executable (:pr:3451) by :user:JingHao-Leon and :user:gaborbernat.
    • 

  • Copy the content of a symlinked directory when a tree is copied into an environment, instead of dropping it
(:pr:3454) by :user:JingHao-Leon and :user:gaborbernat.
    • 

  • Count each -v, -q, -p and --try-first-with option once instead of once per internal parsing pass, so
Session.verbosity is 3 rather than 9 for a single -v (:pr:3457) by :user:darrenhuai and
:user:gaborbernat.
    • 

  • Copy the seed packages instead of failing when VIRTUALENV_SYMLINK_APP_DATA or symlink_app_data in the config
file turns on symlink seeding on a host that cannot create symlinks, such as Windows without the symlink privilege
(:pr:3465) by :user:darrenhuai and :user:gaborbernat.
    • 

  • Run the interpreter that collects the target debug information (-vv output and Creator.debug) without
PYTHONPATH and with the environment passed to cli_run, so the reported sys.path no longer lists the
caller's PYTHONPATH entries (:pr:3474) by :user:RaphaelFakhri and :user:gaborbernat.
    • 



.. _release-21-15...

Description has been truncated

@dependabot
Bump the uv group across 1 directory with 9 updates
6fea774 
Bumps the uv group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [black](https://github.com/psf/black) | `26.3.1` | `26.10.1` |
| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.13.0` | `2.15.0` |
| [anyio](https://github.com/agronholm/anyio) | `4.7.0` | `4.14.2` |
| [certifi](https://github.com/certifi/python-certifi) | `2024.8.30` | `2026.10.18` |
| [cryptography](https://github.com/pyca/cryptography) | `48.0.1` | `50.0.0` |
| [dnspython](https://github.com/rthalley/dnspython) | `2.7.0` | `2.9.0` |
| [mako](https://github.com/sqlalchemy/mako) | `1.3.12` | `1.4.2` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.7.0` | `2.8.0` |
| [virtualenv](https://github.com/pypa/virtualenv) | `20.36.1` | `21.14.13` |



Updates `black` from 26.3.1 to 26.10.1
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@26.3.1...26.10.1)

Updates `pyjwt` from 2.13.0 to 2.15.0
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.13.0...2.15.0)

Updates `anyio` from 4.7.0 to 4.14.2
- [Release notes](https://github.com/agronholm/anyio/releases)
- [Commits](agronholm/anyio@4.7.0...4.14.2)

Updates `certifi` from 2024.8.30 to 2026.10.18
- [Commits](certifi/python-certifi@2024.08.30...2026.10.18)

Updates `cryptography` from 48.0.1 to 50.0.0
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@48.0.1...50.0.0)

Updates `dnspython` from 2.7.0 to 2.9.0
- [Release notes](https://github.com/rthalley/dnspython/releases)
- [Changelog](https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst)
- [Commits](rthalley/dnspython@v2.7.0...v2.9.0)

Updates `mako` from 1.3.12 to 1.4.2
- [Release notes](https://github.com/sqlalchemy/mako/releases)
- [Changelog](https://github.com/sqlalchemy/mako/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/mako/commits)

Updates `urllib3` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.7.0...2.8.0)

Updates `virtualenv` from 20.36.1 to 21.14.13
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@20.36.1...21.14.13)

---
updated-dependencies:
- dependency-name: black
  dependency-version: 26.10.1
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: pyjwt
  dependency-version: 2.15.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: anyio
  dependency-version: 4.14.2
  dependency-type: indirect
  dependency-group: uv
- dependency-name: certifi
  dependency-version: 2026.10.18
  dependency-type: indirect
  dependency-group: uv
- dependency-name: cryptography
  dependency-version: 50.0.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: dnspython
  dependency-version: 2.9.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: mako
  dependency-version: 1.4.2
  dependency-type: indirect
  dependency-group: uv
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: indirect
  dependency-group: uv
- dependency-name: virtualenv
  dependency-version: 21.14.13
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Oct 28, 2026
@dependabot dependabot Bot mentioned this pull request Oct 28, 2026
Closed
@coderabbitai

coderabbitai Bot commented Oct 28, 2026

Copy link
Copy Markdown

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration
  • Source mode: Auto
  • Repository: Unavailable
  • Branch: Unavailable
  • File: No configuration file from this repository applied
  • Commit: Unavailable
  • Layers: Organization UI
  • Review profile: CHILL
  • Plan: Advanced
  • Run ID: 0d477315-4cb6-45d4-8092-c8a0a1ea57a2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@jeffmaki
jeffmaki merged commit 33bb59a into main Oct 28, 2026
2 checks passed
@dependabot
dependabot Bot deleted the dependabot/uv/uv-e7f6bc12fe branch October 28, 2026 18:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@jeffmaki