build(deps): bump the uv group across 1 directory with 8 updates by dependabot[bot] · Pull Request #173 · Vulnetix/python-ssvc

dependabot · 2026-07-10T06:39:16Z

Bumps the uv group with 8 updates in the / directory:

Package	From	To
pytest	`8.3.4`	`9.0.3`
filelock	`3.16.1`	`3.20.3`
idna	`3.10`	`3.15`
msgpack	`1.1.0`	`1.2.1`
pip	`24.3.1`	`26.1.2`
requests	`2.32.3`	`2.33.0`
setuptools	`75.6.0`	`78.1.1`
urllib3	`2.2.3`	`2.7.0`

Updates pytest from 8.3.4 to 9.0.3

Release notes

Sourced from pytest's releases.

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

#12444: Fixed pytest.approx which now correctly takes into account ~collections.abc.Mapping keys order to compare them.

#13634: Blocking a conftest.py file using the -p no: option is now explicitly disallowed.

Previously this resulted in an internal assertion failure during plugin loading.

Pytest now raises a clear UsageError explaining that conftest files are not plugins and cannot be disabled via -p.

#13734: Fixed crash when a test raises an exceptiongroup with __tracebackhide__ = True.

#14195: Fixed an issue where non-string messages passed to unittest.TestCase.subTest() were not printed.

#14343: Fixed use of insecure temporary directory (CVE-2025-71176).

Improved documentation

#13388: Clarified documentation for -p vs PYTEST_PLUGINS plugin loading and fixed an incorrect -p example.

#13731: Clarified that capture fixtures (e.g. capsys and capfd) take precedence over the -s / --capture=no command-line options in Accessing captured output from a test function <accessing-captured-output>.

#14088: Clarified that the default pytest_collection hook sets session.items before it calls pytest_collection_finish, not after.

#14255: TOML integer log levels must be quoted: Updating reference documentation.

Contributor-facing changes

#12689: The test reports are now published to Codecov from GitHub Actions. The test statistics is visible on the web interface.

-- by aleguy02

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

#13896: The terminal progress feature added in pytest 9.0.0 has been disabled by default, except on Windows, due to compatibility issues with some terminal emulators.

You may enable it again by passing -p terminalprogress. We may enable it by default again once compatibility improves in the future.

Additionally, when the environment variable TERM is dumb, the escape codes are no longer emitted, even if the plugin is enabled.

#13904: Fixed the TOML type of the tmp_path_retention_count settings in the API reference from number to string.

#13946: The private config.inicfg attribute was changed in a breaking manner in pytest 9.0.0. Due to its usage in the ecosystem, it is now restored to working order using a compatibility shim. It will be deprecated in pytest 9.1 and removed in pytest 10.

... (truncated)

Commits

a7d58d7 Prepare release version 9.0.3
089d981 Merge pull request #14366 from bluetech/revert-14193-backport
8127eaf Revert "Fix: assertrepr_compare respects dict insertion order (#14050) (#14193)"
99a7e60 Merge pull request #14363 from pytest-dev/patchback/backports/9.0.x/95d8423bd...
ddee02a Merge pull request #14343 from bluetech/cve-2025-71176-simple
74eac69 doc: Update training info (#14298) (#14301)
f92dee7 Merge pull request #14267 from pytest-dev/patchback/backports/9.0.x/d6fa26c62...
7ee58ac Merge pull request #12378 from Pierre-Sassoulas/fix-implicit-str-concat-and-d...
37da870 Merge pull request #14259 from mitre88/patch-4 (#14268)
c34bfa3 Add explanation for string context diffs (#14257) (#14266)
Additional commits viewable in compare view

Updates filelock from 3.16.1 to 3.20.3

Release notes

Sourced from filelock's releases.

3.20.3

What's Changed

Fix TOCTOU symlink vulnerability in SoftFileLock by @gaborbernat in tox-dev/filelock#465

Full Changelog: tox-dev/filelock@3.20.2...3.20.3

3.20.2

What's Changed

Support Unix systems without O_NOFOLLOW by @mwilliamson in tox-dev/filelock#463

[pre-commit.ci] pre-commit autoupdate by @pre-commit-ci[bot] in tox-dev/filelock#464

New Contributors

@mwilliamson made their first contribution in tox-dev/filelock#463

Full Changelog: tox-dev/filelock@3.20.1...3.20.2

3.20.1

What's Changed

CVE-2025-68146: Fix TOCTOU symlink vulnerability in lock file creation by @gaborbernat in tox-dev/filelock#461

Full Changelog: tox-dev/filelock@3.20.0...3.20.1

3.20.0

What's Changed

Add tox.toml to sdist by @mtelka in tox-dev/filelock#436

Update docs with example by @znichollscr in tox-dev/filelock#438

Add 3.14 support and drop 3.9 by @gaborbernat in tox-dev/filelock#448

New Contributors

@mtelka made their first contribution in tox-dev/filelock#436

@znichollscr made their first contribution in tox-dev/filelock#438

Full Changelog: tox-dev/filelock@3.19.1...3.20.0

3.19.1

What's Changed

add 3.14t (free threading) to matrix by @paultiq in tox-dev/filelock#433

Increase test coverage by @paultiq in tox-dev/filelock#434

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

3.29.4 (2026-06-13)

keep the read/write heartbeat alive on a transient touch error :pr:562 - by :user:dxbjavid

verify inode in break_lock_file before unlinking a stale lock :pr:561 - by :user:dxbjavid

3.29.3 (2026-06-10)

🐛 fix(ci): restore release environment on tag job :pr:559

validate pid range in _parse_lock_holder :pr:556 - by :user:dxbjavid

🔧 ci(release): publish to PyPI on tag push :pr:557

build(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 :pr:558 - by :user:dependabot[bot]

3.29.2 (2026-06-10)

build(deps): bump actions/checkout from 6.0.2 to 6.0.3 :pr:555 - by :user:dependabot[bot]

[pre-commit.ci] pre-commit autoupdate :pr:554 - by :user:pre-commit-ci[bot]

check hostname in is_lock_held_by_us :pr:553 - by :user:dxbjavid

🔒 fix(soft): harden stale-lock breaking and self-heal malformed locks :pr:551

open marker reads non-blocking to refuse attacker-placed fifo :pr:549 - by :user:dxbjavid

3.29.1 (2026-06-03)

🐛 fix(soft): refuse to follow symlinks when reading the lock file :pr:548 - by :user:dxbjavid

[pre-commit.ci] pre-commit autoupdate :pr:547 - by :user:pre-commit-ci[bot]

[pre-commit.ci] pre-commit autoupdate :pr:546 - by :user:pre-commit-ci[bot]

chore: improve filelock maintenance path :pr:545 - by :user:lphuc2250gma

chore: improve filelock maintenance path :pr:544 - by :user:lphuc2250gma

chore: improve filelock maintenance path :pr:542 - by :user:lphuc2250gma

docs: clarify per-thread scope of FileLock configuration :pr:543 - by :user:Gares95

[pre-commit.ci] pre-commit autoupdate :pr:541 - by :user:pre-commit-ci[bot]

docs: fix API docs of release() :pr:540 - by :user:MrAnno

[pre-commit.ci] pre-commit autoupdate :pr:539 - by :user:pre-commit-ci[bot]

[pre-commit.ci] pre-commit autoupdate :pr:538 - by :user:pre-commit-ci[bot]

[pre-commit.ci] pre-commit autoupdate :pr:537 - by :user:pre-commit-ci[bot]

build(deps): bump astral-sh/setup-uv from 8.0.0 to 8.1.0 :pr:536 - by :user:dependabot[bot]

[pre-commit.ci] pre-commit autoupdate :pr:535 - by :user:pre-commit-ci[bot]

... (truncated)

Commits

41b42dd Fix TOCTOU symlink vulnerability in SoftFileLock (#465)
f2e7d40 [pre-commit.ci] pre-commit autoupdate (#464)
5088854 Support Unix systems without O_NOFOLLOW (#463)
377f622 [pre-commit.ci] pre-commit autoupdate (#460)
4724d7f Fix TOCTOU symlink vulnerability in lock file creation (#461)
cb69414 Bump actions/upload-artifact from 5 to 6 (#459)
0769294 Bump actions/download-artifact from 6 to 7 (#458)
414193a [pre-commit.ci] pre-commit autoupdate (#457)
1456797 [pre-commit.ci] pre-commit autoupdate (#456)
8d6bf90 Bump actions/checkout from 5 to 6 (#455)
Additional commits viewable in compare view

Updates idna from 3.10 to 3.15

Changelog

Sourced from idna's changelog.

3.15 (2026-05-12)

Enforce DNS-length cap on individual labels early in check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.

Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.

Use raise ... from err for proper exception chaining and switch internal string formatting to f-strings.

Allow flit_core 4.x in the build backend.

Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.

Add Dependabot configuration for GitHub Actions.

Convert README and HISTORY from reStructuredText to Markdown.

Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.

3.14 (2026-05-10)

Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]

Thanks to Stan Ulbrych for reporting the issue.

3.13 (2026-04-22)

Correct classification error for codepoint U+A7F1

3.12 (2026-04-21)

Update to Unicode 17.0.0.

Issue a deprecation warning for the transitional argument.

Added lazy-loading to provide some performance improvements.

Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.

Thanks to Rodrigo Nogueira for contributions to this release.

3.11 (2025-10-12)

Update to Unicode 16.0.0, including significant changes to UTS46 processing. As a result of Unicode ending support for it, transitional processing no longer has an effect and returns the same result.

... (truncated)

Commits

af30a09 Release 3.15
30314d4 Pre-release 3.15rc0
05d4b21 Merge pull request #237 from kjd/convert-docs-to-markdown
2987fdb Convert README and HISTORY from reStructuredText to Markdown
59fa800 Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333ea
def6983 Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea
bbd8004 Merge pull request #234 from StanFromIreland/patch-1
edd07c0 Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group
5557db0 Merge branch 'master' into patch-1
f11746c Merge pull request #235 from StanFromIreland/patch-2
Additional commits viewable in compare view

Updates msgpack from 1.1.0 to 1.2.1

Release notes

Sourced from msgpack's releases.

v1.2.1

What's Changed

Bump pypa/cibuildwheel from 4.0.0 to 4.1.0 in the all-dependencies group by @dependabot[bot] in msgpack/msgpack-python#694

release v1.2.1 by @methane in msgpack/msgpack-python#698

Full Changelog: msgpack/msgpack-python@v1.2.0...v1.2.1

v1.2.0

What's Changed

relax setuptools version by @methane in msgpack/msgpack-python#652

update setuptools requirements to >=78.1.1 by @methane in msgpack/msgpack-python#653

cython: freethreading_compatible by @methane in msgpack/msgpack-python#654

drop Python 3.9 by @methane in msgpack/msgpack-python#656

update cython and cibuildwheel by @methane in msgpack/msgpack-python#658

ci: add riscv64 manylinux/musllinux wheels by @justeph in msgpack/msgpack-python#664

fix: check unpack_callback_uint32 result by @KowalskiThomas in msgpack/msgpack-python#666

fix: re-raise existing exception when available by @KowalskiThomas in msgpack/msgpack-python#667

fix: check return code in unpack_callback_int64 by @KowalskiThomas in msgpack/msgpack-python#665

Fixed README example by @vallsv in msgpack/msgpack-python#668

Bump the all-dependencies group with 6 updates by @dependabot[bot] in msgpack/msgpack-python#669

ci: use ubuntu-slim for lint by @methane in msgpack/msgpack-python#670

fix: enforce strict_map_key with object_pairs_hook by @KowalskiThomas in msgpack/msgpack-python#673

Raise DEFAULT_RECURSE_LIMIT from 511 to 1024 by @Copilot in msgpack/msgpack-python#676

fix: properly handle return codes in pack_timestamp by @KowalskiThomas in msgpack/msgpack-python#672

fix: avoid memory leak when decoding invalid nested arrays by @KowalskiThomas in msgpack/msgpack-python#671

Add missing autoreset in Packer.pack_ext_type by @bysiber in msgpack/msgpack-python#663

Add no-GIL interpreter support by @clin1234 in msgpack/msgpack-python#641

skip recursion limit test on free-threaded CPython builds by @methane in msgpack/msgpack-python#679

Fix Timestamp.from_datetime returning wrong value for pre-epoch datetimes by @bysiber in msgpack/msgpack-python#662

Add 3.15 to CI by @clin1234 in msgpack/msgpack-python#678

fix: use-after-free in get_data_from_buffer by @KowalskiThomas in msgpack/msgpack-python#677

change changelog format to markdown by @methane in msgpack/msgpack-python#680

Bump the all-dependencies group with 2 updates by @dependabot[bot] in msgpack/msgpack-python#684

Bump sys.setrecursionlimit within test_nest_limit_1024 by @clin1234 in msgpack/msgpack-python#682

Guard Packer buffer protocol hooks with Cython critical sections by @Copilot in msgpack/msgpack-python#686

Harden Unpacker.__init__ re-entry cleanup to prevent buffer/context leaks by @Copilot in msgpack/msgpack-python#687

release v1.2.0rc1 by @methane in msgpack/msgpack-python#681

Wheels CI hangs for MacOS Intel by @crusaderky in msgpack/msgpack-python#689

Bump pypa/cibuildwheel from 3.4.1 to 4.0.0 in the all-dependencies group by @dependabot[bot] in msgpack/msgpack-python#691

release v1.2.0 by @methane in msgpack/msgpack-python#692

New Contributors

@justeph made their first contribution in msgpack/msgpack-python#664

@KowalskiThomas made their first contribution in msgpack/msgpack-python#666

@vallsv made their first contribution in msgpack/msgpack-python#668

@dependabot[bot] made their first contribution in msgpack/msgpack-python#669

@Copilot made their first contribution in msgpack/msgpack-python#676

@bysiber made their first contribution in msgpack/msgpack-python#663

@clin1234 made their first contribution in msgpack/msgpack-python#641

... (truncated)

Changelog

Sourced from msgpack's changelog.

1.2.1

Release Date: 2026-06-19

Fix a segfault when calling Unpacker.unpack() or Unpacker.skip() after an unpacking failure. But note that reusing the same Unpacker instance after an unpacking failure is not supported. Please create a new Unpacker instance instead. GHSA-6v7p-g79w-8964

1.2.0

Release Date: 2026-06-11

Support free threaded Python. #654, #686

Dropped support for Python 3.9. #656

Fix missing error checks in C code. #665, #666, #667, #672

Fix strict_map_key option didn't work for object_pairs_hook. #673

Increase DEFAULT_RECURSE_LIMIT of Unpacker to 1024. #676

Fix memory leak when Unpacker returns error for invalid input. #671

Fix Packer.pack_ext_type() ignored autoreset option. #663

Fix Timestamp.from_datetime() returning wrong value for pre-epoch datetimes. #662

Fix use-after-free in unpackb() and Unpacker.unpack() for non-contiguous input. #677

Fix possible memory leak when calling Unpacker.__init__() several times. #687

1.1.2

Release Date: 2025-10-08

This release does not change source code. It updates only building wheels:

Update Cython to v3.1.4

Update cibuildwheel to v3.2.0

Drop Python 3.8

Add Python 3.14

Add windows-arm

1.1.1

Release Date: 2025-06-13

No change from 1.1.1rc1.

1.1.1rc1

Release Date: 2025-06-06

Update Cython to 3.1.1 and cibuildwheel to 2.23.3.

Commits

448d43f release v1.2.1 (#698)
2c56ddb Merge commit from fork
0f4f350 Bump pypa/cibuildwheel from 4.0.0 to 4.1.0 in the all-dependencies group (#694)
11ed0a5 release v1.2.0 (#692)
c410a38 Bump pypa/cibuildwheel from 3.4.1 to 4.0.0 (#691)
97ba6ca skip ci: remove unneeded CIBW_SKIP option
cdde1b0 Wheels CI hangs for MacOS Intel (#689)
5eb57e1 release v1.2.0rc1 (#681)
77395c1 Harden Unpacker.__init__ re-entry cleanup to prevent buffer/context leaks (...
7df7136 Guard Packer buffer protocol hooks with Cython critical sections (#686)
Additional commits viewable in compare view

Updates pip from 24.3.1 to 26.1.2

Changelog

Sourced from pip's changelog.

26.1.2 (2026-05-31)

Bug Fixes

Reject console_scripts and gui_scripts entry points whose name would install a script outside the scripts directory. ([#14000](https://github.com/pypa/pip/issues/14000) <https://github.com/pypa/pip/issues/14000>_)

Fix installation incorrectly failing when the target path contains a doubled slash, such as with pip install --root //.... ([#14001](https://github.com/pypa/pip/issues/14001) <https://github.com/pypa/pip/issues/14001>_)

Send a consistent Accept-Encoding header to avoid a spurious Cache entry deserialization failed warning. ([#14012](https://github.com/pypa/pip/issues/14012) <https://github.com/pypa/pip/issues/14012>_)

26.1.1 (2026-05-04)

Bug Fixes

Fix issue where uninstallation left behind empty directories. Revert the removal of the adjacent __pycache__ directory when a .py file is removed. ([#13973](https://github.com/pypa/pip/issues/13973) <https://github.com/pypa/pip/issues/13973>_)

26.1 (2026-04-26)

Deprecations and Removals

Drop support for Python 3.9. ([#13795](https://github.com/pypa/pip/issues/13795) <https://github.com/pypa/pip/issues/13795>_)

Features

Add experimental support to read requirements from standardized pylock.toml files (-r pylock.toml). ([#13876](https://github.com/pypa/pip/issues/13876) <https://github.com/pypa/pip/issues/13876>_)

Allow --uploaded-prior-to to accept a duration in days (e.g., P3D for 3 days ago). ([#13674](https://github.com/pypa/pip/issues/13674) <https://github.com/pypa/pip/issues/13674>_)

Enhancements

Speed up dependency resolution when there are complex conflicts. ([#13859](https://github.com/pypa/pip/issues/13859) <https://github.com/pypa/pip/issues/13859>_)

Reduce memory usage when resolving large dependency trees. ([#13843](https://github.com/pypa/pip/issues/13843) <https://github.com/pypa/pip/issues/13843>_)

Emit a deprecation warning when pip imports an unexpected module after installation of a distribution has started. ([#13912](https://github.com/pypa/pip/issues/13912) <https://github.com/pypa/pip/issues/13912>_)

Allow URL constraints to apply to requirements with extras. ([#12018](https://github.com/pypa/pip/issues/12018) <https://github.com/pypa/pip/issues/12018>_)

Allow unpinned requirements to use hashes from constraints. Constraints like {name}=={version} --hash=... feeds into hash verification for a corresponding requirement. ([#9243](https://github.com/pypa/pip/issues/9243) <https://github.com/pypa/pip/issues/9243>_)

Improve conflict reports that involve direct URLs. ([#13932](https://github.com/pypa/pip/issues/13932) <https://github.com/pypa/pip/issues/13932>_)

Show all errors instead of first error for faulty dependency_groups definitions. ([#13917](https://github.com/pypa/pip/issues/13917) <https://github.com/pypa/pip/issues/13917>_)

... (truncated)

Commits

31d7d16 Bump for release
79f348c Update AUTHORS.txt
237a925 Merge pull request #14001 from notatallshaw/fix-is-within-directory
34d0285 Merge pull request #14006 from laymonage/fix-requirements_from_scripts-space-...
09d3e07 Merge pull request #14012 from notatallshaw/stable-accept-encoding
fa7854f Use is_within_directory for entry point check
d01b46c NEWS ENTRY
7ff8bdd Fix is_within_directory for doubled-slash roots
7ea3466 NEWS ENTRY
85673ea Fix Accept-Encoding to gzip, deflate
Additional commits viewable in compare view

Updates requests from 2.32.3 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.

Dropped support for Python 3.8 following its end of support.

v2.32.4

2.32.4 (2025-06-10)

... (truncated)

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.

Dropped support for Python 3.8 following its end of support.

2.32.4 (2025-06-10)

Security

CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file.

... (truncated)

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates setuptools from 75.6.0 to 78.1.1

Changelog

Sourced from setuptools's changelog.

v78.1.1

Bugfixes

More fully sanitized the filename in PackageIndex._download. (#4946)

v78.1.0

Features

Restore access to _get_vc_env with a warning. (#4874)

v78.0.2

Bugfixes

Postponed removals of deprecated dash-separated and uppercase fields in setup.cfg. All packages with deprecated configurations are advised to move before 2026. (#4911)

v78.0.1

Misc

#4909

v78.0.0

Bugfixes

Reverted distutils changes that broke the monkey patching of command classes. (#4902)

Deprecations and Removals

Setuptools no longer accepts options containing uppercase or dash characters in setup.cfg.

... (truncated)

Commits

8e4868a Bump version: 78.1.0 → 78.1.1
100e9a6 Merge pull request #4951
8faf1d7 Add news fragment.
2ca4a9f Rely on re.sub to perform the decision in one expression.
e409e80 Extract _sanitize method for sanitizing the filename.
250a6d1 Add a check to ensure the name resolves relative to the tmpdir.
d8390fe Extract _resolve_download_filename with test.
4e1e893 Merge https://github.com/jaraco/skeleton
3a3144f Fix typo: pyproject.license -> project.license (#4931)
d751068 Fix typo: pyproject.license -> project.license
Additional commits viewable in compare view

Updates urllib3 from 2.2.3 to 2.7.0

Release notes

Sourced from urllib3's releases.

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially. (Reported by @Cycloctane)

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli library. (Reported by @kimkou2024)

See GHSA-mf9v-mfxr-j63j for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @christos-spearbit)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (urllib3/urllib3#3763)

Removed support for end-of-life Python 3.9. (urllib3/urllib3#3720)

Removed support for end-of-life PyPy3.10. (urllib3/urllib3#4979)

Bumped the minimum supported pyOpenSSL version to 19.0.0. (urllib3/urllib3#3777)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. (urllib3/urllib3#3636)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True. (urllib3/urllib3#4967)

Fixed HTTPResponse.stream() and HTTPResponse.read_chunked() to handle amt=0. (urllib3/urllib3#3793)

Updated _TYPE_BODY type alias to include missing Iterable[str], matching the documented and runtime behavior of chunked request bodies. (urllib3/urllib3#3798)

Fixed LocationParseError when paths resembling schemeless URIs were passed to HTTPConnectionPool.urlopen(). (urllib3/urllib3#3352)

Fixed BaseHTTPResponse.readinto() type annotation to accept memoryview in addition to bytearray, matching the io.RawIOBase.readinto contract and enabling use with io.BufferedReader without type errors. (urllib3/urllib3#3764)

2.6.3

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

Fixed a security issue where decompression-bomb safeguards of the streaming API were bypassed when HTTP redirects were followed. (CVE-2026-21441 reported by @D47A, 8.9 High, GHSA-38jv-5279-wg99)

Started treating Retry-After times greater than 6 hours as 6 hours by default. (urllib3/urllib3#3743)

Fixed urllib3.connection.VerifiedHTTPSConnection on Emscripten. (urllib3/urllib3#3752)

2.6.2

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.7.0 (2026-05-07)

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially.

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli <https://pypi.org/project/brotli/>__ library.

See GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>__ for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc>__)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. ([#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763>__)

Removed support for end-of-life Python 3.9. ([#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720>__)

Removed support for end-of-life PyPy3.10. ([#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979>__)

Bumped the minimum supported pyOpenSSL version to 19.0.0. ([#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777>__)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. ([#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636>__)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True.

... (truncated)

Commits

9a950b9 Release 2.7.0
5ec0de4 Merge commit from fork
2bdcc44 Merge commit from fork
f45b0df Fix a misleading example for ProxyManager (#4970)
577193c Switch to nightly PyPy3.11 in CI for now (#4984)
e90af45 Avoid infinite loop in HTTPResponse.read_chunked when amt=0 (#4974)
67ed74f Bump dev dependencies (#4972)

Bumps the uv group with 8 updates in the / directory: | Package | From | To | | --- | --- | --- | | [pytest](https://github.com/pytest-dev/pytest) | `8.3.4` | `9.0.3` | | [filelock](https://github.com/tox-dev/py-filelock) | `3.16.1` | `3.20.3` | | [idna](https://github.com/kjd/idna) | `3.10` | `3.15` | | [msgpack](https://github.com/msgpack/msgpack-python) | `1.1.0` | `1.2.1` | | [pip](https://github.com/pypa/pip) | `24.3.1` | `26.1.2` | | [requests](https://github.com/psf/requests) | `2.32.3` | `2.33.0` | | [setuptools](https://github.com/pypa/setuptools) | `75.6.0` | `78.1.1` | | [urllib3](https://github.com/urllib3/urllib3) | `2.2.3` | `2.7.0` | Updates `pytest` from 8.3.4 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@8.3.4...9.0.3) Updates `filelock` from 3.16.1 to 3.20.3 - [Release notes](https://github.com/tox-dev/py-filelock/releases) - [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst) - [Commits](tox-dev/filelock@3.16.1...3.20.3) Updates `idna` from 3.10 to 3.15 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.10...v3.15) Updates `msgpack` from 1.1.0 to 1.2.1 - [Release notes](https://github.com/msgpack/msgpack-python/releases) - [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md) - [Commits](msgpack/msgpack-python@v1.1.0...v1.2.1) Updates `pip` from 24.3.1 to 26.1.2 - [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst) - [Commits](pypa/pip@24.3.1...26.1.2) Updates `requests` from 2.32.3 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.3...v2.33.0) Updates `setuptools` from 75.6.0 to 78.1.1 - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](pypa/setuptools@v75.6.0...v78.1.1) Updates `urllib3` from 2.2.3 to 2.7.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.2.3...2.7.0) --- updated-dependencies: - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: uv - dependency-name: filelock dependency-version: 3.20.3 dependency-type: indirect dependency-group: uv - dependency-name: idna dependency-version: '3.15' dependency-type: indirect dependency-group: uv - dependency-name: msgpack dependency-version: 1.2.1 dependency-type: indirect dependency-group: uv - dependency-name: pip dependency-version: 26.1.2 dependency-type: indirect dependency-group: uv - dependency-name: requests dependency-version: 2.33.0 dependency-type: indirect dependency-group: uv - dependency-name: setuptools dependency-version: 78.1.1 dependency-type: indirect dependency-group: uv - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Jul 10, 2026

dependabot Bot mentioned this pull request Jul 10, 2026

build(deps): bump the uv group across 1 directory with 5 updates #172

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the uv group across 1 directory with 8 updates#173

build(deps): bump the uv group across 1 directory with 8 updates#173
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-c5a2a8e789

dependabot Bot commented on behalf of github Jul 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 10, 2026

9.0.3

pytest 9.0.3 (2026-04-07)

Bug fixes

Improved documentation

Contributor-facing changes

9.0.2

pytest 9.0.2 (2025-12-06)

Bug fixes

3.20.3

What's Changed

3.20.2

What's Changed

New Contributors

3.20.1

What's Changed

3.20.0

What's Changed

New Contributors

3.19.1

What's Changed

3.15 (2026-05-12)

3.14 (2026-05-10)

3.13 (2026-04-22)

3.12 (2026-04-21)

3.11 (2025-10-12)

v1.2.1

What's Changed

v1.2.0

What's Changed

New Contributors

1.2.1

1.2.0

1.1.2

1.1.1

1.1.1rc1

26.1.2 (2026-05-31)

Bug Fixes

26.1.1 (2026-05-04)

Bug Fixes

26.1 (2026-04-26)

Deprecations and Removals

Features

Enhancements

v2.33.0

2.33.0 (2026-03-25)

New Contributors

v2.32.5

2.32.5 (2025-08-18)

v2.32.4

2.32.4 (2025-06-10)

2.33.0 (2026-03-25)

2.32.5 (2025-08-18)

2.32.4 (2025-06-10)

v78.1.1

Bugfixes

v78.1.0

Features

v78.0.2

Bugfixes

v78.0.1

Misc

v78.0.0

Bugfixes

Deprecations and Removals

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

Security

Deprecations and Removals

Bugfixes

2.6.3

🚀 urllib3 is fundraising for HTTP/2 support

Changes

2.6.2

2.7.0 (2026-05-07)

Security

Deprecations and Removals

Bugfixes