[dependabot]

Bumps the uv-minor-patch group with 7 updates in the / directory:

Package	From	To
extract-msg	0.56.1	0.57.0
starlette	1.9.0	1.10.0
hypothesis	6.170.8	6.170.9
filelock	4.2.1	4.2.4
jsonpointer	3.4	3.5
soupsieve	3.0.3	3.0.4
tzlocal	5.4.4	5.4.5

Updates extract-msg from 0.56.1 to 0.57.0

Release notes

Sourced from extract-msg's releases.

Version 0.57.0

v0.57.0

• [Advisory GHSA-cxpg-prmv-g4pp] Fixed a vulnerability related to unchecked input passed out to wkhtmltopdf when converting the MSG file to PDF. Javascript is now strongly blocked from being enabled and will be stripped from the HTML where appropriate before reaching wkhtmltopdf. Additionally, the option --wk-allow-external-files on the command line (or wkAllowExternalFiles to MessageBase.save()) will be required for external files to be loaded into the HTML to convert. Without these, they will be stripped before reaching wkhtmltopdf for security.
• [Advisory GHSA-mqxr-j8rh-p4q4] Fixed an issue where an attacker controlled MSG file could take advantage of a poorly written section of code in the RTF deencapsulation function on the extract-msg side to waste massive amounts of time and memory resources.
• [Advisory GHSA-rgjf-vmqv-8pv9] Change the way multiple type properties are accessed for binary and string. This includes modifications to MSGFile.getMultipleBinary(), MSGFile.getMultipleString(), and MSGFile.exists() to significantly reduce wasted times for malicious files. Malicious files previously could cause extract-msg to do unnecessarily large numbers of calls to MSGFile.exists() which previously did not use caching to speed up its search.
• Changed MSGFile.listDir() to return a tuple of tuples to prevent it's cache results from being tampered with.
• Fixed an issue with MSGFile.listDir() that caused it to not cache in certain circumstances when it should always cache.
• Fixed a check in MSGFile.getMultipleBinary() that executed wrong and did not properly check for bad data.
• Fixed MSGFile._getTypedSteam() to correctly parse binary and string streams when an entry is missing.
• Fixed StandardViolationError being raised without checking error behavior in MSGFile.getMultipleBinary() and MSGFile.getMultipleString().
• Added check for standard violation in MSGFile.getMultipleString() that is raised (or logged, depending on error behavior) if a string stream is missing a null byte. This also doesn't strip the last character in the stream if it is not null.
• Added length check log to MSGFile.getMultipleBinary() and MSGFile.getMultipleString() that checks to see if the expected length for each stream matches what the length stream says. If not, it logs a warning about the mismatch, but does not consider this a gross violation of the standard.
• Changed how MessageBase.deencapsulatedRtf handles RTF data without a closing brace.
• Fixed wrong return being used in extract_msg.encoding.utils.singleByteEncode() and extract_msg.encoding.utils.variableByteEncode().
• Fixed missing return in extract_msg.encoding.utils.singleByteEncode().
• Fixed wrong parameter names for codec types made in extract_msg.encoding.utils.createSBEncoding() and extract_msg.encoding.utils.createVBEncoding().
• Fix some values being incorrectly returned from encode/decode functions in extract_msg.encoding.utils.

Changelog

Sourced from extract-msg's changelog.

0.58.1

• [[TeamMsgExtractor #493](TeamMsgExtractor/msg-extractor#493 Fixed unable to open embedded msg files due to MSGBase.prefixList still being used after it was removed.
• Corrected the typing signature of MSGBase.prefix.

v0.58.0

• Changed module to primarily use MSGPath for pathing. All functions still except string paths or list paths, they now just also accept MSGPath and use it under the hood for path conversions. With this, some functions have been changed to specifically return MSGPath rather than list and string versions of paths. Removed: MSGBase.prefixList, utils.inputToMsgPath(), and utils.msgPathToString(). Modified: *.fixPath(), *.listDir(), and MSGBase.prefix.
• Changed setup to use find_packages() to try and get ahead of deprecation and ensure all files are distributed correctly.
• Fixed MSGFile.existsTypedProperty() to actually do what it says it will do. Previous code had it not checking if the right directory was being searched when location was specified.
• Changed MSGFile.sExists() to correctly detect only the valid string stream type for the MSG file instead of unconditionally checking both types.
• Re-added extract_msg.constants.PROPERTIES which was removed for unknown reasons in an earlier version (0.42.0). MSGBase.saveRaw() appears to have been non-functional since then.

v0.57.1

• [[TeamMsgExtractor #489](TeamMsgExtractor/msg-extractor#489 Fix an issue where MessageSignedBase.body would raise an error when the plain text body was not utf-8 encoded bytes. This error was due to extract_msg.utils.unwrapMultipart() accidentally returning the plain text body as bytes instead of string.
• Change some of the command line documentation.
• Fix some of the imports in extract_msg/__init__.py.
• Add additional tests to module.

v0.57.0

• [Advisory GHSA-cxpg-prmv-g4pp] Fixed a vulnerability related to unchecked input passed out to wkhtmltopdf when converting the MSG file to PDF. Javascript is now strongly blocked from being enabled and will be stripped from the HTML where appropriate before reaching wkhtmltopdf. Additionally, the option --wk-allow-external-files on the command line (or wkAllowExternalFiles to MessageBase.save()) will be required for external files to be loaded into the HTML to convert. Without these, they will be stripped before reaching wkhtmltopdf for security.
• [Advisory GHSA-mqxr-j8rh-p4q4] Fixed an issue where an attacker controlled MSG file could take advantage of a poorly written section of code in the RTF deencapsulation function on the extract-msg side to waste massive amounts of time and memory resources.
• [Advisory GHSA-rgjf-vmqv-8pv9] Change the way multiple type properties are accessed for binary and string. This includes modifications to MSGFile.getMultipleBinary(), MSGFile.getMultipleString(), and MSGFile.exists() to significantly reduce wasted times for malicious files. Malicious files previously could cause extract-msg to do unnecessarily large numbers of calls to MSGFile.exists() which previously did not use caching to speed up its search.
• Changed MSGFile.listDir() to return a tuple of tuples to prevent it's cache results from being tampered with.
• Fixed an issue with MSGFile.listDir() that caused it to not cache in certain circumstances when it should always cache.
• Fixed a check in MSGFile.getMultipleBinary() that executed wrong and did not properly check for bad data.
• Fixed MSGFile._getTypedSteam() to correctly parse binary and string streams when an entry is missing.
• Fixed StandardViolationError being raised without checking error behavior in MSGFile.getMultipleBinary() and MSGFile.getMultipleString().
• Added check for standard violation in MSGFile.getMultipleString() that is raised (or logged, depending on error behavior) if a string stream is missing a null byte. This also doesn't strip the last character in the stream if it is not null.
• Added length check log to MSGFile.getMultipleBinary() and MSGFile.getMultipleString() that checks to see if the expected length for each stream matches what the length stream says. If not, it logs a warning about the mismatch, but does not consider this a gross violation of the standard.
• Changed how MessageBase.deencapsulatedRtf handles RTF data without a closing brace.
• Fixed wrong return being used in extract_msg.encoding.utils.singleByteEncode() and extract_msg.encoding.utils.variableByteEncode().
• Fixed missing return in extract_msg.encoding.utils.singleByteEncode().
• Fixed wrong parameter names for codec types made in extract_msg.encoding.utils.createSBEncoding() and extract_msg.encoding.utils.createVBEncoding().
• Fix some values being incorrectly returned from encode/decode functions in extract_msg.encoding.utils.

v0.56.1

• [[TeamMsgExtractor #484](TeamMsgExtractor/msg-extractor#484 Corrected the way the HTML body is decoded in MessageBase.asEmailMessage() to prevent encoding errors.

v0.56.0

• [[TeamMsgExtractor #478](TeamMsgExtractor/msg-extractor#478 Expand allowable versions of ebcdic to include 2.x. The 2.0 release is a pure technical release with no functional changes; it only drops support for Python 2 and 3.8. The lower bound is unchanged so installs on Python 3.8 will continue to resolve to ebcdic 1.1.1.
• [[TeamMsgExtractor #469](TeamMsgExtractor/msg-extractor#469 Expanded beautifulsoup to allow for versions up to 5.*.*. I was previously hesitant to do so because they sometimes do what seems like non backwards compatible changes in minor versions, but it looks like this should be fine.
• [[TeamMsgExtractor #471](TeamMsgExtractor/msg-extractor#471 Added .strip() to file name determination to ensure that folders with trailing spaces would be corrected before being used.
• [[TeamMsgExtractor #481](TeamMsgExtractor/msg-extractor#481 Fixed a typo that caused an HTML body created from plain text to end with </head> instead of </html>.
• [[TeamMsgExtractor #476](TeamMsgExtractor/msg-extractor#476 Fixed MessageBase.asEmailMessage() raising ValueError when a message has multiple To recipients.

v0.55.0

• [[TeamMsgExtractor #465](TeamMsgExtractor/msg-extractor#465 Added missing msg.close() to openMsg(). If the MSG file was actually just a plain OLE file, it would be left open.
• Adjusted the default value of maxNameLength for MessageBase.save() to 40 instead of 256.
• Adjusted exception handling for MessageBase.save() to properly report the reason a folder fails to be created.
• Simplified some of the code for MessageBase.save().
• Fixed some typing information.

... (truncated)

Commits

• bfa86ed Version 0.57.0
• 6f31da7 Add special case for python version 3.8 and 3.9
• eba2d1f Remove accidentally added line
• a0913aa Remove action usage for pure apt, fix typo
• 3b02409 Correctly try to use packages (forgot to specify that's what I was doing
• 92983fc Update workflow to try and get wkhtmltopdf
• 7baac9b Fix some issues with encodings
• b053db3 Bump date and copyright
• 360d26b Ensure all tests are active
• f27992c Update security policy
• Additional commits viewable in compare view

Updates starlette from 1.9.0 to 1.10.0

Release notes

Sourced from starlette's releases.

Version 1.10.0

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.

uv pip install starlette==1.10.0

• Forms with many fields parse faster and use less memory (#3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.
• The last field is kept when the request stream ends without an empty chunk (#3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.
• FormData with repeated uploads can be compared (#3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

• Multidict equality keeps the order of values under a repeated key (#3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.
• starlette.formparsers.FormMessage is deprecated (#3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

• Path parameter values that look like a placeholder are kept as they are (#3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.
• Route matching does less work per request (#3665, #3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.
• WSGIMiddleware strips root_path only at a path segment boundary (#3718). A request to /application under a root_path of /app no longer becomes /lication.
• FloatConvertor reports NaN and infinity correctly (#3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

• Handled exceptions no longer keep requests alive (#3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.
• Middlewares accept http.response.start without headers (#3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.
• FileResponse ignores Range on methods other than GET and HEAD (#3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.
• Config strips one pair of matching outer quotes from env file values (#3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

Changelog

Sourced from starlette's changelog.

1.10.0 (October 24, 2026)

Changed

• Compare multidicts such as FormData and QueryParams by key while keeping the order of values under a repeated key, so FormData with repeated uploads no longer raises TypeError. QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal #3619.
• Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields #3724.
• Compare Match members by identity during routing #3665 and #3722.

Deprecated

• Deprecate starlette.formparsers.FormMessage, which is no longer used #3724.

Fixed

• Parse the last URL-encoded form field when the request stream ends without an empty chunk #3599.
• Keep path parameter values that look like another placeholder in url_path_for() #3725.
• Default omitted http.response.start headers in BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware instead of raising KeyError #3721.
• Clear the traceback of handled exceptions, so reused exception instances no longer keep per-request objects alive #3205.
• Strip only one pair of matching outer quotes from Config env file values #3720.
• Strip root_path from PATH_INFO only at a path segment boundary in WSGIMiddleware #3718.
• Report NaN and infinity correctly in FloatConvertor.to_string() #3716.
• Ignore Range on requests other than GET and HEAD in FileResponse #3679.

Commits

• 8aa828c Version 1.10.0 (#3728)
• a85a5c3 Substitute URL path parameters in a single pass (#3725)
• 6b8b612 Finalize URL-encoded form parsing at stream exhaustion (#3599)
• b973efd Build URL-encoded form fields in parser callbacks (#3724)
• d7731e0 Compare FormData with repeated uploads without raising TypeError (#3619)
• fb3e818 Compare remaining Match members by identity in routing (#3722)
• fc23aa1 Compare Match members by identity in Router.app (#3665)
• fe000fb Replace the removed route decorator hint in the host routing docs (#3713)
• 4114432 Default omitted http.response.start headers in middlewares (#3721)
• 1a01a02 Clear exc.traceback after handled exceptions to prevent memory leak (#3205)
• Additional commits viewable in compare view

Updates hypothesis from 6.170.8 to 6.170.9

Commits

• 5057a16 Bump hypothesis version to 6.170.9 and update changelog
• 2d859e6 Merge pull request #4942 from moreati/issue4934
• 5954d0b Fix DeprecationWarning triggered by importing dateutil.zoneinfo
• See full diff in compare view

Updates filelock from 4.2.1 to 4.2.4

Release notes

Sourced from filelock's releases.

4.2.4

🐍 PyPI release

📜 Full Changelog

4.2.3

Bug fixes

• Creating a lock on a Python 3.15 interpreter without types.LazyImportType no longer triggers AttributeError at exit. #861 by @​gaborbernat.
• Handle EFTYPE when a no-follow open refuses a symlink in a soft reader/writer lock's protocol tree, so heartbeat reports lost ownership rather than a transient refresh error. #859 by @​edsonsims.

New Contributors

• @​edsonsims made their first contribution in #859

🐍 PyPI release

📜 Full Changelog

4.2.2

Bug fixes

• Fix a lock on a relative path that stayed held after a later with lock: ended, when an earlier acquire() had failed because the working directory no longer exists. That call still raises FileNotFoundError, and it now leaves the lock's hold count unchanged. #856 by @​spicysharkco.

New Contributors

• @​spicysharkco made their first contribution in #856

🐍 PyPI release

📜 Full Changelog

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

.. _release-4-2-6:

---

4.2.6 (2026-10-31)

---

.. _release-4-2-6-fixed:

Fixed

• Fix a race in :class:~filelock.SoftFileLock, :class:~filelock.MarkerSoftFileLock and :class:~filelock.SoftFileLease when three or more contenders reclaim a dead marker. The race could strand a live holder's marker under a break name, leaving the lock unusable or admitting a second holder. Contenders now recheck the marker before exchanging names and unwind nested exchanges in order. If the filesystem refuses a return exchange, the contender leaves its marker at the lock path for later recovery (:pr:899) by :user:dxbjavid and :user:gaborbernat.

.. _release-4-2-5:

---

4.2.5 (2026-10-30)

---

.. _release-4-2-5-fixed:

Fixed

• :meth:~filelock.BaseFileLock.acquire and :meth:~filelock.BaseAsyncFileLock.acquire raise :class:TypeError for a blocking that is not a :class:bool, as the constructor and the blocking setter already do. A truthy value such as the string "false" used to count as True, so a call meant as a single attempt waited for the instance's timeout, and without a limit at the default -1 (:pr:870) by :user:simpleqt and :user:gaborbernat.
• A :class:~filelock.SoftFileLock acquisition whose first read of its new marker's identity failed reads it again before rolling back. On Windows the rollback could otherwise not recognize the marker it had created, and the empty marker it left blocked the path for every later acquisition, since no contender breaks an empty marker (:pr:869) by :user:simpleqt and :user:gaborbernat.
• A fork() child of a process holding a :class:~filelock.SoftFileLease starts from an unheld claim. It used to inherit the parent's token, last compromise and heartbeat, so :attr:~filelock.SoftFileLease.token and :attr:~filelock.SoftFileLease.compromise reported a claim the child never held while is_locked reported it unheld (:pr:868) by :user:dxbjavid and :user:gaborbernat.
• A nested acquire of a held :class:~filelock.FileLock or :class:~filelock.SoftFileLock no longer creates the lock

... (truncated)

Commits

• 22f0776 Release 4.2.4
• 9d278ed Document GitHub Release note cleanup (#863)
• 3c33798 🐛 fix(release): trim GitHub release notes (#862)
• e737924 Release 4.2.3
• 84dc80c 👷 ci: collect required checks (#857)
• cb8b57e fix(api): guard lazy import exit hook (#861)
• dd341ac Handle NetBSD EFTYPE for replaced soft-RW protocol directories (#859)
• db47f34 Release 4.2.2
• caaff8a fix(api): keep the hold count when the lock path cannot be resolved (#856)
• See full diff in compare view

Updates jsonpointer from 3.4 to 3.5

Release notes

Sourced from jsonpointer's releases.

3.5

What's Changed

• Handle array-end pointers as CLI resolution errors by @​Zhuyuyangyy in stefankoegl/python-json-pointer#94
• Read CLI JSON and pointer files as UTF-8 by @​KennyMcSimpson in stefankoegl/python-json-pointer#95

New Contributors

• @​Zhuyuyangyy made their first contribution in stefankoegl/python-json-pointer#94
• @​KennyMcSimpson made their first contribution in stefankoegl/python-json-pointer#95

Full Changelog: stefankoegl/python-json-pointer@v3.4...v3.5

Commits

• fdcb426 bump version to 3.5
• 0c1941f Merge pull request #95 from KennyMcSimpson/fix/cli-utf8-input-files
• bb428e5 Merge pull request #94 from Zhuyuyangyy/fix-cli-end-of-list
• 12eb2cb Read CLI JSON and pointer files as UTF-8
• 057a32a Handle array-end pointers as CLI resolution errors
• See full diff in compare view

Updates soupsieve from 3.0.3 to 3.0.4

Release notes

Sourced from soupsieve's releases.

3.0.4

• FIX: Keep own and descendant text separate when combining :-soup-contains() and :-soup-contains-own().
• FIX: Cache resolved directionality when matching :dir() to avoid quadratic time on deeply nested dir="auto" elements.
• FIX: Fix auto handling in regard to :dir() selector. When an element with dir="auto" (or a <bdi>) contains no strong direction characters, it should be assumed as left-to-right and not assume the direction of the parent.
• FIX: Match numeric input ranges correctly when values or bounds use scientific notation.
• FIX: Fix :in-range and :out-of-range raising ValueError for week inputs whose week-year is 10000 or greater.
• FIX: Fix :nth-last-child(an+b of S) matching the wrong elements when the first sibling tested does not match S.
• FIX: escape() now only leaves non-ASCII identifier code points unescaped, as defined by the CSS specification. All other non-ASCII characters are escaped.
• FIX: Allow unescaped U+0080 - U+009F characters in identifiers to match browser behavior.
• FIX: Fix :in-range and :out-of-range treating time and datetime-local values with seconds as invalid.

Commits

• 628ec6b Fix changelog entry
• d2731cb Bump version
• b0de0e6 Fix :in-range and :out-of-range for time and datetime-local values wi...
• 084e370 Fix mixed own and descendant text matching (#319)
• 4510837 Fix :in-range and :out-of-range for week inputs with a week-year of 100...
• 1b3b195 Fix ident pattern and ensure escape properly escapes all non-ident chars
• 395c2bc Fix :nth-last-child(an+b of S) when the first element checked does not matc...
• ede019a Cache resolved direction in :dir() matching (#318)
• fda16a7 Fix auto handling in regard to :dir() selector
• b409c8f Fix numeric input range matching with exponents (#317)
• See full diff in compare view

Updates tzlocal from 5.4.4 to 5.4.5

Changelog

Sourced from tzlocal's changelog.

5.4.5 (2026-10-22)

• Recognize timezone file names with multiple slashes in the TZ environment variable.
• Use HTTPS in place of FTP to retrieve tzdata archive.

Commits

• ab833e7 Preparing release 5.4.5
• 148d36d Update mappings
• f84b23e Use HTTPS in place of FTP to retrieve tzdata archive in update_windows_mappin...
• b5349f6 Recognize nested time zone names in TZ file paths (#186)
• 6ef2c29 Back to development: 5.4.5
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

requirements.txt / pylock.toml drift (unsigned push blocked)

uv.lock / pyproject.toml changed but GitHub Actions cannot push an unsigned commit under the required_signatures ruleset (#1419).

Option A — signed commit on this Dependabot branch:

git fetch origin pull/2153/head:dependabot-review
git checkout dependabot-review
uv export --frozen --no-emit-project -o requirements.txt
uv export --format pylock.toml --frozen --all-extras --all-groups --output-file pylock.toml
git add requirements.txt pylock.toml
git commit -S -m "chore(deps): regenerate requirements.txt and pylock.toml after uv.lock update"
git push origin "HEAD:<dependabot-branch-name>"

Option B — supersede PR: apply the bump + export locally with signed commits (see CONTRIBUTING.md).

Download the CI-generated requirements.txt and pylock.toml from the workflow artifact on this run when present.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.