Skip to content

Bump the python-dependencies group across 1 directory with 31 updates - #107

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-c0cb30a0b4
Closed

Bump the python-dependencies group across 1 directory with 31 updates#107
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-c0cb30a0b4

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on asgiref, autobahn, boto3, botocore, cbor2, coverage, django-stubs-ext, django-stubs, django-unfold, django, djlint, langchain-core, langgraph, langsmith, librt, opentelemetry-api, opentelemetry-exporter-otlp-proto-http, opentelemetry-instrumentation-django, opentelemetry-sdk, pyasn1, pylint-django, pyopenssl, ruff, s3transfer, service-identity, svix, types-psycopg2, types-python-dateutil, types-requests, uuid-utils and xxhash to permit the latest version.
Updates asgiref from 3.11.1 to 3.12.1

Changelog

Sourced from asgiref's changelog.

3.12.1 (2026-07-14)

  • Restored the previous SyncToAsync.call internal code shape, which was relied on by some APM services. (#572)

    Note, this change was available whilst maintaining the underlying fix (from #564). It does not constitute an API stability promise. Ideally APMs are not monkey patching internal APIs, and future changes will be made here if needed.

3.12.0 (2026-07-14)

  • AsyncToSync no longer captures the running event loop on instantiation. (#562)

    This resolves a series of deadlocks that users experienced after asgiref 3.9.0, particularly with pytest-asyncio. pytest-asyncio stops the event loop between tests, and long-running unawaited futures could find themselves trying to schedule work onto a stopped loop, and so would never complete. Ideally, code should be structured to await long-running futures before returning, but this change should help users experiencing issues here.

    The loop is now resolved when the callable is invoked rather than when it is created. If async_to_sync is called from within sync_to_async, the parent event loop is still used, as before.

    The possibility of deadlock therefore remains in some nested patterns. For example, an async function may call a long-running sync_to_async function that itself uses async_to_sync; if the outer function returns before the sync future completes, the parent event loop may already be stopped, and the nested calls cannot be driven to completion.

    This is not a bug in asgiref — the same patterns deadlock in plain asyncio. As above, restructure your code to await the sync_to_async future before exiting the driving coroutine.

  • Fixed an event loop deadlock when exiting ThreadSensitiveContext while its executor thread was still blocked waiting on the event loop. (#535)

  • Dropped support for EOL Python 3.9.

  • Fixed StatelessServer.run() failing on Python 3.14, where asyncio.get_event_loop() no longer creates an event loop if none exists. It now uses asyncio.run(). (#559)

  • Fixed Local leaking data between unrelated sync threads when sys.flags.thread_inherit_context is enabled (Python 3.14+), so a newly

... (truncated)

Commits
  • ef9d4b8 Releasing 3.12.1
  • 34fba63 Restore previous SyncToAsync.call internal code shape.
  • a43900c Separate mypy from tests extra.
  • 1b7c338 Releasing 3.12.0
  • 157d9d4 Renovate precommit (#552)
  • deda0d4 Test free-threading builds and fix Local data leak for thread_inherit_context...
  • a54250a Don’t capture the event loop in AsyncToSync.__init__ (#562)
  • 836356a Use asyncio.run in StatelessServer.run (#561)
  • e04afd5 Dropped support for Python 3.9. (#543)
  • 95d2430 Fixed #535: ThreadSensitiveContext.aexit blocking the event loop. (#563)
  • Additional commits viewable in compare view

Updates autobahn from 26.6.2 to 26.7.1

Release notes

Sourced from autobahn's releases.

Release v26_7_1

Official release v26_7_1

Included Platforms

  • Linux: x86_64, ARM64 (manylinux_2_34 wheels with NVX)
  • macOS: Apple Silicon ARM64 (binary wheels with NVX)
  • Windows: x86_64 (binary wheels with NVX)

Python Versions

  • CPython: 3.11, 3.12, 3.13, 3.14
  • PyPy: 3.11

Installation

pip install autobahn[all]==v26_7_1

Or download wheels directly from this release.

Build Information

  • Release Date: 2026-07-15 18:49:18 UTC
  • Total Wheels: 28
  • Source Distributions: 3

Features

Autobahn|Python provides:

  • WebSocket client and server implementations (RFC 6455)
  • WAMP client library for both Twisted and asyncio
  • NVX acceleration for high-performance networking (binary wheels)
  • Pure Python fallback wheels for maximum compatibility

Documentation

Development Build fork-ec23ef44-oberstet_autobahn_python-fix_1930-202607151609

Development build from pull request

Build Information

... (truncated)

Changelog

Sourced from autobahn's changelog.

26.7.1

Security

  • Fix WebSocket maxMessagePayloadSize being enforced against the compressed on-the-wire frame length instead of the uncompressed reassembled message size when permessage-compress (deflate/bzip2/snappy/brotli) is negotiated. A small compressed frame could inflate far beyond the configured limit and be delivered to the application (a decompression-bomb style denial-of-service; security advisory GHSA-hxp9-w8x3-p566, same class as CVE-2016-10544). The limit is now re-checked at the inflation site against the running uncompressed message size, and the connection is failed with close code 1009 (message too big) before delivery — for both the whole-message and streaming receive APIs and every compression backend. Behaviour change: a compressed message that inflates past maxMessagePayloadSize is now rejected where it previously passed; uncompressed traffic and the per-frame maxFramePayloadSize wire guard are unaffected (#1909)
  • Fix the permessage-deflate max_message_size receive cap silently truncating an over-limit message and raising a zlib error instead of cleanly rejecting it: the bounded decompress(…, max_length) left the remaining input in unconsumed_tail undrained, so the message was corrupted rather than reported. Decompression is now bounded cumulatively across frames and raises PayloadExceededError as soon as the uncompressed size would exceed the cap (#1908)
  • Make bounded decompression backend-agnostic: decompress_message_data() gains an optional max_output_len argument (documented on the PerMessageCompress base class) and every permessage-compress backend now honours it. deflate and bzip2 stop inflating once the limit is reached (native incremental cap); snappy and brotli, whose libraries expose no output-length argument, inflate the frame (already bounded on the wire by maxFramePayloadSize) and then reject — a weaker but still clean per-frame guarantee. The WebSocket receive path passes the remaining maxMessagePayloadSize budget so a compressed frame no longer expands unbounded into memory before the size check; the previous post-inflation check (#1909) remains as a backstop. Previously only deflate had any decompressed-output cap, so a snappy/bzip2/brotli frame could inflate fully into memory first (#1910)
  • Make the asyncio RawSocket receive size limit configurable, at parity with the Twisted backend. The asyncio WampRawSocketFactory now exposes setProtocolOptions(maxMessagePayloadSize=...) / resetProtocolOptions() (bounds [512, 2**24], default 16 MB), and the configured value drives both the advertised handshake length exponent and the enforced receive cap (rounded up to the next power of two), matching the Twisted factory. Previously the asyncio receive limit was hardwired to 16 MB (a dead max_size=None branch), so an asyncio WAMP peer could not tighten its RawSocket receive limit for DoS hardening and Crossbar's RawSocket max_message_size had no effect on the asyncio path (#1911)

FlatBuffers

  • Fix check_zlmdb_flatbuffers_version_in_sync() comparing the build-time version() (which is (0, 0, 0, None, None) on installed wheels, where the vendored FlatBuffers __git_version__ is unstamped) — it now compares the reliably-stamped __version__ and returns a version string. Added regression tests (#1891)
  • Make autobahn.flatbuffers.version() reliable on installed wheels: when the build-time __git_version__ is a bare commit hash or "unknown" (shallow clone / submodule absent from the sdist), version() now falls back to parsing the static vendored __version__ and returns (major, minor, patch, None, None) instead of (0, 0, 0, None, None); rich git describe detail is still returned on genuine dev/git builds. Also hardened hatch_build.py so it never stamps a non-parseable __git_version__. Return shape is unchanged (5-tuple); no API break (#1891)

Build & CI/CD

  • Add CalVer / PEP 440 version-management just recipes (file-version, bump-dev, bump-next, prep-release) mirroring Crossbar.io, and document the versioning policy in CONTRIBUTING.md (#1894)
  • Add ruff check --select ANN,UP,TCH (annotation presence, pyupgrade modern syntax, TYPE_CHECKING imports) to the just check-typing recipe so annotation/style regressions are caught in the quality-checks CI job. The existing gaps in src/autobahn/ are ratcheted via an explicit --ignore allowlist to be removed module-by-module (#1839); all other UP/TC rules are enforced immediately, and generated code is excluded. The annotation rules are scoped to this recipe via the command line rather than the global [tool.ruff.lint] select, so the repo-wide check-format gate is unaffected (#1840)
  • Fix the aarch64 CPython 3.14 wheel shipping the free-threaded ABI (cp314t) in the GIL cp314 slot (26.6.x). Root cause: manylinux images pre-install both the GIL and free-threaded 3.14 under /opt/python and prepend them to PATH, and uv resolved cpython-3.14 to the free-threaded interpreter (first on PATH). The create recipe now drops free-threaded …t/bin dirs from PATH for GIL envs so uv selects the GIL build. As defence-in-depth, just build also asserts (via _check-venv-abi) that the interpreter's GIL/free-threaded status matches the env and aborts on mismatch, so a wrong-ABI wheel can never be published. A reserved cpy314t env spec (cpython-3.14t) is added for a future free-threaded wheel variant (#1875)
  • Bump the .cicd (wamp-cicd) submodule to include exact CPython ABI-tag matching in the shared check-release-fileset release-gate action, so a wrong-ABI wheel (e.g. cp314t in the cp314 slot) is also rejected at release-fileset validation, not only by the build-time guard above (wamp-cicd #11, completes #1875)
  • Publish musllinux_1_2 (musl libc / Alpine Linux) binary wheels with NVX acceleration for CPython 3.11–3.14 on both x86_64 and aarch64. Previously pip install autobahn on Alpine fell back to a source build that failed (the clang-built python-build-standalone interpreter's sysconfig carries a --rtlib=compiler-rt flag that Alpine's gcc rejects), so Alpine users could not install autobahn at all; the prebuilt wheels make it "just work". Built inside the official PyPA musllinux_1_2 images (gcc toolchain), tagged automatically by auditwheel, and gated by the check-release-fileset targets. PyPy-on-musl is a tracked follow-up (no official PyPA musllinux PyPy image) (#1877)
Commits

Updates boto3 from 1.43.40 to 1.43.51

Commits
  • 09cf399 Merge branch 'release-1.43.51'
  • b8f600d Bumping version to 1.43.51
  • f0973ec Add changelog entries from botocore
  • a8ae7f0 Merge branch 'release-1.43.50'
  • acbe14c Merge branch 'release-1.43.50' into develop
  • b8c36a9 Bumping version to 1.43.50
  • fa19980 Add changelog entries from botocore
  • 2ce2fd5 Merge branch 'release-1.43.49'
  • d2937da Merge branch 'release-1.43.49' into develop
  • 159cb6a Bumping version to 1.43.49
  • Additional commits viewable in compare view

Updates botocore from 1.43.40 to 1.43.51

Commits

Updates cbor2 from 5.9.0 to 6.1.3

Release notes

Sourced from cbor2's releases.

6.1.3

  • Fixed the decoder registering 6-byte strings in the string reference namespace at indices 65536–4294967295 where the encoder does not, desynchronising the namespace and resolving later string references to the wrong value (#313; PR by @​sahvx655-wq)
  • Fixed the IPv4/IPv6 network decoders (tags 52 and 54) silently truncating an address byte string that is longer than the address size instead of rejecting it as malformed (#309; PR by @​sahvx655-wq)
  • Fixed quadratic decoding time for indefinite-length and large definite-length byte and text strings, caused by concatenating each chunk onto the accumulated result with + instead of building the result once (#316; PR by @​sahvx655-wq)
  • Fixed datetime_as_timestamp encoding whole-second datetimes before 1970 or after 2106 as floats instead of integers, because the timestamp was narrowed through an unsigned 32-bit integer (#317; PR by @​sahvx655-wq)
  • Fixed the encoder measuring text strings by code point count instead of UTF-8 byte length when deciding whether to add them to the string reference namespace, desynchronising it from the decoder (which counts bytes) and corrupting later string references for non-ASCII strings (#314; PR by @​sahvx655-wq)
  • Fixed the decoder rejecting scoped IPv6 addresses (tag 54) with a CBORDecodeError reading invalid types in input array; the encoder emits them as [address, null, zone id] but the decoder only handled the network and interface array forms, so a scoped ~ipaddress.IPv6Address could not be decoded back (#324; PR by @​sahvx655-wq)

6.1.2

  • Fixed incorrect tracking of string references for definite-length text strings of length greater than 65536 (#308; PR by @​sahvx655-wq)
  • Fixed cbor2.load() crash caused by incorrect handling of internal read buffer extension during stream deserialization. (#307; PR by @​noderyos)

6.1.1

  • Fixed cbor2.load() returning corrupted data for payloads exceeding 4096 bytes (#304)

6.1.0

  • Added the allow_duplicate_keys parameter to CBORDecoder, load and loads (default: True). When set to False, a CBORDecodeError is raised upon encountering a duplicate key within the same map. (#283)
  • Added support for decoding from any object supporting the buffer API (e.g. memoryview or bytearray) in addition to bytes (#297)
  • Fixed compatibility issues with 32-bit systems (#300)

6.0.1

  • Fixed an error in the mutability logic during decoding, leading to values being decoded as immutable in unexpected places (#295)

6.0.0

  • No changes since v6.0.0rc1

6.0.0rc1

  • MAJOR REWRITE: The Python and C implementations of the encoder and decoder were replaced with a single, Rust-based implementation in the interest of maintainability.

    Here are some of the highlights:

    • Improved memory safety (100% safe-mode Rust)
    • Complete elimination of reference leaks
    • Support for free-threading and subinterpreters
    • Substantially improved performance
    • Improved decoder error handling where any non-base exception gets wrapped in a CBORDecodeError
    • Iterative, rather than recursive decoding, meaning the container nesting depth is limited only by the available memory, rather than the C stack size

  • BACKWARD INCOMPATIBLE Changed the signature of the tag_hook decoder callables to accept (CBORTag, immutable as arguments instead of CBORDecoder, CBORTag)

  • BACKWARD INCOMPATIBLE Changed the signature of the object_hook decoder callables to accept (Mapping[Any, Any], bool) instead of (CBORDecoder, dict[Any, Any])

  • BACKWARD INCOMPATIBLE Removed the break_marker singleton as no longer necessary

  • BACKWARD INCOMPATIBLE Removed the CBORDecodeValueError exception, instead chaining ValueError or TypeError to a CBORDecodeError

  • BACKWARD INCOMPATIBLE Changed the decoding of semantic tag 261 to yield an IPv4Interface or IPv6Interface if the address contains host bits

  • BACKWARD INCOMPATIBLE Removed the individual decoding functions from the API as they were mistakenly called directly by users. Please open an issue if you need them back.

... (truncated)

Commits
  • 5820bd4 Bumped up the version
  • 8bb0466 Bump the github-actions group with 2 updates (#323)
  • 00e3dea Decode scoped IPv6 addresses instead of rejecting them (#324)
  • aeff00b Measure text strings by byte length in maybe_stringref (#314)
  • 1c827f1 Encode whole-second datetime timestamps as integers across full range (#317)
  • 791172c Worked around coveralls not working with Homebrew 6
  • 32f66ee [pre-commit.ci] pre-commit autoupdate (#322)
  • 1d5054e Switched to quarterly pre-commit updates
  • c348bbf [pre-commit.ci] pre-commit autoupdate (#319)
  • 6625bc1 Optimized bytestring and text string decoding (#316)
  • Additional commits viewable in compare view

Updates coverage from 7.15.0 to 7.15.2

Release notes

Sourced from coverage's releases.

7.15.2

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

➡️  PyPI page: coverage 7.15.2. :arrow_right:  To install: python3 -m pip install coverage==7.15.2

7.15.1

Version 7.15.1 — 2026-07-12

  • Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare.
  • A number of performance improvements thanks to Paul Kehrer, in pull requests 2213, 2214, 2215, 2216, 2218, 2220, and 2221.

➡️  PyPI page: coverage 7.15.1. :arrow_right:  To install: python3 -m pip install coverage==7.15.1

Changelog

Sourced from coverage's changelog.

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: coveragepy/coveragepy#2229

.. _changes_7-15-1:

Version 7.15.1 — 2026-07-12

  • Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.

  • A number of performance improvements thanks to Paul Kehrer, in pull requests 2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: coveragepy/coveragepy#2213 .. _pull 2214: coveragepy/coveragepy#2214 .. _pull 2215: coveragepy/coveragepy#2215 .. _pull 2216: coveragepy/coveragepy#2216 .. _pull 2218: coveragepy/coveragepy#2218 .. _pull 2220: coveragepy/coveragepy#2220 .. _pull 2221: coveragepy/coveragepy#2221 .. _pull 2224: coveragepy/coveragepy#2224

.. _changes_7-15-0:

Commits
  • 50d8659 docs: sample HTML for 7.15.2
  • b5eed20 docs: prep for 7.15.2
  • 78cab6e fix: reduce memory use during reporting. #2229 (#2231)
  • b4c1fda build: bump version to 7.15.2
  • da63bed docs: sample HTML for 7.15.1
  • bc35e64 docs: prep for 7.15.1
  • 182b010 perf: resolve sysmon branch events lazily, one pair at a time (#2221)
  • ee271ee perf: compute multiline maps cheaply in the sysmon core (#2220)
  • 1441b96 chore: bump the action-dependencies group with 6 updates (#2225)
  • dd80635 fix: escape context labels in html report inline script block (#2224)
  • Additional commits viewable in compare view

Updates django-stubs-ext from 6.0.6 to 6.0.7

Commits

Updates django-stubs from 6.0.6 to 6.0.7

Commits

Updates django-unfold from 0.99.1 to 0.101.0

Release notes

Sourced from django-unfold's releases.

0.101.0

v0.101.0 (2026-07-17)

This release is published under the MIT License.

Bug Fixes

Features

Detailed Changes: 0.100.0...0.101.0

0.100.0

v0.100.0 (2026-07-06)

This release is published under the MIT License.

Bug Fixes

Documentation

... (truncated)

Changelog

Sourced from django-unfold's changelog.

v0.101.0 (2026-07-17)

Bug Fixes

Features

v0.100.0 (2026-07-06)

Bug Fixes

... (truncated)

Commits

Updates django from 6.0.6 to 6.0.7

Commits
  • e2a4246 [6.0.x] Bumped version for 6.0.7 release.
  • a5de13f [6.0.x] Fixed CVE-2026-53878 -- Prevented newlines from being accepted in Dom...
  • 38dfbd2 [6.0.x] Fixed CVE-2026-53877 -- Prevented heap buffer over-read when creating...
  • 64f9a2b [6.0.x] Fixed CVE-2026-48588 -- Prevented caching of responses that set cooki...
  • c26957a [6.0.x] Fixed flatpages synopsis in docs.
  • 0b60f44 [6.0.x] Added FILE_UPLOAD_DIRECTORY_PERMISSIONS to docs settings index.
  • d928e30 [6.0.x] Fixed #37172 -- Linked to upload handlers section in FILE_UPLOAD_* se...
  • e18935c [6.0.x] Fixed #37158 -- Reordered the contribution checklist sections.
  • 490eb9c [6.0.x] Fixed document referenced in multiple toctrees warning in docs/intern...
  • 748a9b5 [6.0.x] Fixed duplicate target name in docs/internals/howto-release-django.txt.
  • Additional commits viewable in compare view

Updates djlint from 1.40.2 to 1.41.0

Release notes

Sourced from djlint's releases.

v1.41.0

Feature

  • New rule T038: block template tags with no matching end tag are now reported: {% if %} without {% endif %}, handlebars {{#if}} without {{/if}}, end tags with no opening tag, and crossed blocks like {% if %}{% for %}{% endif %}. Tags from custom_blocks are checked too; {% block %}/{% endblock %} pairs stay covered by T003.
  • New rule T039: template tags that never reach their closing delimiter are now reported, e.g. {% url 'x" user.url }} (closed by }} instead of %}), {{ user.name } (missing a brace), or a tag cut off by the next tag or the end of the file. Complements T027 (unclosed string in a complete tag) and T034 (}% typo), which keep reporting their own cases.
  • New --rules FILE CLI option: load a custom rules file in .djlint_rules.yaml format from any path, instead of only next to pyproject.toml.

Changed

  • The formatter now condenses runs of extra whitespace inside single-line template tags to a single space, e.g. {% if abc == 101 %} becomes {% if abc == 101 %}. This fixes what rule T032 reports, so the linter and formatter no longer conflict. Whitespace inside string literals is preserved, including strings with backslash-escaped quotes; multiline tags, ignored blocks, the literal contents of {% verbatim %}/{% raw %} and the handlebars/golang profiles are untouched.
  • The default exclude list is now tailored to djLint instead of copying ruff/black. Added directories that hold generated or third-party HTML: htmlcov (coverage.py reports), site-packages (installed packages' templates such as Django admin and DRF, matched in any virtualenv layout) and _site (Jekyll/Eleventy output). Removed Python tool caches and editor config that never contain HTML: .ipynb_checkpoints, .mypy_cache, .pytest_cache, .pytype, .ruff_cache, .pants.d, .vscode and buck-out.

Fix

Formatter indentation:

  • Closing a template block now restores the indentation of its opening tag, so HTML tags left unclosed inside the block (e.g. a wrapper <div> rendered by {% if %}...{% endif %} and closed by a later conditional) no longer shift the indentation of everything after it. When every branch of an {% if %}/{% elif %}/{% else %} shifts the depth equally, e.g. a <tr> opened in both branches, the shift is kept after {% endif %}.
  • Template tags and expressions spanning multiple lines keep the relative indentation of their contents instead of flattening every line to the tag's level. Nested objects and arrays in e.g. {% story ... with { ... } %}, {% include ... with { ... } %} and non-JSON {{ func(...) }} calls are now indented by bracket depth.
  • {% endtrans %} (Jinja/Twig block {% trans %}) no longer decreases the indentation level, which shifted the {% endtrans %} line and everything after it one level to the left.
  • Multiline {% set %} objects nested inside HTML elements are no longer over-indented in proportion to their nesting depth.
  • Self-closing custom block tags (django-components syntax, e.g. {% component "calendar" date="2015-06-19" / %} with custom_blocks = "component") no longer indent the lines that follow them as if a block had been opened.

Formatter line breaks and spacing:

  • A single-line block-form {% set x %}...{% endset %} is no longer expanded onto multiple lines. The block captures its content verbatim, so the added whitespace changed the value of the variable. Authored multi-line set blocks are still indented as before.
  • In multi-line {{ ... }} function calls, a call passed as an argument no longer causes a stray space before the following comma, and the arguments after it keep the same indentation as the other arguments.
  • blank_line_after_tag no longer inserts a blank line when the next line closes a block and decreases the indentation, e.g. between {% endblock %} and </div>.
  • blank_line_before_tag now inserts the blank line above a comment directly preceding the tag, keeping the comment attached to the tag it documents.

Linter:

  • H020 no longer reports <slot></slot>: an empty slot element is the standard way to declare a default slot outlet.
  • H025 no longer reports a tag as an orphan when the same tag is opened in each branch of an {% if %}/{% else %} and closed once outside it (and vice versa for close tags), since only one branch renders.
  • H025 now reports mis-nested tags whose close tag crosses another open tag, e.g. <b> in <h1>blah <b>bold</h1>.
  • T003 no longer requires an endblock name when {% endblock %} is on the same line as its {% block ... %}, e.g. {% block title %}{% endblock %}. The formatter keeps such blocks on one line, so the linter and formatter no longer conflict.
  • Linter rules no longer report errors for the literal contents of {% verbatim %}...{% endverbatim %} blocks, matching th...

    Description has been truncated

@dependabot
Bump the python-dependencies group across 1 directory with 31 updates
16b04de 
Updates the requirements on [asgiref](https://github.com/django/asgiref), [autobahn](https://github.com/crossbario/autobahn-python), [boto3](https://github.com/boto/boto3), [botocore](https://github.com/boto/botocore), [cbor2](https://github.com/agronholm/cbor2), [coverage](https://github.com/coveragepy/coveragepy), [django-stubs-ext](https://github.com/typeddjango/django-stubs), [django-stubs](https://github.com/typeddjango/django-stubs), [django-unfold](https://github.com/unfoldadmin/django-unfold), [django](https://github.com/django/django), [djlint](https://github.com/djlint/djLint), [langchain-core](https://github.com/langchain-ai/langchain), [langgraph](https://github.com/langchain-ai/langgraph), [langsmith](https://github.com/langchain-ai/langsmith-sdk), [librt](https://github.com/mypyc/librt), [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python), [opentelemetry-exporter-otlp-proto-http](https://github.com/open-telemetry/opentelemetry-python), [opentelemetry-instrumentation-django](https://github.com/open-telemetry/opentelemetry-python-contrib), [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python), [pyasn1](https://github.com/pyasn1/pyasn1), [pylint-django](https://github.com/pylint-dev/pylint-django), [pyopenssl](https://github.com/pyca/pyopenssl), [ruff](https://github.com/astral-sh/ruff), [s3transfer](https://github.com/boto/s3transfer), [service-identity](https://github.com/pyca/service-identity), [svix](https://github.com/svix/svix-webhooks), [types-psycopg2](https://github.com/python/typeshed), [types-python-dateutil](https://github.com/python/typeshed), [types-requests](https://github.com/python/typeshed), [uuid-utils](https://github.com/aminalaee/uuid-utils) and [xxhash](https://github.com/ifduyue/python-xxhash) to permit the latest version.

Updates `asgiref` from 3.11.1 to 3.12.1
- [Changelog](https://github.com/django/asgiref/blob/main/CHANGELOG.txt)
- [Commits](django/asgiref@3.11.1...3.12.1)

Updates `autobahn` from 26.6.2 to 26.7.1
- [Release notes](https://github.com/crossbario/autobahn-python/releases)
- [Changelog](https://github.com/crossbario/autobahn-python/blob/master/docs/changelog.rst)
- [Commits](crossbario/autobahn-python@v26.6.2...v26.7.1)

Updates `boto3` from 1.43.40 to 1.43.51
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.40...1.43.51)

Updates `botocore` from 1.43.40 to 1.43.51
- [Commits](boto/botocore@1.43.40...1.43.51)

Updates `cbor2` from 5.9.0 to 6.1.3
- [Release notes](https://github.com/agronholm/cbor2/releases)
- [Commits](agronholm/cbor2@5.9.0...6.1.3)

Updates `coverage` from 7.15.0 to 7.15.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.0...7.15.2)

Updates `django-stubs-ext` from 6.0.6 to 6.0.7
- [Release notes](https://github.com/typeddjango/django-stubs/releases)
- [Commits](typeddjango/django-stubs@6.0.6...6.0.7)

Updates `django-stubs` from 6.0.6 to 6.0.7
- [Release notes](https://github.com/typeddjango/django-stubs/releases)
- [Commits](typeddjango/django-stubs@6.0.6...6.0.7)

Updates `django-unfold` from 0.99.1 to 0.101.0
- [Release notes](https://github.com/unfoldadmin/django-unfold/releases)
- [Changelog](https://github.com/unfoldadmin/django-unfold/blob/main/CHANGELOG.md)
- [Commits](unfoldadmin/django-unfold@0.99.1...0.101.0)

Updates `django` from 6.0.6 to 6.0.7
- [Commits](django/django@6.0.6...6.0.7)

Updates `djlint` from 1.40.2 to 1.41.0
- [Release notes](https://github.com/djlint/djLint/releases)
- [Changelog](https://github.com/djlint/djLint/blob/master/CHANGELOG.md)
- [Commits](djlint/djLint@v1.40.2...v1.41.0)

Updates `langchain-core` from 1.4.8 to 1.4.9
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-core==1.4.8...langchain-core==1.4.9)

Updates `langgraph` from 1.2.7 to 1.2.9
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](langchain-ai/langgraph@1.2.7...1.2.9)

Updates `langsmith` from 0.9.7 to 0.10.7
- [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases)
- [Commits](langchain-ai/langsmith-sdk@v0.9.7...v0.10.7)

Updates `librt` from 0.12.0 to 0.13.0
- [Commits](mypyc/librt@v0.12.0...v0.13.0)

Updates `opentelemetry-api` to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.43.0...v1.44.0)

Updates `opentelemetry-exporter-otlp-proto-http` to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.43.0...v1.44.0)

Updates `opentelemetry-instrumentation-django` to 0.65b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-sdk` to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.43.0...v1.44.0)

Updates `pyasn1` from 0.6.3 to 0.6.4
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4)

Updates `pylint-django` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/pylint-dev/pylint-django/releases)
- [Changelog](https://github.com/pylint-dev/pylint-django/blob/master/CHANGELOG.rst)
- [Commits](pylint-dev/pylint-django@v2.7.0...v2.8.0)

Updates `pyopenssl` from 26.2.0 to 26.3.0
- [Changelog](https://github.com/pyca/pyopenssl/blob/main/CHANGELOG.rst)
- [Commits](pyca/pyopenssl@26.2.0...26.3.0)

Updates `ruff` from 0.15.20 to 0.15.22
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.15.22)

Updates `s3transfer` from 0.19.0 to 0.19.1
- [Changelog](https://github.com/boto/s3transfer/blob/develop/CHANGELOG.rst)
- [Commits](boto/s3transfer@0.19.0...0.19.1)

Updates `service-identity` from 24.2.0 to 26.1.0
- [Release notes](https://github.com/pyca/service-identity/releases)
- [Changelog](https://github.com/pyca/service-identity/blob/main/CHANGELOG.md)
- [Commits](pyca/service-identity@24.2.0...26.1.0)

Updates `svix` from 1.96.1 to 1.98.0
- [Release notes](https://github.com/svix/svix-webhooks/releases)
- [Changelog](https://github.com/svix/svix-webhooks/blob/main/ChangeLog.md)
- [Commits](svix/svix-webhooks@v1.96.1...v1.98.0)

Updates `types-psycopg2` from 2.9.21.20260518 to 2.9.21.20260712
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-python-dateutil` from 2.9.0.20260518 to 2.9.0.20260716
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-requests` from 2.33.0.20260518 to 2.33.0.20260712
- [Commits](https://github.com/python/typeshed/commits)

Updates `uuid-utils` from 0.16.2 to 0.17.0
- [Release notes](https://github.com/aminalaee/uuid-utils/releases)
- [Commits](aminalaee/uuid-utils@0.16.2...0.17.0)

Updates `xxhash` from 3.8.0 to 3.8.1
- [Release notes](https://github.com/ifduyue/python-xxhash/releases)
- [Changelog](https://github.com/ifduyue/python-xxhash/blob/master/CHANGELOG.rst)
- [Commits](ifduyue/python-xxhash@v3.8.0...v3.8.1)

---
updated-dependencies:
- dependency-name: asgiref
  dependency-version: 3.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: autobahn
  dependency-version: 26.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: boto3
  dependency-version: 1.43.51
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: botocore
  dependency-version: 1.43.51
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: cbor2
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-dependencies
- dependency-name: coverage
  dependency-version: 7.15.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: django-stubs-ext
  dependency-version: 6.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: django-stubs
  dependency-version: 6.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: django-unfold
  dependency-version: 0.101.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: django
  dependency-version: 6.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: djlint
  dependency-version: 1.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: langchain-core
  dependency-version: 1.4.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: langgraph
  dependency-version: 1.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: langsmith
  dependency-version: 0.10.7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: librt
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: opentelemetry-api
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: python-dependencies
- dependency-name: opentelemetry-exporter-otlp-proto-http
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: python-dependencies
- dependency-name: opentelemetry-instrumentation-django
  dependency-version: 0.65b0
  dependency-type: direct:production
  dependency-group: python-dependencies
- dependency-name: opentelemetry-sdk
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: python-dependencies
- dependency-name: pyasn1
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pylint-django
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: pyopenssl
  dependency-version: 26.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: ruff
  dependency-version: 0.15.22
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: s3transfer
  dependency-version: 0.19.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: service-identity
  dependency-version: 26.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-dependencies
- dependency-name: svix
  dependency-version: 1.98.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: types-psycopg2
  dependency-version: 2.9.21.20260712
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: types-python-dateutil
  dependency-version: 2.9.0.20260716
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: types-requests
  dependency-version: 2.33.0.20260712
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: uuid-utils
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: xxhash
  dependency-version: 3.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 20, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 27, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 27, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/python-dependencies-c0cb30a0b4 branch July 27, 2026 17:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants