Skip to content

build(deps): bump the python group across 1 directory with 11 updates - #12

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-da3210abdd
Open

build(deps): bump the python group across 1 directory with 11 updates#12
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-da3210abdd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 24, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on av, django, django-health-check, django-tailwind-cli, djangorestframework, drf-spectacular-sidecar, gunicorn, pillow, psycopg, pydantic and ruff to permit the latest version.
Updates av to 19.0.2

Release notes

Sourced from av's releases.

v19.0.2

What's Changed

New Contributors

Full Changelog: PyAV-Org/PyAV@v19.0.1...v19.0.2

Changelog

Sourced from av's changelog.

v19.0.2

Fixes:

  • Audio encoding now correctly passes the codec's thread_count to its internal :class:.AudioResampler, which takes a new threads argument, as video encoding does for its reformatter. Audio codecs without threading (e.g. MP3) resolve thread_count to 1, but the resampler ignored it and started an idle thread per CPU. By :gh-user:tonyay163.
  • Output containers now pass their options to avio_open2() before avformat_write_header(), as the ffmpeg program does, so protocol options are used by the protocol. By :gh-user:ANDYwyLEE.
  • Fix memory corruption bug when decoding audio with custom channel layouts: :class:.AudioLayout, :class:.AudioFrame, and :class:.AudioCodecContext shallow-copied channel layouts, so custom-order layouts (e.g. "FR+FL") were double freed. Fixes (:issue:2444) by :gh-user:WyattBlue.

v19.0.1

Fixes:

  • Reading :attr:.Frame.side_data no longer holds the frame in a reference cycle, which kept its picture buffer alive until gc ran. By :gh-user:WyattBlue.
  • :class:.MotionVectors no longer memoizes the vectors it hands out, a cache that never evicted and put every one of them in a reference cycle with the side data, retaining 1640 objects for a single 640x360 frame. By :gh-user:WyattBlue.
  • :attr:.Stream.index_entries is now a view built on access rather than an object allocated for every stream whether or not anything reads it, which also takes the stream out of a reference cycle with it. Fixes (:issue:2425) by :gh-user:WyattBlue.
  • :class:.Filter and :class:.FilterContext pads are now built on access rather than cached, which takes a filter out of a reference cycle with its pads and makes a pad compare equal by what it denotes. By :gh-user:WyattBlue.

v19.0.0

Major:

  • Drop support for Python 3.11. Binary wheels are now built for Python 3.12 and later.
  • Remove the undocumented CodecContext.hwaccel attribute. It held the HWAccel settings object passed in, not the live device context; use CodecContext.is_hwaccel to check whether hardware acceleration is in use.
  • Rational attributes (time_base, average_rate, base_rate, guessed_rate, framerate, rate, sample_aspect_ratio, and display_aspect_ratio) now return :class:av.AVRational rather than fractions.Fraction, and are never None: an unset value is the falsy AVRational(0, 1). Test them with if not stream.time_base: instead of is None. Setters still accept a fractions.Fraction.
  • Closing an :class:.OutputContainer now frees its context, so using one afterwards raises Container is not open instead of continuing against a finished file. Muxing has no avformat_close_input() to do this for it, so add_stream(), mux(), start_encoding() and the rest kept working after close(), and streams held from it stayed readable.
  • Remove Capabilities.hwaccel, Capabilities.hwaccel_vdpau, and Capabilities.neg_linesizes, none of which FFmpeg defines any more.
  • Remove the metadata_encoding and metadata_errors arguments to :func:av.open, and the matching attributes. Metadata is now always read and written as UTF-8 with surrogateescape, which is byte exact: a tag in another encoding survives as surrogates and is recovered per key with value.encode("utf-8", "surrogateescape").decode("cp1251"). Previously one encoding had to be chosen for a whole container, so a file mixing encodings across tags could not be represented at all.
  • Remove the stream_options argument to :func:av.open and the matching attribute. They only ever reached avformat_find_stream_info(), and only for formats that expose their streams before it runs, so they raised for MPEG and friends; output containers rejected them outright. Pass options for every stream, set stream.codec_context.options for one, and Container.add_stream(..., options={}) when writing.

Features:

  • av.dump_codecs() now lists every codec FFmpeg knows of rather than only those with an encoder or a decoder, so data and attachment codecs appear, matching ffmpeg -codecs. Its legend gains the ..D... and ..T... media types.
  • ContainerFormat.fixed_framesize reports whether a format wants fixed size audio frames.
  • :class:.CodecContext exposes more of AVCodecContext: pkt_timebase, frame_num, active_thread_type, bits_per_raw_sample, compression_level, rc_buffer_size, min_bit_rate, a setter for max_bit_rate, the audio initial_padding, trailing_padding, and seek_preroll, and stats_in/stats_out for two-pass encoding. VideoCodecContext gains chroma_sample_location, refs, and mb_decision; AudioCodecContext gains block_align.
  • CodecContext.coded_side_data and CodecContext.decoded_side_data expose the context's global side data as dicts of bytes, keyed by packet side data name and :class:~av.sidedata.sidedata.Type respectively. Stream wide HDR metadata, such as mastering display and content light level, arrives in decoded_side_data once a frame has been decoded.
  • VideoFrame.chroma_location exposes AVFrame.chroma_location, the position of the chroma samples relative to the luma samples, and the new ChromaLocation enum names its values. Only the codec context side of the field was wrapped, as VideoCodecContext.chroma_sample_location, so the siting a decoder actually reported per frame could not be read at all. Each property mirrors its C field name, which FFmpeg spells differently on the two structs.
  • Enums gained the members FFmpeg has since added: Properties.FIELDS, Properties.ENHANCEMENT, PixFmtLoss.EXCESS_RESOLUTION, PixFmtLoss.EXCESS_DEPTH, Flags2.icc_profiles, format.Flags.experimental, Interpolation.STRICT, Interpolation.UNSTABLE, ColorTrc.V_LOG, ColorPrimaries.V_GAMUT, the LCEVC, VIEW_ID, THREE_D_REFERENCE_DISPLAYS, and EXIF members of sidedata.Type, and the exif, dynamic_hdr_smpte_2094_app5, and hevc_conf packet side data names.

Fixes:

  • Frame.side_data and PacketSideData.data_type no longer raise on side data types FFmpeg has added since PyAV last listed them. The packet side data names were missing three, so reading, say, the AV_PKT_DATA_HEVC_CONF an HEVC stream in MP4 or Matroska carries raised IndexError. A frame side data type that no sidedata.Type member names, which is anything a newer FFmpeg than PyAV was built against added, now becomes an UNKNOWN_<value> member rather than raising ValueError.
  • CodecContext.bit_rate_tolerance returns its value instead of always None; the getter was missing its return.
  • A rejected add_stream() or add_mux_stream() no longer breaks the container.
  • InputContainer.size returns None when the size cannot be determined rather than the negative AVERROR it was passing through, which read as a plausible byte count. A non-seekable input, such as a pipe, reported -78.
  • av.dump_codecs() no longer drops the canonical names h264, hevc, av1, dirac, and ilbc, each of which was overwritten by the row of whichever encoder it resolved to.

... (truncated)

Commits
  • a4ad013 Release 19.0.2
  • 5e489d6 Deep copy AVChannelLayout to fix double free, fixes #2444
  • 78f906b Pass output options so protocol uses them
  • e15e4b3 Update hwcontext_cuda definitions
  • 333bc1d Pass thread_count to the audio encode resampler
  • ae38dc3 Bump to next dev version
  • 85fcb47 Move macOS CI off deprecated macos-14 runners
  • 52e6691 Release 19.0.1
  • 9093605 Update readme
  • bcc95ff Build filter pads on access instead of caching them
  • Additional commits viewable in compare view

Updates django to 6.1.2

Commits

Updates django-health-check to 4.10.0

Release notes

Sourced from django-health-check's releases.

4.10.0

What's Changed

Full Changelog: codingjoe/django-health-check@4.9.0...4.10.0

Commits
  • eedc7bc Isolate a raising check override from the health check report (#802)
  • f5c3166 Use Codecov OIDC authentication
  • 9b8b827 Update supported Python versions (#800)
  • 03760af [pre-commit.ci] pre-commit autoupdate (#799)
  • 0d17159 Fix #747 -- Log failed health checks at warning level (#796)
  • 0fa2a29 Add PyPI status check (#793)
  • 0984937 Add npm status page check (#794)
  • 0b93c39 Bound every check probe by its own timeout (#789)
  • aec2712 Choose static defaults and update docs w/ more specific instructions (#787)
  • 9576ac7 Fix #779 -- Redact RabbitMQ broker credentials from repr, labels and logs (#786)
  • Additional commits viewable in compare view

Updates django-tailwind-cli to 4.8.1

Release notes

Sourced from django-tailwind-cli's releases.

v4.8.1

🐛 Bug Fixes

  • tailwind build always rebuilds every stylesheet. Template changes, imported CSS and build options could previously leave stale output because only the source CSS timestamp was checked. --force remains accepted for compatibility but is no longer needed. The build step in tailwind setup also always runs.
  • {% tailwind_css %} resolves only stylesheet paths. Rendering no longer looks up Tailwind releases or searches for a CLI binary, so serving prebuilt CSS does not require a Tailwind installation. CSS configuration errors are still reported; CLI settings are validated by management commands.
  • Failed CLI downloads leave an existing binary intact. Downloads are staged on the destination filesystem and replace the binary only after a successful transfer. A mismatch with the advertised Content-Length now fails instead of installing an incomplete file; responses without that header remain supported.

📚 Documentation

  • Clarified contribution expectations around focused submissions, actionable reports, contributor responsibility and variable review times.
  • Reorganized the README into a working quickstart, the installation guide into setup and optional integrations, and the workflow guide into recurring tasks and troubleshooting.
  • Source detection guidance corrected: Tailwind scans automatically by default; @source adds paths. Documentation and command guides now explain when to add external sources and how source(none) limits scanning to explicit sources.
Changelog

Sourced from django-tailwind-cli's changelog.

4.8.1 (2026-09-18)

🐛 Bug Fixes

  • tailwind build always rebuilds every stylesheet. Template changes, imported CSS and build options could previously leave stale output because only the source CSS timestamp was checked. --force remains accepted for compatibility but is no longer needed. The build step in tailwind setup also always runs.
  • {% tailwind_css %} resolves only stylesheet paths. Rendering no longer looks up Tailwind releases or searches for a CLI binary, so serving prebuilt CSS does not require a Tailwind installation. CSS configuration errors are still reported; CLI settings are validated by management commands.
  • Failed CLI downloads leave an existing binary intact. Downloads are staged on the destination filesystem and replace the binary only after a successful transfer. A mismatch with the advertised Content-Length now fails instead of installing an incomplete file; responses without that header remain supported.

📚 Documentation

  • Clarified contribution expectations around focused submissions, actionable reports, contributor responsibility and variable review times.
  • Reorganized the README into a working quickstart, the installation guide into setup and optional integrations, and the workflow guide into recurring tasks and troubleshooting.
  • Source detection guidance corrected: Tailwind scans automatically by default; @source adds paths. Documentation and command guides now explain when to add external sources and how source(none) limits scanning to explicit sources.

4.8.0 (2026-08-30)

💥 Dependencies

  • django-typer replaced by django-click, which drops typer from the dependency tree entirely. django-typer caps typer<0.26.0, click<8.5 and django<6.2; django-click requires only click>=7.1 with no upper bound, so those caps no longer reach into your environment. The nine subcommands, their options and the runserver passthrough are unchanged, call_command still accepts options both as keywords and as strings, and CommandError still reaches a programmatic caller. Help text is now rendered by click rather than by typer's markdown mode, so backticks in --help appear literally.
  • call_command("tailwind", ..., verbosity=0) no longer raises TypeError. Django's own command options were rejected by the command group, which made the command unusable from a script that passes them — as deploy scripts and other packages' test suites routinely do. stdout and stderr are honoured rather than merely accepted, so a caller can capture the output.
  • An option meant for another subcommand is refused instead of ignored. call_command("tailwind", "config", verbose=True) used to run and do nothing with verbose; it now raises TypeError, as Django does for an option a command does not have.
  • --skip-checks and --force-color work again, on the group and on every subcommand, as they do for any other Django management command.
  • manage.py tailwind with no subcommand exits 2 rather than 1, click's code for a usage error. It still prints the help text.
  • manage.py tailwind --version reports this package's version, not Django's.

🎯 New Features

  • A source CSS inside STATICFILES_DIRS is reported by the system check django_tailwind_cli.W001 instead of failing on deploy. Such a file is collected by collectstatic, and a manifest storage backend then cannot resolve the @import "tailwindcss"; it contains. It stays a warning, not an error — without a manifest backend the file is merely published alongside the build output — and SILENCED_SYSTEM_CHECKS turns it off.
  • Hand edits to the managed source.css no longer vanish silently: the command says what it is about to replace, keeps your version as source.css.bak, and points at TAILWIND_CLI_SRC_CSS as the way to own the file. Toggling DaisyUI or a changed set of auto-@sourced apps does not trip it — only content this library could not have written does.

🐛 Bug Fixes

  • TAILWIND_CLI_CSS_MAP works end to end: the source CSS was written for the first entry only and tailwind setup built only that one, so a multi-entry project came out of setup with one stylesheet and the next build failed on the missing second input. Both iterate every entry now.
  • Two TAILWIND_CLI_CSS_MAP entries writing one output file are rejected instead of quietly building only one of them: the first build wrote the file, the freshness check then found the second entry up to date, and it was reported as built without ever having run. Different spellings of the same path (./out.css next to out.css) count as the same destination.
  • A missing setting reads as a configuration error, not an unexpected one: get_config raises ConfigurationError now, so STATICFILES_DIRS is empty arrives with the STATICFILES_DIRS = [BASE_DIR / 'assets'] hint and one line of output instead of ❌ Unexpected error and a traceback. It subclasses ValueError, so code calling get_config() directly and catching one is unaffected. Through a management command it arrives as a CommandError, as every other command failure does.
  • tailwind setup uses the same code as tailwind build: it wrote the source CSS and ran the first build with its own copies, so it ignored TAILWIND_CLI_AUTO_SOURCE_EXTERNAL_APPS and TAILWIND_CLI_AUTOMATIC_MINIFY, never wrote the managed directory's .gitignore, ran the build from the shell's working directory rather than BASE_DIR, and exited 0 after reporting that the build had failed. In exchange it now brings an existing source.css to the state a build expects rather than leaving it alone — announced, and with a .css.bak.
  • An @source line you added yourself is no longer deleted in silence: the check for "did we write this file" accepted any @source directive as its own, so widening template discovery by hand in the managed source.css lost the line on the next build, with no warning and no backup. Position decides now — the library only ever writes @source below its own generated comment.
  • Command errors are reported the way they were meant to be: the error decorator sat above @app.command, so typer registered the undecorated function and none of it ever ran. A failing command showed a bare traceback instead of the message and the suggested fix. It now prints the hint to stderr and lets the failure continue: a user error as a CommandError, which Django renders and a caller using call_command can catch, and a bug with its traceback intact. A failing Tailwind build called sys.exit and bypassed all of this; it raises now too.
  • A TAILWIND_CLI_PATH pointing straight at a binary no longer ignores TAILWIND_CLI_VERSION: that filename carries no version, so a bump used to reuse the old binary in silence. build, watch and runserver read the version from the binary now and warn on a mismatch rather than replacing a file you placed there. A managed download is unaffected: its version is in its filename. download_cli still replaces a binary you supplied — that is what it was asked to do — but names the file first.
  • A CLI binary that appears mid-process is seen again: an existence check was cached for five seconds behind a module-level dict, so with TAILWIND_CLI_AUTOMATIC_DOWNLOAD = False a build right after placing the binary still reported it missing. The cache served one call site and is gone.
  • tailwind runserver says when there is no manage.py at BASE_DIR instead of starting both subprocesses and reporting that the server is up, only for it to die a moment later with a bare exit code. Layouts that keep manage.py elsewhere are pointed at running the two halves separately.
  • TAILWIND_CLI_SRC_CSS expands a leading ~, as TAILWIND_CLI_PATH already did. It used to become a directory named ~ below BASE_DIR. TAILWIND_CLI_CSS_MAP sources go through the same resolution now.
  • A prefixed STATICFILES_DIRS entry may be a list, not only a tuple. Django's own FileSystemFinder accepts both; STATICFILES_DIRS[0] in list form raised a TypeError before reaching any Tailwind code.
  • The HTTP layer closes the error it catches. urllib's HTTPError is the response object and owns an open file handle — one it allocates itself when the server sent no body. All three places that wrapped it kept it alive through the exception chain without closing it, which Python 3.14 reports as ResourceWarning: Implicitly cleaning up <HTTPError ...> on a failed download or version lookup.

🛠️ Developer Experience

  • CI builds the docs with warnings as errors: Sphinx reports a missing reference or an unresolvable include as a warning and publishes anyway, so a plain build would pass on exactly the failures worth catching. mise run build-docs runs the same check locally.
  • One download stub for the whole suite: tests/helpers.py holds write_fake_cli, replacing 29 copies of the same fixture across four test modules. Net −290 lines.
  • Coverage has a floor: the suite fails below 90%, and branch coverage is on, so both sides of a condition count. A coverage job in CI enforces it — the tox matrix runs pytest without --cov, so the floor would otherwise have been a local convention.
  • TestPyPI is a gate for the PyPI release again: publish-to-pypi waits for publish-to-testpypi instead of running beside it, so a broken artifact fails somewhere reversible first. The TestPyPI step already sets skip-existing, so a re-run does not block on an already-published version.
  • Shared test fixtures moved into tests/conftest.py: bypass_autoreload and fake_project_settings replace four copies of the autoreload bypass and three copies of the settings setup. Modules opt in with @pytest.mark.usefixtures(...).

... (truncated)

Commits
  • d4c8c9e chore(release): prepare 4.8.1
  • 8e728c8 docs(code): trim redundant comments and configuration docstrings
  • 97bd347 docs(contributing): clarify expectations in a neutral tone
  • 81f12d1 docs(guides): separate quickstart, installation and workflow
  • 6210584 docs(sources): clarify automatic Tailwind source detection
  • 09fc2af test: strengthen build and download behavior coverage
  • b8cd9c7 fix(download): replace CLI binaries atomically
  • 0b76315 fix(config): decouple template rendering from CLI discovery
  • d137345 fix(build): always rebuild production stylesheets
  • 57af3a6 chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#223)
  • Additional commits viewable in compare view

Updates djangorestframework to 3.18.3

Release notes

Sourced from djangorestframework's releases.

3.18.3

What's Changed

Bug fixes

Full Changelog: encode/django-rest-framework@3.18.2...3.18.3

Commits

Updates drf-spectacular-sidecar to 2026.10.1

Commits

Updates gunicorn to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

Commits
  • 36f2a3c gunicorn 26.2.0
  • cbba350 test: cover the h2c edge paths that had none
  • 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
  • 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
  • 5853551 Merge pull request #3712 from Rotzbua/patch-1
  • 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
  • 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
  • 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
  • 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
  • 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
  • Additional commits viewable in compare view

Updates pillow to 13.0.0

Release notes

Sourced from pillow's releases.

13.0.0

https://pillow.readthedocs.io/en/stable/releasenotes/13.0.0.html

Removals

Deprecations

Documentation

Dependencies

... (truncated)

Changelog

Sourced from pillow's changelog.

Changelog (Pillow)

11.1.0 and newer

See GitHub Releases:

11.0.0 (2024-10-15)

  • Update licence to MIT-CMU #8460 [hugovk]

  • Conditionally define ImageCms type hint to avoid requiring core #8197 [radarhere]

  • Support writing LONG8 offsets in AppendingTiffWriter #8417 [radarhere]

  • Use ImageFile.MAXBLOCK when saving TIFF images #8461 [radarhere]

  • Do not close provided file handles with libtiff when saving #8458 [radarhere]

  • Support ImageFilter.BuiltinFilter for I;16* images #8438 [radarhere]

  • Use ImagingCore.ptr instead of ImagingCore.id #8341 [homm, radarhere, hugovk]

  • Updated EPS mode when opening images without transparency #8281 [Yay295, radarhere]

  • Use transparency when combining P frames from APNGs #8443 [radarhere]

  • Support all resampling filters when resizing I;16* images #8422 [radarhere]

  • Free memory on early return #8413 [radarhere]

  • Cast int before potentially exceeding INT_MAX #8402 [radarhere]

... (truncated)

Commits
  • 293218a 13.0.0 version bump
  • 262e8e4 Update release notes for Pillow 13.0.0 (#10223)
  • af56ace Validate TIFF tag values against libtiff's own field definition before TIFFSe...
  • 570df03 Validate TIFF tag values against libtiff's own field definition before TIFFSe...
  • 53318b5 Take libtiff scanline geometry tags from the image, not tiffinfo/exif (#10226)
  • 0a87417 Bound retained TIFF tag data by stream size (#10225)
  • 11582e5 Fix heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO (#10224)
  • 8501adc Fix test
  • ec5f1cb Take libtiff scanline geometry tags from the image, not tiffinfo/exif
  • 4b63dff Share TIFF tag data budget across frames
  • Additional commits viewable in compare view

Updates psycopg to 3.3.6

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Future releases

Psycopg 3.3.7 (unreleased) ^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Fix segfault fetching arrays of strings or timestamps after closing the connection (:ticket:[#1428](https://github.com/psycopg/psycopg/issues/1428)).
  • Fix ~Connection.cancel_safe() failing if the cancel connection is not ready immediately, for instance on a slow network (:ticket:[#1440](https://github.com/psycopg/psycopg/issues/1440)).

Current release

Psycopg 3.3.6 ^^^^^^^^^^^^^

  • Add support for Python 3.15 (:ticket:[#1245](https://github.com/psycopg/psycopg/issues/1245)).
  • Improve performance of async queries by reducing the overhead of the !wait_async() function (:ticket:[#1331](https://github.com/psycopg/psycopg/issues/1331)).
  • Don't wait forever for a query to terminate after interrupting it, for instance if the server is unresponsive. The fix requires libpq 17 or newer (:ticket:[#1371](https://github.com/psycopg/psycopg/issues/1371)).
  • Cancel a running query upon receiving !SystemExit (:ticket:[#1384](https://github.com/psycopg/psycopg/issues/1384)).
  • Report !None instead of 65535 as the Column.precision of an :sql:interval column declared with a fields restriction and no explicit precision, such as e.g. :sql:interval day to second (:ticket:[#1397](https://github.com/psycopg/psycopg/issues/1397)).
  • Fix dumping of nested subclasses of lists as arrays (:ticket:[#1398](https://github.com/psycopg/psycopg/issues/1398)).
  • Discard prepared statements upon :sql:DEALLOCATE ALL (:ticket:[#1408](https://github.com/psycopg/psycopg/issues/1408)).
  • Better guards dumping large Python !int to binary numeric (:ticket:[#1414](https://github.com/psycopg/psycopg/issues/1414)).

Psycopg 3.3.5 ^^^^^^^^^^^^^

  • Discard prepared statements upon :sql:ALTER * or DISCARD * (:ticket:[#1307](https://github.com/psycopg/psycopg/issues/1307)).
  • Fix !ProgrammingError when dumping non-!None values with no !NoneType dumper registered in python implementation (:ticket:[#1325](https://github.com/psycopg/psycopg/issues/1325)).
  • Fix !wait_selector wait function to not raise !KeyError

... (truncated)

Commits
  • a67654d chore: bump psycopg package version to 3.3.6
  • 443814b Merge pull request #1416 from dvarrazzo/wait-async-perf
  • 42966e9 test: add helpful comments to some tests
  • 5e8797f test: add reasonable connect_timeout to most tests
  • c81ba62 perf: reduce the overhead of wait_async()
  • d2bbfe4 refactor: use get_running_loop() in the async wait functions
  • 2b1484a test: add a script to measure the async wait functions
  • 573cf4a test: fix incorrect wait timing test
  • 2b68990 refactor: drop leftovers of waiting with inf interval in wait_conn_async
  • 60765dd Merge pull request #1414 from dvarrazzo/fix-decimal-overflow
  • Additional commits viewable in compare view

Updates pydantic to 2.14.1

Release notes

Sourced from pydantic's releases.

v2.14.1 2026-10-11

What's Changed

Performance

  • Avoid Python tuple allocation during model fields validation by @​Viicos in #13955
  • Avoid unnecessary extra dict allocation in model validation by @​Viicos in #13956

Fixes

Full Changelog: pydantic/pydantic@v2.14.0...v2.14.1

Changelog

Sourced from pydantic...

Description has been truncated

@dependabot
build(deps): bump the python group across 1 directory with 11 updates
541db1e 
Updates the requirements on [av](https://github.com/PyAV-Org/PyAV), [django](https://github.com/django/django), [django-health-check](https://github.com/codingjoe/django-health-check), [django-tailwind-cli](https://github.com/django-commons/django-tailwind-cli), [djangorestframework](https://github.com/encode/django-rest-framework), [drf-spectacular-sidecar](https://github.com/tfranzel/drf-spectacular-sidecar), [gunicorn](https://github.com/benoitc/gunicorn), [pillow](https://github.com/python-pillow/Pillow), [psycopg](https://github.com/psycopg/psycopg), [pydantic](https://github.com/pydantic/pydantic) and [ruff](https://github.com/astral-sh/ruff) to permit the latest version.

Updates `av` to 19.0.2
- [Release notes](https://github.com/PyAV-Org/PyAV/releases)
- [Changelog](https://github.com/PyAV-Org/PyAV/blob/master/CHANGELOG.rst)
- [Commits](PyAV-Org/PyAV@v18.0.0...v19.0.2)

Updates `django` to 6.1.2
- [Commits](django/django@6.1...6.1.2)

Updates `django-health-check` to 4.10.0
- [Release notes](https://github.com/codingjoe/django-health-check/releases)
- [Commits](codingjoe/django-health-check@4.4.4...4.10.0)

Updates `django-tailwind-cli` to 4.8.1
- [Release notes](https://github.com/django-commons/django-tailwind-cli/releases)
- [Changelog](https://github.com/django-commons/django-tailwind-cli/blob/main/CHANGELOG.md)
- [Commits](django-commons/django-tailwind-cli@v4.6.2...v4.8.1)

Updates `djangorestframework` to 3.18.3
- [Release notes](https://github.com/encode/django-rest-framework/releases)
- [Commits](encode/django-rest-framework@3.18.0...3.18.3)

Updates `drf-spectacular-sidecar` to 2026.10.1
- [Commits](tfranzel/drf-spectacular-sidecar@2026.8.1...2026.10.1)

Updates `gunicorn` to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@26.0.0...26.2.0)

Updates `pillow` to 13.0.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.3.0...13.0.0)

Updates `psycopg` to 3.3.6
- [Changelog](https://github.com/psycopg/psycopg/blob/master/docs/news.rst)
- [Commits](psycopg/psycopg@3.3.4...3.3.6)

Updates `pydantic` to 2.14.1
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/main/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.14.1)

Updates `ruff` to 0.17.1
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.1...0.17.1)

---
updated-dependencies:
- dependency-name: av
  dependency-version: 19.0.2
  dependency-type: direct:production
  dependency-group: python
- dependency-name: django
  dependency-version: 6.1.2
  dependency-type: direct:production
  dependency-group: python
- dependency-name: django-health-check
  dependency-version: 4.10.0
  dependency-type: direct:production
  dependency-group: python
- dependency-name: django-tailwind-cli
  dependency-version: 4.8.1
  dependency-type: direct:production
  dependency-group: python
- dependency-name: djangorestframework
  dependency-version: 3.18.3
  dependency-type: direct:production
  dependency-group: python
- dependency-name: drf-spectacular-sidecar
  dependency-version: 2026.10.1
  dependency-type: direct:production
  dependency-group: python
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  dependency-group: python
- dependency-name: pillow
  dependency-version: 13.0.0
  dependency-type: direct:production
  dependency-group: python
- dependency-name: psycopg
  dependency-version: 3.3.6
  dependency-type: direct:production
  dependency-group: python
- dependency-name: pydantic
  dependency-version: 2.14.1
  dependency-type: direct:production
  dependency-group: python
- dependency-name: ruff
  dependency-version: 0.17.1
  dependency-type: direct:development
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants