Skip to content

chore(deps): bump the python-minor-and-patch group across 1 directory with 18 updates#1426

Open
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/uv/shifter/shifter_platform/dev/python-minor-and-patch-b9978314a9
Open

chore(deps): bump the python-minor-and-patch group across 1 directory with 18 updates#1426
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/uv/shifter/shifter_platform/dev/python-minor-and-patch-b9978314a9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 18 updates in the /shifter/shifter_platform directory:

Package From To
asyncssh 2.23.0 2.24.0
boto3 1.43.2 1.43.51
daphne 4.2.1 4.2.2
django 6.0.6 6.0.7
drf-spectacular 0.29.0 0.30.0
drf-spectacular-sidecar 2026.6.1 2026.7.1
firebase-admin 7.4.0 7.5.0
pycurl 7.46.0 7.47.0
regex 2026.6.28 2026.7.19
requests 2.33.1 2.34.2
websockets 16.0 16.1.1
import-linter 2.11 2.13
pytest 9.0.3 9.1.1
ruff 0.15.13 0.15.22
pytest-asyncio 1.3.0 1.4.0
mypy 2.1.0 2.3.0
django-stubs 6.0.4 6.0.7
types-bleach 6.3.0.20260508 6.4.0.20260607

Updates asyncssh from 2.23.0 to 2.24.0

Changelog

Sourced from asyncssh's changelog.

Release 2.24.0 (27 Jun 2026)

  • Added support for creating and validating SSHSIG signatures, as well as OpenSSH "allowed signers" files.

  • Added support for ML-KEM key exchange from the PyCA cryptography package when it is available. This avoids the need to have the liboqs library installed to use ML-KEM. However, liboqs is still required to support SNTRUP kex exchange.

  • Fixed an issue with handling of SSH maximum packet size when opening a new SSH channel, aborting with a protocol error if a peer attempts to set this size to 0. Thanks go to GitHub user afldl for reporting this issue and providing analysis and reproduction code.

  • Fixed an issue with include directives in OpenSSH config files. Thanks go to GitHub users sethholmes and tazle for reporting this issue and providing analysis and a proposed fix.

Release 2.23.1 (6 Jun 2026)

  • Fixed an SCP path traversal issue. Thanks go to Jaden Furtado for reporting this issue.

  • Expanded previous fix to block unsafe user substitutions in server config. Thanks go to GitHub user cesabici-bit for reporting this issue.

  • Fixed default value for reuse_address and reuse_port, matching the behaavior of asyncio.create_server(). Thanks go to Alexander Shlemin for reporting the inconsistency.

Commits
  • 3577224 Bump version number up to 2.24.0 and update change log
  • 321588d Avoid a coverage issue on a protocol definition
  • eefa2fa Update the documentation to list supported SSHSIG options
  • 9c35427 Add input validation on maximum packet size
  • c3ab96f Remove unused import
  • b3039b2 Bump cryptography from 2.8 to 48.0.1 in /docs
  • 9ef998c Bump cryptography min version to pick up security vulnerability fix
  • d1caa62 Add support for ML-KEM implementation in PyCA
  • c0d349b Fix an issue with include directives in SSH confid files
  • 87c58b2 Add support for creating and validating SSHSIG format signatures
  • Additional commits viewable in compare view

Updates boto3 from 1.43.2 to 1.43.51

Commits
  • 09cf399 Merge branch 'release-1.43.51'
  • b8f600d Bumping version to 1.43.51
  • f0973ec Add changelog entries from botocore
  • a8ae7f0 Merge branch 'release-1.43.50'
  • acbe14c Merge branch 'release-1.43.50' into develop
  • b8c36a9 Bumping version to 1.43.50
  • fa19980 Add changelog entries from botocore
  • 2ce2fd5 Merge branch 'release-1.43.49'
  • d2937da Merge branch 'release-1.43.49' into develop
  • 159cb6a Bumping version to 1.43.49
  • Additional commits viewable in compare view

Updates daphne from 4.2.1 to 4.2.2

Changelog

Sourced from daphne's changelog.

4.2.2 (2026-06-03)

  • Fixed a denial of service vulnerability via unbounded WebSocket message sizes. Daphne previously passed no message or frame size limits to autobahn, whose defaults are unbounded. This allowed an unauthenticated client to exhaust server memory by sending a very large WebSocket messages/frames (CVE-2026-44545).

    Both limits now default to 1 MiB and can be configured via the new --websocket-max-message-size and --websocket-max-frame-size CLI flags (or the matching Server constructor arguments). Pass 0 to restore the previous unlimited behaviour.

    Thanks to ParkHyunWoo for the report.

  • Fixed a header injection vulnerability on the WebSocket upgrade path (CVE-2026-44546).

    Header values containing \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 were parsed as a single header by Twisted but split into multiple headers by autobahn during the WebSocket handshake. An attacker could exploit this parser differential to smuggle additional headers (e.g. authentication tokens, X-Forwarded-For, Origin, Daphne-Root-Path) into the ASGI scope passed to the application.

    Daphne now rejects requests carrying these bytes in any header value with a 400 Bad Request response, as required by RFC 9110 §5.5.

    Thanks to Rene Henningsen for the report.

Commits

Updates django from 6.0.6 to 6.0.7

Commits
  • e2a4246 [6.0.x] Bumped version for 6.0.7 release.
  • a5de13f [6.0.x] Fixed CVE-2026-53878 -- Prevented newlines from being accepted in Dom...
  • 38dfbd2 [6.0.x] Fixed CVE-2026-53877 -- Prevented heap buffer over-read when creating...
  • 64f9a2b [6.0.x] Fixed CVE-2026-48588 -- Prevented caching of responses that set cooki...
  • c26957a [6.0.x] Fixed flatpages synopsis in docs.
  • 0b60f44 [6.0.x] Added FILE_UPLOAD_DIRECTORY_PERMISSIONS to docs settings index.
  • d928e30 [6.0.x] Fixed #37172 -- Linked to upload handlers section in FILE_UPLOAD_* se...
  • e18935c [6.0.x] Fixed #37158 -- Reordered the contribution checklist sections.
  • 490eb9c [6.0.x] Fixed document referenced in multiple toctrees warning in docs/intern...
  • 748a9b5 [6.0.x] Fixed duplicate target name in docs/internals/howto-release-django.txt.
  • Additional commits viewable in compare view

Updates drf-spectacular from 0.29.0 to 0.30.0

Release notes

Sourced from drf-spectacular's releases.

0.30.0

After working through the backlog for several week, we are finally in a comfortable place again. Thank you to all contributors and users that waited patiently for me the catch up. It does not include all the PRs that were opened, but imho the most critical ones.

This release includes many small improvement, a few bug fixes, updates to the test suite and a renovated test matrix. Some minor schema corrections are to be expected, but nothing drastic. It is mostly fixing small inconsistencies and improving corner cases.

What's Changed

New Contributors

Full Changelog: tfranzel/drf-spectacular@0.29.0...0.30.0

Changelog

Sourced from drf-spectacular's changelog.

0.30.0 (2026-07-06)

  • Add OAS 3.2 schema for validation & test
  • Type hint build_bearer_security_scheme_object ([#1509](https://github.com/tfranzel/drf-spectacular/issues/1509) <https://github.com/tfranzel/drf-spectacular/issues/1509>_) [johnthagen]
  • Fix formatted CharField allow_blank handling ([#1511](https://github.com/tfranzel/drf-spectacular/issues/1511) <https://github.com/tfranzel/drf-spectacular/issues/1511>, ([#1499](https://github.com/tfranzel/drf-spectacular/issues/1499) <https://github.com/tfranzel/drf-spectacular/issues/1499>)) [Luciano de la Iglesia]
  • Consider allOf anyOf with nullable on OAS3.1 [#1480](https://github.com/tfranzel/drf-spectacular/issues/1480) <https://github.com/tfranzel/drf-spectacular/issues/1480>_
  • Proper handling for OAS 3.2
  • fix modification of user-provided schematas [#1500](https://github.com/tfranzel/drf-spectacular/issues/1500) <https://github.com/tfranzel/drf-spectacular/issues/1500>_
  • relax contraint on oneOf null case with OAS3.1 [#1480](https://github.com/tfranzel/drf-spectacular/issues/1480) <https://github.com/tfranzel/drf-spectacular/issues/1480>_
  • Add blueprint for django-rest-knox ([#1506](https://github.com/tfranzel/drf-spectacular/issues/1506) <https://github.com/tfranzel/drf-spectacular/issues/1506>_) [johnthagen]
  • Mitigate GeneratedField lost arguments and special case for DecimalField [#1166](https://github.com/tfranzel/drf-spectacular/issues/1166) <https://github.com/tfranzel/drf-spectacular/issues/1166>_
  • Webhook explicit operationId ([#1505](https://github.com/tfranzel/drf-spectacular/issues/1505) <https://github.com/tfranzel/drf-spectacular/issues/1505>_)
  • change conflicting license field for 3.8 ([#1504](https://github.com/tfranzel/drf-spectacular/issues/1504) <https://github.com/tfranzel/drf-spectacular/issues/1504>_)
  • Document django-rest-knox support [johnthagen]
  • add help text to spectacular management command arguments [#1175](https://github.com/tfranzel/drf-spectacular/issues/1175) <https://github.com/tfranzel/drf-spectacular/issues/1175>_ [Jean-Baptiste Braun]
  • Mark FileField as nullable in response when not required [#1493](https://github.com/tfranzel/drf-spectacular/issues/1493) <https://github.com/tfranzel/drf-spectacular/issues/1493>_ [mojtaba sohrabi]
  • Extend Choices hint fix with generated label description [#1486](https://github.com/tfranzel/drf-spectacular/issues/1486) <https://github.com/tfranzel/drf-spectacular/issues/1486>_
  • Suppress py<=3.14 deprecation warning [#1497](https://github.com/tfranzel/drf-spectacular/issues/1497) <https://github.com/tfranzel/drf-spectacular/issues/1497>_
  • Remove ancient DRF3.11 and Django2.2 due to contrib packages failing
  • feat: add support for django 6.0 and and drf 3.17 [Vjeran Grozdanic]
  • Add setting to disable docstring extraction [Phil Starkey]
  • feat: add support for polymorphic built-in drf support [Benedikt Bauer]
  • Clarifies post-processing hooks [Andy Piltser-Cowan]
  • Clarifies customizations step 5 [Andy Piltser-Cowan]
  • Fix dependency definition for Django 5.2 [Ülgen Sarıkavak]
  • Implement x-spec-enum-id for type hint Choices. [Noam Kushinsky]
  • Add Support for unsigned integers uint16, uint32 and uint64 [Nicolas Delaby]
  • Fix regression introduced in [#1450](https://github.com/tfranzel/drf-spectacular/issues/1450) <https://github.com/tfranzel/drf-spectacular/issues/1450>_ ([#1469](https://github.com/tfranzel/drf-spectacular/issues/1469) <https://github.com/tfranzel/drf-spectacular/issues/1469>_) [Oleg Höfling]

Breaking changes / important additions:

  • Many small improvement, bug fixes, updates to the test suite and renovated test matrix. Some minor schema corrections are to be expected, but nothing drastic.
Commits

Updates drf-spectacular-sidecar from 2026.6.1 to 2026.7.1

Commits

Updates firebase-admin from 7.4.0 to 7.5.0

Release notes

Sourced from firebase-admin's releases.

Firebase Admin Python SDK v7.5.0

New Features

  • feat(fcm): Enable fid and deprecate token for Send API (#951)

Bug Fixes

  • fix(deps): Added universe_domain override to MockGoogleComputeEngineCredential (#954)

Miscellaneous

  • [chore] Release 7.5.0 (#958)
  • chore(deps): update pytest-mock requirement from >=3.6.1 to >=3.15.1 (#959)
  • chore(deps): update pytest-localserver requirement (#961)
  • chore(deps): update pytest requirement from >=8.2.2 to >=8.4.2 (#946)
  • chore(deps): update google-cloud-firestore requirement (#947)
  • chore(deps): update pyjwt requirement from >=2.10.1 to >=2.12.1 (#948)
  • chore: Pinned cryptography version for older PyPy interpreters (#952)
Commits
  • c5e66f8 [chore] Release 7.5.0 (#958)
  • 0656dc2 chore(deps): update pytest-mock requirement from >=3.6.1 to >=3.15.1 (#959)
  • a013e56 chore(deps): update pytest-localserver requirement (#961)
  • 6d3fc8e chore(deps): update pytest requirement from >=8.2.2 to >=8.4.2 (#946)
  • a157407 chore(deps): update google-cloud-firestore requirement (#947)
  • e989b13 chore(deps): update pyjwt requirement from >=2.10.1 to >=2.12.1 (#948)
  • aa001ce fix(deps): Added universe_domain override to MockGoogleComputeEngineCredentia...
  • 44f7246 feat(fcm): Enable fid and deprecate token for Send API (#951)
  • f493fb0 chore: Pinned cryptography version for older PyPy interpreters (#952)
  • See full diff in compare view

Updates pycurl from 7.46.0 to 7.47.0

Release notes

Sourced from pycurl's releases.

PycURL 7.47.0

What's Changed

Other changes

  • Use dynamic SSL ports in certificate tests (patch by Jorge Rocamora)
  • Harden test_clear_assignment_inside_socket_callback_resets_socketp test (patch by Jorge Rocamora)
  • Rename index field to idx in HstsIndex to avoid shadowing (patch by Jorge Rocamora)
  • Fix test_callbacks_non_minus_one_return_continues_transfer on macOS (patch by Jorge Rocamora)
  • Use PYCURL_REQUIRE_HANDLE and PYCURL_REQUIRE_NOT_RUNNING instead of magic numbers (patch by Jorge Rocamora)
  • Convert pycurl to a Python package with the C extension renamed to pycurl._pycurl (patch by Jorge Rocamora)
  • Fix flaky CONNECT_ONLY send/recv tests by waiting on active socket readiness instead of sleeping after EAGAIN (#997) (patch by Jorge Rocamora)
  • Add PyMutex support on Python 3.13+ (patch by Jorge Rocamora)
  • Modernize ssh_key_cb_test and use a local SFTP server (patch by Scott Talbert)
  • Use set instead of dict for saving refs to easy objects in multi (patch by Jorge Rocamora)
  • Make closed as property instead a method (patch by Jorge Rocamora)
  • Add free-threaded CPython support (patch by Jorge Rocamora)
  • Add AsyncCurlMulti (patch by Jorge Rocamora)
  • Fix flaky memory_mgmt callback (patch by Jorge Rocamora)
  • Add libcurl strerror wrappers (easy/multi/share/url) (patch by Jorge Rocamora)
  • Modernize write/header tests (patch by Jorge Rocamora)
  • Implement Curl multi notify API (patch by Jorge Rocamora)
  • Pin socket callback tests to IPv4 to handle dual-stack localhost resolution (patch by Jorge Rocamora)
  • Integrate notify in AsyncCurlMulti (patch by Jorge Rocamora)
  • Review GIL management (patch by Jorge Rocamora)
  • Capture more expected warnings during tests (patch by Scott Talbert)
  • Fix/update/remove some examples (patch by Scott Talbert)
  • Fix truncated timeout value in multi timer callback (patch by Jorge Rocamora)
  • Fix incorrect argument type in debug callback (patch by Jorge Rocamora)
  • Fix some reference leaks (patch by Jorge Rocamora)
  • Ensure errors are logged in progress/xferinfo callbacks (patch by Scott Talbert)
  • Support zero-copy write/header callbacks (patch by Jorge Rocamora)
  • Evolve CurlShare with share()/unshare(), Python-level thread safety, and CURLSHcode error propagation (patch by Jorge Rocamora)
  • Fix test_default_mode_autopongs_server_ping with libcurl 8.21.0 (patches by Jorge Rocamora)

Full Changelog: pycurl/pycurl@REL_7_46_0...v7.47.0

Changelog

Sourced from pycurl's changelog.

Version 7.47.0 [requires libcurl-7.19.0 or better] - 2026-06-29

    * Use dynamic SSL ports in certificate tests (patch by Jorge Rocamora)
    * Harden test_clear_assignment_inside_socket_callback_resets_socketp test (patch by Jorge Rocamora)
    * Rename index field to idx in HstsIndex to avoid shadowing (patch by Jorge Rocamora)
    * Fix test_callbacks_non_minus_one_return_continues_transfer on macOS (patch by Jorge Rocamora)
    * Use PYCURL_REQUIRE_HANDLE and PYCURL_REQUIRE_NOT_RUNNING instead of magic numbers (patch by Jorge Rocamora)
    * Convert pycurl to a Python package with the C extension renamed to pycurl._pycurl (patch by Jorge Rocamora)
    * Fix flaky CONNECT_ONLY send/recv tests by waiting on active socket readiness instead of sleeping after EAGAIN ([#997](https://github.com/pycurl/pycurl/issues/997)) (patch by Jorge Rocamora)
    * Add PyMutex support on Python 3.13+ (patch by Jorge Rocamora)
    * Modernize ssh_key_cb_test and use a local SFTP server (patch by Scott Talbert)
    * Use set instead of dict for saving refs to easy objects in multi (patch by Jorge Rocamora)
    * Make closed as property instead a method (patch by Jorge Rocamora)
    * Add free-threaded CPython support (patch by Jorge Rocamora)
    * Add AsyncCurlMulti (patch by Jorge Rocamora)
    * Fix flaky memory_mgmt callback (patch by Jorge Rocamora)
    * Add libcurl strerror wrappers (easy/multi/share/url) (patch by Jorge Rocamora)
    * Modernize write/header tests (patch by Jorge Rocamora)
    * Implement Curl multi notify API (patch by Jorge Rocamora)
    * Pin socket callback tests to IPv4 to handle dual-stack localhost resolution (patch by Jorge Rocamora)
    * Integrate notify in AsyncCurlMulti (patch by Jorge Rocamora)
    * Review GIL management (patch by Jorge Rocamora)
    * Capture more expected warnings during tests (patch by Scott Talbert)
    * Fix/update/remove some examples (patch by Scott Talbert)
    * Fix truncated timeout value in multi timer callback (patch by Jorge Rocamora)
    * Fix incorrect argument type in debug callback (patch by Jorge Rocamora)
    * Fix some reference leaks (patch by Jorge Rocamora)
    * Ensure errors are logged in progress/xferinfo callbacks (patch by Scott Talbert)
    * Support zero-copy write/header callbacks (patch by Jorge Rocamora)
    * Evolve CurlShare with share()/unshare(), Python-level thread safety, and CURLSHcode error propagation (patch by Jorge Rocamora)
    * Fix test_default_mode_autopongs_server_ping with libcurl 8.21.0 (patches by Jorge Rocamora)
Commits

Updates regex from 2026.6.28 to 2026.7.19

Changelog

Sourced from regex's changelog.

Version: 2026.7.19

Git issue 607: SIGSEGV: NULL pointer dereference in `basic_match()` when `(?R)`/`(?0)` recursion is used inside a fuzzy-matching quantifier
Git issue 608: SIGSEGV: out-of-bounds read in `bytes1_char_at()` with `DOTALL` + a fuzzy constraint + `(?r)` reverse-direction matching

Version: 2026.7.10

Clarified that the POSIX flag makes it look for only the longest overall match.

Git issue 606: regex's compiled-pattern cache eviction is not free-threading-safe

Version: 2026.6.28

Git issue 604: regex fails on free-threading python because setlocale is not thread-safe

Version: 2026.5.9

Reverse matching with full unicode casefolding could lead to out-of-range string indexes.

Version: 2026.4.4

A fix for older Python versions before free-threading was  supported.

Version: 2026.4.3

More fixes for free-threading.

Version: 2026.3.32

Fixed segfault.

Version: 2026.3.31

Fixed bug again.

Version: 2026.3.30

Fixed bug.

Version: 2026.3.28

Fixed version.

Version: 2026.3.27

Various fixes, including ones to improve free-threading support.

Version: 2026.2.28

Replaced atomic operations with mutex on pattern object for free-threaded Python.

... (truncated)

Commits
  • 0525aff Git issue 608: SIGSEGV: out-of-bounds read in bytes1_char_at() with `DOTALL...
  • 07dfa3b Git issue 607: SIGSEGV: NULL pointer dereference in basic_match() when `(?R...
  • e7716da Python 3.15 not released yet.
  • e204ddb Git issue 606: regex's compiled-pattern cache eviction is not free-threadin...
  • d7e1927 Updated main.yml for Python 3.15.
  • See full diff in compare view

Updates requests from 2.33.1 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)
Commits

Updates websockets from 16.0 to 16.1.1

Release notes

Sourced from websockets's releases.

16.1.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

16.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

Commits
  • 01df1e4 Revert "Decode non-ASCII header values with iso-8859-1."
  • 2d61f74 Clarify restriction on headers in 16.1.
  • 4df6f90 Release version 16.1.
  • 7c69eca Increase timeout for building wheels.
  • 493864e Complete and review changelog.
  • 73ff538 Temporarily remove the trio implementation (again).
  • 77f7d71 Shorten changelog and docstring for previous commit.
  • 84859e1 Add text argument to broadcast() to force the frame type
  • 1a38f5a Document research on removing a workaround.
  • 99431ee Apply code style to docs/conf.py.
  • Additional commits viewable in compare view

Updates import-linter from 2.11 to 2.13

Changelog

Sourced from import-linter's changelog.

2.13 (2026-07-03)

  • Add module counts option to the explore UI and drawgraph command.

2.12 (2026-06-23)

  • Improve error message when root package is a single-file module.
  • Alert users with all unmatched ignored imports in the same run.
  • Allow overlapping modules in forbidden contracts.
Commits
  • f544deb Release v2.13
  • ef5adf8 Add more tests for drawgraph
  • 73ee730 Upgrade grimp 3.14 -> 3.15
  • 6d0bffc Add comma for thousands separator
  • 8b0e7df Document module counts option
  • 542e2c9 Add a module count to the UI
  • ad48a96 Release v2.12
  • f136ff0 Run uv lock --upgrade (#363)
  • 5c174fc Skip self-pairs in forbidden contracts so wildcards can include the source (#...
  • c6ed24d Bump urllib3 from 2.6.3 to 2.7.0 (#356)
  • Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

  • #14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.
  • #14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @​pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".
  • #14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.
  • #14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

  • #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

    If this is undesirable, move the fixture definition to a conftest.py file if possible.

    Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

  • #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

    See 10819 and 14011.

  • #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

    See dynamic-fixture-request-during-teardown for details.

  • #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

    These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

    See parametrize-iterators for details and suggestions.

  • #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

    See config-inicfg for more details.

  • #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

... (truncated)

Commits
  • cf470ec Prepare release version 9.1.1
  • e0c8ce6 Merge pull request #14625 from pytest-dev/patchback/backports/9.1.x/a07c31a97...
  • 1b82d16 Merge pull request #14624 from pytest-dev/patchback/backports/9.1.x/b375b79ec...
  • 501c4bc Merge pull request #14596 from bluetech/doc-classmethod
  • b61f588 Merge pull request #14622 from chrisburr/fix-14608-initial-conftest-test-subdir
  • 9a567e0 [automated] Update plugin list (#14617) (#14618)
  • ef8b299 Merge pull request #14620 from pytest-dev/patchback/backports/9.1.x/680f9f3ed...
  • 66abd07 Merge pull request #14220 from bysiber/fix-stale-iexp-raisesgroup
  • 79fbf93 Merge pull request #14612 from pytest-dev/patchback/backports/9.1.x/974ed48b6...
  • 0d312eb Merge pull request #14611 from bluetech/parametrize-argvalues-typing
  • Additional commits viewable in compare view

Updates ruff from 0.15.13 to 0.15.22

Release notes

Sourced from ruff's releases.

0.15.22

Release Notes

Released on 2026-07-16.

Preview features

  • [pycodestyle] Add an autofix for E402 (#22212)
  • [refurb] Allow subclassing builtins in stub files (FURB189) (#26812)
  • [ruff] Add rule to replace noqa comments with ruff:ignore (RUF105) (#26423)
  • [ruff] Add rule to use human-readable names in ruff:ignore comments (RUF106) (#26682)
  • [ruff] Add rule to use human-readable names in configuration selectors (RUF201) (#26772)

Bug fixes

  • [Description has been truncated

@dependabot
chore(deps): bump the python-minor-and-patch group across 1 directory…
bd2a2b1 
… with 18 updates

Bumps the python-minor-and-patch group with 18 updates in the /shifter/shifter_platform directory:

| Package | From | To |
| --- | --- | --- |
| [asyncssh](https://github.com/ronf/asyncssh) | `2.23.0` | `2.24.0` |
| [boto3](https://github.com/boto/boto3) | `1.43.2` | `1.43.51` |
| [daphne](https://github.com/django/daphne) | `4.2.1` | `4.2.2` |
| [django](https://github.com/django/django) | `6.0.6` | `6.0.7` |
| [drf-spectacular](https://github.com/tfranzel/drf-spectacular) | `0.29.0` | `0.30.0` |
| [drf-spectacular-sidecar](https://github.com/tfranzel/drf-spectacular-sidecar) | `2026.6.1` | `2026.7.1` |
| [firebase-admin](https://github.com/firebase/firebase-admin-python) | `7.4.0` | `7.5.0` |
| [pycurl](https://github.com/pycurl/pycurl) | `7.46.0` | `7.47.0` |
| [regex](https://github.com/mrabarnett/mrab-regex) | `2026.6.28` | `2026.7.19` |
| [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` |
| [websockets](https://github.com/python-websockets/websockets) | `16.0` | `16.1.1` |
| [import-linter](https://github.com/seddonym/import-linter) | `2.11` | `2.13` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.13` | `0.15.22` |
| [pytest-asyncio](https://github.com/pytest-dev/pytest-asyncio) | `1.3.0` | `1.4.0` |
| [mypy](https://github.com/python/mypy) | `2.1.0` | `2.3.0` |
| [django-stubs](https://github.com/typeddjango/django-stubs) | `6.0.4` | `6.0.7` |
| [types-bleach](https://github.com/python/typeshed) | `6.3.0.20260508` | `6.4.0.20260607` |



Updates `asyncssh` from 2.23.0 to 2.24.0
- [Changelog](https://github.com/ronf/asyncssh/blob/develop/docs/changes.rst)
- [Commits](ronf/asyncssh@v2.23.0...v2.24.0)

Updates `boto3` from 1.43.2 to 1.43.51
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.2...1.43.51)

Updates `daphne` from 4.2.1 to 4.2.2
- [Changelog](https://github.com/django/daphne/blob/main/CHANGELOG.txt)
- [Commits](django/daphne@4.2.1...4.2.2)

Updates `django` from 6.0.6 to 6.0.7
- [Commits](django/django@6.0.6...6.0.7)

Updates `drf-spectacular` from 0.29.0 to 0.30.0
- [Release notes](https://github.com/tfranzel/drf-spectacular/releases)
- [Changelog](https://github.com/tfranzel/drf-spectacular/blob/master/CHANGELOG.rst)
- [Commits](tfranzel/drf-spectacular@0.29.0...0.30.0)

Updates `drf-spectacular-sidecar` from 2026.6.1 to 2026.7.1
- [Commits](tfranzel/drf-spectacular-sidecar@2026.6.1...2026.7.1)

Updates `firebase-admin` from 7.4.0 to 7.5.0
- [Release notes](https://github.com/firebase/firebase-admin-python/releases)
- [Commits](firebase/firebase-admin-python@v7.4.0...v7.5.0)

Updates `pycurl` from 7.46.0 to 7.47.0
- [Release notes](https://github.com/pycurl/pycurl/releases)
- [Changelog](https://github.com/pycurl/pycurl/blob/master/ChangeLog)
- [Commits](https://github.com/pycurl/pycurl/commits/v7.47.0)

Updates `regex` from 2026.6.28 to 2026.7.19
- [Changelog](https://github.com/mrabarnett/mrab-regex/blob/hg/changelog.txt)
- [Commits](mrabarnett/mrab-regex@2026.6.28...2026.7.19)

Updates `requests` from 2.33.1 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.1...v2.34.2)

Updates `websockets` from 16.0 to 16.1.1
- [Release notes](https://github.com/python-websockets/websockets/releases)
- [Commits](python-websockets/websockets@16.0...16.1.1)

Updates `import-linter` from 2.11 to 2.13
- [Changelog](https://github.com/seddonym/import-linter/blob/main/docs/release_notes.md)
- [Commits](seddonym/import-linter@v2.11...v2.13)

Updates `pytest` from 9.0.3 to 9.1.1
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.3...9.1.1)

Updates `ruff` from 0.15.13 to 0.15.22
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.13...0.15.22)

Updates `pytest-asyncio` from 1.3.0 to 1.4.0
- [Release notes](https://github.com/pytest-dev/pytest-asyncio/releases)
- [Commits](pytest-dev/pytest-asyncio@v1.3.0...v1.4.0)

Updates `mypy` from 2.1.0 to 2.3.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v2.1.0...v2.3.0)

Updates `django-stubs` from 6.0.4 to 6.0.7
- [Release notes](https://github.com/typeddjango/django-stubs/releases)
- [Commits](typeddjango/django-stubs@6.0.4...6.0.7)

Updates `types-bleach` from 6.3.0.20260508 to 6.4.0.20260607
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: asyncssh
  dependency-version: 2.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: boto3
  dependency-version: 1.43.51
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: daphne
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: django
  dependency-version: 6.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: drf-spectacular
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: drf-spectacular-sidecar
  dependency-version: 2026.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: firebase-admin
  dependency-version: 7.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pycurl
  dependency-version: 7.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: regex
  dependency-version: 2026.7.19
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: websockets
  dependency-version: 16.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: import-linter
  dependency-version: '2.13'
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: pytest
  dependency-version: 9.1.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.15.22
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: pytest-asyncio
  dependency-version: 1.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: mypy
  dependency-version: 2.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: django-stubs
  dependency-version: 6.0.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: types-bleach
  dependency-version: 6.4.0.20260607
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants