Skip to content

Bump the pip-minor-and-patch group across 2 directories with 5 updates - #850

Merged
pstokkink merged 1 commit into
mainfrom
dependabot/pip/jwtproxy/pip-minor-and-patch-5e20340df2
Aug 31, 2026
Merged

Bump the pip-minor-and-patch group across 2 directories with 5 updates#850
pstokkink merged 1 commit into
mainfrom
dependabot/pip/jwtproxy/pip-minor-and-patch-5e20340df2

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip-minor-and-patch group with 5 updates in the /jwtproxy directory:

Package From To
charset-normalizer 3.4.9 3.5.1
idna 3.18 3.19
pre-commit 4.6.1 4.6.2
pygments 2.20.0 2.21.0
ruff 0.16.2 0.16.4

Bumps the pip-minor-and-patch group with 3 updates in the /tools directory: charset-normalizer, idna and pre-commit.

Updates charset-normalizer from 3.4.9 to 3.5.1

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.1

3.5.1 (2026-08-15)

Changed

  • Raised upper bound of setuptools to v84 (#794)
  • Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

  • No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

Version 3.5.0

3.5.0 (2026-08-12)

Added

  • Explicit support for Python 3.15

Fixed

  • Comparing a CharsetMatch to a non-alias encoding strings (#773)
  • Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
  • A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
  • iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

  • Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
  • Applied micro-optimization on several utils.
  • CharsetMatches no longer sort on each match insertion.

Misc

  • Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).
Changelog

Sourced from charset-normalizer's changelog.

3.5.1 (2026-08-15)

Changed

  • Raised upper bound of setuptools to v84 (#794)
  • Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

  • No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

3.5.0 (2026-08-12)

Added

  • Explicit support for Python 3.15

Fixed

  • Comparing a CharsetMatch to a non-alias encoding strings (#773)
  • Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
  • A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
  • iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

  • Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
  • Applied micro-optimization on several utils.
  • CharsetMatches no longer sort on each match insertion.

Misc

  • Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).
Commits
  • e239bdc Merge pull request #795 from jawah/release-3.5.1
  • 648ad77 docs: update faq
  • fab2749 docs: write changelog for 3.5.1
  • 7d32774 chore: bump version to 3.5.1
  • 9a69f60 docs: update data/info
  • 5dcc6dd perf: charinfo cache access optimization in cython
  • ea3b447 fix: do not validate-decode large payload when md says it's noise
  • a05917f chore: allow setuptools 84 builds (#794)
  • 3325d87 Merge pull request #792 from jawah/update-cibuildwheel-action
  • 77203b1 chore: reformat noxfile.py
  • Additional commits viewable in compare view

Updates idna from 3.18 to 3.19

Release notes

Sourced from idna's releases.

v3.19

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Changelog

Sourced from idna's changelog.

3.19 (2026-08-18)

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Commits
  • 03a9a11 Release 3.19
  • 2d2a7ef Pre-release 3.19rc0
  • 5cce130 Merge pull request #268 from kjd/fix-std3-regex-alert
  • 3914b75 Split the STD3 disallowed-character range so uppercase is explicit
  • ce9fd98 Merge pull request #267 from kjd/housekeeping
  • 809240c Fail CI when the license copyright year is behind the current year
  • d9e16c5 Consolidate test fixtures, prune stale gitignore entries, and fix doc typos
  • ef30fee Remove dead code and pare back superfluous comments
  • b907913 Tighten the version support and Unicode notes in the README
  • 6204cbe Ignore local build artifacts and stop packaging stray tooling config
  • Additional commits viewable in compare view

Updates pre-commit from 4.6.1 to 4.6.2

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.2

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.2 - 2026-08-10

Fixes

Commits

Updates pygments from 2.20.0 to 2.21.0

Release notes

Sourced from pygments's releases.

2.21.0

  • New lexers:

  • Updated lexers:

    • Bash: Fix coloured keyword at the beginning of a name (#2926)
    • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
    • C#:
      • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
      • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
      • Recognize union (#3182)
    • C/C++:
      • Add C23/C++26 attributes (#3084)
      • Add more C2Y keywords (#3092)
      • Highlight a function following a namespace body (#2928)
      • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
      • Add .ipp as a file extension (#3141, #1008)
    • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
    • Csound: Add missing opcode parameter type letter (#3161)
    • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
    • D: Allow non-ASCII (Unicode) identifiers (#1088)
    • Fish: Fix single quote backslash escape (#3138, #2821)
    • Go: Various lexer improvements (#3199)
    • GoogleSQL: Require a word break after SET (#3167)
    • Hexdump: Only match valid digits (#3200, #2847)
    • JavaScript: Highlight the arguments object (#3146)
    • Jsonnet: Recognize colons in array slice expressions (#2828)
    • JSX: Allow apostrophes in element text (#2816)
    • Julia: Fix rstrings backslash (#3140, #2537)
    • Kotlin: Support companion objects without an explicit name (#2525)
    • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
    • Kusto: Recognize member-access dots in dynamic objects (#2779)
    • Lua: Various improvements (#3143)
    • Macaulay2: Update symbols to 1.26.05 (#3120)
    • Markdown:
      • Highlight bold-italics (***...*** and ___...___) (#3067)
      • Fix mention regex to support hyphens in usernames (#3139, #3135)
    • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for embedded code blocks (#3133)
    • Mathematica: Recognize \[Name] named-character escapes such as \[Nu] instead of emitting an Error token (#3097)

... (truncated)

Changelog

Sourced from pygments's changelog.

Version 2.21.0

(released August 17th, 2026)

  • New lexers:

  • Updated lexers:

    • Bash: Fix coloured keyword at the beginning of a name (#2926)
    • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
    • C#:
      • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
      • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
      • Recognize union (#3182)
    • C/C++:
      • Add C23/C++26 attributes (#3084)
      • Add more C2Y keywords (#3092)
      • Highlight a function following a namespace body (#2928)
      • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
      • Add .ipp as a file extension (#3141, #1008)
    • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
    • Csound: Add missing opcode parameter type letter (#3161)
    • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
    • D: Allow non-ASCII (Unicode) identifiers (#1088)
    • Fish: Fix single quote backslash escape (#3138, #2821)
    • Go: Various lexer improvements (#3199)
    • GoogleSQL: Require a word break after SET (#3167)
    • Hexdump: Only match valid digits (#3200, #2847)
    • JavaScript: Highlight the arguments object (#3146)
    • Jsonnet: Recognize colons in array slice expressions (#2828)
    • JSX: Allow apostrophes in element text (#2816)
    • Julia: Fix rstrings backslash (#3140, #2537)
    • Kotlin: Support companion objects without an explicit name (#2525)
    • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
    • Kusto: Recognize member-access dots in dynamic objects (#2779)
    • Lua: Various improvements (#3143)
    • Macaulay2: Update symbols to 1.26.05 (#3120)
    • Markdown:
      • Highlight bold-italics (***...*** and ___...___) (#3067)
      • Fix mention regex to support hyphens in usernames (#3139, #3135)
    • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for

... (truncated)

Commits
  • a43b45d Get ready for the 2.21.0 release.
  • d8f14cb Fix version_added for Purescript.
  • 19c5817 Remove superfluous parentheses from PostgresExplainLexer (#3232)
  • 9992e09 Merge pull request #3191 from jvoisin/dupes
  • bd22577 Fix regexlint warnings after latest update.
  • 6a62df1 Release preparation: Update the changelog.
  • aabba32 Merge pull request #3221 from jvoisin/alter
  • d3441d0 Merge pull request #3225 from jvoisin/caddy
  • c593f3f Add a lexer for Caddy
  • 0644b53 Simplify single-character regex alternations to character classes
  • Additional commits viewable in compare view

Updates ruff from 0.16.2 to 0.16.4

Release notes

Sourced from ruff's releases.

0.16.4

Release Notes

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)

Documentation

  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)

Other changes

  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.4

Released on 2026-08-20.

Preview features

  • [flake8-use-pathlib] Add autofix for PTH116 (#26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#27643)

Bug fixes

  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#27738)

Rule changes

  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#27753)
  • [syntax-errors] Detect duplicate keyword arguments (#17804)
  • [syntax-errors] Detect parameters declared nonlocal (#27628)

Server

  • Offer display-only fixes and mark safe fixes preferred (#27807)
  • Support pull diagnostics for notebook cells (#27779)

Documentation

  • Add default indicator to rules table (#27724)
  • Fix broken link to Python docs (#27757)

Other changes

  • Fix s390x stacker assembly in release builds (#27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#25464)
  • Reduce configuration deserialization code size (#27924)
  • Check packed AST index bounds (#27849)

Contributors

... (truncated)

Commits

Updates charset-normalizer from 3.4.9 to 3.5.1

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.1

3.5.1 (2026-08-15)

Changed

  • Raised upper bound of setuptools to v84 (#794)
  • Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

  • No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

Version 3.5.0

3.5.0 (2026-08-12)

Added

  • Explicit support for Python 3.15

Fixed

  • Comparing a CharsetMatch to a non-alias encoding strings (#773)
  • Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
  • A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
  • iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

  • Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
  • Applied micro-optimization on several utils.
  • CharsetMatches no longer sort on each match insertion.

Misc

  • Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).
Changelog

Sourced from charset-normalizer's changelog.

3.5.1 (2026-08-15)

Changed

  • Raised upper bound of setuptools to v84 (#794)
  • Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

  • No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

3.5.0 (2026-08-12)

Added

  • Explicit support for Python 3.15

Fixed

  • Comparing a CharsetMatch to a non-alias encoding strings (#773)
  • Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
  • A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
  • iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

  • Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
  • Applied micro-optimization on several utils.
  • CharsetMatches no longer sort on each match insertion.

Misc

  • Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).
Commits
  • e239bdc Merge pull request #795 from jawah/release-3.5.1
  • 648ad77 docs: update faq
  • fab2749 docs: write changelog for 3.5.1
  • 7d32774 chore: bump version to 3.5.1
  • 9a69f60 docs: update data/info
  • 5dcc6dd perf: charinfo cache access optimization in cython
  • ea3b447 fix: do not validate-decode large payload when md says it's noise
  • a05917f chore: allow setuptools 84 builds (#794)
  • 3325d87 Merge pull request #792 from jawah/update-cibuildwheel-action
  • 77203b1 chore: reformat noxfile.py
  • Additional commits viewable in compare view

Updates idna from 3.18 to 3.19

Release notes

Sourced from idna's releases.

v3.19

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Changelog

Sourced from idna's changelog.

3.19 (2026-08-18)

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Commits
  • 03a9a11 Release 3.19
  • 2d2a7ef Pre-release 3.19rc0
  • 5cce130 Merge pull request #268 from kjd/fix-std3-regex-alert
  • 3914b75 Split the STD3 disallowed-character range so uppercase is explicit
  • ce9fd98 Merge pull request #267 from kjd/housekeeping
  • 809240c Fail CI when the license copyright year is behind the current year
  • d9e16c5 Consolidate test fixtures, prune stale gitignore entries, and fix doc typos
  • ef30fee Remove dead code and pare back superfluous comments
  • b907913 Tighten the version support and Unicode notes in the README
  • 6204cbe Ignore local build artifacts and stop packaging stray tooling config
  • Additional commits viewable in compare view

Updates pre-commit from 4.6.1 to 4.6.2

Release notes

Sourced from pre-commit's releases.

pre-commit v4.6.2

Fixes

Changelog

Sourced from pre-commit's changelog.

4.6.2 - 2026-08-10

Fixes

Commits

Updates charset-normalizer from 3.4.9 to 3.5.1

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.1

3.5.1 (2026-08-15)

Changed

  • Raised upper bound of setuptools to v84 (#794)
  • Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

  • No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

Version 3.5.0

3.5.0 (2026-08-12)

Added

  • Explicit support for Python 3.15

Fixed

  • Comparing a CharsetMatch to a non-alias encoding strings (#773)
  • Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
  • A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
  • iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

  • Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
  • Applied micro-optimization on several utils.
  • CharsetMatches no longer sort on each match insertion.

Misc

  • Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).
Changelog

Sourced from charset-normalizer's changelog.

3.5.1 (2026-08-15)

Changed

  • Raised upper bound of setuptools to v84 (#794)
  • Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

  • No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

3.5.0 (2026-08-12)

Added

  • Explicit support for Python 3.15

Fixed

  • Comparing a CharsetMatch to a non-alias encoding strings (#773)
  • Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
  • A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
  • iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

  • Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
  • Applied micro-optimization on several utils.
  • CharsetMatches no longer sort on each match insertion.

Misc

  • Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).
Commits
  • e239bdc Merge pull request #795 from jawah/release-3.5.1
  • 648ad77 docs: update faq
  • fab2749 docs: write changelog for 3.5.1
  • 7d32774 chore: bump version to 3.5.1
  • 9a69f60 docs: update data/info
  • 5dcc6dd perf: charinfo cache access optimization in cython
  • ea3b447 fix: do not validate-decode large payload when md says it's noise
  • a05917f chore: allow setuptools 84 builds (#794)
  • 3325d87 Merge pull request #792 from jawah/update-cibuildwheel-action
  • 77203b1 chore: reformat noxfile.py
  • Additional commits viewable in compare view

Updates idna from 3.18 to 3.19

Release notes

Sourced from idna's releases.

v3.19

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing t...

    Description has been truncated

@dependabot
Bump the pip-minor-and-patch group across 2 directories with 5 updates
6483429 
Bumps the pip-minor-and-patch group with 5 updates in the /jwtproxy directory:

| Package | From | To |
| --- | --- | --- |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.9` | `3.5.1` |
| [idna](https://github.com/kjd/idna) | `3.18` | `3.19` |
| [pre-commit](https://github.com/pre-commit/pre-commit) | `4.6.1` | `4.6.2` |
| [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.2` | `0.16.4` |

Bumps the pip-minor-and-patch group with 3 updates in the /tools directory: [charset-normalizer](https://github.com/jawah/charset_normalizer), [idna](https://github.com/kjd/idna) and [pre-commit](https://github.com/pre-commit/pre-commit).


Updates `charset-normalizer` from 3.4.9 to 3.5.1
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.9...3.5.1)

Updates `idna` from 3.18 to 3.19
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.18...v3.19)

Updates `pre-commit` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.1...v4.6.2)

Updates `pygments` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.20.0...2.21.0)

Updates `ruff` from 0.16.2 to 0.16.4
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.2...0.16.4)

Updates `charset-normalizer` from 3.4.9 to 3.5.1
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.9...3.5.1)

Updates `idna` from 3.18 to 3.19
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.18...v3.19)

Updates `pre-commit` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.1...v4.6.2)

Updates `charset-normalizer` from 3.4.9 to 3.5.1
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.9...3.5.1)

Updates `idna` from 3.18 to 3.19
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.18...v3.19)

Updates `pre-commit` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.1...v4.6.2)

Updates `charset-normalizer` from 3.4.9 to 3.5.1
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.9...3.5.1)

Updates `idna` from 3.18 to 3.19
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.18...v3.19)

Updates `pre-commit` from 4.6.1 to 4.6.2
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.1...v4.6.2)

---
updated-dependencies:
- dependency-name: charset-normalizer
  dependency-version: 3.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: idna
  dependency-version: '3.19'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-minor-and-patch
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.16.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-minor-and-patch
- dependency-name: charset-normalizer
  dependency-version: 3.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: idna
  dependency-version: '3.19'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-minor-and-patch
- dependency-name: charset-normalizer
  dependency-version: 3.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: idna
  dependency-version: '3.19'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-and-patch
- dependency-name: charset-normalizer
  dependency-version: 3.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: idna
  dependency-version: '3.19'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-minor-and-patch
- dependency-name: pre-commit
  dependency-version: 4.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 26, 2026
@pstokkink
pstokkink merged commit 47fcd7c into main Aug 31, 2026
4 checks passed
@pstokkink
pstokkink deleted the dependabot/pip/jwtproxy/pip-minor-and-patch-5e20340df2 branch August 31, 2026 08:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pstokkink pstokkink pstokkink approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@pstokkink