From 3aebfc4b8521d7acc509bcf639f4e87402b41eab Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 11:29:03 +0000 Subject: [PATCH 1/8] Bump aiofastnet from 1.1.0 to 1.1.1 (#13764) Bumps [aiofastnet](https://github.com/tarasko/aiofastnet) from 1.1.0 to 1.1.1.
Release notes

Sourced from aiofastnet's releases.

v1.1.1

Changelog

Sourced from aiofastnet's changelog.

1.1.1

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=aiofastnet&package-manager=pip&previous-version=1.1.0&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/base-ft.txt | 2 +- requirements/base.txt | 2 +- requirements/constraints.txt | 5 ++++- requirements/dev.txt | 5 ++++- requirements/lint.txt | 2 +- requirements/runtime-deps.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test-mobile.txt | 2 +- requirements/test.txt | 2 +- 9 files changed, 15 insertions(+), 9 deletions(-) diff --git a/requirements/base-ft.txt b/requirements/base-ft.txt index ca987359618..13fed6406f5 100644 --- a/requirements/base-ft.txt +++ b/requirements/base-ft.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/base.txt b/requirements/base.txt index 01119ba484c..449d7259646 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/constraints.txt b/requirements/constraints.txt index d3f19ae0e43..db1439b8f7d 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -8,7 +8,7 @@ aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in -aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in @@ -268,9 +268,12 @@ sphinx==8.1.3 # via # -r requirements/doc.in # myst-parser + # sphinx-issues # sphinxcontrib-mermaid # sphinxcontrib-spelling # sphinxcontrib-towncrier +sphinx-issues==6.0.0 + # via -r requirements/doc.in sphinxcontrib-applehelp==2.0.0 # via sphinx sphinxcontrib-devhelp==2.0.0 diff --git a/requirements/dev.txt b/requirements/dev.txt index 8abbb8b0f98..87486db67b8 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -8,7 +8,7 @@ aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in -aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via # -r requirements/lint.in # -r requirements/runtime-deps.in @@ -261,8 +261,11 @@ sphinx==8.1.3 # via # -r requirements/doc.in # myst-parser + # sphinx-issues # sphinxcontrib-mermaid # sphinxcontrib-towncrier +sphinx-issues==6.0.0 + # via -r requirements/doc.in sphinxcontrib-applehelp==2.0.0 # via sphinx sphinxcontrib-devhelp==2.0.0 diff --git a/requirements/lint.txt b/requirements/lint.txt index 5f2b0684305..c239bd60f11 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 # via -r requirements/lint.in -aiofastnet==1.1.0 +aiofastnet==1.1.1 # via -r requirements/lint.in aiohappyeyeballs==2.7.1 # via aiohttp diff --git a/requirements/runtime-deps.txt b/requirements/runtime-deps.txt index c2891745cd8..86d72baa7e0 100644 --- a/requirements/runtime-deps.txt +++ b/requirements/runtime-deps.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via -r requirements/runtime-deps.in diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index 0553ef4f844..dc3f8b0a464 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via diff --git a/requirements/test-mobile.txt b/requirements/test-mobile.txt index 90ab3af30fa..ef0eea13a1b 100644 --- a/requirements/test-mobile.txt +++ b/requirements/test-mobile.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via diff --git a/requirements/test.txt b/requirements/test.txt index fc7fef9164d..9e11639da02 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -6,7 +6,7 @@ # aiodns==4.0.4 ; sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in -aiofastnet==1.1.0 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" +aiofastnet==1.1.1 ; platform_python_implementation == "CPython" and sys_platform != "android" and sys_platform != "ios" # via -r requirements/runtime-deps.in aiohappyeyeballs==2.7.1 # via From 90875d646c2802d7ae0bed899948d551a076c051 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 11:45:32 +0000 Subject: [PATCH 2/8] Bump urllib3 from 2.7.0 to 2.8.0 (#13767) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.7.0 to 2.8.0.
Release notes

Sourced from urllib3's releases.

2.8.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Fixed the following security issues:

  • The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77)
  • HTTPResponse.stream() and read_chunked() could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw)
  • Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g)

[!IMPORTANT] urllib3 2.8.0 fixes HTTPS proxy TLS configuration being ignored or overridden by destination settings. Configurations relying on that behavior may require changes.

Configure proxy CA certificates and client certificates in proxy_ssl_context, and proxy identity checks with proxy_assert_hostname or proxy_assert_fingerprint. Destination client certificates and identity overrides no longer apply to HTTPS forwarding proxy connections.

[!NOTE] CVE IDs had not yet been assigned to these advisories at the time of release due to a backlog at GitHub's CNA.

Deprecations & Removals

  • Deprecated using an empty collection as the Retry option allowed_methods to retry any verb. (#5044)

Features

  • Added Url.auth_decoded and Url.auth_decoded_joined convenience properties to the result of parse_url(). (#4945)
  • Added basic_auth_encoding and proxy_basic_auth_encoding parameters to urllib3.util.make_headers(). (#5092)

Bugfixes

  • Fixed response header handling to replace obsolete folded header lines (obs-fold) with spaces in accordance with RFC 9112, preventing raw CRLF sequences from appearing in header values such as Set-Cookie. (#1362)

  • Fixed usage of proxy_ssl_context with ProxyManager when use_forwarding_for_https=True. Passing ssl_context instead of proxy_ssl_context for HTTPS proxies in this configuration now emits a FutureWarning and will raise an error in v3.0. (#2577)

  • Changed behavior of the default ConnectionPool.pool initialization. LifoQueue is now resolved from the queue module after the ConnectionPool is instantiated instead of using the default cached QueueCls class property. This is done because sometimes the queue.LifoQueue is monkey-patched late in the program, such as by gevent. (#3289)

  • Raised UnrewindableBodyError instead of ValueError when retrying a request whose body had tell() but not seek(). (#3779)

  • Decoded percent-encoded SOCKS proxy credentials before authenticating with the proxy server. (#3785)

  • Fixed HTTPResponse.drain_conn() to discard unread response data in 64 KiB chunks (same as the default amt when doing HTTPResponse.stream(...)). (#5019)

  • Fixed is_ipaddress() to detect non-standard IPv4 forms accepted by socket.connect, such as hex (0x7f000001), octal (0177.0.0.1), and decimal integers (2130706433), ensuring SSL certificate verification uses the correct mode for these addresses. (#5029)

  • Fixed HTTPConnectionPool.urlopen raising a misleading FullPoolError instead of ValueError when called with an invalid timeout argument on a pool created with block=True. (#5059)

  • Fixed port-zero handling to preserve explicit :0 values instead of substituting the default ports 80 or 443 in URL parsing, pool selection, proxy configuration, connection_from_url(), and HTTP/2 request authority. (#5071, #5101)

  • Fixed a bug where PoolManager passed the assert_hostname and assert_fingerprint parameters to HTTP connection pools. (#5077)

  • Fixed HTTPConnectionPool.urlopen() and HTTP proxy forwarding to strip URL fragments from absolute request targets before sending requests. (#5079)

  • Added safeguards to the proxy tunneling code to prevent potential security issues when handling invalid characters in the proxy host and HTTP headers. This change affects users of Python 3.10, Python 3.11, and Python 3.12 when the standard library does not contain the fix; those on newer Python versions should upgrade to 3.13.14+ or 3.14.5+ to get the same security fixes. (#5091)

  • Fixed HTTPSConnection.connect() overriding ProxyConfig.ssl_context's certificate policy and proxy identity checks with the target connection's TLS settings when forwarding through an HTTPS proxy.

    HTTPSConnection no longer applies target SNI, assertions, or client credentials to forwarding proxy handshakes and continues to use its ssl_context as a fallback when an HTTPS proxy forwards an HTTP target. (#5093)

  • Fixed URL parsing to more strictly enforce RFC 3986 host syntax, rejecting invalid host input such as raw spaces and control characters, malformed percent-encodings, and percent-encoded control characters in HTTP(S) hosts and IPv6 zone identifiers, including proxy CONNECT tunnel targets. Host normalization now also follows RFC 3986 normalization rules for percent-encoded octets by decoding percent-encoded unreserved characters and uppercasing the hexadecimal digits of retained percent-encoded octets. (#5095)

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.8.0 (2026-09-15)

Security

Fixed the following security issues:

  • The TLS configuration for HTTPS proxies could be ignored or overridden. (High severity, GHSA-8988-9cw3-xx77 <https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77>__)
  • HTTPResponse.stream() and read_chunked() could buffer a chunk-size line of unbounded length in memory. (High severity, GHSA-vxq7-64xx-v4gw <https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw>__)
  • Chunked Deflate streaming could enter an infinite loop. (Medium severity, GHSA-gh4c-6fx4-qh6g <https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g>__)

.. caution::

urllib3 2.8.0 fixes HTTPS proxy TLS configuration being
ignored or
overridden by destination settings. Configurations relying on that
behavior may require changes.

Configure proxy CA certificates and client certificates in
proxy_ssl_context, and proxy identity checks with
proxy_assert_hostname or
proxy_assert_fingerprint.
Destination client certificates and identity overrides no longer
apply to HTTPS forwarding proxy connections.

Deprecations & Removals

  • Deprecated using an empty collection as the Retry option allowed_methods to retry any verb. ([#5044](https://github.com/urllib3/urllib3/issues/5044) <https://github.com/urllib3/urllib3/issues/5044>__)

Features

  • Added Url.auth_decoded and Url.auth_decoded_joined convenience properties to the result of parse_url(). ([#4945](https://github.com/urllib3/urllib3/issues/4945) <https://github.com/urllib3/urllib3/issues/4945>__)
  • Added basic_auth_encoding and proxy_basic_auth_encoding parameters to urllib3.util.make_headers(). ([#5092](https://github.com/urllib3/urllib3/issues/5092) <https://github.com/urllib3/urllib3/issues/5092>__)

Bugfixes

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=urllib3&package-manager=pip&previous-version=2.7.0&new-version=2.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/doc-spelling.txt | 2 +- requirements/doc.txt | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index db1439b8f7d..0e520f09557 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -328,7 +328,7 @@ typing-extensions==4.16.0 ; python_version < "3.13" # virtualenv typing-inspection==0.4.4 # via pydantic -urllib3==2.7.0 +urllib3==2.8.0 # via requests uvloop==0.22.1 ; platform_system != "Windows" # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 87486db67b8..01f71fb8ab6 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -318,7 +318,7 @@ typing-extensions==4.16.0 ; python_version < "3.13" # virtualenv typing-inspection==0.4.4 # via pydantic -urllib3==2.7.0 +urllib3==2.8.0 # via requests uvloop==0.22.1 ; platform_system != "Windows" and implementation_name == "cpython" # via diff --git a/requirements/doc-spelling.txt b/requirements/doc-spelling.txt index 231a8a06876..22370c04fb2 100644 --- a/requirements/doc-spelling.txt +++ b/requirements/doc-spelling.txt @@ -94,5 +94,5 @@ towncrier==26.9.0 # via # -r requirements/doc.in # sphinxcontrib-towncrier -urllib3==2.7.0 +urllib3==2.8.0 # via requests diff --git a/requirements/doc.txt b/requirements/doc.txt index 07a50a4bb54..f755a1a37a9 100644 --- a/requirements/doc.txt +++ b/requirements/doc.txt @@ -87,5 +87,5 @@ towncrier==26.9.0 # via # -r requirements/doc.in # sphinxcontrib-towncrier -urllib3==2.7.0 +urllib3==2.8.0 # via requests From 0d7cf8a826096b7da6956763b20f3fe7f80a648b Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 11:50:38 +0000 Subject: [PATCH 3/8] Bump pyproject-hooks from 1.2.0 to 1.3.3 (#13769) Bumps [pyproject-hooks](https://github.com/pypa/pyproject-hooks) from 1.2.0 to 1.3.3.
Changelog

Sourced from pyproject-hooks's changelog.

v1.3.3

  • No code changes from 1.3. The git tags and the version number got out of sync while fixing an issue with the Github actions workflow to publish the release. 1.3.3 exists only to get them back in sync without reassigning any tags.

v1.3

  • Python 3.8 or above is now required (:pr:214).
  • UserWarnings from the backend are now captured and re-emitted in the frontend process as a new category BuildBackendWarning, so that frontends can control how they are shown to users (:pr:213).
  • Show the traceback from the backend on a BackendUnavailable error (:pr:219).
  • Fix the return type annotation for prepare_metadata_for_build_wheel (:pr:209).
  • Fix removing the internal _in_process directory from sys.path where the install location includes a symlink (:pr:230).
  • Use os.path.commonpath instead of the deprecated commonprefix to validate the location of in-tree backends.
  • Fix in-tree backends in locations containing the path separator character - : on Posix platforms, ; on Windows (:pr:232).
  • Fix finding distribution metadata with importlib.metadata in the backend when an in-tree backend is used (:pr:212).
  • pyproject_hooks can be built from source using flit_core 4.x (:pr:233).
  • Document that the hooks.subprocess_runner context manager API is not thread-safe (:pr:227`)

v1.2

  • Improve interoperability with importlib.metadata, fixing a regression in setuptools compatibility in 1.1 (PR :pr:199).
  • Clean up the _in_process directory inside the package from sys.path before imporing the backend (PR :pr:193).

v1.1

  • Add type annotations to the public API.
  • More careful handling of the backend-path key from pyproject.toml. Previous versions would load the backend and then check that it was loaded from the specified path; the new version only loads it from the specified path. The BackendInvalid exception is now a synonym for :exc:BackendUnavailable, and code should move to using the latter name.

v1.0

... (truncated)

Commits
  • 184c9f5 Merge pull request #239 from pypa/1.3.3
  • a7c2c18 Describe why 1.3.3 in changelog
  • 8cc3947 Update version to 1.3.3
  • 6b92c2b Merge pull request #238 from pypa/gh-action-fix-publish
  • 1b1013d Fix reference to pypi publish action
  • 32cad4e Merge pull request #237 from pypa/update-gh-action-shas
  • 514a241 Latest action versions for lint job as well
  • 91c12fa Add dependabot config to update Github actions automatically
  • 271cf6c Update Github action SHAs to current versions
  • 3f24f34 Merge pull request #235 from pypa/changelog-1.3
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pyproject-hooks&package-manager=pip&previous-version=1.2.0&new-version=1.3.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 0e520f09557..89cd511aef7 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -200,7 +200,7 @@ pygments==2.21.0 # pytest # rich # sphinx -pyproject-hooks==1.2.0 +pyproject-hooks==1.3.3 # via # build # pip-tools diff --git a/requirements/dev.txt b/requirements/dev.txt index 01f71fb8ab6..0179a06dc88 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -195,7 +195,7 @@ pygments==2.21.0 # pytest # rich # sphinx -pyproject-hooks==1.2.0 +pyproject-hooks==1.3.3 # via # build # pip-tools From 8a1a80d0e215fcdbc5bd3b9601ec5af631461284 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 12:49:16 +0000 Subject: [PATCH 4/8] Bump idna from 3.19 to 3.20 (#13777) Bumps [idna](https://github.com/kjd/idna) from 3.19 to 3.20.
Release notes

Sourced from idna's releases.

v3.20

  • Update to Unicode 18.0.0.
  • Better enforcement of the domain length limit in the incremental codec.
  • Add support for Python 3.15.
Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

  • Update to Unicode 18.0.0.
  • Better enforcement of the domain length limit in the incremental codec.
  • Add support for Python 3.15.
Commits
  • d55e65e Release 3.20
  • 0c0824a Pre-release 3.20rc0
  • bd7c316 Note Python 3.15 support in the 3.20 changelog
  • b6cce85 Merge pull request #276 from kjd/unicode-18
  • 9a4bc59 Update to Unicode 18.0.0
  • dfab5a0 Merge branch 'python-3.15'
  • 417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
  • cd17392 Merge pull request #274 from kjd/fix-decode-length-check
  • c5796d7 Skip the decode round-trip check for domains past encode's length limit
  • d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
  • Additional commits viewable in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=idna&package-manager=pip&previous-version=3.19&new-version=3.20)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/base-ft.txt | 2 +- requirements/base.txt | 2 +- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/doc-spelling.txt | 2 +- requirements/doc.txt | 2 +- requirements/lint.txt | 2 +- requirements/runtime-deps.txt | 2 +- requirements/test-common-base.txt | 2 +- requirements/test-common.txt | 2 +- requirements/test-ft.txt | 2 +- requirements/test-mobile.txt | 2 +- requirements/test.txt | 2 +- 13 files changed, 13 insertions(+), 13 deletions(-) diff --git a/requirements/base-ft.txt b/requirements/base-ft.txt index 13fed6406f5..f0a78e30435 100644 --- a/requirements/base-ft.txt +++ b/requirements/base-ft.txt @@ -28,7 +28,7 @@ frozenlist==1.8.0 # aiosignal gunicorn==26.2.0 # via -r requirements/base-ft.in -idna==3.19 +idna==3.20 # via yarl multidict==6.8.0 # via diff --git a/requirements/base.txt b/requirements/base.txt index 449d7259646..dda25e2b3fd 100644 --- a/requirements/base.txt +++ b/requirements/base.txt @@ -28,7 +28,7 @@ frozenlist==1.8.0 # aiosignal gunicorn==26.2.0 # via -r requirements/base.in -idna==3.19 +idna==3.20 # via yarl multidict==6.8.0 # via diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 89cd511aef7..4f5f440a94c 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -106,7 +106,7 @@ gunicorn==26.2.0 # via -r requirements/base.in identify==2.6.19 # via pre-commit -idna==3.19 +idna==3.20 # via # requests # trustme diff --git a/requirements/dev.txt b/requirements/dev.txt index 0179a06dc88..b51f4649223 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -104,7 +104,7 @@ gunicorn==26.2.0 # via -r requirements/base.in identify==2.6.19 # via pre-commit -idna==3.19 +idna==3.20 # via # requests # trustme diff --git a/requirements/doc-spelling.txt b/requirements/doc-spelling.txt index 22370c04fb2..d4f7c698489 100644 --- a/requirements/doc-spelling.txt +++ b/requirements/doc-spelling.txt @@ -20,7 +20,7 @@ docutils==0.21.2 # via # myst-parser # sphinx -idna==3.19 +idna==3.20 # via requests imagesize==2.0.1 # via sphinx diff --git a/requirements/doc.txt b/requirements/doc.txt index f755a1a37a9..3e93b1e1cc2 100644 --- a/requirements/doc.txt +++ b/requirements/doc.txt @@ -20,7 +20,7 @@ docutils==0.21.2 # via # myst-parser # sphinx -idna==3.19 +idna==3.20 # via requests imagesize==2.0.1 # via sphinx diff --git a/requirements/lint.txt b/requirements/lint.txt index c239bd60f11..0d341ccec3e 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -58,7 +58,7 @@ frozenlist==1.8.0 # aiosignal identify==2.6.19 # via pre-commit -idna==3.19 +idna==3.20 # via # trustme # yarl diff --git a/requirements/runtime-deps.txt b/requirements/runtime-deps.txt index 86d72baa7e0..4b5cad0acd0 100644 --- a/requirements/runtime-deps.txt +++ b/requirements/runtime-deps.txt @@ -26,7 +26,7 @@ frozenlist==1.8.0 # via # -r requirements/runtime-deps.in # aiosignal -idna==3.19 +idna==3.20 # via yarl multidict==6.8.0 # via diff --git a/requirements/test-common-base.txt b/requirements/test-common-base.txt index b014c17fcb8..f6154ce5cba 100644 --- a/requirements/test-common-base.txt +++ b/requirements/test-common-base.txt @@ -24,7 +24,7 @@ frozenlist==1.8.0 # via # aiohttp # aiosignal -idna==3.19 +idna==3.20 # via yarl iniconfig==2.3.0 # via pytest diff --git a/requirements/test-common.txt b/requirements/test-common.txt index 09de3082aff..bf97f5858e0 100644 --- a/requirements/test-common.txt +++ b/requirements/test-common.txt @@ -40,7 +40,7 @@ frozenlist==1.8.0 # via # aiohttp # aiosignal -idna==3.19 +idna==3.20 # via # trustme # yarl diff --git a/requirements/test-ft.txt b/requirements/test-ft.txt index dc3f8b0a464..43cb1256be2 100644 --- a/requirements/test-ft.txt +++ b/requirements/test-ft.txt @@ -61,7 +61,7 @@ frozenlist==1.8.0 # aiosignal gunicorn==26.2.0 # via -r requirements/base-ft.in -idna==3.19 +idna==3.20 # via # trustme # yarl diff --git a/requirements/test-mobile.txt b/requirements/test-mobile.txt index ef0eea13a1b..94198dd2bd6 100644 --- a/requirements/test-mobile.txt +++ b/requirements/test-mobile.txt @@ -51,7 +51,7 @@ frozenlist==1.8.0 # aiosignal gunicorn==26.2.0 # via -r requirements/base-ft.in -idna==3.19 +idna==3.20 # via yarl iniconfig==2.3.0 # via pytest diff --git a/requirements/test.txt b/requirements/test.txt index 9e11639da02..6e374735161 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -61,7 +61,7 @@ frozenlist==1.8.0 # aiosignal gunicorn==26.2.0 # via -r requirements/base.in -idna==3.19 +idna==3.20 # via # trustme # yarl From 79c65c1d49ae7cbf9c50c5ad110bae677f134c0c Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 13:14:35 +0000 Subject: [PATCH 5/8] Bump filelock from 3.32.6 to 3.32.7 (#13779) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.32.6 to 3.32.7.
Release notes

Sourced from filelock's releases.

3.32.7

What's Changed

New Contributors

Full Changelog: https://github.com/tox-dev/filelock/compare/3.32.6...3.32.7

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.0.1 (2026-09-19)

  • poll_interval is now validated at construction, on the setter, and on acquire(): a negative, non-finite, or non-numeric value raises :class:ValueError/:class:TypeError immediately instead of failing inside time.sleep. :pr:739

4.0.0 (2026-09-17)

  • The :class:~filelock.SoftReadWriteLock on-disk protocol is a generation log under <path>.rw, and a process running an earlier release does not see it: an old and a new participant on one lock path do not exclude each other. Stop every participant, upgrade them all, then restart them; the new code ignores leftover .state, .write and .readers/ files, and you can delete them. The filesystem must provide no-replace hard links, as it must for :class:~filelock.StrictSoftFileLock, so a runtime without os.link raises :class:~filelock.SoftFileLockProtocolError on acquire. Constructing a singleton again with a different on_compromise, or with poll_interval at or above stale_threshold, now raises :class:ValueError. :pr:735
  • :class:~filelock.SoftReadWriteLock exposes :attr:~filelock.SoftReadWriteLock.generation as a fencing token for the protected resource and reports a lost hold through on_compromise and :attr:~filelock.SoftReadWriteLock.compromise. :pr:735
  • :class:~filelock.SoftReadWriteLock no longer deadlocks when a holder dies on another host mid-transition, and release() no longer waits on a mutex a dead host left behind (:pr:725, :pr:735). The state mutex is gone. Each transition is one atomic snapshot commit, and liveness is a heartbeat nonce read on the observer's own clock rather than an mtime read against another host's. :pr:735

3.32.7 (2026-09-16)

  • Validate final-symlink refusal by error number so the test works across libc implementations. :pr:737
  • Document that :meth:~filelock.BaseFileLock.acquire reads blocking=None as the lock's blocking attribute and raises :class:~filelock.Timeout after one attempt when blocking=False. :pr:733

3.32.6 (2026-09-08)

  • SoftFileLease and AsyncSoftFileLease now reject a boolean or non-finite lease_duration, which used to publish an owner record their own owner property reads back as malformed. :pr:723
  • Reject non-finite heartbeat, stale, and polling intervals in SoftReadWriteLock and AsyncSoftReadWriteLock, including cached singleton construction and overflow in the default stale threshold. :pr:724

... (truncated)

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filelock&package-manager=pip&previous-version=3.32.6&new-version=3.32.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 4f5f440a94c..5b48b0c9cc4 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -87,7 +87,7 @@ exceptiongroup==1.3.1 # pytest execnet==2.1.2 # via pytest-xdist -filelock==3.32.6 +filelock==3.32.7 # via # python-discovery # virtualenv diff --git a/requirements/dev.txt b/requirements/dev.txt index b51f4649223..63e4df00d99 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -85,7 +85,7 @@ exceptiongroup==1.3.1 # pytest execnet==2.1.2 # via pytest-xdist -filelock==3.32.6 +filelock==3.32.7 # via # python-discovery # virtualenv diff --git a/requirements/lint.txt b/requirements/lint.txt index 0d341ccec3e..9ce911f9751 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -44,7 +44,7 @@ exceptiongroup==1.3.1 # via # aiofastnet # pytest -filelock==3.32.6 +filelock==3.32.7 # via # python-discovery # virtualenv From 4ad007d0d050c1bf161f5a59694aa909dbee798f Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 13:16:15 +0000 Subject: [PATCH 6/8] Bump platformdirs from 4.11.8 to 4.11.10 (#13775) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [platformdirs](https://github.com/tox-dev/platformdirs) from 4.11.8 to 4.11.10.
Release notes

Sourced from platformdirs's releases.

4.11.10

What's Changed

Full Changelog: https://github.com/tox-dev/platformdirs/compare/4.11.9...4.11.10

4.11.9

What's Changed

New Contributors

Full Changelog: https://github.com/tox-dev/platformdirs/compare/4.11.8...4.11.9

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.11 (2026-09-19)

  • Reject appname, appauthor and version values that leave the platform base directory (a .. segment, a leading separator, a drive or a UNC share) with ValueError, so ensure_exists cannot create directories outside it - by :user:Pitchfork-and-Torch. :pr:552

4.11.10 (2026-09-18)

  • With ensure_exists, the site_*_dir and site_*_path properties and the iter_*_dirs iterators only create the site directories they return or yield, instead of every entry in the site list - by :user:darrenhuai. :pr:550

4.11.9 (2026-09-16)

  • Accept multipath in :func:~platformdirs.site_cache_dir and :func:~platformdirs.site_cache_path. Without it, the function API could not return the Homebrew cache prefix that :attr:~platformdirs.macos.MacOS.site_cache_dir adds under multipath - by :user:darrenhuai. :pr:544
  • Parse Unix user-dirs.dirs line by line like xdg-user-dir. The INI parser raised on a repeated key or a line without =, and returned trailing comments and backslash escapes inside :func:~platformdirs.user_documents_dir and the other media directories. The last valid assignment now wins, and platformdirs unescapes the quoted value and ignores text after the closing quote - by :user:darrenhuai. :pr:545
  • Read PUBLIC before the home directory in :func:~platformdirs.user_publicshare_dir on Windows, so it no longer raises RuntimeError when PUBLIC is set and the home directory cannot be determined - by :user:emme1t. :pr:546
  • Raise RuntimeError from :class:~platformdirs.android.Android directories when the app folder cannot be found, instead of TypeError: expected str, bytes or os.PathLike object, not NoneType - by :user:Str0k. :pr:547

4.11.8 (2026-09-08)

  • Make :func:~platformdirs.user_data_path, :func:~platformdirs.user_config_path, :func:~platformdirs.user_preference_path and :func:~platformdirs.user_applications_path return the first site entry when root is redirected by use_site_for_root under multipath, matching their site_*_path twins. They passed the whole joined list to :class:~pathlib.Path, giving one unusable path such as /xdg/a/foo:/xdg/b/foo - by :user:darrenhuai. :pr:538

... (truncated)

Commits
  • 35391fc Release 4.11.10
  • 7d5c85d fix: only create the site dirs a call hands back (#550)
  • 5118d32 👷 ci(release): docstrfmt the changelog before committing it (#551)
  • 4ebd03d Release 4.11.9
  • 0ae539b fix: raise RuntimeError when the Android app folder is missing (#547)
  • de87396 fix: resolve PUBLIC before looking up the user home (#546)
  • 2ba683b fix: accept multipath in the site cache functions (#544)
  • bdb0a67 fix: read user-dirs.dirs as shell assignments, not INI (#545)
  • 5921065 [pre-commit.ci] pre-commit autoupdate (#549)
  • See full diff in compare view

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=platformdirs&package-manager=pip&previous-version=4.11.8&new-version=4.11.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 5b48b0c9cc4..d4f0c9db486 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -168,7 +168,7 @@ pip-tools==7.6.1 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.11.8 +platformdirs==4.11.10 # via virtualenv pluggy==1.6.0 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 63e4df00d99..c5f10259499 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -165,7 +165,7 @@ pip-tools==7.6.1 # via -r requirements/dev.in pkgconfig==1.6.0 # via -r requirements/test-common-base.in -platformdirs==4.11.8 +platformdirs==4.11.10 # via virtualenv pluggy==1.6.0 # via diff --git a/requirements/lint.txt b/requirements/lint.txt index 9ce911f9751..708b9b1fd57 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -86,7 +86,7 @@ packaging==26.3 # via pytest pathspec==1.1.1 # via mypy -platformdirs==4.11.8 +platformdirs==4.11.10 # via virtualenv pluggy==1.6.0 # via pytest From b9d92700ee641e2c0270379e994bdeaa58839a95 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 13:43:31 +0000 Subject: [PATCH 7/8] Bump python-discovery from 1.6.0 to 1.6.1 (#13780) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [python-discovery](https://github.com/tox-dev/python-discovery) from 1.6.0 to 1.6.1.
Release notes

Sourced from python-discovery's releases.

v1.6.1

What's Changed

Full Changelog: https://github.com/tox-dev/python-discovery/compare/1.6.0...1.6.1

Changelog

Sourced from python-discovery's changelog.

Bug fixes - 1.6.1

  • Skip empty PATH entries during interpreter discovery - by :user:gaborbernat. (:issue:129)

Improved documentation - 1.6.1

  • Document :attr:~python_discovery.PythonInfo.system_exe across the tutorial, the how-to guide and the explanation of how resolution reaches a base interpreter. The class diagram in the how-to guide had :attr:~python_discovery.PythonInfo.system_executable typed str rather than str | None - by :user:gaborbernat. (:issue:128)

v1.6.0 (2026-08-28)

Commits

Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index d4f0c9db486..27636d18d0b 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -237,7 +237,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.6.0 +python-discovery==1.6.1 # via virtualenv python-on-whales==0.81.0 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index c5f10259499..5e11343147c 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -232,7 +232,7 @@ pytest-xdist==3.8.0 # via -r requirements/test-common.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.6.0 +python-discovery==1.6.1 # via virtualenv python-on-whales==0.81.0 # via diff --git a/requirements/lint.txt b/requirements/lint.txt index 708b9b1fd57..7b984e7c3f4 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -127,7 +127,7 @@ pytest-mock==3.15.1 # via -r requirements/lint.in python-dateutil==2.9.0.post0 # via freezegun -python-discovery==1.6.0 +python-discovery==1.6.1 # via virtualenv python-on-whales==0.81.0 # via -r requirements/lint.in From 40d568dd8fd86239e5e241ca24dcdb603ee92799 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 21 Sep 2026 14:00:50 +0000 Subject: [PATCH 8/8] Bump virtualenv from 21.7.9 to 21.7.14 (#13761) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.7.9 to 21.7.14.
Release notes

Sourced from virtualenv's releases.

21.7.14

What's Changed

Full Changelog: https://github.com/pypa/virtualenv/compare/21.7.13...21.7.14

21.7.13

What's Changed

Full Changelog: https://github.com/pypa/virtualenv/compare/21.7.12...21.7.13

21.7.12

What's Changed

Full Changelog: https://github.com/pypa/virtualenv/compare/21.7.11...21.7.12

21.7.11

What's Changed

Full Changelog: https://github.com/pypa/virtualenv/compare/21.7.10...21.7.11

... (truncated)

Changelog

Sourced from virtualenv's changelog.

Bugfixes - 21.7.14

  • Fix activate.csh failing with Event not found when the virtual environment path contains !. (:issue:3256)

v21.7.13 (2026-09-18)

Bugfixes - 21.7.13

  • Fix activate and activate.fish running commands embedded in the virtual environment path or in the interpreter's Tcl/Tk library paths. (:issue:3252)

v21.7.12 (2026-09-18)

Bugfixes - 21.7.12

  • Fix activate.bat running arbitrary commands from a crafted --prompt, VIRTUALENV_PROMPT, or config file value. (:issue:3250)
  • Verify a downloaded seed wheel's sha256 against PyPI before seeding it into a virtual environment, skipped when a custom pip index is configured. (:issue:3251)

v21.7.11 (2026-09-17)

Bugfixes - 21.7.11

  • Running activate.bat again before deactivate no longer makes deactivate leave the environment's PKG_CONFIG_PATH, TCL_LIBRARY and TK_LIBRARY behind, or lose values the user had set before the first activation - by :user:darrenhuai. (:issue:3245)
  • Write pyvenv.cfg values on a single line, so a prompt carrying a line boundary can no longer inject configuration. --prompt, the VIRTUALENV_PROMPT environment variable and the config file all set the prompt, and pyvenv.cfg has no escape syntax, so a newline, a carriage return, or any other boundary str.splitlines recognizes, such as U+2028, started a new configuration line. Reading the file back picked up those lines as keys, and since the last value for a key wins, they replaced anything written earlier, including home. (:issue:3247)

Improved Documentation - 21.7.11

  • Document the policy for AI-assisted contributions and the licensing rules for dependencies. (:issue:3239)

Misc - 21.7.11

... (truncated)

Commits
  • 9baea3c release 21.7.14
  • ab3dcff 🐛 fix(activation): escape ! for csh history expansion (#3256)
  • 0c295ff release 21.7.13
  • 4d5a105 🐛 fix(activation): stop path command injection in bash and fish (#3252)
  • 0525dce 👷 ci: scope the nushell apt key to its own repo (#3253)
  • aa8323a 🔧 chore: drop misc as a changelog fragment type (#3255)
  • a435477 👷 ci: correct a stale checkout pin comment (#3254)
  • 9666b42 release 21.7.12
  • a01ed3e 🐛 fix(seed): verify downloaded wheel digests (#3251)
  • d721ff1 🐛 fix(activation): escape batch quote() against injection (#3250)
  • Additional commits viewable in compare view

Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 27636d18d0b..b67bdde9f3d 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -336,7 +336,7 @@ uvloop==0.22.1 ; platform_system != "Windows" # -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.7.9 +virtualenv==21.7.14 # via pre-commit wheel==0.48.0 # via pip-tools diff --git a/requirements/dev.txt b/requirements/dev.txt index 5e11343147c..79920b77887 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -326,7 +326,7 @@ uvloop==0.22.1 ; platform_system != "Windows" and implementation_name == "cpytho # -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.7.9 +virtualenv==21.7.14 # via pre-commit wheel==0.48.0 # via pip-tools diff --git a/requirements/lint.txt b/requirements/lint.txt index 7b984e7c3f4..38b6241f5fa 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -166,7 +166,7 @@ uvloop==0.22.1 ; platform_system != "Windows" # via -r requirements/lint.in valkey==6.1.1 # via -r requirements/lint.in -virtualenv==21.7.9 +virtualenv==21.7.14 # via pre-commit yarl==1.25.1 # via aiohttp