chore(deps): bump the patch-and-minor group across 1 directory with 189 updates

[dependabot]

Bumps the patch-and-minor group with 189 updates in the / directory:

Package	From	To
anyio	4.9.0	4.15.0
charset-normalizer	3.4.2	3.5.1
httpx	0.26.0	0.28.1
idna	3.10	3.19
pyyaml	6.0.2	6.0.3
requests	2.32.5	2.34.2
ruff	0.2.1	0.16.6
urllib3	2.6.3	2.7.0
prometheus-client	0.22.1	0.26.0
aiohttp	3.13.3	3.14.3
python-dotenv	1.0.1	1.2.3
wheel	0.46.2	0.48.0
authlib	1.6.9	1.8.0
nltk	3.9.1	3.10.3
pyjwt	2.12.0	2.13.0
python-multipart	0.0.22	0.0.32
tornado	6.5.5	6.5.8
fastapi	0.111.0	0.141.1
aiohappyeyeballs	2.6.1	2.7.1
alembic	1.18.4	1.19.1
annotated-doc	0.0.4	0.0.5
annotated-types	0.7.0	0.8.0
apscheduler	3.11.2	3.11.3
arq	0.27.0	0.28.0
asgiref	3.11.1	3.12.1
astroid	4.0.4	4.3.1
asyncpg	0.30.0	0.31.0
bandit	1.8.6	1.9.4
beautifulsoup4	4.13.4	4.15.0
bidict	0.23.1	0.24.1
boto3	1.42.64	1.43.88
botocore	1.42.64	1.43.88
build	1.3.0	1.6.0
celery	5.6.2	5.6.3
cffi	2.0.0	2.1.1
chromadb	1.0.15	1.5.9
click	8.2.1	8.5.0
colorlog	6.9.0	6.12.0
coverage	7.13.4	7.16.0
cross-web	0.4.1	0.7.0
decorator	5.2.1	5.3.1
deprecated	1.2.18	1.3.1
discord-py	2.5.2	2.7.1
docker	7.1.0	7.2.0
docstring-parser	0.17.0	0.18.0
durationpy	0.10	0.11
fabric	3.2.2	3.2.3
fakeredis	2.33.0	2.37.1
feedparser	6.0.11	6.0.14
filelock	3.20.3	3.32.5
flask-cors	6.0.1	6.0.5
flask-socketio	5.5.1	5.6.1
flatbuffers	25.2.10	25.12.19
fonttools	4.60.2	4.64.0
frozenlist	1.7.0	1.8.0
fsspec	2026.3.0	2026.7.0
geographiclib	2.0	2.1
geopy	2.4.1	2.5.0
gitpython	3.1.50	3.1.61
google-auth	2.40.3	2.57.1
googleapis-common-protos	1.70.0	1.75.3
graphql-core	3.2.8	3.2.12
greenlet	3.3.2	3.5.5
grpcio	1.74.0	1.83.1
hiredis	3.3.0	3.4.1
httptools	0.6.4	0.8.0
iniconfig	2.1.0	2.3.0
jaraco-context	6.1.0	6.1.2
jiter	0.10.0	0.16.0
joblib	1.5.1	1.6.0
jsonpointer	3.0.0	3.1.1
jsonschema	4.25.0	4.26.0
jsonschema-specifications	2025.4.1	2025.9.1
kiwisolver	1.4.8	1.5.1
langgraph	1.1.0	1.2.11
langgraph-checkpoint	4.0.1	4.2.0
langgraph-prebuilt	1.0.8	1.1.0
langgraph-sdk	0.3.13	0.4.4
levenshtein	0.27.3	0.27.4
lxml	6.1.0	6.1.3
mako	1.3.12	1.4.1
markupsafe	3.0.2	3.0.3
matplotlib	3.10.5	3.11.1
mmh3	5.2.0	5.3.0
mpmath	1.3.0	1.4.1
msgpack	1.1.2	1.2.2
multidict	6.6.3	6.7.1
narwhals	2.0.1	2.25.0
networkx	3.5	3.6.1
numpy	2.3.2	2.5.2
onnxruntime	1.22.1	1.29.0
openai	1.98.0	1.109.1
opentelemetry-api	1.40.0	1.44.0
opentelemetry-distro	0.61b0	0.65b0
opentelemetry-exporter-otlp	1.40.0	1.44.0
opentelemetry-exporter-otlp-proto-common	1.40.0	1.44.0
opentelemetry-exporter-otlp-proto-grpc	1.40.0	1.44.0
opentelemetry-exporter-otlp-proto-http	1.40.0	1.44.0
opentelemetry-instrumentation	0.61b0	0.65b0
opentelemetry-instrumentation-asgi	0.61b0	0.65b0
opentelemetry-instrumentation-fastapi	0.61b0	0.65b0
opentelemetry-instrumentation-httpx	0.61b0	0.65b0
opentelemetry-instrumentation-logging	0.61b0	0.65b0
opentelemetry-instrumentation-redis	0.61b0	0.65b0
opentelemetry-instrumentation-sqlalchemy	0.61b0	0.65b0
opentelemetry-instrumentation-system-metrics	0.61b0	0.65b0
opentelemetry-proto	1.40.0	1.44.0
opentelemetry-sdk	1.40.0	1.44.0
opentelemetry-semantic-conventions	0.61b0	0.65b0
opentelemetry-util-http	0.61b0	0.65b0
orjson	3.11.7	3.12.0
pathspec	1.1.0	1.1.1
pip-tools	7.5.3	7.6.1
pip-audit	2.8.0	2.10.1
platformdirs	4.9.4	4.11.7
prompt-toolkit	3.0.52	3.0.53
propcache	0.3.2	0.5.2
psycopg2-binary	2.9.10	2.9.12
py-cord	2.6.1	2.8.1
pyasn1	0.6.3	0.6.4
pybase64	1.4.2	1.5.0
pydantic-settings	2.13.1	2.15.0
pydeck	0.9.1	0.9.3
pygithub	2.9.0	2.10.0
pygments	2.20.0	2.21.0
pylint	4.0.5	4.0.8
pyparsing	3.2.3	3.3.2
pypika	0.48.9	0.51.1
pyreadline3	3.5.4	3.5.6
python-engineio	4.12.2	4.14.0
python-levenshtein	0.27.3	0.27.4
python-socketio	5.14.0	5.16.4
qiskit	2.3.1	2.5.2
rapidfuzz	3.14.3	3.14.6
referencing	0.36.2	0.37.0
ruamel-yaml	0.18.14	0.19.1
ruamel-yaml-clib	0.2.12	0.2.15
rustworkx	0.17.1	0.18.1
s3transfer	0.16.0	0.19.2
safehttpx	0.1.6	0.1.7
scikit-learn	1.7.1	1.9.0
scipy	1.12.0	1.18.1
slowapi	0.1.9	0.1.10
smmap	5.0.2	5.0.3
soupsieve	2.7	2.9.2
sqlalchemy	2.0.48	2.0.52
stevedore	5.4.1	5.9.1
strawberry-graphql	0.312.3	0.327.2
tomlkit	0.13.3	0.15.1
tqdm	4.66.1	4.70.0
typer	0.16.0	0.27.2
types-requests	2.32.4.20260107	2.33.0.20260712
typing-inspection	0.4.2	0.4.4
typing-extensions	4.14.1	4.16.0
tzlocal	5.3.1	5.4.4
uuid-utils	0.14.1	0.17.0
uvicorn	0.27.1	0.52.4
watchfiles	1.1.0	1.2.0
wcwidth	0.5.3	0.8.3
websocket-client	1.8.0	1.9.2
werkzeug	3.1.6	3.1.8
wsproto	1.2.0	1.3.2
yarl	1.20.1	1.24.5
safety	3.2.0	3.8.1
opentelemetry-instrumentation-celery	0.61b0	0.65b0
langchain-community	0.3.5	0.4.2
langserve	0.2.1	0.3.3
autogen	0.5.0	0.14.1
eth-account	0.13.0	0.14.0
eth-keys	0.7.1	0.8.0
semgrep	1.92.0	1.176.0
pytest-benchmark	5.1.0	5.3.0
hypothesis	6.131.0	6.167.1
accelerate	1.10.0	1.14.0
bitsandbytes	0.46.1	0.50.2
langchain-text-splitters	1.1.1	1.1.2
langsmith	0.7.16	0.12.1
safetensors	0.5.3	0.8.0
streamlit	1.54.0	1.63.0
tokenizers	0.21.4	0.23.2
torch	2.2.0	2.14.0
torchvision	0.17.0	0.29.0
torchaudio	2.2.0	2.11.0
scikit-image	0.22.0	0.26.0
soundfile	0.12.1	0.14.0
wyn-wav2lip	0.1.0	0.2.3
face-alignment	1.4.1	1.5.0
azure-cognitiveservices-speech	1.35.0	1.51.2
supabase	2.3.4	2.31.0

Updates anyio from 4.9.0 to 4.15.0

Release notes

Sourced from anyio's releases.

4.15.0

• Added support for the newer keyword-only arguments on anyio.Path methods to match the standard library pathlib.Path:

  • follow_symlinks on exists() (Python 3.12+)
  • follow_symlinks on is_dir() (Python 3.13+)
  • follow_symlinks on is_file() (Python 3.13+)
  • follow_symlinks on owner() (Python 3.13+)
  • follow_symlinks on group() (Python 3.13+)
  • newline on read_text() (Python 3.13+)

  (#1286, #1293; PR by @​jaideeppyne)

• Added amap, gather, and as_completed utility functions to simplify common patterns (#1173; PR by @​Graeme22)

• Added --anyio-mode command-line option as an alternative to the anyio_mode ini setting, and fix the pytest plugin's auto mode detection to recognize the mode when set via either mechanism(e.g: pytest_asyncio). (#1242; PR by @​EmmanuelNiyonshuti)

• Added the anyio.Future synchronization primitive which behaves similar to asyncio.Future, allowing tasks to wait for a value (or exception) from another task (#1146; PR by @​Vizonex)

• Added guidance for managing multiple memory object stream producers and consumers with cloned streams (#330; PR by @​nightcityblade)

• Added StapledObjectStream.send_nowait() that delegates to the underlying ObjectSendStream, if it implements it (#1241; PR by @​davidbrochart)

• Added the move_on_at() and fail_at() functions to complement move_on_after() and fail_after()

• Changed the default name for a task spawned with TaskGroup.create_task(func()) to match the default task name for the analogous task spawned with TaskGroup.start_soon(func) or TaskGroup.start(func) in more situations. Previously, the default name of a TaskGroup.create_task task never included the module name. (The default name for a task spawned with TaskGroup.start_soon or TaskGroup.start typically includes the module name.) (#1234; PR by @​gschaffner)

• Changed the anyio and anyio.abc modules to lazily (much like 810) import the necessary submodules. This is done by parsing the AST of the module and building a lookup table from the if TYPE_CHECKING: block. A fallback mode has been provided for installations where the source code is unavailable (e.g. PyInstaller). (#1169)

• Fixed free-threading compatibility issues arising from the fact that on Python 3.14 free-threading builds, newly created threads inherit the current context by default, causing AnyIO to behave erroneously in relation to start_blocking_portal() and anyio.to_thread.run_sync() (#1224; PR by @​EmmanuelNiyonshuti)

• Fixed SpooledTemporaryFile.readinto() and readinto1() reading twice before rollover, so the destination buffer was overwritten by the second read and the file position advanced twice, silently losing data (#1215; PR by @​c-tonneslan)

• Added a reason parameter to fail_after (and the new fail_at) allowing for added exception context when raising TimeoutError (#1227; PR by @​Graeme22)

• Fixed the default TaskHandle.name missing part of the task name for tasks started with TaskGroup.start on Trio (#1231; PR by @​gschaffner)

• Fixed anyio.run leaking, or at least, delaying collection of loop and root_task due to the root task being cached in a RunVar. (#1203; PR by @​tapetersen)

• Fixed anyio.Path.with_stem() silently producing a wrong path (e.g. Path(".txt")) instead of raising ValueError when given an empty stem on a path with a non-empty suffix, unlike pathlib.PurePath.with_stem (#1200; PR by @​Sanjays2402)

• Fixed UNIXSocketStream.aclose() raising asyncio.InvalidStateError when a concurrent receive or send operation had just been cancelled on the asyncio backend (#1267; PR by @​alloutflo)

• Fixed the pytest plugin importing the deprecated _pytest.python.CallSpec2 alias, which triggers PytestRemovedIn10Warning on pytest>=9.2 and crashes pytest at startup when filterwarnings = error is configured (#1271; PR by @​matthewfeickert)

• Fixed an asyncio worker thread race that could raise RuntimeError when the event loop closed between checking its state and scheduling the worker result (#1265; PR by @​hansu650)

• Fixed CapacityLimiter on the asyncio backend over-granting tokens when total_tokens was raised while the limiter was over-subscribed (#1223; PR by @​zelinewang)

• Fixed asyncio task groups leaking unawaited coroutines when a custom task constructor fails; default task creation is unaffected (#1274; PR by @​dsfaccini)

... (truncated)

Commits

• 9283662 Bumped up the version
• d137692 Improved the instructions for AI agents
• 033fc52 Shield TemporaryDirectory cleanup from cancellation (#1304)
• 942e9a6 [pre-commit.ci] pre-commit autoupdate (#1305)
• b825c3b Fixed pyproject.toml changes not triggering the test suite
• 9727dc5 Fixed start inconsistencies between trio and asyncio (#1198)
• b05fe6d Fixed wrong type in move_on_after (#1297)
• 44d0c93 Fixed asyncio task group coroutine cleanup (#1275)
• ae25044 [pre-commit.ci] pre-commit autoupdate (#1290)
• 6d3a30d Add follow_symlinks argument to anyio.Path.owner() and group() (#1293)
• Additional commits viewable in compare view

Updates charset-normalizer from 3.4.2 to 3.5.1

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.1

3.5.1 (2026-08-15)

Changed

• Raised upper bound of setuptools to v84 (#794)
• Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

• No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

Version 3.5.0

3.5.0 (2026-08-12)

Added

• Explicit support for Python 3.15

Fixed

• Comparing a CharsetMatch to a non-alias encoding strings (#773)
• Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
• A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
• iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

• Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
• Applied micro-optimization on several utils.
• CharsetMatches no longer sort on each match insertion.

Misc

• Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).

Version 3.4.9

3.4.9 (2026-07-07)

Fixed

• Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

Version 3.4.8

3.4.8 (2026-07-06)

Fixed

... (truncated)

Changelog

Sourced from charset-normalizer's changelog.

3.5.1 (2026-08-15)

Changed

• Raised upper bound of setuptools to v84 (#794)
• Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

• No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

3.5.0 (2026-08-12)

Added

• Explicit support for Python 3.15

Fixed

• Comparing a CharsetMatch to a non-alias encoding strings (#773)
• Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
• A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
• iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

• Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
• Applied micro-optimization on several utils.
• CharsetMatches no longer sort on each match insertion.

Misc

• Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).

3.4.9 (2026-07-07)

Fixed

• Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

3.4.8 (2026-07-06)

Fixed

• Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)
• Unnecessary json import at runtime (#753)
• Inverse capitalization not seen by noise detector (#731)

... (truncated)

Commits

• e239bdc Merge pull request #795 from jawah/release-3.5.1
• 648ad77 docs: update faq
• fab2749 docs: write changelog for 3.5.1
• 7d32774 chore: bump version to 3.5.1
• 9a69f60 docs: update data/info
• 5dcc6dd perf: charinfo cache access optimization in cython
• ea3b447 fix: do not validate-decode large payload when md says it's noise
• a05917f chore: allow setuptools 84 builds (#794)
• 3325d87 Merge pull request #792 from jawah/update-cibuildwheel-action
• 77203b1 chore: reformat noxfile.py
• Additional commits viewable in compare view

Updates httpx from 0.26.0 to 0.28.1

Release notes

Sourced from httpx's releases.

Version 0.28.1

0.28.1 (6th December, 2024)

• Fix SSL case where verify=False together with client side certificates.

Version 0.28.0

0.28.0 (28th November, 2024)

The 0.28 release includes a limited set of deprecations.

Deprecations:

We are working towards a simplified SSL configuration API.

For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...

• The verify argument as a string argument is now deprecated and will raise warnings.
• The cert argument is now deprecated and will raise warnings.

Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.

The following changes are also included:

• The deprecated proxies argument has now been removed.
• The deprecated app argument has now been removed.
• JSON request bodies use a compact representation. (#3363)
• Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
• Ensure certifi and httpcore are only imported if required. (#3377)
• Treat socks5h as a valid proxy scheme. (#3178)
• Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
• Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)

Version 0.27.2

0.27.2 (27th August, 2024)

Fixed

• Reintroduced supposedly-private URLTypes shortcut. (#2673)

Version 0.27.1

0.27.1 (27th August, 2024)

Added

• Support for zstd content decoding using the python zstandard package is added. Installable using httpx[zstd]. (#3139)

Fixed

• Improved error messaging for InvalidURL exceptions. (#3250)
• Fix app type signature in ASGITransport. (#3109)

... (truncated)

Changelog

Sourced from httpx's changelog.

0.28.1 (6th December, 2024)

• Fix SSL case where verify=False together with client side certificates.

0.28.0 (28th November, 2024)

Be aware that the default JSON request bodies now use a more compact representation. This is generally considered a prefered style, tho may require updates to test suites.

The 0.28 release includes a limited set of deprecations...

Deprecations:

We are working towards a simplified SSL configuration API.

For users of the standard verify=True or verify=False cases, or verify=<ssl_context> case this should require no changes. The following cases have been deprecated...

• The verify argument as a string argument is now deprecated and will raise warnings.
• The cert argument is now deprecated and will raise warnings.

Our revised SSL documentation covers how to implement the same behaviour with a more constrained API.

The following changes are also included:

• The deprecated proxies argument has now been removed.
• The deprecated app argument has now been removed.
• JSON request bodies use a compact representation. (#3363)
• Review URL percent escape sets, based on WHATWG spec. (#3371, #3373)
• Ensure certifi and httpcore are only imported if required. (#3377)
• Treat socks5h as a valid proxy scheme. (#3178)
• Cleanup Request() method signature in line with client.request() and httpx.request(). (#3378)
• Bugfix: When passing params={}, always strictly update rather than merge with an existing querystring. (#3364)

0.27.2 (27th August, 2024)

Fixed

• Reintroduced supposedly-private URLTypes shortcut. (#2673)

0.27.1 (27th August, 2024)

Added

• Support for zstd content decoding using the python zstandard package is added. Installable using httpx[zstd]. (#3139)

Fixed

• Improved error messaging for InvalidURL exceptions. (#3250)
• Fix app type signature in ASGITransport. (#3109)

0.27.0 (21st February, 2024)

... (truncated)

Commits

• 26d48e0 Version 0.28.1 (#3445)
• 89599a9 Fix verify=False, cert=... case. (#3442)
• 8ecb86f Add test for request params behavior changes (#3364) (#3440)
• 0cb7e5a Bump the python-packages group with 11 updates (#3434)
• 15e21e9 Updating deprecated docstring Client() class (#3426)
• 80960fa Version 0.28.0. (#3419)
• a33c878 Fix extensions type annotation. (#3380)
• ce7e14d Error on verify as str. (#3418)
• 47f4a96 Handle empty zstd responses (#3412)
• 189fc4b Update CHANGELOG.md, fix typo(s) (#3406)
• Additional commits viewable in compare view

Updates idna from 3.10 to 3.19

Release notes

Sourced from idna's releases.

v3.19

• Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
• Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
• Test on free-threaded CPython with the GIL disabled and document thread safety.
• Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
• Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
• The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
• Reject A-labels that are not the canonical Punycode encoding of their U-label.
• Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
• Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
• Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
• Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

v3.18

No release notes provided.

v3.17

No release notes provided.

v3.16

No release notes provided.

v3.15

No release notes provided.

v3.14

No release notes provided.

v3.13

No release notes provided.

v3.12

... (truncated)

Changelog

Sourced from idna's changelog.

3.19 (2026-08-18)

• Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
• Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
• Test on free-threaded CPython with the GIL disabled and document thread safety.
• Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
• Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
• The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
• Reject A-labels that are not the canonical Punycode encoding of their U-label.
• Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
• Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
• Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
• Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

3.18 (2026-06-02)

• When decoding a domain, add a display argument that will pass through invalid labels rather than raising an exception.

3.17 (2026-05-28)

• Substantial 75% reduction in memory usage through new data structures and some optimization in processing speed.
• Added a general 1024-character input length cap to the public validation, conversion, and codec entry points. This is well above any legitimate domain or label and guards against pathological inputs.

3.16 (2026-05-22)

• Add a command-line interface (python -m idna, also available as the idna script). Encodes or decodes one or more domains supplied

... (truncated)

Commits

• 03a9a11 Release 3.19
• 2d2a7ef Pre-release 3.19rc0
• 5cce130 Merge pull request #268 from kjd/fix-std3-regex-alert
• 3914b75 Split the STD3 disallowed-character range so uppercase is explicit
• ce9fd98 Merge pull request #267 from kjd/housekeeping
• 809240c Fail CI when the license copyright year is behind the current year
• d9e16c5 Consolidate test fixtures, prune stale gitignore entries, and fix doc typos
• ef30fee Remove dead code and pare back superfluous comments
• b907913 Tighten the version support and Unicode notes in the README
• 6204cbe Ignore local build artifacts and stop packaging stray tooling config
• Additional commits viewable in compare view

Updates pyyaml from 6.0.2 to 6.0.3

Release notes

Sourced from pyyaml's releases.

6.0.3

What's Changed

• Support for Python 3.14 and free-threading (experimental).

Full Changelog: yaml/pyyaml@6.0.2...6.0.3

Changelog

Sourced from pyyaml's changelog.

6.0.3 (2025-09-25)

• yaml/pyyaml#864 -- Support for Python 3.14 and free-threading (experimental)

Commits

• 49790e7 Release 6.0.3 (#889)
• See full diff in compare view

Updates requests from 2.32.5 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

• @​k223kim made their first contribution in psf/requests#7433

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

• Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

• Widened json input type from dict and list to Mapping and Sequence. (#7436)
• Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
• Response.reason moved from str | None to str to improve handling for users. (#7437)
• Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

• Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

  Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

• Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
• Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
• Requests added support for Python 3.14t. (#7419)

Bugfixes

• Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
• Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
• Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

• 6e83187 v2.34.2
• 84d10f0 Move Request.headers back to Mapping (#7441)
• b7b549b v2.34.1
• e511bc7 Fix mutability issues with headers input types (#7431)
• 5691f59 Update JsonType containers to read-based collections (#7436)
• 2144213 Constrain Response.reason to str (#7437)
• 6404f34 Fix prepare_body stream detection for __getattr__-based file wrappers (#7...
• 0b401c7 v2.34.0
• 86b378d Align Session.get parameters with requests.get (#7429)
• a4f9a59 Port bpo-39057 to Requests (#7427)
• Additional commits viewable in compare view

Updates ruff from 0.2.1 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

• Move pytest-fixture-autouse to the restriction category (#28219)
• [flake8-pytest-style] Add an autofix for PT020 (#27993)
• [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
• [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

• Validate unary expressions when parsing (#28233)
• [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
• [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
• [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
• [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
• [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

• [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

• Add another example and glob reference for...

  Description has been truncated

[dependabot]

Labels

The following labels could not be found: dependencies, python. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.