Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 17 updates - #507

Closed
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/minor-and-patch-bfb833a2dc
Closed

build(deps): bump the minor-and-patch group across 1 directory with 17 updates#507
dependabot[bot] wants to merge 2 commits into
mainfrom
dependabot/uv/minor-and-patch-bfb833a2dc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 17 updates in the / directory:

Package From To
boto3 1.43.49 1.43.92
django-bootstrap5 26.2 26.3
django-htmx 1.28.0 1.29.0
django-markdownfield 0.20.2 0.21.1
django-oauth-toolkit 3.3.0 3.4.1
django 5.2.15 6.0.8
flower 2.0.1 2.1.0
faker 40.31.0 40.38.0
pytest-django 4.12.0 4.14.0
django-stubs 6.0.7 6.1.0
djlint 1.40.7 1.46.1
mkdocs-git-revision-date-localized-plugin 1.5.3 1.5.4
mkdocs-material 9.7.6 9.7.7
django-test-plus 2.4.1 2.6.2
pytest-lazy-fixtures 1.4.0 1.4.1
pgcli 4.5.0 4.6.0
ruff 0.15.21 0.16.7

Updates boto3 from 1.43.49 to 1.43.92

Commits

Updates django-bootstrap5 from 26.2 to 26.3

Changelog

Sourced from django-bootstrap5's changelog.

26.3 (2026-08-28)

  • Drop support for Django 4.2 (EOL).
  • Add support for Django 6.1.
  • Recognize month and datetime-local input-type widget subclasses as form-control widgets, enabling addons and floating labels for them (#309, #678).
  • Breaking: Rewrite radio_select.html to forward each option's own attrs (fixing custom attrs like data-total from a custom create_option() being silently dropped on RadioSelect/CheckboxSelectMultiple, #300) and to stop leaking disabled/required/form/an always-empty class="" onto the non-form-control wrapper <div> (#806). Individual radio/checkbox inputs now correctly get required/disabled, matching Django's own default widget rendering, instead of only the wrapper having them.
  • Fix server_side_validation not propagating from bootstrap_form/bootstrap_formset to field renderers (#612).
  • Fix placeholder being set on color and range inputs (#832).
  • Fix bugs in url_replace_param, jinja2 helpers, and BaseRenderer.render; add AGENTS.md (#830).
  • Add label argument to bootstrap_field to override a field's label text without touching the form definition — works with horizontal/floating layout and as the default placeholder (#635).
  • Add label_class setting so a default label CSS class can be set globally (#260).
  • Support addon_before/addon_after on Select widgets, excluding SelectMultiple and RadioSelect (#613).
  • Add layout setting to set a default layout for forms and fields (#190, #531, thanks @​blag).
  • Update default Bootstrap to 5.3.8.
  • Add input_class argument to bootstrap_field (#525, #535, thanks @​frolenkov-nikita).
  • Warn when layout="floating" is used with addon_before or addon_after (#833).
  • Add a maintenance-round section and release-note ordering convention to MAINTAINING.md.
  • Add tests for django.contrib.gis form field rendering.
  • Add a 15-minute timeout-minutes to every CI job.
  • Fix just build: ignore the transient pyproject.toml.orig in check-manifest.
  • Add typos spell checking to just lint.
  • Add MAINTAINING.md (version-support policy, release process); add scope statement and PR-review checklist to CONTRIBUTING.md.
  • Fix typos in CHANGELOG.md and docs/settings.rst.
  • Fix size docstrings for bootstrap_field/bootstrap_form and bootstrap_pagination — the documented values ('small'/'medium'/'large') don't exist; the accepted values are 'sm'/'md'/'lg' (#777).
Commits
  • 5c77b00 Release 26.3 (#862)
  • 6c94dd5 Add maintenance-round section and release-note ordering to MAINTAINING.md (#863)
  • cb28f12 Add tests for django.contrib.gis form field rendering (#861)
  • f6b0892 Add a 15-minute timeout to every CI job (#860)
  • 02a665b Add typos spell checking to just lint (#858)
  • 5ffe7c2 Fix check-manifest failure on main: ignore pyproject.toml.orig (#855)
  • 31aaefe Bump sqlparse from 0.5.5 to 0.6.0 (#857)
  • 59e4c4c Fix just build: ignore transient pyproject.toml.orig in check-manifest (#859)
  • 19404a3 Bump django from 5.2.15 to 5.2.16 (#856)
  • 20a5034 Note in AGENTS.md: re-run just upgrade after dependency constraint changes
  • Additional commits viewable in compare view

Updates django-htmx from 1.28.0 to 1.29.0

Changelog

Sourced from django-htmx's changelog.

1.29.0 (2026-08-06)

  • Vendor some stable htmx extensions, named per their htmx 4 versions: htmx-2-compat, hx-browser-indicator, hx-download, hx-head, hx-optimistic, hx-preload, hx-prompt, hx-ptag, hx-sse, hx-targets, hx-upsert, and hx-ws. Render their script tags with the new extensions argument of the htmx_script :doc:template tags \<template_tags>, which selects the extension files matching the htmx version in use:

    .. code-block:: django

    {% htmx_script version=4 extensions="hx-sse,hx-ws" %}

    hx-head, hx-preload, hx-sse, and hx-ws are available for both htmx versions 2 and 4; the rest are htmx 4 only.

    The special name htmax renders htmx 4’s htmax bundle of htmx plus its most popular extensions, in place of the plain htmx script:

    .. code-block:: django

    {% htmx_script version=4 extensions="htmax" %}

    PR [#614](https://github.com/adamchainz/django-htmx/issues/614) <https://github.com/adamchainz/django-htmx/pull/614>. Thanks to Rex Zhang for initial work in PR [#575](https://github.com/adamchainz/django-htmx/issues/575) <https://github.com/adamchainz/django-htmx/pull/575/commits>.

  • Upgrade the vendored htmx 2 to version 2.0.10 <https://github.com/bigskysoftware/htmx/blob/master/CHANGELOG.md#2010---2026-04-21>__.

    PR [#594](https://github.com/adamchainz/django-htmx/issues/594) <https://github.com/adamchainz/django-htmx/pull/594>__.

  • Upgrade the vendored htmx 4 to version 4.0.0-beta6 <https://github.com/bigskysoftware/htmx/releases/tag/v4.0.0-beta6>__.

    PR [#610](https://github.com/adamchainz/django-htmx/issues/610) <https://github.com/adamchainz/django-htmx/pull/610>__.

  • Add support for the polling tags protocol of the htmx 4 |hx-ptag extension|__:

    • :attr:HtmxDetails.ptag <django_htmx.middleware.HtmxDetails.ptag> reads the HX-PTag request header directly.

    • The :func:django_htmx.http.ptag view decorator implements the protocol, with an API mirroring Django’s |etag decorator|__. It computes the current tag with the given function and, when the HX-PTag request header matches, returns a 304 (Not Modified) response without calling the view, making htmx skip the swap. Otherwise, it calls the view and sets the HX-PTag response header.

    .. |hx-ptag extension| replace:: hx-ptag extension __ https://four.htmx.org/extensions/hx-ptag

    .. |etag decorator| replace:: etag decorator __ https://docs.djangoproject.com/en/stable/topics/conditional-view-processing/

    PR [#613](https://github.com/adamchainz/django-htmx/issues/613) <https://github.com/adamchainz/django-htmx/pull/613>__.

  • Switch package build backend from setuptools to uv_build <https://docs.astral.sh/uv/concepts/build-backend/>__. This makes builds with uv about nine times faster, since uv runs the backend natively, without creating a build environment or spawning a Python process. Additionally, source distributions no longer include test files, which setuptools previously included incompletely, missing the files needed to actually run them.

Commits

Updates django-markdownfield from 0.20.2 to 0.21.1

Changelog

Sourced from django-markdownfield's changelog.

0.21.1

Changed

  • Update custom EasyMDE to v2.21.0

0.21.0

Changed

  • Dependency Bumps.
  • Stop Ruff failing lint due to Python blocks in Readme.
  • Update supported versions.
Commits
  • 8771f6c update bundled easymde
  • 5ffb216 futher housekeeping for next release (not worth pushing for this)
  • 85b5ead accursed packaging
  • 158195e dependency bumps, new supported versions, lint fix
  • b0d7467 Bump actions/checkout from 6.0.3 to 7.0.0 (#61)
  • bcc021b Bump the uv-minor-patch group across 1 directory with 4 updates (#68)
  • 7e49e72 Bump django from 5.2.14 to 5.2.16 (#67)
  • d13e9a1 Bump pypa/gh-action-pypi-publish (#65)
  • ef8b880 Bump sqlparse from 0.5.5 to 0.6.0 (#69)
  • 7789b37 Bump the actions-minor-patch group with 2 updates (#59)
  • Additional commits viewable in compare view

Updates django-oauth-toolkit from 3.3.0 to 3.4.1

Release notes

Sourced from django-oauth-toolkit's releases.

3.4.1

This release is dominated by security hardening of redirect URI matching, token revocation and refresh token handling. Several entries below change behavior that was previously accepted, and they are spread across Fixed and Security: the "Upgrading to 3.4.1" section of the Upgrading guide collects everything you need to act on in one place, so start there. Of particular note: redirect URIs are now matched exactly per RFC 9700 §2.1, so a request may no longer carry query parameters, path parameters, credentials or a fragment that the registered URI does not have; REFRESH_TOKEN_EXPIRE_SECONDS, where set, is now enforced when a refresh token is presented rather than only by the cleartokens sweep; and the built-in templates now link a stylesheet shipped with the package instead of a CDN, so run collectstatic or the pages render unstyled.

Added

  • #681 Redirect URI mismatches are now diagnosed on the oauth2_provider logger at DEBUG, reporting the requested URI, every registered candidate it was compared against, and which component of each one differed (scheme, hostname, port, path, query). The same detail is emitted for post_logout_redirect_uri and for the token endpoint's comparison against the URI recorded on the grant. The error response is unchanged: the registered URIs are never disclosed to the requester, only to the server's log. See "Debugging redirect URI mismatches" in the documentation. Note that AbstractApplication.redirect_uri_allowed() and post_logout_redirect_uri_allowed() now call the new check_redirect_to_uri_allowed() (same verdict, plus the mismatch reasons) instead of redirect_to_uri_allowed(), so code that wrapped or patched the latter to influence those methods must target the former.
  • #634 A system check (oauth2_provider.W011) that warns when the AccessToken and RefreshToken models are swapped into different apps, and a new "Extending the token models" documentation section explaining how to swap the interrelated token models together.
  • #1623 Documentation ("Content Security Policy and the authorization form") on completing the authorization-code flow under a strict form-action Content Security Policy, which Chromium enforces against the post-authorization redirect to the client's redirect_uri.
  • #410 Documentation ("Resource scope syntax") clarifying that TokenHasResourceScope checks each required_scopes entry suffixed with the READ_SCOPE/WRITE_SCOPE setting value (defaults read/write, e.g. music:read, music:write), so a bare music scope is rejected; with the default settings-based scopes backend the suffixed scopes must be declared in SCOPES.
  • #1157 An "Upgrading" documentation page collecting the breaking changes and upgrade steps for every release that needs them — 2.0, 3.0 and this release — linked from the documentation index, so upgrade guidance is discoverable outside the CHANGELOG. A release that asks nothing of you has no section there, so a gap between two versions is an answer rather than an omission.
  • #452 Documentation ("Custom scopes backend") explaining how to replace the default settings-driven scopes backend via SCOPES_BACKEND_CLASS, including a worked model-based example that stores scopes in the database.
  • #1045 Tutorial ("Managing applications and tokens in the Django admin") walking through the admin site for applications and issued tokens, including client-secret hashing, credential masking, and that tokens cannot be created by hand.
  • #403 Translatable (gettext_lazy) verbose_name labels on every field of the Application, Grant, AccessToken, RefreshToken, IDToken and DeviceGrant models, so the Django admin and the authorization UI can be localized. Migration

... (truncated)

Changelog

Sourced from django-oauth-toolkit's changelog.

[3.4.1] - 2026-08-21

This release is dominated by security hardening of redirect URI matching, token revocation and refresh token handling. Several entries below change behavior that was previously accepted, and they are spread across Fixed and Security: the "Upgrading to 3.4.1" section of the Upgrading guide collects everything you need to act on in one place, so start there. Of particular note: redirect URIs are now matched exactly per RFC 9700 §2.1, so a request may no longer carry query parameters, path parameters, credentials or a fragment that the registered URI does not have; REFRESH_TOKEN_EXPIRE_SECONDS, where set, is now enforced when a refresh token is presented rather than only by the cleartokens sweep; and the built-in templates now link a stylesheet shipped with the package instead of a CDN, so run collectstatic or the pages render unstyled.

Added

  • #681 Redirect URI mismatches are now diagnosed on the oauth2_provider logger at DEBUG, reporting the requested URI, every registered candidate it was compared against, and which component of each one differed (scheme, hostname, port, path, query). The same detail is emitted for post_logout_redirect_uri and for the token endpoint's comparison against the URI recorded on the grant. The error response is unchanged: the registered URIs are never disclosed to the requester, only to the server's log. See "Debugging redirect URI mismatches" in the documentation. Note that AbstractApplication.redirect_uri_allowed() and post_logout_redirect_uri_allowed() now call the new check_redirect_to_uri_allowed() (same verdict, plus the mismatch reasons) instead of redirect_to_uri_allowed(), so code that wrapped or patched the latter to influence those methods must target the former.
  • #634 A system check (oauth2_provider.W011) that warns when the AccessToken and RefreshToken models are swapped into different apps, and a new "Extending the token models" documentation section explaining how to swap the interrelated token models together.
  • #1623 Documentation ("Content Security Policy and the authorization form") on completing the authorization-code flow under a strict form-action Content Security Policy, which Chromium enforces against the post-authorization redirect to the client's redirect_uri.
  • #410 Documentation ("Resource scope syntax") clarifying that TokenHasResourceScope checks each required_scopes entry suffixed with the READ_SCOPE/WRITE_SCOPE setting value (defaults read/write, e.g. music:read, music:write), so a bare music scope is rejected; with the default settings-based scopes backend the suffixed scopes must be declared in SCOPES.
  • #1157 An "Upgrading" documentation page collecting the breaking changes and upgrade steps for every release that needs them — 2.0, 3.0 and this release — linked from the documentation index, so upgrade guidance is discoverable outside the CHANGELOG. A release that asks nothing of you has no section there, so a gap between two versions is an answer rather than an omission.
  • #452 Documentation ("Custom scopes backend") explaining how to replace the default settings-driven scopes backend via SCOPES_BACKEND_CLASS, including a worked model-based example that stores scopes in the database.
  • #1045 Tutorial ("Managing applications and tokens in the Django admin") walking through the admin site for applications and issued tokens, including client-secret hashing, credential masking, and that tokens cannot be created by hand.
  • #403 Translatable (gettext_lazy) verbose_name labels on every field of the Application, Grant, AccessToken, RefreshToken, IDToken and DeviceGrant models, so the Django admin and the authorization UI can be localized. Migration

... (truncated)

Commits
  • db6c4f5 chore: 3.4.1 release (#1820)
  • 9c70975 fix: enforce device grant confirmation ownership (#1819)
  • 28bf64c perf: revoke refresh token families as a set on reuse detection (#1810)
  • f797b8a fix(validators): stop honoring revoked refresh tokens in the grace window (#1...
  • 11024a0 chore(deps): bump cryptography in the uv group across 1 directory (#1807)
  • 1e19d4d Log why a redirect URI failed to match (#1814)
  • 4f18e0e feat(templates): serve default styles from a bundled stylesheet (#1815)
  • ae05be9 feat(models): make model field labels translatable (#1812)
  • 2b1a322 fix(models): associate Application validation errors with their fields (#1811)
  • 0915396 fix(dcr): honour hashed token storage for registration access tokens (#1799)
  • Additional commits viewable in compare view

Updates django from 5.2.15 to 6.0.8

Commits
  • b282145 [6.0.x] Bumped version for 6.0.8 release.
  • 13debb6 [6.0.x] Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before...
  • 6af5da3 [6.0.x] Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry c...
  • 224dbc8 [6.0.x] Fixed CVE-2026-15337 -- Mitigated potential DoS in check_for_language().
  • 208f80c [6.0.x] Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial l...
  • e85df4d [6.0.x] Fixed #37069 -- Clarified that UniqueConstraint may create a unique i...
  • 015caad [6.0.x] Fixed #36770 -- Fixed incomplete mocking in SQLiteInMemoryTestDbs.
  • 6dbc749 [6.0.x] Fixed #37235 -- Added compatibility for sqlparse 0.5.5.
  • 457d178 [6.0.x] Fixed #37111 -- Added sprints quickstart docs page.
  • c81c6a9 [6.0.x] Fixed #37234 -- Fixed bulk_create() for late-saved related primary keys.
  • Additional commits viewable in compare view

Updates flower from 2.0.1 to 2.1.0

Release notes

Sourced from flower's releases.

v2.1.0

Features

  • Added read-only mode for the UI and API by @​MrEarle #1468
  • Updated the UI with a responsive design
  • Added persistent dark mode with light and system theme options
  • Added a browser favicon by @​rolfws #1502
  • Improved task search with boolean operators and field filters
  • Preserved task-table preferences across visits by @​fretman92 #1333
  • Added TLS support for Redis Sentinel by @​cyberjunk #1327
  • Added AMQPS support for RabbitMQ connections by @​borland667
  • Updated and auto-provisioned the Grafana dashboard

Performance and reliability

  • Moved blocking broker and control operations off the I/O loop
  • Made Redis queue inspection asynchronous and pipelined
  • Prevented duplicate worker inspections
  • Fixed broker connection leaks #1490
  • Purged stale offline-worker Prometheus metrics #1128
  • Persisted dashboard counters across restarts #787
  • Improved handling of missing custom configuration files

Bug fixes

  • Fixed Redis SSL configurations #1177
  • Fixed percent-encoded IPv6 broker addresses #1220
  • Stopped exposing broker alternate URLs in worker statistics #1512
  • Fixed broker page rendering when queue inspection fails by @​alexei #1501
  • Fixed autoscaling response interpolation by @​funkyrailroad #1427
  • Improved GitHub OAuth errors when email access is unavailable by @​bysiber #1486
  • Prevented authentication failures while rendering error pages #1268, #1499
  • Fixed task search for non-string values #1401
  • Fixed task state filters to require the state prefix by @​AleksaMCode #1516
  • Fixed worker names in timeout and rate-limit error responses by @​phanky1 #1506
  • Fixed startup banner output when using a dynamic port #1449
  • Fixed worker active-task totals when counts are null by @​M4RC0Sx #1511
  • Fixed undefined worker pool grow and shrink values by @​daydaychen #1324

Documentation

... (truncated)

Changelog

Sourced from flower's changelog.

Flower 2.1.0

Features

  • Added read-only mode for the UI and API #1468 by @​MrEarle.
  • Updated the UI with a responsive design.
  • Added persistent dark mode with light and system theme options.
  • Added a browser favicon #1502 by @​rolfws.
  • Improved task search with boolean operators and field filters.
  • Preserved task-table preferences across visits #1333 by @​fretman92.
  • Added TLS support for Redis Sentinel #1327 by @​cyberjunk.
  • Added AMQPS support for RabbitMQ connections by @​borland667.
  • Updated and auto-provisioned the Grafana dashboard.
  • Enabled API access in the Docker Compose demo.

Performance and reliability

  • Moved blocking broker and control operations off the I/O loop.
  • Made Redis queue inspection asynchronous and pipelined.
  • Prevented duplicate worker inspections.
  • Fixed broker connection leaks #1490.
  • Purged stale offline-worker Prometheus metrics #1128.
  • Persisted dashboard counters across restarts #787.
  • Improved handling of missing custom configuration files.
  • Fixed startup banner output when using a dynamic port #1449.
  • Fixed worker active-task totals when counts are null #1511 by @​M4RC0Sx.
  • Fixed undefined worker pool grow and shrink values #1324 by @​daydaychen.

Bug fixes

  • Fixed Redis SSL configurations #1177.
  • Fixed percent-encoded IPv6 broker addresses #1220.
  • Stopped exposing broker alternate URLs in worker statistics #1512.
  • Fixed broker page rendering when queue inspection fails #1501 by @​alexei.
  • Fixed autoscaling response interpolation #1427 by @​funkyrailroad.
  • Improved GitHub OAuth errors when email access is unavailable #1486 by @​bysiber.
  • Prevented authentication failures while rendering error pages #1268, #1499.
  • Fixed task search for non-string values #1401.
  • Fixed task state filters to require the state prefix #1516 by @​AleksaMCode.
  • Fixed worker names in timeout and rate-limit error responses #1506 by @​phanky1.

Documentation

... (truncated)

Commits
  • 3597bd1 Set release version
  • d083f73 Update documentation for 2.1.0
  • b58869b Merge remote-tracking branch 'origin/master' into 2.0
  • e6cf8ef Add Python 3.13 and 3.14 support
  • 8ecede9 Document custom authentication providers
  • 00d310b Persist dashboard counters across restarts
  • 0a51160 Purge offline workers from metrics
  • 72a09c8 Prevent duplicate worker inspections
  • 17ead90 Make Redis queue inspection non-blocking
  • b11ddcb Update blocking operation handling
  • Additional commits viewable in compare view

Updates faker from 40.31.0 to 40.38.0

Release notes

Sourced from faker's releases.

Release v40.38.0

See CHANGELOG.md.

Release v40.37.0

See CHANGELOG.md.

Release v40.36.0

See CHANGELOG.md.

Release v40.35.0

See CHANGELOG.md.

Release v40.34.0

See CHANGELOG.md.

Release v40.33.2

See CHANGELOG.md.

Release v40.33.1

See CHANGELOG.md.

Release v40.33.0

See CHANGELOG.md.

Release v40.32.0

See CHANGELOG.md.

Changelog

Sourced from faker's changelog.

v40.38.0 - 2026-09-01

v40.37.0 - 2026-08-20

v40.36.0 - 2026-07-24

  • Fix: correct uk_UA bban_format to 6 digits + 19 letters so iban() generates valid Ukrainian IBANs (#2417). Thanks @​CedricConday.

v40.35.0 - 2026-07-22

  • Fix: add correct bban_format so ru_RU iban() generates valid Russian IBANs (#2416). Thanks @​CedricConday.

v40.34.0 - 2026-07-22

  • Fix: correct BBAN length so da_DK iban() generates valid Danish IBANs (#2409). Thanks @​CedricConday.

v40.33.2 - 2026-07-22

  • Validate positive=True against a non-positive max_value in pydecimal (#2428). Thanks @​Sreekant13.

v40.33.1 - 2026-07-22

  • Make uuid1() and uuid7() reproducible under a fixed seed (#2427). Thanks @​vidigoat.

v40.33.0 - 2026-07-22

  • Add alphanumeric CNPJ support for pt_BR via flag (#2402). Thanks @​moohbr.

v40.32.0 - 2026-07-20

Commits
  • 59a6872 Bump version: 40.37.0 → 40.38.0
  • 2407c71 📝 Update CHANGELOG.md
  • f6a8427 💄 Format code
  • ce50bde Add step to check for existing issues or PRs
  • 4ca9116 Add si_LK (Sinhala, Sri Lanka) person provider (#2430)
  • c5a0093 mention pull request template in contributing doc
  • 4a464c8 Bump version: 40.36.0 → 40.37.0
  • f33e820 📝 Update CHANGELOG.md
  • 74efb07 fix(en_IE): generate structurally valid Irish IBANs (#2411)
  • d80d125 add Pillow as an optional dependency (#2442)
  • Additional commits viewable in compare view

Updates pytest-django from 4.12.0 to 4.14.0

Release notes

Sourced from pytest-django's releases.

v4.14.0

https://pytest-django.readthedocs.io/en/stable/changelog.html#v4-14-0-2026-08-10

v4.13.0

https://pytest-django.readthedocs.io/en/latest/changelog.html#v4-13-0-2026-08-06

Changelog

Sourced from pytest-django's changelog.

v4.14.0 (2026-08-10)

Compatibility ^^^^^^^^^^^^^

  • Restored (unofficial) support for Django 5.0 and Django 5.1.

Improvements ^^^^^^^^^^^^

  • Added a django extra to the package. By depending on this extra (e.g. pip install pytest-django[django]), the dependency resolver will ensure you get a version of pytest-django that is compatible with your version of Django (lower bound only). At least from now on...

v4.13.0 (2026-08-06)

Compatibility ^^^^^^^^^^^^^

  • Dropped support for Django 4.2 and 5.1.

Improvements ^^^^^^^^^^^^

  • Export pytest_django.Settings from the top-level pytest_django module so the :fixture:settings fixture can be type-annotated ([#1257](https://github.com/pytest-dev/pytest-django/issues/1257) <https://github.com/pytest-dev/pytest-django/issues/1257>__).

Bugfixes ^^^^^^^^

  • Fixed type hints of assert methods to match actual signature (PR [#1271](https://github.com/pytest-dev/pytest-django/issues/1271) <https://github.com/pytest-dev/pytest-django/pull/1271>__)
  • Handled Django 6.2's ImproperlyConfigured (in addition to ImportError) when the configured DJANGO_SETTINGS_MODULE cannot be imported, so pytest-django still shows its guidance message.
  • Fixed django_db(transaction=True) tests being set up twice, which repeated the serialized_rollback restore and the fixtures load, and sent setting_changed and post_migrate twice when available_apps is set.
  • Fixed --help/--version failing with AppRegistryNotReady (surfaced as a could not load initial conftests warning) when a conftest.py imports Django models at the top level. Django is now set up even when --help/--version are passed, before the initial conftests are loaded for these options ([#1152](https://github.com/pytest-dev/pytest-django/issues/1152) <https://github.com/pytest-dev/pytest-django/issues/1152>__).
Commits
  • 1a6b612 Release 4.14.0
  • fffb11d docs: remove $ for consistency
  • e8c0606 docs: move the django extra explanation
  • b66deb6 tests: strict import to make pyright happy
  • 823db39 tests: fix wrong type (typing only)
  • a1eaf5d Drop django<5 message asserts compat
  • 2ea1423 Fix _pre_setup_ran_eagerly on Django 5.0 and 5.1
  • 903429c Add django extra to ensure Django dependency compatible lower bound
  • 9661589 docs: prefer newer pytest config TOML format
  • 7646196 docs: remove needless comment
  • Additional commits viewable in compare view

Updates django-stubs from 6.0.7 to 6.1.0

Commits

offbyone and others added 2 commits September 18, 2026 09:08
@offbyone
bump django lower bound to 6.0
5d23f73
@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 1…
c5ab8a8 
…7 updates

Bumps the minor-and-patch group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [boto3](https://github.com/boto/boto3) | `1.43.49` | `1.43.92` |
| [django-bootstrap5](https://github.com/zostera/django-bootstrap5) | `26.2` | `26.3` |
| [django-htmx](https://github.com/adamchainz/django-htmx) | `1.28.0` | `1.29.0` |
| [django-markdownfield](https://github.com/dmptrluke/django-markdownfield) | `0.20.2` | `0.21.1` |
| [django-oauth-toolkit](https://github.com/django-oauth/django-oauth-toolkit) | `3.3.0` | `3.4.1` |
| [django](https://github.com/django/django) | `5.2.15` | `6.0.8` |
| [flower](https://github.com/mher/flower) | `2.0.1` | `2.1.0` |
| [faker](https://github.com/joke2k/faker) | `40.31.0` | `40.38.0` |
| [pytest-django](https://github.com/pytest-dev/pytest-django) | `4.12.0` | `4.14.0` |
| [django-stubs](https://github.com/typeddjango/django-stubs) | `6.0.7` | `6.1.0` |
| [djlint](https://github.com/djlint/djLint) | `1.40.7` | `1.46.1` |
| [mkdocs-git-revision-date-localized-plugin](https://github.com/timvink/mkdocs-git-revision-date-localized-plugin) | `1.5.3` | `1.5.4` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.7.6` | `9.7.7` |
| [django-test-plus](https://github.com/revsys/django-test-plus) | `2.4.1` | `2.6.2` |
| [pytest-lazy-fixtures](https://github.com/dev-petrov/pytest-lazy-fixtures) | `1.4.0` | `1.4.1` |
| [pgcli](https://github.com/dbcli/pgcli) | `4.5.0` | `4.6.0` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.21` | `0.16.7` |



Updates `boto3` from 1.43.49 to 1.43.92
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.49...1.43.92)

Updates `django-bootstrap5` from 26.2 to 26.3
- [Changelog](https://github.com/zostera/django-bootstrap5/blob/main/CHANGELOG.md)
- [Commits](zostera/django-bootstrap5@v26.2...v26.3)

Updates `django-htmx` from 1.28.0 to 1.29.0
- [Changelog](https://github.com/adamchainz/django-htmx/blob/main/docs/changelog.rst)
- [Commits](adamchainz/django-htmx@1.28.0...1.29.0)

Updates `django-markdownfield` from 0.20.2 to 0.21.1
- [Changelog](https://github.com/dmptrluke/django-markdownfield/blob/master/CHANGELOG.md)
- [Commits](dmptrluke/django-markdownfield@v0.20.2...v0.21.1)

Updates `django-oauth-toolkit` from 3.3.0 to 3.4.1
- [Release notes](https://github.com/django-oauth/django-oauth-toolkit/releases)
- [Changelog](https://github.com/django-oauth/django-oauth-toolkit/blob/master/CHANGELOG.md)
- [Commits](django-oauth/django-oauth-toolkit@3.3.0...3.4.1)

Updates `django` from 5.2.15 to 6.0.8
- [Commits](django/django@5.2.15...6.0.8)

Updates `flower` from 2.0.1 to 2.1.0
- [Release notes](https://github.com/mher/flower/releases)
- [Changelog](https://github.com/mher/flower/blob/v2.1.0/CHANGELOG.md)
- [Commits](mher/flower@v2.0.1...v2.1.0)

Updates `faker` from 40.31.0 to 40.38.0
- [Release notes](https://github.com/joke2k/faker/releases)
- [Changelog](https://github.com/joke2k/faker/blob/master/CHANGELOG.md)
- [Commits](joke2k/faker@v40.31.0...v40.38.0)

Updates `pytest-django` from 4.12.0 to 4.14.0
- [Release notes](https://github.com/pytest-dev/pytest-django/releases)
- [Changelog](https://github.com/pytest-dev/pytest-django/blob/main/docs/changelog.rst)
- [Commits](pytest-dev/pytest-django@v4.12.0...v4.14.0)

Updates `django-stubs` from 6.0.7 to 6.1.0
- [Release notes](https://github.com/typeddjango/django-stubs/releases)
- [Commits](typeddjango/django-stubs@6.0.7...6.1.0)

Updates `djlint` from 1.40.7 to 1.46.1
- [Release notes](https://github.com/djlint/djLint/releases)
- [Changelog](https://github.com/djlint/djLint/blob/master/CHANGELOG.md)
- [Commits](djlint/djLint@v1.40.7...v1.46.1)

Updates `mkdocs-git-revision-date-localized-plugin` from 1.5.3 to 1.5.4
- [Release notes](https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/releases)
- [Commits](timvink/mkdocs-git-revision-date-localized-plugin@v1.5.3...v1.5.4)

Updates `mkdocs-material` from 9.7.6 to 9.7.7
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.7.6...9.7.7)

Updates `django-test-plus` from 2.4.1 to 2.6.2
- [Changelog](https://github.com/revsys/django-test-plus/blob/main/CHANGELOG.md)
- [Commits](revsys/django-test-plus@2.4.1...2.6.2)

Updates `pytest-lazy-fixtures` from 1.4.0 to 1.4.1
- [Release notes](https://github.com/dev-petrov/pytest-lazy-fixtures/releases)
- [Commits](dev-petrov/pytest-lazy-fixtures@1.4.0...1.4.1)

Updates `pgcli` from 4.5.0 to 4.6.0
- [Changelog](https://github.com/dbcli/pgcli/blob/main/changelog.rst)
- [Commits](dbcli/pgcli@v4.5.0...v4.6.0)

Updates `ruff` from 0.15.21 to 0.16.7
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.21...0.16.7)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.92
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: django-bootstrap5
  dependency-version: '26.3'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: django-htmx
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: django-markdownfield
  dependency-version: 0.21.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: django-oauth-toolkit
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: django
  dependency-version: 6.0.8
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: minor-and-patch
- dependency-name: flower
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: faker
  dependency-version: 40.38.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pytest-django
  dependency-version: 4.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: django-stubs
  dependency-version: 6.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: djlint
  dependency-version: 1.46.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: mkdocs-git-revision-date-localized-plugin
  dependency-version: 1.5.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: django-test-plus
  dependency-version: 2.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pytest-lazy-fixtures
  dependency-version: 1.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: pgcli
  dependency-version: 4.6.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: ruff
  dependency-version: 0.16.7
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 18, 2026
@dependabot @github

dependabot Bot commented on behalf of github Sep 23, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 23, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/minor-and-patch-bfb833a2dc branch September 23, 2026 04:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@offbyone