Skip to content

chore(deps): bump the dependencies group across 1 directory with 24 updates - #392

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/docs/dependencies-a7e3ce1ef0
Open

chore(deps): bump the dependencies group across 1 directory with 24 updates#392
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/docs/dependencies-a7e3ce1ef0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 17, 2026

Copy link
Copy Markdown

Bumps the dependencies group with 24 updates in the /src/backend directory:

Package From To
blessed 1.44.0 1.47.0
boto3 1.43.36 1.43.45
botocore 1.43.36 1.43.45
cffi 2.0.0 2.1.0
charset-normalizer 3.4.7 3.4.9
django 5.2.15 6.0.7
django-allauth 65.14.3 65.18.0
django-otp 1.3.0 1.7.0
drf-spectacular 0.29.0 0.30.0
dulwich 1.2.6 1.2.10
fido2 2.2.0 2.2.1
grpcio 1.81.1 1.82.1
jinxed 2.0.4 2.1.0
pillow 12.2.0 12.3.0
python-fsutil 0.16.1 0.17.0
rpds-py 2026.5.1 2026.6.3
sentry-sdk 2.63.0 2.64.0
setuptools 82.0.1 83.0.0
tqdm 4.68.3 4.68.4
typing-extensions 4.15.0 4.16.0
wcwidth 0.8.1 0.8.2
coverage 7.14.3 7.15.0
prek 0.4.5 0.4.8
ty 0.0.54 0.0.58

Updates blessed from 1.44.0 to 1.47.0

Release notes

Sourced from blessed's releases.

1.46

Full Changelog: jquast/blessed@1.45...1.46

1.17.9: Initial support for Python 3.10

  • bugfix: Now imports on 3.10+

1.15.0: Disable various integration tests, support python 3.7

No release notes provided.

1.14.0: bugfix term.wrap for text containing newlines

  • bugfix: term.wrap misbehaved for text containing newlines, #74

1.13.0: new Terminal.split_seqs() function, speed enhancement

  • enhancement: method Terminal.split_seqs introduced, and 4x cost reduction in related sequence-aware functions, #29.
  • deprecated: function blessed.sequences.measure_length superseded by blessed.sequences.iter_parse if necessary.
  • deprecated: warnings about "binary-packed capabilities" are no longer emitted on strange terminal types, making best effort.

1.12.0: add Terminal.get_location() method

  • enhancement: method Terminal.get_locationreturns the(row, col)`` position of the cursor at the time of call for attached terminal.
  • enhancement: a keyboard now detected as stdin when stream is sys.stderr.
Changelog

Sourced from blessed's changelog.

.. py:currentmodule:: blessed.terminal

Version History

1.47

  • bugfix: :meth:~Terminal.does_sixel now returns True for SyncTERM using special-case matching of its illegal DA1 response.
  • bugfix: legacy SGR mouse decoder reported no-button motion event (mode 1003) as LEFT_MOTION instead of MOTION, :ghpull:398.
  • bugfix: match keyboard input \x1b\n as KEY_ALT_ENTER instead of KEY_CTRL_ALT_J.

1.46

  • bugfix: :meth:~Terminal.does_sixel failed to detect DA1 and caused the response to "leak" into next call to :meth:~Terminal.inkey for some terminals of unmatched patterns (e.g., kitty).
  • improve: add new sugar for extended cap-defined styles, like 'clear_scrollback' (common), 'strikethrough', and 'overline' (not common).
  • improve: Truecolor support by unique TERM, improves remote sessions like SSH that do not forward COLORTERM, and, for the few terminals that do not respond to XTGETTCAP request for RGB: (kitty).

1.45

  • bugfix: name consistency of kitty keyboard modifiers :ghpull:390.

1.44

  • improve: reduce errant XTGETTCAP output for Terminal.app and ConEmu.exe :ghpull:385.

1.43

  • bugfix: regression of XTGETTCAP responses leaking into first call for empty/non-response terminals (libvte/Gnome Terminal), in versions 1.40 to 1.42 :ghpull:383.

1.42

  • bugfix: regression in :meth:~.Terminal.cbreak and :meth:~.Terminal.raw were not thread-safe broken in versions 1.40 and 1.41, remove signal ignore of SIGTTOU :ghissue:380.

1.41

  • bugfix: :meth:~.Terminal.get_location broken in 1.40, returned a generator instead of a tuple. :ghissue:378.

1.40

  • improved: jinxed_ is now required on all platforms, providing a curses-free and singleton-free <https://jinxed.readthedocs.io/en/stable/capabilities.html#singleton-free>_ implementation of the subset of curses_ used by blessed. The jinxed_ 1.5.0 release provides a terminal capability database <https://jinxed.readthedocs.io/en/stable/capabilities.html#database> of 45 terminals and their common aliases.

  • improved: Class initialization of :class:~.Terminal() now uses XTGETTCAP_ to determine preferred terminal name TN, 24-bit color support RGB, number of colors Co, italic, and blink capabilities.

    This improves detection of Terminal kind and number_of_colors over protocols like serial

... (truncated)

Commits

Updates boto3 from 1.43.36 to 1.43.45

Commits
  • 75de637 Merge branch 'release-1.43.45'
  • 497253d Bumping version to 1.43.45
  • 5e9768e Add changelog entries from botocore
  • 19a915b Merge branch 'release-1.43.44'
  • 1b69a06 Merge branch 'release-1.43.44' into develop
  • b0e3f6a Bumping version to 1.43.44
  • d190ab9 Add changelog entries from botocore
  • fb07aa2 Merge branch 'release-1.43.43'
  • b847379 Merge branch 'release-1.43.43' into develop
  • 42f28ac Bumping version to 1.43.43
  • Additional commits viewable in compare view

Updates botocore from 1.43.36 to 1.43.45

Commits
  • af6622c Merge branch 'release-1.43.45'
  • 98cb2a8 Bumping version to 1.43.45
  • 2788423 Update to latest models
  • c945566 Merge branch 'release-1.43.44'
  • da12f11 Merge branch 'release-1.43.44' into develop
  • 9afed17 Bumping version to 1.43.44
  • 14bbc48 Update to latest models
  • a4d4f6f Merge customizations for Signin
  • 0fecce5 Merge branch 'release-1.43.43'
  • 8262ebe Merge branch 'release-1.43.43' into develop
  • Additional commits viewable in compare view

Updates cffi from 2.0.0 to 2.1.0

Release notes

Sourced from cffi's releases.

v2.1.0

  • Added support for Python 3.15 and support for C extensions generated by CFFI to target the new abi3t free-threaded ABI.
  • Dropped support for Python 3.9.
  • Added cffi-gen-src CLI to generate CFFI C extension source for alternate build backend support.
  • Fixed crashes inside __delitem__.
  • Fixed "string too big" error under MSVC.
  • Fixed mingw builds.
  • Added support for arm64 iOS wheels.
Commits
  • d9f6f70 New release 2.1.0
  • 02a7b0e Misc pre-2.1 release/packaging cleanup (#253)
  • 1362e5d Move cffi-gen-src release note to 2.1.0 notes
  • a797055 Make error message when embedding version test fails more friendly
  • f1f40a8 Update changelog
  • dc62c93 Delete missed cp39 Windows builds
  • a341180 Update version numbers to prepare for v2.1 release
  • 9f04d85 Mark test using inet_ntoa as thread-unsafe
  • 5f12702 Fix flaky pytest-run-parallel CI crash
  • 26b3d3a Merge branch 'main' into integrate-buildtool
  • Additional commits viewable in compare view

Updates charset-normalizer from 3.4.7 to 3.4.9

Release notes

Sourced from charset-normalizer's releases.

Version 3.4.9

3.4.9 (2026-07-07)

Fixed

  • Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

Version 3.4.8

3.4.8 (2026-07-06)

Fixed

  • Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)
  • Unnecessary json import at runtime (#753)
  • Inverse capitalization not seen by noise detector (#731)

Changed

  • No longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.
  • Micro-optimizations in our noise / coherence measurements.
  • No longer using regex search by default for our preemptive charset mark algorithm.
  • Raised upperbound of setuptools to v83.
  • Raised upperbound of mypy(c) to v2.1.

Removed

  • Redundant UTF7 BOM marker (#730)
Changelog

Sourced from charset-normalizer's changelog.

3.4.9 (2026-07-07)

Fixed

  • Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

3.4.8 (2026-07-06)

Fixed

  • Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)
  • Unnecessary json import at runtime (#753)
  • Inverse capitalization not seen by noise detector (#731)

Changed

  • No longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.
  • Micro-optimizations in our noise / coherence measurements.
  • No longer using regex search by default for our preemptive charset mark algorithm.
  • Raised upperbound of setuptools to v83.
  • Raised upperbound of mypy(c) to v2.1.

Removed

  • Redundant UTF7 BOM marker (#730)
Commits
  • cc68407 Merge pull request #772 from jawah/fix-regression-fallback-path
  • 152b923 chore: release 3.4.9
  • 2bc2607 fix: unicodedecodeerror in fallback path
  • be252d7 chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (#767)
  • 71c7bdd chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#768)
  • aeea391 chore(deps): bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#758)
  • a6f8feb Merge pull request #770 from jawah/unblock-ci
  • 528e16c chore: add osv-scanner.toml
  • 5993498 chore: ast_serialize musl missing prebuilt riscv,s390x,ppc64le
  • aa2ddd8 Release 3.4.8 (#766)
  • Additional commits viewable in compare view

Updates django from 5.2.15 to 6.0.7

Commits
  • e2a4246 [6.0.x] Bumped version for 6.0.7 release.
  • a5de13f [6.0.x] Fixed CVE-2026-53878 -- Prevented newlines from being accepted in Dom...
  • 38dfbd2 [6.0.x] Fixed CVE-2026-53877 -- Prevented heap buffer over-read when creating...
  • 64f9a2b [6.0.x] Fixed CVE-2026-48588 -- Prevented caching of responses that set cooki...
  • c26957a [6.0.x] Fixed flatpages synopsis in docs.
  • 0b60f44 [6.0.x] Added FILE_UPLOAD_DIRECTORY_PERMISSIONS to docs settings index.
  • d928e30 [6.0.x] Fixed #37172 -- Linked to upload handlers section in FILE_UPLOAD_* se...
  • e18935c [6.0.x] Fixed #37158 -- Reordered the contribution checklist sections.
  • 490eb9c [6.0.x] Fixed document referenced in multiple toctrees warning in docs/intern...
  • 748a9b5 [6.0.x] Fixed duplicate target name in docs/internals/howto-release-django.txt.
  • Additional commits viewable in compare view

Updates django-allauth from 65.14.3 to 65.18.0

Commits

Updates django-otp from 1.3.0 to 1.7.0

Changelog

Sourced from django-otp's changelog.

v1.7.0 - January 07, 2026 - Async support

  • [#185](https://github.com/django-otp/django-otp/issues/185)_: Make OTPMiddleware async capable

Thanks to Aljosha Papsch.

.. _#185: django-otp/django-otp#185

v1.6.3 - October 25, 2025 - Spanish update

  • [#182](https://github.com/django-otp/django-otp/issues/182)_: Correct missing Spanish translations
  • [#181](https://github.com/django-otp/django-otp/issues/181)_: Wrong :rtype: in StaticToken.random_token docstring

.. _#181: django-otp/django-otp#181 .. _#182: django-otp/django-otp#182

v1.6.2 - October 21, 2025 - Cleanup

  • [#179](https://github.com/django-otp/django-otp/issues/179)_: Add missing gettext strings
  • [#180](https://github.com/django-otp/django-otp/issues/180)_: Remove tests from wheels

.. _#179: django-otp/django-otp#179 .. _#180: django-otp/django-otp#180

v1.6.1 - July 08, 2025 - Small improvements

  • Allow a {token} placeholder in :setting:OTP_EMAIL_SUBJECT.

v1.6.0 - April 02, 2025 - Django 5.2

  • Update test matrix for Django 5.2.
  • Remove support for Django 3.2.

v1.5.4 - September 06, 2024 - Ignore proxy models when enumerating device classes

  • [#161](https://github.com/django-otp/django-otp/issues/161)_: Discard proxied models when iterating device models

.. _#161: django-otp/django-otp#161

... (truncated)

Commits

Updates drf-spectacular from 0.29.0 to 0.30.0

Release notes

Sourced from drf-spectacular's releases.

0.30.0

After working through the backlog for several week, we are finally in a comfortable place again. Thank you to all contributors and users that waited patiently for me the catch up. It does not include all the PRs that were opened, but imho the most critical ones.

This release includes many small improvement, a few bug fixes, updates to the test suite and a renovated test matrix. Some minor schema corrections are to be expected, but nothing drastic. It is mostly fixing small inconsistencies and improving corner cases.

What's Changed

New Contributors

Full Changelog: tfranzel/drf-spectacular@0.29.0...0.30.0

Changelog

Sourced from drf-spectacular's changelog.

0.30.0 (2026-07-06)

  • Add OAS 3.2 schema for validation & test
  • Type hint build_bearer_security_scheme_object ([#1509](https://github.com/tfranzel/drf-spectacular/issues/1509) <https://github.com/tfranzel/drf-spectacular/issues/1509>_) [johnthagen]
  • Fix formatted CharField allow_blank handling ([#1511](https://github.com/tfranzel/drf-spectacular/issues/1511) <https://github.com/tfranzel/drf-spectacular/issues/1511>, ([#1499](https://github.com/tfranzel/drf-spectacular/issues/1499) <https://github.com/tfranzel/drf-spectacular/issues/1499>)) [Luciano de la Iglesia]
  • Consider allOf anyOf with nullable on OAS3.1 [#1480](https://github.com/tfranzel/drf-spectacular/issues/1480) <https://github.com/tfranzel/drf-spectacular/issues/1480>_
  • Proper handling for OAS 3.2
  • fix modification of user-provided schematas [#1500](https://github.com/tfranzel/drf-spectacular/issues/1500) <https://github.com/tfranzel/drf-spectacular/issues/1500>_
  • relax contraint on oneOf null case with OAS3.1 [#1480](https://github.com/tfranzel/drf-spectacular/issues/1480) <https://github.com/tfranzel/drf-spectacular/issues/1480>_
  • Add blueprint for django-rest-knox ([#1506](https://github.com/tfranzel/drf-spectacular/issues/1506) <https://github.com/tfranzel/drf-spectacular/issues/1506>_) [johnthagen]
  • Mitigate GeneratedField lost arguments and special case for DecimalField [#1166](https://github.com/tfranzel/drf-spectacular/issues/1166) <https://github.com/tfranzel/drf-spectacular/issues/1166>_
  • Webhook explicit operationId ([#1505](https://github.com/tfranzel/drf-spectacular/issues/1505) <https://github.com/tfranzel/drf-spectacular/issues/1505>_)
  • change conflicting license field for 3.8 ([#1504](https://github.com/tfranzel/drf-spectacular/issues/1504) <https://github.com/tfranzel/drf-spectacular/issues/1504>_)
  • Document django-rest-knox support [johnthagen]
  • add help text to spectacular management command arguments [#1175](https://github.com/tfranzel/drf-spectacular/issues/1175) <https://github.com/tfranzel/drf-spectacular/issues/1175>_ [Jean-Baptiste Braun]
  • Mark FileField as nullable in response when not required [#1493](https://github.com/tfranzel/drf-spectacular/issues/1493) <https://github.com/tfranzel/drf-spectacular/issues/1493>_ [mojtaba sohrabi]
  • Extend Choices hint fix with generated label description [#1486](https://github.com/tfranzel/drf-spectacular/issues/1486) <https://github.com/tfranzel/drf-spectacular/issues/1486>_
  • Suppress py<=3.14 deprecation warning [#1497](https://github.com/tfranzel/drf-spectacular/issues/1497) <https://github.com/tfranzel/drf-spectacular/issues/1497>_
  • Remove ancient DRF3.11 and Django2.2 due to contrib packages failing
  • feat: add support for django 6.0 and and drf 3.17 [Vjeran Grozdanic]
  • Add setting to disable docstring extraction [Phil Starkey]
  • feat: add support for polymorphic built-in drf support [Benedikt Bauer]
  • Clarifies post-processing hooks [Andy Piltser-Cowan]
  • Clarifies customizations step 5 [Andy Piltser-Cowan]
  • Fix dependency definition for Django 5.2 [Ülgen Sarıkavak]
  • Implement x-spec-enum-id for type hint Choices. [Noam Kushinsky]
  • Add Support for unsigned integers uint16, uint32 and uint64 [Nicolas Delaby]
  • Fix regression introduced in [#1450](https://github.com/tfranzel/drf-spectacular/issues/1450) <https://github.com/tfranzel/drf-spectacular/issues/1450>_ ([#1469](https://github.com/tfranzel/drf-spectacular/issues/1469) <https://github.com/tfranzel/drf-spectacular/issues/1469>_) [Oleg Höfling]

Breaking changes / important additions:

  • Many small improvement, bug fixes, updates to the test suite and renovated test matrix. Some minor schema corrections are to be expected, but nothing drastic.
Commits

Updates dulwich from 1.2.6 to 1.2.10

Release notes

Sourced from dulwich's releases.

dulwich-1.2.10

  • Fix regression in 1.2.9 where loose objects whose content inflates to more than 8192 bytes failed to parse with `zlib.error: object header exceeds maximum size`. (Jelmer Vernooij, #2292)

dulwich-1.2.9

Highlights of this release:

Security fixes

  • Reject checkout paths whose leading component is a DOS drive-letter prefix on Windows (e.g. C:), which os.path.join would otherwise treat as absolute and let a crafted tree write outside the work tree. (reported by Luke Baton)
  • Bound zlib decompression of pack entries and loose objects against decompression-bomb DoS. read_zlib_chunks now caps the inflated size at the declared decomp_len, and loose-object parsing accepts max_size defaulting to git's core.bigFileThreshold (512 MiB). (reported by Luke Bento)
  • Reject OFS_DELTA pack entries whose delta_base_offset is zero. Such an entry references itself, so Pack.resolve_object would loop forever growing its delta stack until OOM. (reported by Luke Banto)
  • Bound Transfer-Encoding: chunked request bodies in dulwich.web: strip chunk extensions, reject negative sizes, enforce per-chunk and per-request size limits, and cap requests that omit Content-Length.
  • Bound the running length when decoding EWAH bitmaps so a corrupt or malformed .bitmap index raises ValueError instead of hanging in an unbounded loop that exhausts memory.

Other changes

  • web: Reject smart HTTP git-upload-pack / git-receive-pack POSTs whose Content-Type is not the exact application/x-<service>-request value, matching git http-backend.
  • dulwich.web: Warn at startup that running python3 -m dulwich.web is not intended as a production web server (no authentication, etc.).

See NEWS for the full list.

dulwich-1.2.8

Security

  • GHSA-8w8g-wq8h-fq33: Write files through build_file_from_blob in path-restricted porcelain.checkout(paths=...) instead of a raw os.open. The old path followed a symlink left at the target, so a crafted repository could write attacker content outside the work tree (e.g. into .git/hooks) on checkout.
  • GHSA-5fqc-mrg8-w798: Build the temporary index for filter-branch --index-filter in memory instead of materializing tree entries into CWD. Persisted entries between commits let a symlink from an ancestor commit redirect a descendant's writes outside the work tree.
  • Refuse to write a stash entry through an intermediate symlink on stash.pop. The old os.path.exists check followed symlinks, so a crafted stash whose parent path was a symlink already present in the worktree (e.g. link -> .git/hooks) let the subsequent write land outside the work tree.
  • Refuse path-restricted porcelain.checkout, restore and reset_file writes whose leading directory is an existing symlink, so a crafted repository can no longer land sub as a link to .git/hooks and have a write to sub/anything traverse it.
  • Canonicalize file modes to 0o644/0o755 before chmod on checkout and patch apply, matching git. An untrusted tree entry or patch `new file mode` could otherwise set setuid/setgid/sticky or world-writable bits on a materialized file.
  • Reject non-hex pkt-line length prefixes in the protocol parser. int(sizestr, 16) accepted a leading -, whose negative length made the following `read(size - 4)` slurp the rest of the stream and caused `PktLineParser` to loop without consuming its buffer. (#2267)
  • Escape the repository path passed to the remote in the SSH client, so a path containing a single quote can no longer close the quoting and have the remainder interpreted by the remote shell. (#2254)
  • Reject an option-like host in TCPGitClient before invoking the core.gitProxy command, matching the SubprocessSSHVendor guard, so a URL like `git://-oProxyCommand=...` can no longer be interpreted as a flag by the proxy program. (#2240)
  • Validate object ids in the object store and refs container. An id containing path separators would previously be joined into a filename by `DiskObjectStore._get_shafile_path` (escaping the objects directory) or stored as a ref value. (#2256)
  • Validate the object id in LFS server request handlers before it reaches the store, so a request path containing .. cannot escape the LFS directory. (#2255)
  • Don't expand config include/includeIf directives when parsing bundle lists served by an untrusted bundle-uri host, matching the handling of `.gitmodules`. (#2243)
  • Read the signing key from gpg's --status-fd (VALIDSIG) in `GPGCliSignatureVendor.verify` instead of the human-readable stderr text, which could be spoofed by embedding a matching line in the signed payload. (#2245)
  • Raise UntrustedSignature from verify_commit/verify_tag when keyids is set and the object carries no signature, instead of silently accepting it. (#2238)
  • Fix quadratic backtracking in _find_scissors_line so a crafted patch can no longer stall mailinfo/git am --scissors. (#2239)
  • Collapse consecutive * wildcards to at most ** in .gitattributes, .gitignore and config glob translation to avoid catastrophic backtracking (ReDoS). (#2237)
  • Fix quadratic buffering in web.ChunkReader.read. (#2262)
  • Skip invalid tree paths (containing .., .git, etc.) in `diff_working_tree_to_tree` instead of joining them onto the work tree; a working-tree diff against an untrusted commit could otherwise read a file outside the work tree and disclose its contents. (#2261)
  • Fix quadratic header accumulation in ShaFile._parse_message. (#2273)

Fixes

  • Enumerate the objects to push before the HTTP git-receive-pack request body starts streaming. `generate_pack_data` previously ran lazily inside the body generator, after the header pkt-lines were already on the wire, so on large repositories the request stalled mid-body while objects were counted and servers such as GitHub aborted the push with a timeout / broken pipe. (#2248)
  • Replace a symlink left at the target path with a fresh regular file in build_file_from_blob instead of writing through it, matching git on checkout. (#2259)
  • Raise GitProtocolError carrying the server's message when the fetch/send-pack tail loop sees a fatal side-band channel (\x03), instead of crashing with `AssertionError: Invalid sideband channel 3` and swallowing the server's error text.

... (truncated)

Changelog

Sourced from dulwich's changelog.

1.2.10 2026-07-07

  • Fix regression in 1.2.9 where loose objects whose content inflates to more than 8192 bytes failed to parse with zlib.error: object header exceeds maximum size. (Jelmer Vernooij, #2292)

1.2.9 2026-07-06

  • Bound the running length when decoding EWAH bitmaps, so a corrupt or malformed .bitmap index raises ValueError instead of hanging in an unbounded loop that exhausts memory. (Jelmer Vernooij)

  • web: Reject smart HTTP git-upload-pack / git-receive-pack POSTs whose Content-Type is not the exact application/x-<service>-request value, matching git http-backend. Real git clients (and dulwich's own client) already send this header, so there is no interop cost; the check is defense in depth against cross-origin POSTs for deployments that wrap dulwich.web in a cookie-based auth layer.

  • SECURITY: On Windows, reject checkout paths whose leading component is a DOS drive-letter prefix like C:. os.path.join(root, "C:...") discards root and writes to the absolute drive path, so a tree entry named C: could otherwise write arbitrary files outside the work tree. (reported by Luke Baton, Jelmer Vernooij)

  • SECURITY: Bound zlib decompression of pack entries and loose objects against decompression-bomb DoS. read_zlib_chunks now caps the inflated size at the declared decomp_len, and loose-object parsing (ShaFile.from_file/from_path) accepts a max_size argument defaulting to Git's core.bigFileThreshold (512 MiB). The disk object store reads core.bigFileThreshold from config and enforces it on _get_loose_object. (reported by Luke Bento, Jelmer Vernooij)

  • SECURITY: Reject OFS_DELTA pack entries whose delta_base_offset is zero. Such an entry references itself, so Pack.resolve_object would loop forever growing its delta stack until the process ran out of memory. unpack_object now raises ApplyDeltaError at parse time, matching git's delta offset == 0 is invalid guard. (reported by Luke Banto, Jelmer Vernooij)

  • dulwich.web: Warn at startup that running python3 -m dulwich.web is not meant to provide a production web server. It does not support authentication, for example. (Jelmer Vernooij)

  • SECURITY: Bound Transfer-Encoding: chunked request bodies in dulwich.web. _chunk_iter now strips chunk extensions, rejects negative sizes, and enforces per-chunk and per-request size limits; LimitedInputFilter also caps requests that omit Content-Length. (Jelmer Vernooij)

... (truncated)

Commits
  • 9c45439 Release 1.2.10
  • 6100e4e Fix regression parsing loose objects that inflate past 8KB (#2293)
  • f489f7d Fix regression parsing loose objects that inflate past 8KB
  • c93ab9b Release 1.2.9
  • 3526b18 Fix resource warnings (#2291)
  • 8bbb5e8 Fix Windows tempdir cleanup in pack index writing tests
  • 2c9f698 Stop tests from writing to stdout
  • e5f79c9 Fix resource warnings
  • 7c94365 Fix more fallout from running tests in parallel (#2290)
  • d70c70b Add overrideHome test helper; use in maintenance tests
  • Additional commits viewable in compare view

Updates fido2 from 2.2.0 to 2.2.1

Release notes

Sourced from fido2's releases.

python-fido2 2.2.1

Version 2.2.1 (released 2026-06-29)

  • Server example: Migrate build tool from poetry to uv.
  • Fix: Correctly format att_obj in previewSign.
Changelog

Sourced from fido2's changelog.

  • Version 2.2.1 (released 2026-06-29) ** Server example: Migrate build tool from poetry to uv. ** Fix: Correctly format att_obj in previewSign.
Commits
  • 018ef97 Set date in NEWS
  • e5b022d Use hmac_mc in prf example
  • 27e0999 Fix examples for WindowsClient
  • 1cc7241 Bump version
  • 664f033 Add ML-DSA support
  • 24b03d0 Migrate server example to uv
  • 1f15f16 Lock cryptography to <49 for win x86 builds
  • a084d2d Bump pre-commit and fix ty issues
  • f0816a3 Bump dependencies and PSL data
  • bac45ad Add Pico controller support for automated device tests
  • Additional commits viewable in compare view

Updates grpcio from 1.81.1 to 1.82.1

Release notes

Sourced from grpcio's releases.

Release v1.82.1

This is release gRPC Core 1.82.1 (glacier).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

What's Changed

Python

Full Changelog: grpc/grpc@v1.82.0...v1.82.1

Release v1.82.0

This is release gRPC Core 1.82.0 (glacier).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes. This is release 1.82.0 (glacier) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

  • [call creds] Add support for looking up and attaching regional access boundary policy metadata. (#41594)
  • Unregister CFStream callbacks during endpoint shutdown. (#42211)
  • Fix fd 0 incorrectly treated as invalid across POSIX socket code. (#41764)
  • [xDS] enable new ORCA-to-LRS propagation behavior (gRFC A85). (#42411)
  • [RetryFilter::LegacyCallData]: avoid tripping abseil nullopt assertion. (#42405)
  • [xds] Implement A114: WRR support for custom backend metrics. (#41750)
  • [Core] Upgrade to protobuf 35 (#42512)

PHP

  • [Backport][v1.82.x][PHP] Add PIE support for PHP extention. (#42873)

Python

Added 2026-07-12: CAUTION! This gRPC Python release 1.82.0 was yanked from PyPI on 2026-07-07 due to issue grpc/grpc#42906.

... (truncated)

Commits
  • acccf84 [Release] Bump version to 1.82.1 (on v1.82.x branch) (#42924)
  • 4f356a0 [Backport][v1.82.x][Python] Update lower bound for protobuf from 6.33.5 to 7....
  • 742600a [Release] Bump version to 1.82.0 (on v1.82.x branch) (#42876)
  • 1a59ee2 [Backport][v1.82.x][PHP] Add PIE support for PHP extention (#42873)
  • 6c34462 [Release] Bump version to 1.82.0-pre2 (on v1.82.x branch) (#42789)
  • 0ddb577 [Backport][v1.82.x] Memory optimization experiments (#42788)
  • b3580d6 [Backport][v1.82.x][PSM interop] adds python kokoro config file for regional ...
  • d8183a8 [Backport][v1.82.x][PSM interop] adds kokoro config file for regional TD test...
  • f3289ea [Release] Bump version to 1.82.0-pre1 (on v1.82.x branch) (#42639)
  • 9a7455f [Release] Bump core version to 55.0.0 for upcoming release (#42626)
  • Additional commits viewable in compare view

Updates jinxed from 2.0.4 to 2.1.0

Release notes

Sourced from jinxed's releases.

2.1.0

Full Changelog: Rockhopper-Technologies/jinxed@2.0.4...2.1.0

Commits

Updates pillow from 12.2.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

  • Remove non-image ImageCms modes #9697 [

@dependabot
chore(deps): bump the dependencies group across 1 directory with 24 u…
cc8cc3a 
…pdates

Bumps the dependencies group with 24 updates in the /src/backend directory:

| Package | From | To |
| --- | --- | --- |
| [blessed](https://github.com/jquast/blessed) | `1.44.0` | `1.47.0` |
| [boto3](https://github.com/boto/boto3) | `1.43.36` | `1.43.45` |
| [botocore](https://github.com/boto/botocore) | `1.43.36` | `1.43.45` |
| [cffi](https://github.com/python-cffi/cffi) | `2.0.0` | `2.1.0` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.7` | `3.4.9` |
| [django](https://github.com/django/django) | `5.2.15` | `6.0.7` |
| [django-allauth](https://github.com/sponsors/pennersr) | `65.14.3` | `65.18.0` |
| [django-otp](https://github.com/django-otp/django-otp) | `1.3.0` | `1.7.0` |
| [drf-spectacular](https://github.com/tfranzel/drf-spectacular) | `0.29.0` | `0.30.0` |
| [dulwich](https://github.com/dulwich/dulwich) | `1.2.6` | `1.2.10` |
| [fido2](https://github.com/Yubico/python-fido2) | `2.2.0` | `2.2.1` |
| [grpcio](https://github.com/grpc/grpc) | `1.81.1` | `1.82.1` |
| [jinxed](https://github.com/Rockhopper-Technologies/jinxed) | `2.0.4` | `2.1.0` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` |
| [python-fsutil](https://github.com/fabiocaccamo/python-fsutil) | `0.16.1` | `0.17.0` |
| [rpds-py](https://github.com/crate-py/rpds) | `2026.5.1` | `2026.6.3` |
| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.63.0` | `2.64.0` |
| [setuptools](https://github.com/pypa/setuptools) | `82.0.1` | `83.0.0` |
| [tqdm](https://github.com/tqdm/tqdm) | `4.68.3` | `4.68.4` |
| [typing-extensions](https://github.com/python/typing_extensions) | `4.15.0` | `4.16.0` |
| [wcwidth](https://github.com/jquast/wcwidth) | `0.8.1` | `0.8.2` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.3` | `7.15.0` |
| [prek](https://github.com/j178/prek) | `0.4.5` | `0.4.8` |
| [ty](https://github.com/astral-sh/ty) | `0.0.54` | `0.0.58` |



Updates `blessed` from 1.44.0 to 1.47.0
- [Release notes](https://github.com/jquast/blessed/releases)
- [Changelog](https://github.com/jquast/blessed/blob/master/docs/history.rst)
- [Commits](https://github.com/jquast/blessed/commits)

Updates `boto3` from 1.43.36 to 1.43.45
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.36...1.43.45)

Updates `botocore` from 1.43.36 to 1.43.45
- [Commits](boto/botocore@1.43.36...1.43.45)

Updates `cffi` from 2.0.0 to 2.1.0
- [Release notes](https://github.com/python-cffi/cffi/releases)
- [Commits](python-cffi/cffi@v2.0.0...v2.1.0)

Updates `charset-normalizer` from 3.4.7 to 3.4.9
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.7...3.4.9)

Updates `django` from 5.2.15 to 6.0.7
- [Commits](django/django@5.2.15...6.0.7)

Updates `django-allauth` from 65.14.3 to 65.18.0
- [Commits](https://github.com/sponsors/pennersr/commits)

Updates `django-otp` from 1.3.0 to 1.7.0
- [Changelog](https://github.com/django-otp/django-otp/blob/master/CHANGES.rst)
- [Commits](django-otp/django-otp@v1.3.0...v1.7.0)

Updates `drf-spectacular` from 0.29.0 to 0.30.0
- [Release notes](https://github.com/tfranzel/drf-spectacular/releases)
- [Changelog](https://github.com/tfranzel/drf-spectacular/blob/master/CHANGELOG.rst)
- [Commits](tfranzel/drf-spectacular@0.29.0...0.30.0)

Updates `dulwich` from 1.2.6 to 1.2.10
- [Release notes](https://github.com/dulwich/dulwich/releases)
- [Changelog](https://github.com/jelmer/dulwich/blob/main/NEWS)
- [Commits](jelmer/dulwich@dulwich-1.2.6...dulwich-1.2.10)

Updates `fido2` from 2.2.0 to 2.2.1
- [Release notes](https://github.com/Yubico/python-fido2/releases)
- [Changelog](https://github.com/Yubico/python-fido2/blob/main/NEWS)
- [Commits](Yubico/python-fido2@2.2.0...2.2.1)

Updates `grpcio` from 1.81.1 to 1.82.1
- [Release notes](https://github.com/grpc/grpc/releases)
- [Commits](grpc/grpc@v1.81.1...v1.82.1)

Updates `jinxed` from 2.0.4 to 2.1.0
- [Release notes](https://github.com/Rockhopper-Technologies/jinxed/releases)
- [Commits](Rockhopper-Technologies/jinxed@2.0.4...2.1.0)

Updates `pillow` from 12.2.0 to 12.3.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.2.0...12.3.0)

Updates `python-fsutil` from 0.16.1 to 0.17.0
- [Release notes](https://github.com/fabiocaccamo/python-fsutil/releases)
- [Changelog](https://github.com/fabiocaccamo/python-fsutil/blob/main/CHANGELOG.md)
- [Commits](fabiocaccamo/python-fsutil@0.16.1...0.17.0)

Updates `rpds-py` from 2026.5.1 to 2026.6.3
- [Release notes](https://github.com/crate-py/rpds/releases)
- [Changelog](https://github.com/crate-py/rpds/blob/main/release.toml)
- [Commits](crate-py/rpds@v2026.5.1...v2026.6.3)

Updates `sentry-sdk` from 2.63.0 to 2.64.0
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.63.0...2.64.0)

Updates `setuptools` from 82.0.1 to 83.0.0
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v82.0.1...v83.0.0)

Updates `tqdm` from 4.68.3 to 4.68.4
- [Release notes](https://github.com/tqdm/tqdm/releases)
- [Commits](tqdm/tqdm@v4.68.3...v4.68.4)

Updates `typing-extensions` from 4.15.0 to 4.16.0
- [Release notes](https://github.com/python/typing_extensions/releases)
- [Changelog](https://github.com/python/typing_extensions/blob/main/CHANGELOG.md)
- [Commits](python/typing_extensions@4.15.0...4.16.0)

Updates `wcwidth` from 0.8.1 to 0.8.2
- [Release notes](https://github.com/jquast/wcwidth/releases)
- [Commits](jquast/wcwidth@0.8.1...0.8.2)

Updates `coverage` from 7.14.3 to 7.15.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.14.3...7.15.0)

Updates `prek` from 0.4.5 to 0.4.8
- [Release notes](https://github.com/j178/prek/releases)
- [Changelog](https://github.com/j178/prek/blob/master/CHANGELOG.md)
- [Commits](j178/prek@v0.4.5...v0.4.8)

Updates `ty` from 0.0.54 to 0.0.58
- [Release notes](https://github.com/astral-sh/ty/releases)
- [Changelog](https://github.com/astral-sh/ty/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ty@0.0.54...0.0.58)

---
updated-dependencies:
- dependency-name: blessed
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: boto3
  dependency-version: 1.43.45
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: botocore
  dependency-version: 1.43.45
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: cffi
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: charset-normalizer
  dependency-version: 3.4.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: django
  dependency-version: 6.0.7
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: django-allauth
  dependency-version: 65.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: django-otp
  dependency-version: 1.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: drf-spectacular
  dependency-version: 0.30.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: dulwich
  dependency-version: 1.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: fido2
  dependency-version: 2.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: grpcio
  dependency-version: 1.82.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: jinxed
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: pillow
  dependency-version: 12.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: python-fsutil
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: rpds-py
  dependency-version: 2026.6.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: sentry-sdk
  dependency-version: 2.64.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: setuptools
  dependency-version: 83.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: tqdm
  dependency-version: 4.68.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: typing-extensions
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: wcwidth
  dependency-version: 0.8.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: coverage
  dependency-version: 7.15.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: prek
  dependency-version: 0.4.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: ty
  dependency-version: 0.0.58
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jul 17, 2026
@sonarqubecloud

sonarqubecloud Bot commented Jul 17, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@matmair matmair

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@matmair