chore(deps): bump the pip group across 1 directory with 15 updates by dependabot[bot] · Pull Request #20 · opensensor/django-forms-workflows

dependabot · 2026-08-17T03:02:44Z

Bumps the pip group with 15 updates in the / directory:

Package	From	To
django	`5.2.7`	`5.2.16`
requests	`2.32.5`	`2.33.0`
weasyprint	`68.1`	`69.0`
pytest	`8.4.2`	`9.0.3`
black	`25.9.0`	`26.3.1`
cryptography	`46.0.3`	`50.0.0`
httplib2	`0.31.1`	`0.32.0`
idna	`3.11`	`3.15`
lxml	`6.0.2`	`6.1.0`
pillow	`12.1.1`	`12.3.0`
protobuf	`6.33.4`	`6.33.5`
pyasn1	`0.6.2`	`0.6.4`
pyjwt	`2.10.1`	`2.13.0`
sqlparse	`0.5.3`	`0.5.4`
urllib3	`2.5.0`	`2.7.0`

Updates django from 5.2.7 to 5.2.16

Commits

6c8eee4 [5.2.x] Bumped version for 5.2.16 release.
d5d60ed [5.2.x] Fixed CVE-2026-53878 -- Prevented newlines from being accepted in Dom...
6c66eb8 [5.2.x] Fixed CVE-2026-53877 -- Prevented heap buffer over-read when creating...
721685a [5.2.x] Fixed CVE-2026-48588 -- Prevented caching of responses that set cooki...
61a829d [5.2.x] Added stub release notes and release date 5.2.16.
21af510 [5.2.x] Avoided breaking sha1sum verification in the generated checksum.txt f...
039df55 [5.2.x] Replaced the defunct pgp.mit.edu keyserver with GitHub for key import.
2b3093f [5.2.x] Fixed #29187 -- Fixed flaky receiver count assertion in signals tests.
4abc595 [5.2.x] Refs #16281 -- Fixed isolation of admin_views.ViewOnSiteTests.
f87add9 [5.2.x] Added CVE-2026-6873, CVE-2026-7666, CVE-2026-8404, CVE-2026-35193, an...
Additional commits viewable in compare view

Updates requests from 2.32.5 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates weasyprint from 68.1 to 69.0

Release notes

Sourced from weasyprint's releases.

v69.0

This is a security update (CVE-2026-49452).

We strongly recommend to upgrade WeasyPrint to the latest version if you use the --presentational-hints option and render untrusted HTML with restricted CSS properties.

Read about this release on our blog.

Security

Avoid CSS injection with HTML presentational hints.

Command-line API

The --srgb option has been replaced by --output-intent=srgb. Other values are possible: device-cmyk for CMYK documents with no ICC profile, or the CSS identifier of a @color-profile rule.

Python API

The output_intent string entry replaces the srgb boolean in default options.

Features

#2357, #2700: Support logical properties

#1194, #2702: Support viewport units

#2686: Detect redirection loops early in URL fetcher

#2735, #2737: Support SVG transform angle units

#2636, #2720, #2773: Use HTML parsers for presentational hints

#2631, #2778, #2785, #2788: Allow users to set PDF output intent

Bug fixes

#2697, #2691: Avoid endless loops in grids

#2709: Be less strict for gradient rasterization in tests

#2683: Fix rendering of emojis in SVG

#2688: Always describe font using absolute sizes

#2676: Fix inheritance for svg/symbol tags referenced by use tags

#2681: Add dc:description field to PDF/A metadata

#2680: Force first grid row rendering on empty pages

#2690: Compute units in gradients used in border background

#2689: Cut flex elements with fixed height and overflowing children

#2651, #2696: Fix tests on Debian

#2698, #2699: Fix alignment of right-to-left elements with auto width and set min/max-width

#2556: Apply presentational hints to svg tags

#2706: Handle infinite border radii

#2707, #2708, #2710: Get mimetypes from Python code instead of various third-party files

#2717, #2580, #2740: Fix table break retry after padding overflow

#2769: Add year in PDF/UA-2 metadata

#2768: Allow SVG lists of numbers to be split on + character

#2770: Add namespace to Document tag in PDF 2

#2771: Never try to render SVG use tags with external sources

#2774: Fix calc in logical

... (truncated)

Changelog

Sourced from weasyprint's changelog.

Version 69.0

Released on 2026-06-02.

This is a security update (CVE-2026-49452).

We strongly recommend to upgrade WeasyPrint to the latest version if you use the --presentational-hints option and render untrusted HTML with restricted CSS properties.

Security:

Avoid CSS injection with HTML presentational hints.

Command-line API:

The --srgb option has been replaced by --output-intent=srgb. Other values are possible: device-cmyk for CMYK documents with no ICC profile, or the CSS identifier of a @color-profile rule.

Python API:

The output_intent string entry replaces the srgb boolean in default options.

Features:

[#2357](https://github.com/Kozea/WeasyPrint/issues/2357) <https://github.com/Kozea/WeasyPrint/issues/2357>, [#2700](https://github.com/Kozea/WeasyPrint/issues/2700) <https://github.com/Kozea/WeasyPrint/pull/2700>: Support logical properties

[#1194](https://github.com/Kozea/WeasyPrint/issues/1194) <https://github.com/Kozea/WeasyPrint/issues/1194>, [#2702](https://github.com/Kozea/WeasyPrint/issues/2702) <https://github.com/Kozea/WeasyPrint/pull/2702>: Support viewport units

[#2686](https://github.com/Kozea/WeasyPrint/issues/2686) <https://github.com/Kozea/WeasyPrint/issues/2686>_: Detect redirection loops early in URL fetcher

[#2735](https://github.com/Kozea/WeasyPrint/issues/2735) <https://github.com/Kozea/WeasyPrint/issues/2735>, [#2737](https://github.com/Kozea/WeasyPrint/issues/2737) <https://github.com/Kozea/WeasyPrint/pull/2737>: Support SVG transform angle units

[#2636](https://github.com/Kozea/WeasyPrint/issues/2636) <https://github.com/Kozea/WeasyPrint/issues/2636>, [#2720](https://github.com/Kozea/WeasyPrint/issues/2720) <https://github.com/Kozea/WeasyPrint/pull/2720>, [#2773](https://github.com/Kozea/WeasyPrint/issues/2773) <https://github.com/Kozea/WeasyPrint/pull/2773>_: Use HTML parsers for presentational hints

[#2631](https://github.com/Kozea/WeasyPrint/issues/2631) <https://github.com/Kozea/WeasyPrint/issues/2631>, [#2778](https://github.com/Kozea/WeasyPrint/issues/2778) <https://github.com/Kozea/WeasyPrint/pull/2778>, [#2785](https://github.com/Kozea/WeasyPrint/issues/2785) <https://github.com/Kozea/WeasyPrint/issues/2785>, [#2788](https://github.com/Kozea/WeasyPrint/issues/2788) <https://github.com/Kozea/WeasyPrint/pull/2788>: Allow users to set PDF output intent

Bug fixes:

... (truncated)

Commits

3287311 Version 69.0
6f58a9a Add security message in Changelog
2d13d3d Update test comment to indicate related issue
227f5f7 Merge pull request #2791 from Kozea/improve-var
ff72115 Improve management of variables
b419c7f Merge pull request #2788 from Kozea/fix-hints
1729ce4 Fix minor errors in presentational hints
9898e84 Merge pull request #2787 from danfitz36/fix-namespace-type-typo
15eea9f Add lang attribute to PDF/UA-2 namespace test
cb5f66c Fix /Namepace typo in PDF 2 structure-tree namespace
Additional commits viewable in compare view

Updates pytest from 8.4.2 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

#12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

#13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

Previously this resulted in an internal assertion failure during plugin loading.

Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

#13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

#14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

#14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

#13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.

#13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.

#14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.

#14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

#12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

-- by aleguy02

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

#13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.

#13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.

#13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0. Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim. It will be deprecated in pytest 9.1 and removed in pytest 10.

... (truncated)

Commits

a7d58d7 Prepare release version 9.0.3
089d981 Merge pull request #14366 from bluetech/revert-14193-backport
8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
74eac69 doc: Update training info (#14298) (#14301)
f92dee7 Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...
7ee58ac Merge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...
37da870 Merge pull request #14259 from mitre88/patch-4 (#14268)
c34bfa3 Add explanation for string context diffs (#14257) (#14266)
Additional commits viewable in compare view

Updates black from 25.9.0 to 26.3.1

Release notes

Sourced from black's releases.

26.3.1

Stable style

Prevent Jupyter notebook magic masking collisions from corrupting cells by using exact-length placeholders for short magics and aborting if a placeholder can no longer be unmasked safely (#5038)

Configuration

Always hash cache filename components derived from --python-cell-magics so custom magic names cannot affect cache paths (#5038)

Blackd

Disable browser-originated requests by default, add configurable origin allowlisting and request body limits, and bound executor submissions to improve backpressure (#5039)

26.3.0

Stable style

Don't double-decode input, causing non-UTF-8 files to be corrupted (#4964)

Fix crash on standalone comment in lambda default arguments (#4993)

Preserve parentheses when # type: ignore comments would be merged with other comments on the same line, preventing AST equivalence failures (#4888)

Preview style

Fix bug where if guards in case blocks were incorrectly split when the pattern had a trailing comma (#4884)

Fix string_processing crashing on unassigned long string literals with trailing commas (one-item tuples) (#4929)

Simplify implementation of the power operator "hugging" logic (#4918)

Packaging

Fix shutdown errors in PyInstaller builds on macOS by disabling multiprocessing in frozen environments (#4930)

Performance

Introduce winloop for windows as an alternative to uvloop (#4996)

Remove deprecated function uvloop.install() in favor of uvloop.new_event_loop() (#4996)

Rename maybe_install_uvloop function to maybe_use_uvloop to simplify loop installation and creation of either a uvloop/winloop evenloop or default eventloop (#4996)

Output

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.3.1

Stable style

Prevent Jupyter notebook magic masking collisions from corrupting cells by using exact-length placeholders for short magics and aborting if a placeholder can no longer be unmasked safely (#5038)

Configuration

Always hash cache filename components derived from --python-cell-magics so custom magic names cannot affect cache paths (#5038)

Blackd

Disable browser-originated requests by default, add configurable origin allowlisting and request body limits, and bound executor submissions to improve backpressure (#5039)

Version 26.3.0

Stable style

Don't double-decode input, causing non-UTF-8 files to be corrupted (#4964)

Fix crash on standalone comment in lambda default arguments (#4993)

Preserve parentheses when # type: ignore comments would be merged with other comments on the same line, preventing AST equivalence failures (#4888)

Preview style

Fix bug where if guards in case blocks were incorrectly split when the pattern had a trailing comma (#4884)

Fix string_processing crashing on unassigned long string literals with trailing commas (one-item tuples) (#4929)

Simplify implementation of the power operator "hugging" logic (#4918)

Packaging

Fix shutdown errors in PyInstaller builds on macOS by disabling multiprocessing in frozen environments (#4930)

Performance

Introduce winloop for windows as an alternative to uvloop (#4996)

Remove deprecated function uvloop.install() in favor of uvloop.new_event_loop() (#4996)

Rename maybe_install_uvloop function to maybe_use_uvloop to simplify loop installation and creation of either a uvloop/winloop eventloop or default eventloop (#4996)

... (truncated)

Commits

c6755bb Prepare release 26.3.1 (#5046)
69973fd Harden blackd browser-facing request handling (#5039)
4937fe6 Fix some shenanigans with the cache file and IPython (#5038)
2e641d1 docs: remove outdated Black Playground references (#5044)
c014b22 Remove unused internal code (#5041)
0dae20b Add new changelog (#5036)
c5c1cbd Minor release patches (#5035)
7e5a828 docs: clarify relationship between Black style and PEP 8 (#5025)
69705de docs: add clearer pyproject configuration guidance (#5026)
35ea679 Prepare release 26.3.0 (#5032)
Additional commits viewable in compare view

Updates cryptography from 46.0.3 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

dcb7050 Prepare for 50.0.0 release (#15372)
53fccd9 Don't leak how PKCS#7 encryptedKey decryption failed (#15369)
d472f97 Add from __future__ import annotations to all src/ Python files (#15371)
908773d Bump downstream dependencies in CI (#15368)
2cc07cc Bump BoringSSL, OpenSSL, AWS-LC in CI (#15367)
c94ede9 chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)
67a8308 chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)
95018ff Release the GIL in one-shot AEAD encrypt/decrypt (#15361)
6954733 Release the GIL during DH and DSA parameter generation (#15364)
6893b94 Import _serialization instead of serialization in x509/extensions (#15363)
Additional commits viewable in compare view

Updates httplib2 from 0.31.1 to 0.32.0

Changelog

Sourced from httplib2's changelog.

0.32.0

Python support 3.8+ only

decompression limited by size and ratio

decoder foundation to support more compression algorithms

0.31.2

build(deps): pp.DelimitedList (camel case) only available in pyparsing>=3.1 httplib2/httplib2#255

DO NOT use 0.31.1

Commits

ba9bf50 v0.32.0 release
87581ad decompression limited by size and ratio; require python 3.8+
a99a11f v0.31.2 release
370010a dep-compat: pp.DelimitedList (camel case) only available in pyparsing>=3.1
See full diff in compare view

Updates idna from 3.11 to 3.15

Changelog

Sourced from idna's changelog.

3.15 (2026-05-12)

Enforce DNS-length cap on individual labels early in check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.

Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.

Use raise ... from err for proper exception chaining and switch internal string formatting to f-strings.

Allow flit_core 4.x in the build backend.

Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.

Add Dependabot configuration for GitHub Actions.

Convert README and HISTORY from reStructuredText to Markdown.

Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.

3.14 (2026-05-10)

Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]

Thanks to Stan Ulbrych for reporting the issue.

3.13 (2026-04-22)

Correct classification error for codepoint U+A7F1

3.12 (2026-04-21)

Update to Unicode 17.0.0.

Issue a deprecation warning for the transitional argument.

Added lazy-loading to provide some performance improvements.

Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.

Thanks to Rodrigo Nogueira for contributions to this release.

Commits

af30a09 Release 3.15
30314d4 Pre-release 3.15rc0
05d4b21 Merge pull request #237 from kjd/convert-docs-to-markdown
2987fdb Convert README and HISTORY from reStructuredText to Markdown
59fa800 Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333ea
def6983 Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea
bbd8004 Merge pull request #234 from StanFromIreland/patch-1
edd07c0 Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group
5557db0 Merge branch 'master' into patch-1
f11746c Merge pull request #235 from StanFromIreland/patch-2
Additional commits viewable in compare view

Updates lxml from 6.0.2 to 6.1.0

Changelog

Sourced from lxml's changelog.

6.1.0 (2026-04-17)

This release fixes a possible external entity injection (XXE) vulnerability in iterparse() and the ETCompatXMLParser.

Features added

GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes in lxml.html.defs. This allows lxml_html_clean to pass them through. Patch by oomsveta.

The default chunk size for reading from file-likes in iterparse() is now configurable with a new chunk_size argument.

Bugs fixed

LP#2146291: The resolve_entities option was still set to True for iterparse and ETCompatXMLParser, allowing for external entity injection (XXE) when using these parsers without setting this option explicitly. The default was now changed to 'internal' only (as for the normal XML and HTML parsers since lxml 5.0). Issue found by Sihao Qiu as CVE-2026-41066.

6.0.4 (2026-04-12)

Bugs fixed

LP#2148019: Spurious MemoryError during namespace cleanup.

6.0.3 (2026-04-09)

Bugs fixed

Several out of memory error cases now raise MemoryError that were not handled before.

Slicing with large step values (outside of +/- sys.maxsize) could trigger undefined C behaviour.

LP#2125399: Some failing tests were fixed or disabled in PyPy.

LP#2138421: Memory leak in error cases when setting the public_id or system_url of a document.

... (truncated)

Commits

43722f4 Update changelog.
8747040 Name version of option change in docstring.
6c36e6c Fix pypistats URL in download statistics script.
c7d76d6 Change security policy to point to Github security advisories.
378ccf8 Update project income report.
315270b Docs: Reduce TOC depth of package pages and move module contents first.
6dbba7f Docs: Show current year in copyright line.
e4385bf Update project income report.
5bed1e1 Validate file hashes in release download script.
c13ee10 Prepare release of 6.1.0.
Additional commits viewable in compare view

Updates pillow from 12.1.1 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Remove non-image ImageCms modes #9697 [@radarhere]

Documentation

Add release notes for SBOM and performance improvements #9747 [@radarhere]

Add security release notes #9741 [@radarhere]

Add release notes for Python 3.15 beta wheels #9696 [@radarhere]

ImageFont can also be used with ImageText #9597 [@radarhere]

Additional guidelines for security reports #9659 [@wiredfool]

Fixed typo #9636 [@radarhere]

Added CVEs to 12.2.0 release notes #9591 [@radarhere]

Revise development support information in README #9583 [@aclark4life]

Add INCIDENT_RESPONSE.md #9555 [@aclark4life]

Add STRIDE threat model to security docs #9562 [@aclark4life]

Add CVEs to 12.2.0 release notes #9556 [@radarhere]

Update README with revised security policy #9553 [@radarhere]

Update security policy #9552 [@aclark4life]

Update macOS tested Python versions #9534 [@radarhere]

Dependencies

Update dependency harfbuzz to v14.2.1 #9720 [@renovate[bot]]

Update dependency mypy to v2 #9653 [@renovate[bot]]

Update dependency cibuildwheel to v4 #9665 [@renovate[bot]]

Update github-actions #9655 [@renovate[bot]]

Update dependency libavif to v1.4.2 #9652 [@renovate[bot]]

Update dependency lcms2 to v2.19.1 #9651 [@renovate[bot]]

Update dependency check-jsonschema to v0.37.2 #9650 [@renovate[bot]]

Update google/oss-fuzz digest to d872252 #9614 [@renovate[bot]]

Update dependency lcms2 to v2.19 #9609 [@renovate[bot]]

Update dependency libpng to v1.6.58 - autoclosed #9608 [@renovate[bot]]

Update dependency harfbuzz to v14 #9610 [@renovate[bot]]

Update dependency mypy to v1.20.2 #9599 [@renovate[bot]]

Update github-actions #9611 [@renovate[bot]]

Update dependency cibuildwheel to v3.4.1 #9607 [@renovate[bot]]

Move dependency versions to single JSON and enable Renovate #9559 [@hugovk]

Updated raqm to 0.10.5 #9557 [@radarhere]

Update dependency cibuildwheel to v3.4.0 #9532 [@renovate[bot]]

Testing

Remove matrix.os from benchmark #9735 [@radarhere]

Remove references to libavif patch #9734 [@radarhere]

Add benchmark tests #9654 [@akx]

Use reshape() instead of setting NumPy array shape directly #9728 [@radarhere]

... (truncated)

Commits

bb1d8e8 12.3.0 version bump
e63fc48 Add release notes for SBOM and performance improvements (#9747)
13b701b Add release notes for #9679
5564ca7 List methods
a0920fd Speed up ImageChops operations (#9738)
07e9a6c Speed up Image.filter() (#9736)
a94578c Speed up Image.getchannel(), Image.merge(), Image.putalpha() and `Image...
53e02c4 Speed up Image.fill(), Image.linear_gradient() and `Image.radial_gradient...
af03747 Speed up Image.resample() (#9739)
5c9ca56 Speed up alpha_composite, matrix, negative, quantize (#9740)
Additional commits viewable in compare view

Updates protobuf from 6.33.4 to 6.33.5

Commits

See full diff in compare view

Updates pyasn1 from 0.6.2 to 0.6.4

Release notes

Sourced from pyasn1's releases.

Release 0.6.4

This is a security release.

CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.

CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.

CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.

Pinned PyPI publish GitHub Action to an immutable commit.

All changes are noted in the CHANGELOG.

Release 0.6.3

It's a minor release.

Added nesting depth limit to ASN.1 decoder to prevent stack overflow from deeply nested structures (CVE-2026-30922).

Fixed OverflowError from oversized BER length field.

Fixed DeprecationWarning stacklevel for deprecated attributes.

Fixed asDateTime incorrect fractional seconds parsing.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.4, released 08-07-2026

CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU. Arcs are now accumulated in linear time; decoded values are unchanged (thanks for reporting, tynus2)

CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits), matching the OID arc limit introduced in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume...
Description has been truncated

Bumps the pip group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [django](https://github.com/django/django) | `5.2.7` | `5.2.16` | | [requests](https://github.com/psf/requests) | `2.32.5` | `2.33.0` | | [weasyprint](https://github.com/Kozea/WeasyPrint) | `68.1` | `69.0` | | [pytest](https://github.com/pytest-dev/pytest) | `8.4.2` | `9.0.3` | | [black](https://github.com/psf/black) | `25.9.0` | `26.3.1` | | [cryptography](https://github.com/pyca/cryptography) | `46.0.3` | `50.0.0` | | [httplib2](https://github.com/httplib2/httplib2) | `0.31.1` | `0.32.0` | | [idna](https://github.com/kjd/idna) | `3.11` | `3.15` | | [lxml](https://github.com/lxml/lxml) | `6.0.2` | `6.1.0` | | [pillow](https://github.com/python-pillow/Pillow) | `12.1.1` | `12.3.0` | | [protobuf](https://github.com/protocolbuffers/protobuf) | `6.33.4` | `6.33.5` | | [pyasn1](https://github.com/pyasn1/pyasn1) | `0.6.2` | `0.6.4` | | [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` | | [sqlparse](https://github.com/andialbrecht/sqlparse) | `0.5.3` | `0.5.4` | | [urllib3](https://github.com/urllib3/urllib3) | `2.5.0` | `2.7.0` | Updates `django` from 5.2.7 to 5.2.16 - [Commits](django/django@5.2.7...5.2.16) Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `weasyprint` from 68.1 to 69.0 - [Release notes](https://github.com/Kozea/WeasyPrint/releases) - [Changelog](https://github.com/Kozea/WeasyPrint/blob/main/docs/changelog.rst) - [Commits](Kozea/WeasyPrint@v68.1...v69.0) Updates `pytest` from 8.4.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@8.4.2...9.0.3) Updates `black` from 25.9.0 to 26.3.1 - [Release notes](https://github.com/psf/black/releases) - [Changelog](https://github.com/psf/black/blob/main/CHANGES.md) - [Commits](psf/black@25.9.0...26.3.1) Updates `cryptography` from 46.0.3 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@46.0.3...50.0.0) Updates `httplib2` from 0.31.1 to 0.32.0 - [Changelog](https://github.com/httplib2/httplib2/blob/master/CHANGELOG) - [Commits](httplib2/httplib2@v0.31.1...v0.32.0) Updates `idna` from 3.11 to 3.15 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.11...v3.15) Updates `lxml` from 6.0.2 to 6.1.0 - [Release notes](https://github.com/lxml/lxml/releases) - [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt) - [Commits](lxml/lxml@lxml-6.0.2...lxml-6.1.0) Updates `pillow` from 12.1.1 to 12.3.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.1.1...12.3.0) Updates `protobuf` from 6.33.4 to 6.33.5 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `pyasn1` from 0.6.2 to 0.6.4 - [Release notes](https://github.com/pyasn1/pyasn1/releases) - [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst) - [Commits](pyasn1/pyasn1@v0.6.2...v0.6.4) Updates `pyjwt` from 2.10.1 to 2.13.0 - [Release notes](https://github.com/jpadilla/pyjwt/releases) - [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst) - [Commits](jpadilla/pyjwt@2.10.1...2.13.0) Updates `sqlparse` from 0.5.3 to 0.5.4 - [Changelog](https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG) - [Commits](andialbrecht/sqlparse@0.5.3...0.5.4) Updates `urllib3` from 2.5.0 to 2.7.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.5.0...2.7.0) --- updated-dependencies: - dependency-name: django dependency-version: 5.2.16 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: weasyprint dependency-version: '69.0' dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: black dependency-version: 26.3.1 dependency-type: direct:development dependency-group: pip - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: indirect dependency-group: pip - dependency-name: httplib2 dependency-version: 0.32.0 dependency-type: indirect dependency-group: pip - dependency-name: idna dependency-version: '3.15' dependency-type: indirect dependency-group: pip - dependency-name: lxml dependency-version: 6.1.0 dependency-type: indirect dependency-group: pip - dependency-name: pillow dependency-version: 12.3.0 dependency-type: indirect dependency-group: pip - dependency-name: protobuf dependency-version: 6.33.5 dependency-type: indirect dependency-group: pip - dependency-name: pyasn1 dependency-version: 0.6.4 dependency-type: indirect dependency-group: pip - dependency-name: pyjwt dependency-version: 2.13.0 dependency-type: indirect dependency-group: pip - dependency-name: sqlparse dependency-version: 0.5.4 dependency-type: indirect dependency-group: pip - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: indirect dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 17, 2026

matteius merged commit c642ceb into main Aug 17, 2026
6 checks passed

dependabot Bot deleted the dependabot/pip/pip-11be74d813 branch August 17, 2026 04:55

Navigation Menu

Uh oh!

chore(deps): bump the pip group across 1 directory with 15 updates - #20

chore(deps): bump the pip group across 1 directory with 15 updates#20
matteius merged 1 commit into
mainfrom
dependabot/pip/pip-11be74d813

dependabot Bot commented on behalf of github Aug 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 17, 2026

v2.33.0

2.33.0 (2026-03-25)

New Contributors

2.33.0 (2026-03-25)

v69.0

Security

Command-line API

Python API

Features

Bug fixes

Version 69.0

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

Improved documentation

Contributor-facing changes

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

26.3.1

Stable style

Configuration

Blackd

26.3.0

Stable style

Preview style

Packaging

Performance

Output

Version 26.3.1

Stable style

Configuration

Blackd

Version 26.3.0

Stable style

Preview style

Packaging

Performance

3.15 (2026-05-12)

3.14 (2026-05-10)

3.13 (2026-04-22)

3.12 (2026-04-21)

6.1.0 (2026-04-17)

Features added

Bugs fixed

6.0.4 (2026-04-12)

Bugs fixed

6.0.3 (2026-04-09)

Bugs fixed

12.3.0

Removals

Documentation

Dependencies

Testing

Release 0.6.4

Release 0.6.3

Revision 0.6.4, released 08-07-2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant