Bump the python-dependencies group with 6 updates

[dependabot]

Bumps the python-dependencies group with 6 updates:

Package	From	To
cbor2	5.9.0	6.1.3
django-unfold	0.99.1	0.100.0
djlint	1.40.2	1.40.3
pyopenssl	26.2.0	26.3.0
service-identity	24.2.0	26.1.0
xxhash	3.8.0	3.8.1

Updates cbor2 from 5.9.0 to 6.1.3

Release notes

Sourced from cbor2's releases.

6.1.3

• Fixed the decoder registering 6-byte strings in the string reference namespace at indices 65536–4294967295 where the encoder does not, desynchronising the namespace and resolving later string references to the wrong value (#313; PR by @​sahvx655-wq)
• Fixed the IPv4/IPv6 network decoders (tags 52 and 54) silently truncating an address byte string that is longer than the address size instead of rejecting it as malformed (#309; PR by @​sahvx655-wq)
• Fixed quadratic decoding time for indefinite-length and large definite-length byte and text strings, caused by concatenating each chunk onto the accumulated result with + instead of building the result once (#316; PR by @​sahvx655-wq)
• Fixed datetime_as_timestamp encoding whole-second datetimes before 1970 or after 2106 as floats instead of integers, because the timestamp was narrowed through an unsigned 32-bit integer (#317; PR by @​sahvx655-wq)
• Fixed the encoder measuring text strings by code point count instead of UTF-8 byte length when deciding whether to add them to the string reference namespace, desynchronising it from the decoder (which counts bytes) and corrupting later string references for non-ASCII strings (#314; PR by @​sahvx655-wq)
• Fixed the decoder rejecting scoped IPv6 addresses (tag 54) with a CBORDecodeError reading invalid types in input array; the encoder emits them as [address, null, zone id] but the decoder only handled the network and interface array forms, so a scoped ~ipaddress.IPv6Address could not be decoded back (#324; PR by @​sahvx655-wq)

6.1.2

• Fixed incorrect tracking of string references for definite-length text strings of length greater than 65536 (#308; PR by @​sahvx655-wq)
• Fixed cbor2.load() crash caused by incorrect handling of internal read buffer extension during stream deserialization. (#307; PR by @​noderyos)

6.1.1

• Fixed cbor2.load() returning corrupted data for payloads exceeding 4096 bytes (#304)

6.1.0

• Added the allow_duplicate_keys parameter to CBORDecoder, load and loads (default: True). When set to False, a CBORDecodeError is raised upon encountering a duplicate key within the same map. (#283)
• Added support for decoding from any object supporting the buffer API (e.g. memoryview or bytearray) in addition to bytes (#297)
• Fixed compatibility issues with 32-bit systems (#300)

6.0.1

• Fixed an error in the mutability logic during decoding, leading to values being decoded as immutable in unexpected places (#295)

6.0.0

• No changes since v6.0.0rc1

6.0.0rc1

• MAJOR REWRITE: The Python and C implementations of the encoder and decoder were replaced with a single, Rust-based implementation in the interest of maintainability.

  Here are some of the highlights:

  • Improved memory safety (100% safe-mode Rust)
  • Complete elimination of reference leaks
  • Support for free-threading and subinterpreters
  • Substantially improved performance
  • Improved decoder error handling where any non-base exception gets wrapped in a CBORDecodeError
  • Iterative, rather than recursive decoding, meaning the container nesting depth is limited only by the available memory, rather than the C stack size

• BACKWARD INCOMPATIBLE Changed the signature of the tag_hook decoder callables to accept (CBORTag, immutable as arguments instead of CBORDecoder, CBORTag)

• BACKWARD INCOMPATIBLE Changed the signature of the object_hook decoder callables to accept (Mapping[Any, Any], bool) instead of (CBORDecoder, dict[Any, Any])

• BACKWARD INCOMPATIBLE Removed the break_marker singleton as no longer necessary

• BACKWARD INCOMPATIBLE Removed the CBORDecodeValueError exception, instead chaining ValueError or TypeError to a CBORDecodeError

• BACKWARD INCOMPATIBLE Changed the decoding of semantic tag 261 to yield an IPv4Interface or IPv6Interface if the address contains host bits

• BACKWARD INCOMPATIBLE Removed the individual decoding functions from the API as they were mistakenly called directly by users. Please open an issue if you need them back.

... (truncated)

Commits

• 5820bd4 Bumped up the version
• 8bb0466 Bump the github-actions group with 2 updates (#323)
• 00e3dea Decode scoped IPv6 addresses instead of rejecting them (#324)
• aeff00b Measure text strings by byte length in maybe_stringref (#314)
• 1c827f1 Encode whole-second datetime timestamps as integers across full range (#317)
• 791172c Worked around coveralls not working with Homebrew 6
• 32f66ee [pre-commit.ci] pre-commit autoupdate (#322)
• 1d5054e Switched to quarterly pre-commit updates
• c348bbf [pre-commit.ci] pre-commit autoupdate (#319)
• 6625bc1 Optimized bytestring and text string decoding (#316)
• Additional commits viewable in compare view

Updates django-unfold from 0.99.1 to 0.100.0

Release notes

Sourced from django-unfold's releases.

0.100.0

v0.100.0 (2026-07-06)

This release is published under the MIT License.

Bug Fixes

• Badge callback (#2133, 916e045)

• Filter background color (#2132, 5b6c4d7)

Documentation

• Crispy form doc demo URL (#2135, fa014e8)

• Custom site app name (#2047, d79567c)

Features

• Add link shortcut (#2130, 19de972)

• Toggle filter shortcut (#2131, 675fdb1)

---

Detailed Changes: 0.99.1...0.100.0

Changelog

Sourced from django-unfold's changelog.

v0.100.0 (2026-07-06)

Bug Fixes

• Badge callback (#2133, 916e045)

• Filter background color (#2132, 5b6c4d7)

Documentation

• Crispy form doc demo URL (#2135, fa014e8)

• Custom site app name (#2047, d79567c)

Features

• Add link shortcut (#2130, 19de972)

• Toggle filter shortcut (#2131, 675fdb1)

Commits

• dfdd8de 0.100.0
• fa014e8 docs: crispy form doc demo URL (#2135)
• 17b5eab chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#2134)
• d79567c docs: custom site app name (#2047)
• 916e045 fix: badge callback (#2133)
• 5b6c4d7 fix: filter background color (#2132)
• 675fdb1 feat: toggle filter shortcut (#2131)
• 19de972 feat: add link shortcut (#2130)
• See full diff in compare view

Updates djlint from 1.40.2 to 1.40.3

Release notes

Sourced from djlint's releases.

v1.40.3

Fix

• Preserve djlint:off blocks inside tag attributes and avoid false H025 orphan reports when a matching tag crosses a djlint:off block boundary.
• Keep repeated single-line Django {% if %} blocks idempotent after one reformat pass.

Changelog

Sourced from djlint's changelog.

[1.40.3] - 2026-07-04

Fix

• Preserve djlint:off blocks inside tag attributes and avoid false H025 orphan reports when a matching tag crosses a djlint:off block boundary.
• Keep repeated single-line Django {% if %} blocks idempotent after one reformat pass.

Commits

• df39c89 v1.40.3
• 655afef fix: preserve djlint off blocks across tag boundaries
• e54e3de chore(deps): lock file maintenance (#2180)
• 32ea3a7 chore(deps): lock file maintenance (#2179)
• 868cfb8 chore(deps): lock file maintenance (#2178)
• a7af3d2 chore(deps): lock file maintenance (#2177)
• 0bdb790 chore(deps): update pre-commit hook rbubley/mirrors-prettier to v3.9.4 (#2176)
• db40aa8 chore(deps): update pre-commit hook types-regex to v2026.6.28.20260630 (#2175)
• ed54658 chore(deps): update dependency prettier to v3.9.4 (#2174)
• See full diff in compare view

Updates pyopenssl from 26.2.0 to 26.3.0

Changelog

Sourced from pyopenssl's changelog.

26.3.0 (2026-06-12)

Backward-incompatible changes: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Dropped support for Python 3.8.
• The minimum cryptography version is now 49.0.0.
• Removed deprecated OpenSSL.crypto.X509Req, OpenSSL.crypto.dump_certificate_request, and OpenSSL.crypto.load_certificate_request. cryptography.x509 should be used instead.
• OpenSSL.SSL.Connection.set_session now raises ValueError if the Session was obtained from a Connection that was using a different Context than this one. OpenSSL requires (but does not verify) that sessions only be re-used with a compatible SSL_CTX, so this contract is now enforced.

Deprecations: ^^^^^^^^^^^^^

• Deprecated OpenSSL.crypto.PKey.generate_key and OpenSSL.crypto.PKey.check. The key generation and loading APIs in cryptography should be used instead.
• Deprecated OpenSSL.crypto.dump_privatekey. The serialization APIs on cryptography private key types should be used instead.
• Deprecated all the mutable APIs on OpenSSL.crypto.X509: set_version, set_pubkey, sign, set_serial_number, gmtime_adj_notAfter, gmtime_adj_notBefore, set_notBefore, set_notAfter, set_issuer, and set_subject. cryptography.x509.CertificateBuilder should be used instead.
• Deprecated OpenSSL.SSL.Context.set_passwd_cb. Users should decrypt and load their private keys themselves, with cryptography's key loading APIs, and then call OpenSSL.SSL.Context.use_privatekey.
• Deprecated OpenSSL.crypto.X509Name, as well as the remaining APIs that consume or return it: OpenSSL.crypto.X509.get_issuer, OpenSSL.crypto.X509.get_subject, and OpenSSL.SSL.Context.set_client_ca_list. The APIs in cryptography.x509 should be used instead.

Changes: ^^^^^^^^

• OpenSSL.SSL.Connection.get_client_ca_list now takes an as_cryptography keyword-argument. When True is passed then cryptography.x509.Name are returned, instead of OpenSSL.crypto.X509Name. In the future, passing False (the default) will be deprecated.

Commits

• a34aa1d Prepare 26.3.0 release (#1515)
• 24db880 Deprecate X509Name and the remaining APIs that consume or return it (#1514)
• 1dc08be Add as_cryptography parameter to Connection.get_client_ca_list (#1508)
• 55653a5 Require cryptography 49, drop Python 3.8 (#1513)
• 9bad760 Remove deprecated CSR functionality (#1507)
• 98ca874 Enforce that Session is only re-used with the Context it came from (#1512)
• cbcb1da Deprecate Context.set_passwd_cb (#1511)
• 3b9d07d Deprecate all the mutable APIs on X509 (#1510)
• e096920 Deprecate PKey.generate_key, PKey.check, and dump_privatekey (#1509)
• 7079d6d Fix zizmor findings in GitHub Actions workflows (#1506)
• Additional commits viewable in compare view

Updates service-identity from 24.2.0 to 26.1.0

Release notes

Sourced from service-identity's releases.

26.1.0

Highlights

The true highlight is that thanks to cryptography 47, we can drop two dependencies (that have served use very well for more than a decade; thank you so much pyasn1 maintainers!).

Full changelog below!

Special Thanks

This release would not be possible without my generous sponsors! Thank you to all of you making sustainable maintenance possible! If you would like to join them, go to https://github.com/sponsors/hynek and check out the sweet perks!

Above and Beyond

Variomedia AG (@variomedia), Tidelift (@tidelift), Kraken Tech (@kraken-tech), Klaviyo (@klaviyo), Privacy Solutions GmbH (@privacy-solutions), FilePreviews (@filepreviews), Ecosystems (@ecosyste-ms), Doist (@Doist), Daniel Fortunov (@asqui), and Kevin P. Fleming (@kpfleming).

Maintenance Sustainers

Buttondown (@buttondown), Christopher Dignam (@chdsbd), Magnus Watn (@magnuswatn), David Cramer (@dcramer), Rivo Laks (@rivol), Polar (@polarsource), Mike Fiedler (@miketheman), Duncan Hill (@cricalix), Colin Marquardt (@cmarqu), Pieter Swinkels (@swinkels), Nick Libertini (@libertininick), Brian M. Dennis (@crossjam), Al Sweigart (@asweigart), Celebrity News AG (@celebritynewsag), The Westervelt Company (@westerveltco), Sławomir Ehlert (@slafs), Mostafa Khalil (@khadrawy), Filip Mularczyk (@mukiblejlok), Thomas Klinger (@thmsklngr), Andreas Poehlmann (@ap--), August Trapper Bigelow (@atbigelow), Carlton Gibson (@carltongibson), and Roboflow (@roboflow).

Full Changelog

Added

• Python 3.14 and 3.15 are now officially supported. #85 #93

Changed

• service-identity now uses cryptography's Rust-based ASN.1 decoder and doesn't depend on pyasn1 and pyasn1-modules anymore. As a result, the oldest supported pyOpenSSL backend combination is now pyOpenSSL 26.1.0 with cryptography 47.0.0. #95

Fixed

• Verifying a single-label hostname (e.g. localhost) against a wildcard certificate pattern now raises VerificationError cleanly instead of crashing with an opaque ValueError. #92

Changelog

Sourced from service-identity's changelog.

26.1.0 - 2026-05-30

Added

• Python 3.14 and 3.15 are now officially supported. #85 #93

Changed

• service-identity now uses cryptography's Rust-based ASN.1 decoder and doesn't depend on pyasn1 and pyasn1-modules anymore. As a result, the oldest supported pyOpenSSL backend combination is now pyOpenSSL 26.1.0 with cryptography 47.0.0. #95

Fixed

• Verifying a single-label hostname (e.g. localhost) against a wildcard certificate pattern now raises VerificationError cleanly instead of crashing with an opaque ValueError. #92

Commits

• 5025f92 Prepare 26.1.0
• e1683fd update dev
• 258ba8a Amend funding
• 1b62802 docs/dev: avoid concrete numbers
• e0b7c14 dev: update contributing guide and print coverage summary
• 4dd83da Replace pyasn1 by cryptography.hazmat.asn1 (#95)
• 47a40c7 dev: set UV_CONSTRAINT, too
• a83a5d7 dev: ignore tests in ty
• 7de4489 dev/docs: switch to 3.14 (#94)
• 1fa356c Add 3.15 (#93)
• Additional commits viewable in compare view

Updates xxhash from 3.8.0 to 3.8.1

Release notes

Sourced from xxhash's releases.

v3.8.1

• Register the "benchmark" pytest mark to avoid PytestUnknownMarkWarning
• Update C extension docstrings and remove stale comments

---

Full list of changes: ifduyue/python-xxhash@v3.8.0...v3.8.1

Changelog

Sourced from xxhash's changelog.

v3.8.1 2026-07-06

- Register the "benchmark" pytest mark to avoid PytestUnknownMarkWarning
- Update C extension docstrings and remove stale comments

Commits

• 0a1adf7 Release v3.8.1
• aa419ca Prepare 3.8.1
• e26b770 docs: update C extension docstrings and remove stale comments
• aa69707 Register the “benchmark” pytest mark
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.