chore(deps): bump the python-minor-and-patch group across 1 directory with 27 updates

[dependabot]

Bumps the python-minor-and-patch group with 27 updates in the /shifter/shifter_platform directory:

Package	From	To
asyncssh	2.23.0	2.24.0
boto3	1.43.2	1.43.98
daphne	4.2.1	4.2.3
django	6.0.6	6.1.1
django-anymail	15.0	15.2
django-ses	4.7.2	4.8.0
djangorestframework	3.17.1	3.18.1
drf-spectacular	0.29.0	0.30.0
drf-spectacular-sidecar	2026.6.1	2026.9.1
firebase-admin	7.4.0	7.6.0
markdown	3.10.2	3.10.3
pycurl	7.46.0	7.48.0
pydantic	2.13.4	2.13.5
python-dotenv	1.2.2	1.2.3
regex	2026.6.28	2026.9.10
requests	2.33.1	2.34.2
import-linter	2.11	2.15
pytest	9.0.3	9.1.1
pytest-django	4.12.0	4.14.0
ruff	0.15.13	0.16.8
pre-commit	4.6.0	4.6.2
pytest-asyncio	1.3.0	1.4.0
mypy	2.1.0	2.3.1
django-stubs	6.0.4	6.1.1
types-bleach	6.3.0.20260508	6.4.0.20260728
google-auth	2.50.0	2.58.0
google-cloud-storage	3.10.1	3.14.1

Updates asyncssh from 2.23.0 to 2.24.0

Changelog

Sourced from asyncssh's changelog.

Release 2.24.0 (27 Jun 2026)

• Added support for creating and validating SSHSIG signatures, as well as OpenSSH "allowed signers" files.

• Added support for ML-KEM key exchange from the PyCA cryptography package when it is available. This avoids the need to have the liboqs library installed to use ML-KEM. However, liboqs is still required to support SNTRUP kex exchange.

• Fixed an issue with handling of SSH maximum packet size when opening a new SSH channel, aborting with a protocol error if a peer attempts to set this size to 0. Thanks go to GitHub user afldl for reporting this issue and providing analysis and reproduction code.

• Fixed an issue with include directives in OpenSSH config files. Thanks go to GitHub users sethholmes and tazle for reporting this issue and providing analysis and a proposed fix.

Release 2.23.1 (6 Jun 2026)

• Fixed an SCP path traversal issue. Thanks go to Jaden Furtado for reporting this issue.

• Expanded previous fix to block unsafe user substitutions in server config. Thanks go to GitHub user cesabici-bit for reporting this issue.

• Fixed default value for reuse_address and reuse_port, matching the behaavior of asyncio.create_server(). Thanks go to Alexander Shlemin for reporting the inconsistency.

Commits

• 3577224 Bump version number up to 2.24.0 and update change log
• 321588d Avoid a coverage issue on a protocol definition
• eefa2fa Update the documentation to list supported SSHSIG options
• 9c35427 Add input validation on maximum packet size
• c3ab96f Remove unused import
• b3039b2 Bump cryptography from 2.8 to 48.0.1 in /docs
• 9ef998c Bump cryptography min version to pick up security vulnerability fix
• d1caa62 Add support for ML-KEM implementation in PyCA
• c0d349b Fix an issue with include directives in SSH confid files
• 87c58b2 Add support for creating and validating SSHSIG format signatures
• Additional commits viewable in compare view

Updates boto3 from 1.43.2 to 1.43.98

Commits

• 3314d84 Merge branch 'release-1.43.98'
• 3a3637f Bumping version to 1.43.98
• d802350 Add changelog entries from botocore
• ed7de96 Merge branch 'release-1.43.97'
• fba1e41 Merge branch 'release-1.43.97' into develop
• 275709c Bumping version to 1.43.97
• a5c0088 Add changelog entries from botocore
• 2be9967 Merge branch 'release-1.43.96'
• bc62489 Merge branch 'release-1.43.96' into develop
• 6e1774a Bumping version to 1.43.96
• Additional commits viewable in compare view

Updates daphne from 4.2.1 to 4.2.3

Changelog

Sourced from daphne's changelog.

4.2.3 (2026-07-21)

• Added --websocket-max-message-size and --websocket-max-frame-size CLI flags to the runserver management command for use in development.

4.2.2 (2026-06-03)

• Fixed a denial of service vulnerability via unbounded WebSocket message sizes. Daphne previously passed no message or frame size limits to autobahn, whose defaults are unbounded. This allowed an unauthenticated client to exhaust server memory by sending a very large WebSocket messages/frames (CVE-2026-44545).

  Both limits now default to 1 MiB and can be configured via the new --websocket-max-message-size and --websocket-max-frame-size CLI flags (or the matching Server constructor arguments). Pass 0 to restore the previous unlimited behaviour.

  Thanks to ParkHyunWoo for the report.

• Fixed a header injection vulnerability on the WebSocket upgrade path (CVE-2026-44546).

  Header values containing \x0b, \x0c, \x1c, \x1d, \x1e, or \x85 were parsed as a single header by Twisted but split into multiple headers by autobahn during the WebSocket handshake. An attacker could exploit this parser differential to smuggle additional headers (e.g. authentication tokens, X-Forwarded-For, Origin, Daphne-Root-Path) into the ASGI scope passed to the application.

  Daphne now rejects requests carrying these bytes in any header value with a 400 Bad Request response, as required by RFC 9110 §5.5.

  Thanks to Rene Henningsen for the report.

Commits

• 8a60e56 Bumped version and changelog for v4.2.3 release.
• 389b9a7 Add ability to configure websocket message size when running as django dev se...
• 0cd79c2 [pre-commit.ci] pre-commit autoupdate (#571)
• c19f2f4 Bumped version for v4.2.2 release.
• 32f8be0 Fixed CVE-2026-44545: Limit WebSocket sizes in autobahn config.
• 2628b7b Fixed CVE-2026-44546: Prevent header injection on WebSocket upgrade path
• fef65a7 Added .DS_Store files to .gitignore.
• 8b56967 Bump actions/setup-python from 5 to 6 (#569)
• 032c560 Bump actions/checkout from 4 to 5 (#564)
• cb23638 [pre-commit.ci] pre-commit autoupdate (#563)
• See full diff in compare view

Updates django from 6.0.6 to 6.1.1

Commits

• 249b13d [6.1.x] Bumped version for 6.1.1 release.
• 5f26fa8 [6.1.x] Added release date for 6.1.1.
• fdcf78a [6.1.x] Added remaining community package mentions to the documentation.
• 7241568 [6.1.x] Fixed #37222 -- Fixed QuerySet.distinct() crash on duplicated selecti...
• ef3fc80 [6.1.x] Fixed #37312, Refs #36605 -- Fixed annotation preservation and key se...
• b09cb6b [6.1.x] Clarified scope of object-level admin view permissions.
• a6d3aa2 [6.1.x] Corrected heading hierarchy in the admin actions documentation.
• 9031d41 [6.1.x] Clarified object-level permission checks in admin actions.
• fc805c6 [6.1.x] Fixed #37311 -- Prevented consumption of rhs iterators in annotation ...
• 4b0185a [6.1.x] Fixed #37300 -- Preserved parent instance hints on custom Prefetch qu...
• Additional commits viewable in compare view

Updates django-anymail from 15.0 to 15.2

Release notes

Sourced from django-anymail's releases.

v15.2

Changelog

v15.1

Changelog

Changelog

Sourced from django-anymail's changelog.

v15.2

2026-09-05

Features

* **Amazon SES:** Add support for inbound messages using S3 encryption.
  This requires the :pypi:`amazon-s3-encryption-client-python` package, which
  is now included when installing with the ``django-anymail[amazon-ses]`` extra.


Amazon SES: When using the S3 receipt action for inbound email, large
messages are now downloaded and parsed incrementally to reduce memory usage.


Mailtrap: Support signature verification for tracking event webhooks.


Mailtrap: Add support for inbound email. See
docs <https://anymail.dev/en/stable/esps/mailtrap/#inbound-webhook>.


Postmark: Add support for Postmark's bulk API. See
Using Postmark's bulk API <https://anymail.dev/en/stable/esps/postmark/#using-postmark-s-bulk-api>_.


Postmark: Add POSTMARK_MESSAGE_STREAM option to specify the id of the
Postmark message stream used for sending. With Django 6.1 MAILERS you can
use a different message_stream for each configured mailer.


Resend: Large inbound messages are now downloaded and parsed
incrementally to reduce memory usage.


Fixes

* **Amazon SES:** Avoid a Python bug that could corrupt images and attachments
  in inbound messages.

Inbound: AnymailInboundMessage's text and html attributes

and get_content_text() method now normalize line endings to \n.

In earlier releases, either \n or \r\n could be returned,

inconsistently and somewhat unpredictably.

v15.1
2026-07-30
Fixes


</tr></table>

... (truncated)

Commits

• 81c6505 Release 15.2
• 8ce3aca Mailgun: Stop polling event API in integration tests
• d3c121c Resend: Stream inbound messages
• 9ab940e Mailtrap: Make inbound download chunk size configurable
• 8540841 Remove unused AnymailInboundMessage.parse_raw_mime_file()
• 05dd35a Amazon SES: Stream inbound messages from S3
• d8b4593 Inbound: Normalize line endings on text parts
• aef5d9d Brevo: Update quirks documentation for HTML body
• bc8d362 Mailtrap: Make inbound work with example payload
• 7bc9520 Amazon SES: Support inbound S3 encryption
• Additional commits viewable in compare view

Updates django-ses from 4.7.2 to 4.8.0

Release notes

Sourced from django-ses's releases.

v4.8.0

What's Changed

• Update pyproject.toml, default python to 3.14 by @​pcraciunoiu in django-ses/django-ses#372
• Fix LocalStack CI; align Poetry Django bounds with tox matrix by @​pcraciunoiu in django-ses/django-ses#374
• Bump idna from 3.11 to 3.15 by @​dependabot[bot] in django-ses/django-ses#375
• Add Django 6.1 support, including use as a MAILERS backend by @​interplanetarychris in django-ses/django-ses#376

New Contributors

• @​interplanetarychris made their first contribution in django-ses/django-ses#376

Full Changelog: django-ses/django-ses@v4.7.2...v4.8.0

Changelog

Sourced from django-ses's changelog.

Change Log

For a list of releases, see: https://github.com/django-ses/django-ses/releases/

Upcoming (dev)

The following changes are not yet released, but are code complete:

Pulls and Issues:

• None

Features:

• None

Changes:

• None

Deprecations:

• None

Fixes:

• None

Current

4.8.0

Add support for Django 6.1, including use as a MAILERS backend.

SESBackend no longer forwards fail_silently to BaseEmailBackend.__init__(). Django 6.1 removed that argument: forwarding it raised InvalidMailer when the backend was instantiated from a MAILERS alias, and emitted a RemovedInDjango70Warning otherwise.

Pulls:

• django-ses/django-ses#376
• django-ses/django-ses#374
• django-ses/django-ses#372
• django-ses/django-ses#375

Past

4.7.2

Handle bounce with bounceType when status is missing

Pulls:

• django-ses/django-ses#369

... (truncated)

Commits

• f3e10d5 Update changelog, bump minor
• bfabcbd Add Django 6.1 support, including use as a MAILERS backend (#376)
• f49e897 Bump idna from 3.11 to 3.15 (#375)
• 8bbe73d Fix LocalStack CI; align Poetry Django bounds with tox matrix (#374)
• efbdc70 Update pyproject.toml, default python to 3.14 (#372)
• See full diff in compare view

Updates djangorestframework from 3.17.1 to 3.18.1

Release notes

Sourced from djangorestframework's releases.

3.18.1

What's Changed

Bug fixes

• Fix duplicate validation errors for GenericIPAddressField with protocol by @​browniebroke in encode/django-rest-framework#10011
• Fix int64 format detection for negative IntegerField minimums in OpenAPI schema definition by @​zainnadeem786 in encode/django-rest-framework#9989
• Fix list serializer on unique constraint validator by @​MehrazRumman in encode/django-rest-framework#10033
• Reject non-finite values (nan, inf) in FloatField by @​winklemad in encode/django-rest-framework#9998

Other changes

• Add a compatibility setting for ListSerializer error formats by @​Kub-AT in encode/django-rest-framework#10027
• Expand deprecation classes and review deprecation policy by @​browniebroke in encode/django-rest-framework#10034

New Contributors

• @​abidaliamanat9 made their first contribution in encode/django-rest-framework#10028
• @​epuronta made their first contribution in encode/django-rest-framework#10030
• @​Kub-AT made their first contribution in encode/django-rest-framework#10027
• @​winklemad made their first contribution in encode/django-rest-framework#9998

Full Changelog: encode/django-rest-framework@3.18.0...3.18.1

3.18.0

What's Changed

Breaking changes

• Drop support for Django 4.2, Django 5.0 and Django 5.1 by @​p-r-a-v-i-n in encode/django-rest-framework#9899
• Change errors for list serializers (many=True) to dict format by @​p-r-a-v-i-n in encode/django-rest-framework#9837

Features

• Add unaccent to SearchFilter by @​mgaligniana in encode/django-rest-framework#9385
• Add support for Django 6.1 by @​browniebroke in encode/django-rest-framework#10003
• Add @throttle_scope function based view decorator by @​d-ryzhykau in encode/django-rest-framework#9963
• Add nulls_distinct support to UniqueTogetherValidator by @​mag123c in encode/django-rest-framework#9866

Bug fixes

• Include choices param for non-editable fields by @​ticosax in encode/django-rest-framework#9929
• Improve cursor pagination template accessibility in browsable API by @​kosbemrunal in encode/django-rest-framework#9905
• Fix partial form data updates involving ListField by @​Natgho in encode/django-rest-framework#9902
• Fix crash due to browsable API extra action permissions by @​dlfoerster in encode/django-rest-framework#9934
• Handle unhashable BooleanField representation value by @​emfpdlzj in encode/django-rest-framework#9973
• Fix OpenAPI schema for zero numeric bounds on ListField children by @​zainnadeem786 in encode/django-rest-framework#9977
• Replace cc_delim_re usage with split_header_value for Django 6.1+ compatibility by @​laymonage in encode/django-rest-framework#9978
• Fix set_rollback to only rollback initialized connections by @​jdetaeye in encode/django-rest-framework#9599
• Fix DictField HTML input returning empty dict for missing fields by @​veeceey in encode/django-rest-framework#9891
• Raise clear error for unsupported unique-together list updates by @​zainnadeem786 in encode/django-rest-framework#9981

Other changes

• Prepare release 3.18.0 by @​github-actions[bot] in encode/django-rest-framework#10015

New Contributors

• @​Im-Bilal made their first contribution in encode/django-rest-framework#9967
• @​dlfoerster made their first contribution in encode/django-rest-framework#9934

... (truncated)

Commits

• dd23495 Prepare release 3.18.1 (#10036)
• cb1fb66 Install gettext in prepare-release
• 858f1fc Reject non-finite values (nan, inf) in FloatField (#9998)
• ea695cd Ensure translations are up to date when preparing release
• 0406c6e Update pygments requirement from >=2.17,<2.21 to ==2.21.* in the optional gro...
• 8c92e89 Expand deprecation classes and review deprecation policy (#10034)
• 3157a6a Update pytest config to native TOML format from v9 (#10035)
• 4f77428 Fixing issue #9484 (#10033)
• f17d70f Fix int64 format detection for negative IntegerField minimums in Open API s...
• 5668281 Add a compatibility setting for ListSerializer error formats (#10027)
• Additional commits viewable in compare view

Updates drf-spectacular from 0.29.0 to 0.30.0

Release notes

Sourced from drf-spectacular's releases.

0.30.0

After working through the backlog for several week, we are finally in a comfortable place again. Thank you to all contributors and users that waited patiently for me the catch up. It does not include all the PRs that were opened, but imho the most critical ones.

This release includes many small improvement, a few bug fixes, updates to the test suite and a renovated test matrix. Some minor schema corrections are to be expected, but nothing drastic. It is mostly fixing small inconsistencies and improving corner cases.

What's Changed

• Fix regression introduced in #1450 by @​hoefling in tfranzel/drf-spectacular#1469
• Fix dependency definition for Django 5.2 by @​ulgens in tfranzel/drf-spectacular#1487
• feat: add support for Django 6.0 and and DRF 3.17 by @​vgrozdanic in tfranzel/drf-spectacular#1496
• Add Support for unsigned integers uint16, uint32 and uint64 by @​ticosax in tfranzel/drf-spectacular#1483
• Implement x-spec-enum-id for type hint Choices. by @​noamkush in tfranzel/drf-spectacular#1486
• Clarifies Docs in Customizations.rst by @​APCBoston in tfranzel/drf-spectacular#1489
• Add setting to disable docstring extraction by @​philipstarkey in tfranzel/drf-spectacular#1491
• feat: add support for polymorphic built-in drf support by @​mastacheata in tfranzel/drf-spectacular#1490
• Document django-rest-knox support by @​johnthagen in tfranzel/drf-spectacular#1503
• add help text to spectacular management command arguments #1175 by @​jbbqqf in tfranzel/drf-spectacular#1502
• change conflicting license field for 3.8 by @​tfranzel in tfranzel/drf-spectacular#1504
• Pr1438 by @​tfranzel in tfranzel/drf-spectacular#1505
• Add blueprint for django-rest-knox by @​johnthagen in tfranzel/drf-spectacular#1506
• Pr1499 by @​tfranzel in tfranzel/drf-spectacular#1511
• Type hint build_bearer_security_scheme_object by @​johnthagen in tfranzel/drf-spectacular#1509
• Housekeeping by @​tfranzel in tfranzel/drf-spectacular#1512
• Pr1501 by @​tfranzel in tfranzel/drf-spectacular#1514
• Fix nullable FileField response schema when blank=True (#1493) by @​mojtabasohrabi in tfranzel/drf-spectacular#1501

New Contributors

• @​ulgens made their first contribution in tfranzel/drf-spectacular#1487
• @​vgrozdanic made their first contribution in tfranzel/drf-spectacular#1496
• @​noamkush made their first contribution in tfranzel/drf-spectacular#1486
• @​APCBoston made their first contribution in tfranzel/drf-spectacular#1489
• @​philipstarkey made their first contribution in tfranzel/drf-spectacular#1491
• @​mastacheata made their first contribution in tfranzel/drf-spectacular#1490
• @​jbbqqf made their first contribution in tfranzel/drf-spectacular#1502
• @​mojtabasohrabi made their first contribution in tfranzel/drf-spectacular#1501

Full Changelog: tfranzel/drf-spectacular@0.29.0...0.30.0

Changelog

Sourced from drf-spectacular's changelog.

0.30.0 (2026-07-06)

• Add OAS 3.2 schema for validation & test
• Type hint build_bearer_security_scheme_object ([#1509](https://github.com/tfranzel/drf-spectacular/issues/1509) <https://github.com/tfranzel/drf-spectacular/issues/1509>_) [johnthagen]
• Fix formatted CharField allow_blank handling ([#1511](https://github.com/tfranzel/drf-spectacular/issues/1511) <https://github.com/tfranzel/drf-spectacular/issues/1511>, ([#1499](https://github.com/tfranzel/drf-spectacular/issues/1499) <https://github.com/tfranzel/drf-spectacular/issues/1499>)) [Luciano de la Iglesia]
• Consider allOf anyOf with nullable on OAS3.1 [#1480](https://github.com/tfranzel/drf-spectacular/issues/1480) <https://github.com/tfranzel/drf-spectacular/issues/1480>_
• Proper handling for OAS 3.2
• fix modification of user-provided schematas [#1500](https://github.com/tfranzel/drf-spectacular/issues/1500) <https://github.com/tfranzel/drf-spectacular/issues/1500>_
• relax contraint on oneOf null case with OAS3.1 [#1480](https://github.com/tfranzel/drf-spectacular/issues/1480) <https://github.com/tfranzel/drf-spectacular/issues/1480>_
• Add blueprint for django-rest-knox ([#1506](https://github.com/tfranzel/drf-spectacular/issues/1506) <https://github.com/tfranzel/drf-spectacular/issues/1506>_) [johnthagen]
• Mitigate GeneratedField lost arguments and special case for DecimalField [#1166](https://github.com/tfranzel/drf-spectacular/issues/1166) <https://github.com/tfranzel/drf-spectacular/issues/1166>_
• Webhook explicit operationId ([#1505](https://github.com/tfranzel/drf-spectacular/issues/1505) <https://github.com/tfranzel/drf-spectacular/issues/1505>_)
• change conflicting license field for 3.8 ([#1504](https://github.com/tfranzel/drf-spectacular/issues/1504) <https://github.com/tfranzel/drf-spectacular/issues/1504>_)
• Document django-rest-knox support [johnthagen]
• add help text to spectacular management command arguments [#1175](https://github.com/tfranzel/drf-spectacular/issues/1175) <https://github.com/tfranzel/drf-spectacular/issues/1175>_ [Jean-Baptiste Braun]
• Mark FileField as nullable in response when not required [#1493](https://github.com/tfranzel/drf-spectacular/issues/1493) <https://github.com/tfranzel/drf-spectacular/issues/1493>_ [mojtaba sohrabi]
• Extend Choices hint fix with generated label description [#1486](https://github.com/tfranzel/drf-spectacular/issues/1486) <https://github.com/tfranzel/drf-spectacular/issues/1486>_
• Suppress py<=3.14 deprecation warning [#1497](https://github.com/tfranzel/drf-spectacular/issues/1497) <https://github.com/tfranzel/drf-spectacular/issues/1497>_
• Remove ancient DRF3.11 and Django2.2 due to contrib packages failing
• feat: add support for django 6.0 and and drf 3.17 [Vjeran Grozdanic]
• Add setting to disable docstring extraction [Phil Starkey]
• feat: add support for polymorphic built-in drf support [Benedikt Bauer]
• Clarifies post-processing hooks [Andy Piltser-Cowan]
• Clarifies customizations step 5 [Andy Piltser-Cowan]
• Fix dependency definition for Django 5.2 [Ülgen Sarıkavak]
• Implement x-spec-enum-id for type hint Choices. [Noam Kushinsky]
• Add Support for unsigned integers uint16, uint32 and uint64 [Nicolas Delaby]
• Fix regression introduced in [#1450](https://github.com/tfranzel/drf-spectacular/issues/1450) <https://github.com/tfranzel/drf-spectacular/issues/1450>_ ([#1469](https://github.com/tfranzel/drf-spectacular/issues/1469) <https://github.com/tfranzel/drf-spectacular/issues/1469>_) [Oleg Höfling]

Breaking changes / important additions:

• Many small improvement, bug fixes, updates to the test suite and renovated test matrix. Some minor schema corrections are to be expected, but nothing drastic.

Commits

• 1a5c44a version bump
• 6ba553f Merge pull request #1514 from tfranzel/pr1501
• d4787a4 Adapt FileField null handling #1501
• d867942 Merge pull request #1512 from tfranzel/housekeeping26
• 5685cf8 Add OAS 3.2 schema for validation & test
• 9fa6f7c minor cleanup
• 69033ea update linting version due to misleading security warnings
• d9e0de6 Type hint build_bearer_security_scheme_object (#1509)
• 9b18b30 Pr1499 (#1511)
• 6e3c72e Consider allOf anyOf with nullable on OAS3.1 #1480
• Additional commits viewable in compare view

Updates drf-spectacular-sidecar from 2026.6.1 to 2026.9.1

Commits

• b88657e version bump 2026.9.1
• 07766c9 version bump 2026.8.1
• fe54428 version bump 2026.7.1
• See full diff in compare view

Updates firebase-admin from 7.4.0 to 7.6.0

Release notes

Sourced from firebase-admin's releases.

Firebase Admin Python SDK v7.6.0

New Features

• feat(appcheck): Verify one-time tokens for replay protection (#976)
• feat(ml): deprecate Machine Learning APIs (#981)

Miscellaneous

• [chore] Release 7.6.0 (#985)
• chore(ml): Skip flaky ML tests blocking nightly builds (#979)
• update GitHub Actions to Node 24 versions (#974)
• chore(ci): Fix zizmor security findings in workflows (#956)

Firebase Admin Python SDK v7.5.0

New Features

• feat(fcm): Enable fid and deprecate token for Send API (#951)

Bug Fixes

• fix(deps): Added universe_domain override to MockGoogleComputeEngineCredential (#954)

Miscellaneous

• [chore] Release 7.5.0 (#958)
• chore(deps): update pytest-mock requirement from >=3.6.1 to >=3.15.1 (#959)
• chore(deps): update pytest-localserver requirement (#961)
• chore(deps): update pytest requirement from >=8.2.2 to >=8.4.2 (#946)
• chore(deps): update google-cloud-firestore requirement (#947)
• chore(deps): update pyjwt requirement from >=2.10.1 to >=2.12.1 (#948)
• chore: Pinned cryptography version for older PyPy interpreters (#952)

Commits

• cbacb02 [chore] Release 7.6.0 (#985)
• 2ef3414 feat(appcheck): Verify one-time tokens for replay protection (#976)
• a7aafa2 feat(ml): deprecate Machine Learning APIs (#981)
• eba8fa0 chore(ml): Skip flaky ML tests blocking nightly builds (#979)
• 62e559b update GitHub Actions to Node 24 versions (#974)
• b40e738 chore(ci): Fix zizmor security findings in workflows (#956)
• c5e66f8 [chore] Release 7.5.0 (#958)
• 0656dc2 chore(deps): update pytest-mock requirement from >=3.6.1 to >=3.15.1 (#959)
• a013e56 chore(deps): update pytest-localserver requirement (#961)
• 6d3fc8e chore(deps): update pytest requirement from >=8.2.2 to >=8.4.2 (#946)
• Additional commits viewable in compare view

Updates markdown from 3.10.2 to 3.10.3

Release notes

Sourced from markdown's releases.

Release 3.10.3

Fixed

• Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
• Add AI Policy to Contributing Guide.
• Officially document all included extensions as being in maintenance mode.
• Link the Extension API documentation to the API Reference (#1612).

Changelog

Sourced from markdown's changelog.

[3.10.3] - 2026-07-30

Fixed

• Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
• Add AI Policy to Contributing Guide.
• Officially document all included extensions as being in maintenance mode.
• Link the Extension API documentation to the API Reference (#1612).

Commits

• bb50627 Bump version to 3.10.3
• 8453df0 Update Extension API documentation
• 93ac448 Document that all extensions are in maintenance mode
• d38fd4a Create AI Policy
• ddead47 Prevent mixed =/- chars in Setext-style headings
• See full diff in compare view

Updates pycurl from 7.46.0 to 7.48.0

Release notes

Sourced from pycurl's releases.

PycURL 7.48.0

Changes in this release:

• Expose more CURLOPT_SSL_OPTIONS (patch by Scott Talbert)
• Read long description from README.rst instead of duplicating it in setup.py (patch by Scott Talbert)
• Fix test_redir_protocols_setopt (patch by Scott Talbert)
• Add CURL_LOCK_DATA_HSTS as a CurlShare option (patch by Scott Talbert)
• Add libpsl support to vcpkg installs for CI and wheel builds (patch by Scott Talbert)
• Configure nuget repo access as read-only from PRs (patch by Scott Talbert)
• Officially change project URL to https://pycurl.github.io/ (patch by Scott Talbert)
• Replace bare except clauses in examples with specific exception types (patch by Kotesh Kumar Yelamati)
• Add HTTP/3 support in libcurl wheel (patch by Will Noble)
• Fix segfault when calling duphandle() on a closed Curl handle (patch by Jorge Rocamora)
• Fix abort on non-text string arguments (patch by Jorge Rocamora)
• Fix CurlShare leak when close() detaches attached handles (patch by Jorge Rocamora)
• Document that views derived from the callback memoryview are not released (patch by Jorge Rocamora)
• Fix crash when duplicating a handle that uses set_ca_certs() (patch by Jorge Rocamora)
• Add CurlUrl object wrapping libcurl's URL API, with CURLOPT_CURLU support (patch by Jorge Rocamora)
• Fix callback exceptions being replaced by SystemError (patch by Jorge Rocamora)
• Fix test guard silently passing on real libcurl errors (patch by Jorge Rocamora)
• Update the docstring and manifest source lists (patch by Jorge Rocamora)
• Refuse pause() from a thread other than the performing one (patch by Jorge Rocamora)
• Add support for Python 3.15 (patch by Scott Talbert)
• Refuse integers for blob options instead of crashing (patch by Jorge Rocamora)
• Accept buffer objects for blob options (patch by Jorge Rocamora)
• Release all httppost encoded values and unset the form before MIMEPOST (patch by Jorge Rocamora)
• Reject callback return values that do not fit in an int (patch by Jorge Rocamora)
• Clear CurlMulti callbacks before deallocating attached handles (patch by Eric Buehl)
• Serve the test apps from a threaded WSGI server (patch by Jorge Rocamora)
• Add support for missing CURL options (patch by Khavish Anshudass Bhundoo)
• Add CURLOPT_SSL_EC_CURVES & CURLOPT_SSL_SIGNATURE_ALGORITHMS options (patch by Khavish Anshudass Bhundoo)
• Remove unused variable from do_curl_setopt_httppost (patch by Scott Talbert)
• test: silence WSGI test server access logging to stderr (patch by Scott Talbert)
• test: pin down oversized mime data_cb error assertions (patch by Scott Talbert)
• Give vendored OpenSSL a private OPENSSLDIR on Linux manylinux wheels (patch by Scott Talbert)
• Enable -Werror for the pycurl build in cibuildwheel without affecting vcpkg (patch by Scott Talbert)
• Handle libcurl options deprecated in 8.22.0 (patch by Scott Talbert)

PycURL 7.47.0

What's Changed

Other changes

• Use dynamic SSL ports in certificate tests (patch by Jorge Rocamora)
• Harden test_clear_assignment_inside_socket_callback_resets_socketp test (patch by Jorge Rocamora)
• Rename index field to idx in HstsIndex to avoid shadowing (patch by Jorge Rocamora)
• Fix test_callbacks_non_minus_one_return_continues_transfer on macOS (patch by Jorge Rocamora)
• Use PYCURL_REQUIRE_HANDLE and PYCURL_REQUIRE_NOT_RUNNING instead of magic numbers (patch by Jorge Rocamora)
• Convert pycurl to a Python package with the C extension renamed to pycurl._pycurl (patch by Jorge Rocamora)
• Fix flaky CONNECT_ONLY send/recv tests by waiting on active socket readiness instead of sleeping after EAGAIN (#997) (patch by Jorge Rocamora)
• Add PyMutex support on Python 3.13+ (patch by Jorge Rocamora)

... (truncated)

Changelog

Sourced from pycurl's changelog.

Version 7.48.0 [requires libcurl-7.19.0 or better] - 2026-09-15

    * Expose more CURLOPT_SSL_OPTIONS (patch by Scott Talbert)
    * Read long description from README.rst instead of duplicating it in setup.py (patch by Scott Talbert)
    * Fix test_redir_protocols_setopt (patch by Scott Talbert)
    * Add CURL_LOCK_DATA_HSTS as a CurlShare option (patch by Scott Talbert)
    * Add libpsl support to vcpkg installs for CI and wheel builds (patch by Scott Talbert)
    * Configure nuget repo access as read-only from PRs (patch by Scott Talbert)
    * Officially change project URL to https://pycurl.github.io/ (patch by Scott Talbert)
    * Replace bare except clauses in examples with specific exception types (patch by Kotesh Kumar Yelamati)
    * Add HTTP/3 support in libcurl wheel (patch by Will Noble)
    * Fix segfault when calling duphandle() on a closed Curl handle (patch by Jorge Rocamora)
    * Fix abort on non-text string arguments (patch by Jorge Rocamora)
    * Fix CurlShare leak when close() detaches attached handles (patch by Jorge Rocamora)
    * Document that views derived from the callback memoryview are not released (patch by Jorge Rocamora)
    * Fix crash when duplicating a handle that uses set_ca_certs() (patch by Jorge Rocamora)
    * Add CurlUrl object wrapping libcurl's URL API, with CURLOPT_CURLU support (patch by Jorge Rocamora)
    * Fix callback exceptions being replaced by SystemError (patch by Jorge Rocamora)
    * Fix test guard silently passing on real libcurl errors (patch by Jorge Rocamora)
    * Update the docstring and manifest source lists (patch by Jorge Rocamora)
    * Refuse pause() from a thread other than the performing one (patch by Jorge Rocamora)
    * Add support for Python 3.15 (patch by Scott Talbert)
    * Refuse integers for blob options instead of crashing (patch by Jorge Rocamora)
    * Accept buffer objects for blob options (patch by Jorge Rocamora)
    * Release all httppost encoded values and unset the form before MIMEPOST (patch by Jorge Rocamora)
    * Reject callback return values that do not fit in an int (patch by Jorge Rocamora)
    * Clear CurlMulti callbacks before deallocating attached handles (patch by Eric Buehl)
    * Serve the test apps from a threaded WSGI server (patch by Jorge Rocamora)
    * Add support for missing CURL options (patch by Khavish Anshudass Bhundoo)
    * Add CURLOPT_SSL_EC_CURVES & CURLOPT_SSL_SIGNATURE_ALGORITHMS options (patch by Khavish A...
Description has been truncated