Skip to content

chore(deps-dev): bump idna from 3.10 to 3.15#1057

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/idna-3.15
Closed

chore(deps-dev): bump idna from 3.10 to 3.15#1057
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/idna-3.15

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 19, 2026

Bumps idna from 3.10 to 3.15.

Changelog

Sourced from idna's changelog.

3.15 (2026-05-12)

  • Enforce DNS-length cap on individual labels early in check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.
  • Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.
  • Use raise ... from err for proper exception chaining and switch internal string formatting to f-strings.
  • Allow flit_core 4.x in the build backend.
  • Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.
  • Add Dependabot configuration for GitHub Actions.
  • Convert README and HISTORY from reStructuredText to Markdown.
  • Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.

3.14 (2026-05-10)

  • Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]

Thanks to Stan Ulbrych for reporting the issue.

3.13 (2026-04-22)

  • Correct classification error for codepoint U+A7F1

3.12 (2026-04-21)

  • Update to Unicode 17.0.0.
  • Issue a deprecation warning for the transitional argument.
  • Added lazy-loading to provide some performance improvements.
  • Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.

Thanks to Rodrigo Nogueira for contributions to this release.

3.11 (2025-10-12)

  • Update to Unicode 16.0.0, including significant changes to UTS46 processing. As a result of Unicode ending support for it, transitional processing no longer has an effect and returns the same result.

... (truncated)

Commits
  • af30a09 Release 3.15
  • 30314d4 Pre-release 3.15rc0
  • 05d4b21 Merge pull request #237 from kjd/convert-docs-to-markdown
  • 2987fdb Convert README and HISTORY from reStructuredText to Markdown
  • 59fa800 Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333ea
  • def6983 Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea
  • bbd8004 Merge pull request #234 from StanFromIreland/patch-1
  • edd07c0 Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group
  • 5557db0 Merge branch 'master' into patch-1
  • f11746c Merge pull request #235 from StanFromIreland/patch-2
  • Additional commits viewable in compare view

@dependabot dependabot Bot requested a review from a team as a code owner May 19, 2026 17:25
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels May 19, 2026
@github-actions github-actions Bot enabled auto-merge May 19, 2026 17:26
@dependabot dependabot Bot force-pushed the dependabot/pip/idna-3.15 branch 2 times, most recently from 571656f to 16e32ed Compare May 20, 2026 01:18
Bumps [idna](https://github.com/kjd/idna) from 3.10 to 3.15.
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.10...v3.15)

---
updated-dependencies:
- dependency-name: idna
  dependency-version: '3.15'
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/pip/idna-3.15 branch from 16e32ed to 2fd726c Compare May 21, 2026 01:39
gavinbarron added a commit that referenced this pull request May 21, 2026
* chore(deps-dev): consolidate dependabot dependency updates

Bump the following dev dependencies:
- aiohttp: 3.12.15 → 3.13.5
- anyio: 4.10.0 → 4.13.0
- attrs: 25.3.0 → 26.1.0
- cryptography: 46.0.5 → 48.0.0
- dill: 0.4.0 → 0.4.1
- idna: 3.10 → 3.15
- opentelemetry-api: 1.38.0 → 1.42.0
- opentelemetry-sdk: 1.38.0 → 1.42.0
- opentelemetry-semantic-conventions: 0.59b0 → 0.63b0
- requests: 2.32.5 → 2.33.0
- tomlkit: 0.13.3 → 0.15.0
- tzdata: 2025.2 → 2026.2

Consolidates PRs #1047, #1050, #1051, #1052, #1053, #1054, #1055, #1056, #1057, #1059

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* chore: group remaining dependabot updates with catch-all pattern

Add an 'other-dependencies' group with a wildcard pattern to catch
all packages not already matched by a specific group. This reduces
individual PRs for ungrouped packages like requests, idna, attrs,
cryptography, etc. into a single grouped PR.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github May 22, 2026

Looks like idna is up-to-date now, so this is no longer needed.

@dependabot dependabot Bot closed this May 22, 2026
auto-merge was automatically disabled May 22, 2026 00:02

Pull request was closed

@dependabot dependabot Bot deleted the dependabot/pip/idna-3.15 branch May 22, 2026 00:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants