Skip to content

chore(deps): bump the dependencies group across 1 directory with 9 updates#11671

Merged
SchrodingersGat merged 6 commits intomasterfrom
dependabot/pip/src/backend/dependencies-1a4e795e78
Apr 8, 2026
Merged

chore(deps): bump the dependencies group across 1 directory with 9 updates#11671
SchrodingersGat merged 6 commits intomasterfrom
dependabot/pip/src/backend/dependencies-1a4e795e78

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot bot commented on behalf of github Apr 3, 2026

Bumps the dependencies group with 9 updates in the /src/backend directory:

Package From To
gunicorn 25.2.0 25.3.0
bleach 4.1.0 6.3.0
boto3 1.42.76 1.42.77
botocore 1.42.76 1.42.77
googleapis-common-protos 1.73.0 1.73.1
importlib-metadata 8.7.1 9.0.0
protobuf 6.33.6 7.34.1
wrapt 1.17.3 2.1.2
python-discovery 1.2.0 1.2.1

Updates gunicorn from 25.2.0 to 25.3.0

Release notes

Sourced from gunicorn's releases.

Gunicorn 25.3.0

Bug Fixes

  • HTTP/2 ASGI Body Duplication: Fix request body being received twice in HTTP/2 ASGI requests, causing JSON parsing errors with "Extra data" messages (#3558)

  • ASGI Chunked EOF Handling: Add finish() method to callback parser to handle chunked encoding edge case where connection closes before final CRLF after zero-chunk

  • HTTP/2 Documentation: Fix http_protocols examples to use comma-separated string instead of list syntax (#3561)

  • Chunked Encoding: Reject chunk extensions containing bare CR bytes per RFC 9112 (#3556)

  • Request Line Limit: Fix --limit-request-line 0 to mean unlimited as documented, instead of using default maximum. Works with both Python and fast C parser. (#3563)

Security

  • ASGI Parser Header Validation: Add security checks per RFC 9110/9112:
    • Reject duplicate Content-Length headers
    • Reject requests with both Content-Length and Transfer-Encoding
    • Reject chunked transfer encoding in HTTP/1.0
    • Reject stacked chunked encoding
    • Validate Transfer-Encoding values
    • Strict chunk size validation

Changes

  • Fast HTTP Parser: Update to gunicorn_h1c >= 0.6.3 for asgi_headers property and InvalidChunkExtension validation for bare CR rejection

  • ASGI PROXY Protocol: Add PROXY protocol v1/v2 support to callback parser

  • Docker Images: Update to Python 3.14

Commits
  • 9bce72c Update changelog with missing 25.3.0 changes
  • 2a15fdb Fix pylint isinstance-second-argument-not-valid-type warning
  • 8d08aaa Fix --limit-request-line 0 to mean unlimited
  • d40a374 Fix pytest-asyncio configuration and treq_asgi hex escapes
  • da8bd48 Remove unused AsyncRequest class
  • b00f125 Integrate gunicorn_h1c 0.6.3 with InvalidChunkExtension support
  • bdb2ebd Reject chunk extensions with bare CR bytes (RFC 9112)
  • 7057fc9 Fix http_protocols documentation to use string syntax
  • d43acb8 Update to gunicorn_h1c >= 0.6.2 for asgi_headers support
  • cbd27e8 Merge pull request #3559 from benleembruggen/fix/http2-asgi-body-duplication
  • Additional commits viewable in compare view

Updates bleach from 4.1.0 to 6.3.0

Changelog

Sourced from bleach's changelog.

Version 6.3.0 (October 27th, 2025)

Backwards incompatible changes

  • Dropped support for Python 3.9. (#756)

Security fixes

None

Bug fixes

  • Add support for Python 3.14. (#758)
  • Fix wbr handling. (#488)

Version 6.2.0 (October 29th, 2024)

Backwards incompatible changes

  • Dropped support for Python 3.8. (#737)

Security fixes

None

Bug fixes

  • Add support for Python 3.13. (#736)
  • Remove six depdenncy. (#618)
  • Update known-good versions for tinycss2. (#732)
  • Fix additional < followed by characters and EOF issues. (#728)

Version 6.1.0 (October 6th, 2023)

Backwards incompatible changes

  • Dropped support for Python 3.7. (#709)

Security fixes

None

Bug fixes

  • Add support for Python 3.12. (#710)

... (truncated)

Commits
  • 5546d5d chore: prep for 6.3.0 release
  • 88df3ff chore: fix readthedocs
  • d8b2fb4 fix: fix wbr handling (#488)
  • 55e48ce chore: add support for Python 3.14 (#758)
  • a4d6cdd chore: drop support for Python 3.9 (#756)
  • 172d92f Bump actions/setup-python from 5.6.0 to 6.0.0
  • df88612 Bump actions/checkout from 4.2.2 to 5.0.0
  • cbcf6b1 Bump actions/cache from 4.2.3 to 4.3.0
  • d9aa7ef Switch from dependabot reviewers to CODEOWNERS
  • 06f0f76 Update setuptools, wheel, and twine for devs
  • Additional commits viewable in compare view

Updates boto3 from 1.42.76 to 1.42.77

Commits
  • 48369ea Merge branch 'release-1.42.77'
  • 4398c8e Bumping version to 1.42.77
  • 7c449e2 Add changelog entries from botocore
  • a5ad9c3 Merge branch 'release-1.42.76' into develop
  • See full diff in compare view

Updates botocore from 1.42.76 to 1.42.77

Commits

Updates googleapis-common-protos from 1.73.0 to 1.73.1

Commits
  • 7a05a34 chore: create a release (#16191)
  • 0f19d85 chore: fix missing heading in changelog (#16189)
  • a16755d chore: librarian onboard pull request: 20260323T111101Z (#16141)
  • 9694ce9 chore: librarian onboard pull request: 20260323T114549Z (#16143)
  • c4a35cf chore: librarian onboard pull request: 20260323T132735Z (#16146)
  • 640a86b chore: librarian update image pull request: 20260325T221325Z (#16175)
  • 341284c chore(deps): bump pyasn1 from 0.6.1 to 0.6.3 in /packages/sqlalchemy-spanner ...
  • ec9262c fix: Allow Protobuf 7.x, require Python 3.9 (#16102)
  • cf50cea feat(firestore): literals pipeline stage (#16028)
  • 4b400fa chore: librarian generate pull request: 20260325T142358Z (#16166)
  • Additional commits viewable in compare view

Updates importlib-metadata from 8.7.1 to 9.0.0

Changelog

Sourced from importlib-metadata's changelog.

v9.0.0

Deprecations and Removals

  • Added MetadataNotFound (subclass of FileNotFoundError) and updated Distribution.metadata/metadata() to raise it when the metadata files are missing instead of returning Nonepython/cpython#143387#532)

v8.9.0

Features

v8.8.0

Features

  • Removed Python 3.9 compatibility.
Commits

Updates protobuf from 6.33.6 to 7.34.1

Release notes

Sourced from protobuf's releases.

Protocol Buffers v34.0-rc1

Announcements

Bazel

Compiler

C++

... (truncated)

Commits

Updates wrapt from 1.17.3 to 2.1.2

Release notes

Sourced from wrapt's releases.

wrapt-2.1.2

See the project page on the Python Package Index at https://pypi.org/project/wrapt/2.1.2/ for more information.

wrapt-2.1.1

See the project page on the Python Package Index at https://pypi.org/project/wrapt/2.1.1/ for more information.

wrapt-2.1.0

See the project page on the Python Package Index at https://pypi.org/project/wrapt/2.1.0/ for more information.

wrapt-2.0.1

See the project page on the Python Package Index at https://pypi.org/project/wrapt/2.0.1/ for more information.

wrapt-2.0.0

See the project page on the Python Package Index at https://pypi.org/project/wrapt/2.0.0/ for more information.

Changelog

Sourced from wrapt's changelog.

Version 2.1.2

Bugs Fixed

  • Building of Python wheels for riscv64 Linux platform had been accidentally removed from the build configuration. This has now been added back in.

  • When a weak function proxy was created for a bound method and the instance it was bound to was garbage collected, calling the proxy would silently call the function as unbound instead of raising a ReferenceError.

  • When deleting an attribute named __annotations__ on an object proxy, the attribute was only being deleted from the proxy and not also from the wrapped object.

Version 2.1.1

Bugs Fixed

  • Search field for documentation hosted on Read the Docs wasn't working correctly due to JavaScript error.

  • Missing tox.ini from source distribution package has been added.

Version 2.1.0

Features Changed

  • Drop support for Python 3.8. Python version 3.9 or later is now required.

Bugs Fixed

  • Improved type hints so that mypy and ty work better for methods of classes when using wrapt.decorator and wrapt.function_wrapper. Note that applying these to static methods still does not work correctly due to possibly limitations in those type checkers. The pyrefly tool still does not work correctly with wrapt.decorator and wrapt.function_wrapper applied to any methods of classes. Overall pyright provides the best experience when using wrapt with type checking.

Version 2.0.1

Bugs Fixed

  • The wrapt.lazy_import() function wasn't included in the __all__ attribute of the wrapt module, meaning that it wasn't

... (truncated)

Commits
  • 1381ae8 Merge branch 'release/2.1.2'
  • 26ab4fd Update ready for 2.1.2 release.
  • fbdbef4 Handle pypy which raises different exception type.
  • 87baf75 Add tests for deletion of qualname and annotations.
  • b48debf Decided only needed a patch level update,
  • 06c698f Update release notes for annotation deletion bug.
  • 6e6ed87 Merge pull request #313 from bysiber/fix/delattr-annotations
  • 4fc2c23 Add test to call proxy after weakref cleared.
  • 9e53a71 Add change notes for ReferenceError fix.
  • 2cda4e6 Merge pull request #312 from bysiber/fix/weakfunctionproxy-expired-instance
  • Additional commits viewable in compare view

Updates python-discovery from 1.2.0 to 1.2.1

Release notes

Sourced from python-discovery's releases.

1.2.1

What's Changed

New Contributors

Full Changelog: tox-dev/python-discovery@1.2.0...1.2.1

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…dates

Bumps the dependencies group with 9 updates in the /src/backend directory:

| Package | From | To |
| --- | --- | --- |
| [gunicorn](https://github.com/benoitc/gunicorn) | `25.2.0` | `25.3.0` |
| [bleach](https://github.com/mozilla/bleach) | `4.1.0` | `6.3.0` |
| [boto3](https://github.com/boto/boto3) | `1.42.76` | `1.42.77` |
| [botocore](https://github.com/boto/botocore) | `1.42.76` | `1.42.77` |
| [googleapis-common-protos](https://github.com/googleapis/google-cloud-python) | `1.73.0` | `1.73.1` |
| [importlib-metadata](https://github.com/python/importlib_metadata) | `8.7.1` | `9.0.0` |
| [protobuf](https://github.com/protocolbuffers/protobuf) | `6.33.6` | `7.34.1` |
| [wrapt](https://github.com/GrahamDumpleton/wrapt) | `1.17.3` | `2.1.2` |
| [python-discovery](https://github.com/tox-dev/python-discovery) | `1.2.0` | `1.2.1` |



Updates `gunicorn` from 25.2.0 to 25.3.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@25.2.0...25.3.0)

Updates `bleach` from 4.1.0 to 6.3.0
- [Changelog](https://github.com/mozilla/bleach/blob/main/CHANGES)
- [Commits](mozilla/bleach@v4.1.0...v6.3.0)

Updates `boto3` from 1.42.76 to 1.42.77
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.42.76...1.42.77)

Updates `botocore` from 1.42.76 to 1.42.77
- [Commits](boto/botocore@1.42.76...1.42.77)

Updates `googleapis-common-protos` from 1.73.0 to 1.73.1
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@googleapis-common-protos-v1.73.0...googleapis-common-protos-v1.73.1)

Updates `importlib-metadata` from 8.7.1 to 9.0.0
- [Release notes](https://github.com/python/importlib_metadata/releases)
- [Changelog](https://github.com/python/importlib_metadata/blob/main/NEWS.rst)
- [Commits](python/importlib_metadata@v8.7.1...v9.0.0)

Updates `protobuf` from 6.33.6 to 7.34.1
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `wrapt` from 1.17.3 to 2.1.2
- [Release notes](https://github.com/GrahamDumpleton/wrapt/releases)
- [Changelog](https://github.com/GrahamDumpleton/wrapt/blob/develop/docs/changes.rst)
- [Commits](GrahamDumpleton/wrapt@1.17.3...2.1.2)

Updates `python-discovery` from 1.2.0 to 1.2.1
- [Release notes](https://github.com/tox-dev/python-discovery/releases)
- [Commits](tox-dev/python-discovery@1.2.0...1.2.1)

---
updated-dependencies:
- dependency-name: gunicorn
  dependency-version: 25.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: dependencies
- dependency-name: bleach
  dependency-version: 6.3.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: boto3
  dependency-version: 1.42.77
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: botocore
  dependency-version: 1.42.77
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: googleapis-common-protos
  dependency-version: 1.73.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: dependencies
- dependency-name: importlib-metadata
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: protobuf
  dependency-version: 7.34.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: wrapt
  dependency-version: 2.1.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: dependencies
- dependency-name: python-discovery
  dependency-version: 1.2.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Apr 3, 2026
@dependabot dependabot bot requested a review from SchrodingersGat as a code owner April 3, 2026 18:54
@dependabot dependabot bot added python Pull requests that update Python code dependencies Pull requests that update a dependency file labels Apr 3, 2026
@netlify
Copy link
Copy Markdown

netlify bot commented Apr 3, 2026

Deploy Preview for inventree-web-pui-preview canceled.

Name Link
🔨 Latest commit 7854125
🔍 Latest deploy log https://app.netlify.com/projects/inventree-web-pui-preview/deploys/69d5e8ca90d4720008ad223e

@matmair matmair added this to the 1.3.0 milestone Apr 7, 2026
@codecov
Copy link
Copy Markdown

codecov bot commented Apr 7, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.45%. Comparing base (4d2ed8f) to head (7854125).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master   #11671   +/-   ##
=======================================
  Coverage   91.45%   91.45%           
=======================================
  Files         964      964           
  Lines       49985    49985           
=======================================
  Hits        45715    45715           
  Misses       4270     4270           
Flag Coverage Δ
backend 89.26% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components Coverage Δ
Backend Apps 91.73% <ø> (ø)
Backend General 93.41% <ø> (ø)
Frontend ∅ <ø> (∅)
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@matmair
Copy link
Copy Markdown
Member

matmair commented Apr 8, 2026

@SchrodingersGat ready for review and merge

@SchrodingersGat SchrodingersGat merged commit fea0865 into master Apr 8, 2026
58 checks passed
@SchrodingersGat SchrodingersGat deleted the dependabot/pip/src/backend/dependencies-1a4e795e78 branch April 8, 2026 07:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants