build(deps): bump the minor-and-patch group across 1 directory with 17 updates by dependabot[bot] · Pull Request #517 · WorldconVotingSystems/nomnom

dependabot · 2026-10-14T20:07:47Z

Bumps the minor-and-patch group with 17 updates in the / directory:

Package	From	To
boto3	`1.43.49`	`1.43.113`
django-bootstrap5	`26.2`	`26.4`
django-htmx	`1.28.0`	`1.29.0`
django-markdownfield	`0.20.2`	`0.21.1`
django-oauth-toolkit	`3.3.0`	`3.4.1`
flower	`2.0.1`	`2.2.0`
faker	`40.31.0`	`40.43.0`
pytest-django	`4.12.0`	`4.14.0`
django-stubs	`6.0.7`	`6.1.2`
djlint	`1.40.7`	`1.46.4`
mkdocs-git-revision-date-localized-plugin	`1.5.3`	`1.6.0`
mkdocs-material	`9.7.6`	`9.7.7`
django-test-plus	`2.4.1`	`2.7.0`
pytest-lazy-fixtures	`1.4.0`	`1.4.1`
pgcli	`4.5.0`	`4.7.1`
ruff	`0.15.21`	`0.17.0`
tenacity	`9.1.4`	`9.2.1`

Updates boto3 from 1.43.49 to 1.43.113

Commits

69ed308 Merge branch 'release-1.43.113'
741f8d9 Bumping version to 1.43.113
ad1c6b5 Add changelog entries from botocore
9ca5e36 Merge branch 'release-1.43.112'
f5581ba Merge branch 'release-1.43.112' into develop
6f065c3 Bumping version to 1.43.112
a980c79 Add changelog entries from botocore
c14ee96 Merge branch 'release-1.43.111'
3557491 Merge branch 'release-1.43.111' into develop
2309640 Bumping version to 1.43.111
Additional commits viewable in compare view

Updates django-bootstrap5 from 26.2 to 26.4

Changelog

Sourced from django-bootstrap5's changelog.

26.4 (2026-10-11)

Breaking: Drop support for Python 3.10, end of life since 2026-10-01. The floor is now Python 3.11.

Breaking: Remove django_bootstrap5.text.text_concat. It is a general string helper, not a Bootstrap concern, and nothing in the package has ever called it: its one caller joined an icon to a button label and went away when icon support was removed, before this package was forked. It was never documented. If you import it, the replacement is three lines (#889).

Remove BaseRenderer.get_size_class, which nothing called. The module-level get_size_class in django_bootstrap5.size is the one in use, and the method shadowed its name inside the class body.

Fix a template_name set on a RadioSelect, CheckboxSelectMultiple or ClearableFileInput subclass being overwritten by this package's own widget template (#388). Widgets that still carry Django's default template are unaffected.

Accept a non-string URL value in css_url, javascript_url and theme_url, so a lazy static() value can be used directly instead of only inside the dict form (#616). Passing one raised ValueError: dictionary update sequence element [#0](https://github.com/zostera/django-bootstrap5/issues/0) has length 1; 2 is required, because anything that was not a str was treated as a dict of attributes. The docs now cover serving Bootstrap from your own static files, which needs the URL resolved at render time so ManifestStaticFilesStorage can supply the hashed filename.

Recognize week, search and color input-type widgets as form-control widgets, so addon_before/addon_after work on them, and warn instead of silently dropping addons on a widget that cannot have them (#743, #872). Floating labels stay unsupported for color, where Bootstrap sizes the swatch itself.

Add the documented inline_field_class setting to BOOTSTRAP5_DEFAULTS, where it was missing. Its effective default is unchanged.

Store src/django_bootstrap5/widgets.py with LF line endings, like every other file and as .editorconfig requires. It was the only file in the repository with CRLF.

Support addon_before/addon_after on fields with layout="floating" (#866). The form-floating element is now nested inside the input-group, as Bootstrap's floating-label input-group markup requires, instead of the two being alternatives. This removes the warning added in 26.3 (#833), which existed because the combination was unsupported.

Add a system check that warns about keys in the BOOTSTRAP5 setting that the package does not read, such as a setting removed in an earlier release or one carried over from django-bootstrap3 or django-bootstrap4 (django_bootstrap5.W001, #867). Silence it with SILENCED_SYSTEM_CHECKS if you keep extra keys deliberately.

Harden the release and Dependabot workflows, and write down the dependency update policy in MAINTAINING.md. The Dependabot auto-merge job gated on github.actor, which is spoofable in a pull_request_target context, and now gates on the pull request author, with fetch-metadata as a second check. The publishing job no longer restores a build cache, so a poisoned entry cannot reach what is uploaded to PyPI. Every job in every workflow now carries timeout-minutes, and ci.yml declares permissions: contents: read.

Fail just lint on invisible and bidirectional control characters, which can make source read differently to a human than to the compiler (Trojan Source, CVE-2021-42574).

Cover every statement and branch in the test suite, and hold it there with fail_under = 100, checked by a coverage report step in CI. Until that step existed the floor was set but never run.

Fail the CI gate when any job fails, not only the test matrix. A failing docs or packaging build could previously be merged.

Test on Python 3.15 against Django 6.1 and main. The job is non-blocking and 3.15 is not advertised as supported, because no Django release claims it yet.

Drop a duplicate coverage[toml] entry from the test dependency group and sort it alphabetically.

Add just release-check to list src/ changes against changelog entries before a release.

Show commits that touch nothing in src/ in just release-check as a second group, instead of hiding them. Tooling, CI and documentation changes belong in the release notes too, and the old output read as a complete list while being a filtered one.

Fail just build when uv.lock does not name the version in pyproject.toml, and add just relock to fix it. uv sync --frozen does not check the project's own version, so a stale lock passed every packaging check.

Add the shared AI assistance policy to CONTRIBUTING.md. Using an AI assistant is fine; saying so when it wrote a meaningful part of a change is the requirement, and it is not held against you.

Document migrating from django-bootstrap3 in MIGRATE.md: renamed settings and their changed defaults, the removed buttons, bootstrap_icon and bootstrap_message_classes, renamed tag arguments, and the Bootstrap class changes that take most of the work.

Cover jQuery in the migration guide: what replaces the jquery_url setting and the jQuery tags, and that django-bootstrap3's default pointed at a CDN alias still serving jQuery 1.11.1, so choosing a version is likely a jump of two majors. Also say to delete the old BOOTSTRAP3 block, since W001 only inspects BOOTSTRAP5 and a leftover block reads like live configuration with nothing warning about it.

Fix the release process in MAINTAINING.md: the version bump goes through a PR, not a direct push to protected main.

Say in MAINTAINING.md that just release-check reporting no Unreleased entries straight after a cut means nothing is pending, not that the changelog was lost.

Note in MAINTAINING.md why the Django dependency carries no upper bound.

26.3 (2026-08-28)

Drop support for Django 4.2 (EOL).

Add support for Django 6.1.

Recognize month and datetime-local input-type widget subclasses as form-control widgets, enabling addons and floating labels for them (#309, #678).

Breaking: Rewrite radio_select.html to forward each option's own attrs (fixing custom attrs like data-total from a custom create_option() being silently dropped on RadioSelect/CheckboxSelectMultiple, #300) and to stop leaking disabled/required/form/an always-empty class="" onto the non-form-control wrapper <div> (#806). Individual radio/checkbox inputs now correctly get required/disabled, matching Django's own default widget rendering, instead of only the wrapper having them.

Fix server_side_validation not propagating from bootstrap_form/bootstrap_formset to field renderers (#612).

Fix placeholder being set on color and range inputs (#832).

Fix bugs in url_replace_param, jinja2 helpers, and BaseRenderer.render; add AGENTS.md (#830).

Add label argument to bootstrap_field to override a field's label text without touching the form definition — works with horizontal/floating layout and as the default placeholder (#635).

Add label_class setting so a default label CSS class can be set globally (#260).

Support addon_before/addon_after on Select widgets, excluding SelectMultiple and RadioSelect (#613).

Add layout setting to set a default layout for forms and fields (#190, #531, thanks @blag).

Update default Bootstrap to 5.3.8.

Add input_class argument to bootstrap_field (#525, #535, thanks @frolenkov-nikita).

Warn when layout="floating" is used with addon_before or addon_after (#833).

Add a maintenance-round section and release-note ordering convention to MAINTAINING.md.

Add tests for django.contrib.gis form field rendering.

Add a 15-minute timeout-minutes to every CI job.

Fix just build: ignore the transient pyproject.toml.orig in check-manifest.

Add typos spell checking to just lint.

Add MAINTAINING.md (version-support policy, release process); add scope statement and PR-review checklist to CONTRIBUTING.md.

... (truncated)

Commits

2c7bf18 release: 26.4 (#895)
209aeb2 Sync the release preflight from django-marina (#896)
601049e Drop support for Python 3.10 (EOL) (#894)
2cba47c docs: cover jQuery and the stale settings block in the migration guide (#893)
2a0cf12 Document migrating from django-bootstrap3 (#892)
8d52ca5 Remove text_concat (#890)
f16f424 Check coverage against the floor in CI (#888)
e24cecc Harden the workflows, and write down the dependency update policy (#887)
7dd4834 Cover every statement and branch, and hold the line at 100% (#886)
643c82e Un-cut 26.4: fold the section back into Unreleased and return to 26.3 (#885)
Additional commits viewable in compare view

Updates django-htmx from 1.28.0 to 1.29.0

Changelog

Sourced from django-htmx's changelog.

1.29.0 (2026-08-06)
Vendor some stable htmx extensions, named per their htmx 4 versions: htmx-2-compat, hx-browser-indicator, hx-download, hx-head, hx-optimistic, hx-preload, hx-prompt, hx-ptag, hx-sse, hx-targets, hx-upsert, and hx-ws. Render their script tags with the new extensions argument of the htmx_script :doc:template tags \<template_tags>, which selects the extension files matching the htmx version in use:

.. code-block:: django
{% htmx_script version=4 extensions="hx-sse,hx-ws" %}
hx-head, hx-preload, hx-sse, and hx-ws are available for both htmx versions 2 and 4; the rest are htmx 4 only.

The special name htmax renders htmx 4’s htmax bundle of htmx plus its most popular extensions, in place of the plain htmx script:

.. code-block:: django
{% htmx_script version=4 extensions="htmax" %}
PR [#614](https://github.com/adamchainz/django-htmx/issues/614) <https://github.com/adamchainz/django-htmx/pull/614>. Thanks to Rex Zhang for initial work in PR [#575](https://github.com/adamchainz/django-htmx/issues/575) <https://github.com/adamchainz/django-htmx/pull/575/commits>.
Upgrade the vendored htmx 2 to version 2.0.10 <https://github.com/bigskysoftware/htmx/blob/master/CHANGELOG.md#2010---2026-04-21>__.

PR [#594](https://github.com/adamchainz/django-htmx/issues/594) <https://github.com/adamchainz/django-htmx/pull/594>__.

Upgrade the vendored htmx 4 to version 4.0.0-beta6 <https://github.com/bigskysoftware/htmx/releases/tag/v4.0.0-beta6>__.

PR [#610](https://github.com/adamchainz/django-htmx/issues/610) <https://github.com/adamchainz/django-htmx/pull/610>__.

Add support for the polling tags protocol of the htmx 4 |hx-ptag extension|__:

:attr:HtmxDetails.ptag <django_htmx.middleware.HtmxDetails.ptag> reads the HX-PTag request header directly.

The :func:django_htmx.http.ptag view decorator implements the protocol, with an API mirroring Django’s |etag decorator|__. It computes the current tag with the given function and, when the HX-PTag request header matches, returns a 304 (Not Modified) response without calling the view, making htmx skip the swap. Otherwise, it calls the view and sets the HX-PTag response header.

.. |hx-ptag extension| replace:: hx-ptag extension __ https://four.htmx.org/extensions/hx-ptag

.. |etag decorator| replace:: etag decorator __ https://docs.djangoproject.com/en/stable/topics/conditional-view-processing/

PR [#613](https://github.com/adamchainz/django-htmx/issues/613) <https://github.com/adamchainz/django-htmx/pull/613>__.

Switch package build backend from setuptools to uv_build <https://docs.astral.sh/uv/concepts/build-backend/>__. This makes builds with uv about nine times faster, since uv runs the backend natively, without creating a build environment or spawning a Python process. Additionally, source distributions no longer include test files, which setuptools previously included incompletely, missing the files needed to actually run them.

Commits

a27556e Version 1.29.0
f59765a Switch build backend to uv_build (#615)
e2da8c5 Note :inherited required on htmx 4 in installation docs (#608)
dcf641f Vendor htmx extensions (#614)
007f97c Add htmx 4 polling support (#613)
f2c3a13 Remove sphinx-build-compatibility (#612)
9404744 [pre-commit.ci] pre-commit autoupdate (#611)
07171ea Upgrade htmx 4 to 4.0.0-beta6 (#610)
c1af311 Upgrade htmx to version 2.0.10 (#594)
65a895a [pre-commit.ci] pre-commit autoupdate (#605)
Additional commits viewable in compare view

Updates django-markdownfield from 0.20.2 to 0.21.1

Changelog

Sourced from django-markdownfield's changelog.

0.21.1

Changed

Update custom EasyMDE to v2.21.0

0.21.0

Changed

Dependency Bumps.

Stop Ruff failing lint due to Python blocks in Readme.

Update supported versions.

Commits

8771f6c update bundled easymde
5ffb216 futher housekeeping for next release (not worth pushing for this)
85b5ead accursed packaging
158195e dependency bumps, new supported versions, lint fix
b0d7467 Bump actions/checkout from 6.0.3 to 7.0.0 (#61)
bcc021b Bump the uv-minor-patch group across 1 directory with 4 updates (#68)
7e49e72 Bump django from 5.2.14 to 5.2.16 (#67)
d13e9a1 Bump pypa/gh-action-pypi-publish (#65)
ef8b880 Bump sqlparse from 0.5.5 to 0.6.0 (#69)
7789b37 Bump the actions-minor-patch group with 2 updates (#59)
Additional commits viewable in compare view

Updates django-oauth-toolkit from 3.3.0 to 3.4.1

Release notes

Sourced from django-oauth-toolkit's releases.

3.4.1

This release is dominated by security hardening of redirect URI matching, token revocation and refresh token handling. Several entries below change behavior that was previously accepted, and they are spread across Fixed and Security: the "Upgrading to 3.4.1" section of the Upgrading guide collects everything you need to act on in one place, so start there. Of particular note: redirect URIs are now matched exactly per RFC 9700 §2.1, so a request may no longer carry query parameters, path parameters, credentials or a fragment that the registered URI does not have; REFRESH_TOKEN_EXPIRE_SECONDS, where set, is now enforced when a refresh token is presented rather than only by the cleartokens sweep; and the built-in templates now link a stylesheet shipped with the package instead of a CDN, so run collectstatic or the pages render unstyled.

Added

#681 Redirect URI mismatches are now diagnosed on the oauth2_provider logger at DEBUG, reporting the requested URI, every registered candidate it was compared against, and which component of each one differed (scheme, hostname, port, path, query). The same detail is emitted for post_logout_redirect_uri and for the token endpoint's comparison against the URI recorded on the grant. The error response is unchanged: the registered URIs are never disclosed to the requester, only to the server's log. See "Debugging redirect URI mismatches" in the documentation. Note that AbstractApplication.redirect_uri_allowed() and post_logout_redirect_uri_allowed() now call the new check_redirect_to_uri_allowed() (same verdict, plus the mismatch reasons) instead of redirect_to_uri_allowed(), so code that wrapped or patched the latter to influence those methods must target the former.

#634 A system check (oauth2_provider.W011) that warns when the AccessToken and RefreshToken models are swapped into different apps, and a new "Extending the token models" documentation section explaining how to swap the interrelated token models together.

#1623 Documentation ("Content Security Policy and the authorization form") on completing the authorization-code flow under a strict form-action Content Security Policy, which Chromium enforces against the post-authorization redirect to the client's redirect_uri.

#410 Documentation ("Resource scope syntax") clarifying that TokenHasResourceScope checks each required_scopes entry suffixed with the READ_SCOPE/WRITE_SCOPE setting value (defaults read/write, e.g. music:read, music:write), so a bare music scope is rejected; with the default settings-based scopes backend the suffixed scopes must be declared in SCOPES.

#1157 An "Upgrading" documentation page collecting the breaking changes and upgrade steps for every release that needs them — 2.0, 3.0 and this release — linked from the documentation index, so upgrade guidance is discoverable outside the CHANGELOG. A release that asks nothing of you has no section there, so a gap between two versions is an answer rather than an omission.

#452 Documentation ("Custom scopes backend") explaining how to replace the default settings-driven scopes backend via SCOPES_BACKEND_CLASS, including a worked model-based example that stores scopes in the database.

#1045 Tutorial ("Managing applications and tokens in the Django admin") walking through the admin site for applications and issued tokens, including client-secret hashing, credential masking, and that tokens cannot be created by hand.

#403 Translatable (gettext_lazy) verbose_name labels on every field of the Application, Grant, AccessToken, RefreshToken, IDToken and DeviceGrant models, so the Django admin and the authorization UI can be localized. Migration

... (truncated)

Changelog

Sourced from django-oauth-toolkit's changelog.

[3.4.1] - 2026-08-21

This release is dominated by security hardening of redirect URI matching, token revocation and refresh token handling. Several entries below change behavior that was previously accepted, and they are spread across Fixed and Security: the "Upgrading to 3.4.1" section of the Upgrading guide collects everything you need to act on in one place, so start there. Of particular note: redirect URIs are now matched exactly per RFC 9700 §2.1, so a request may no longer carry query parameters, path parameters, credentials or a fragment that the registered URI does not have; REFRESH_TOKEN_EXPIRE_SECONDS, where set, is now enforced when a refresh token is presented rather than only by the cleartokens sweep; and the built-in templates now link a stylesheet shipped with the package instead of a CDN, so run collectstatic or the pages render unstyled.

Added

#681 Redirect URI mismatches are now diagnosed on the oauth2_provider logger at DEBUG, reporting the requested URI, every registered candidate it was compared against, and which component of each one differed (scheme, hostname, port, path, query). The same detail is emitted for post_logout_redirect_uri and for the token endpoint's comparison against the URI recorded on the grant. The error response is unchanged: the registered URIs are never disclosed to the requester, only to the server's log. See "Debugging redirect URI mismatches" in the documentation. Note that AbstractApplication.redirect_uri_allowed() and post_logout_redirect_uri_allowed() now call the new check_redirect_to_uri_allowed() (same verdict, plus the mismatch reasons) instead of redirect_to_uri_allowed(), so code that wrapped or patched the latter to influence those methods must target the former.

#634 A system check (oauth2_provider.W011) that warns when the AccessToken and RefreshToken models are swapped into different apps, and a new "Extending the token models" documentation section explaining how to swap the interrelated token models together.

#1623 Documentation ("Content Security Policy and the authorization form") on completing the authorization-code flow under a strict form-action Content Security Policy, which Chromium enforces against the post-authorization redirect to the client's redirect_uri.

#410 Documentation ("Resource scope syntax") clarifying that TokenHasResourceScope checks each required_scopes entry suffixed with the READ_SCOPE/WRITE_SCOPE setting value (defaults read/write, e.g. music:read, music:write), so a bare music scope is rejected; with the default settings-based scopes backend the suffixed scopes must be declared in SCOPES.

#1157 An "Upgrading" documentation page collecting the breaking changes and upgrade steps for every release that needs them — 2.0, 3.0 and this release — linked from the documentation index, so upgrade guidance is discoverable outside the CHANGELOG. A release that asks nothing of you has no section there, so a gap between two versions is an answer rather than an omission.

#452 Documentation ("Custom scopes backend") explaining how to replace the default settings-driven scopes backend via SCOPES_BACKEND_CLASS, including a worked model-based example that stores scopes in the database.

#1045 Tutorial ("Managing applications and tokens in the Django admin") walking through the admin site for applications and issued tokens, including client-secret hashing, credential masking, and that tokens cannot be created by hand.

#403 Translatable (gettext_lazy) verbose_name labels on every field of the Application, Grant, AccessToken, RefreshToken, IDToken and DeviceGrant models, so the Django admin and the authorization UI can be localized. Migration

... (truncated)

Commits

db6c4f5 chore: 3.4.1 release (#1820)
9c70975 fix: enforce device grant confirmation ownership (#1819)
28bf64c perf: revoke refresh token families as a set on reuse detection (#1810)
f797b8a fix(validators): stop honoring revoked refresh tokens in the grace window (#1...
11024a0 chore(deps): bump cryptography in the uv group across 1 directory (#1807)
1e19d4d Log why a redirect URI failed to match (#1814)
4f18e0e feat(templates): serve default styles from a bundled stylesheet (#1815)
ae05be9 feat(models): make model field labels translatable (#1812)
2b1a322 fix(models): associate Application validation errors with their fields (#1811)
0915396 fix(dcr): honour hashed token storage for registration access tokens (#1799)
Additional commits viewable in compare view

Updates flower from 2.0.1 to 2.2.0

Release notes

Sourced from flower's releases.

v2.2.0

Security

Added CSRF protection for cookie-authenticated sessions

Added protection against cross-site state-changing requests

Added an OAuth state check to all login handlers

Restricted the post-login redirect to local paths

Enabled TLS certificate validation for the RabbitMQ management API

Escaped all table cells on the tasks and workers pages

Escaped load average values in the workers grid

Added HttpOnly and SameSite to session cookies

Added the X-Content-Type-Options: nosniff header

Limited CORS headers to the unauthenticated API

Served API error messages as plain text

Features

Added a logout link for OAuth sessions #1074

Added a timeout option to the task apply API

Added a page size selector to the tasks page #1518

Linked task names to a list of all tasks with that name

Linked the task counts on the workers page to the matching tasks

Honored the column order of the tasks_columns option #1262

Added thousands separators to task counts #1374

Formatted durations and showed a dash for missing values

Added search examples as placeholder text

Made wide tables scroll sideways and shortened UUIDs on mobile

Limited worker page task lists to 50 entries by default #1087

Removed the Retried column from the workers page

Named browser tabs by page

Performance and reliability

Made persistent state saves atomic #1403

Fixed startup failing on a corrupt persistent state database #1398

Added a warning when state saving dominates the save interval

Reapplied --max-tasks to restored persistent state #1380

Honored the --purge-offline-workers grace period after worker-offline events #1190

Inspected a worker lazily on its first page visit #1388

Fetched worker task lists only when inspecting a single worker

Validated the --broker-api URL at startup

Required both --certfile and --keyfile when either is set

Validated task API query parameters and publish payloads

Bug fixes

Fixed worker task table column widths #1521 by @ShubhAtWork

Fixed the default RabbitMQ management API URL to use the management port #1232

Fixed the theme dropdown not closing and stuck navbar tooltips

Fixed a server error on the task page for tasks without a name

... (truncated)

Commits

4d4a9ac Set release version
b884844 Exclude compiled and hidden files from the sdist
fba84ef Merge remote-tracking branch 'origin/master' into 2.0
ea34f92 Fix broken and moved links in the docs
1336fbd Fix the unpicklable state test on Python 3.10 to 3.13
0f04846 Open the state shelves with context managers
8034099 Apply the ruff style rewrites to the package
b14b43d Fix the ruff errors in the tests
b9f7189 Apply ruff's safe fixes and literal rewrites to the package
ff33bc8 Tidy the task API test bodies and name lookups
Additional commits viewable in compare view

Updates faker from 40.31.0 to 40.43.0

Release notes

Sourced from faker's releases.

Release v40.43.0

See CHANGELOG.md.

Release v40.42.0

See CHANGELOG.md.

Release v40.41.0

See CHANGELOG.md.

Release v40.40.0

See CHANGELOG.md.

Release v40.39.0

See CHANGELOG.md.

Release v40.38.0

See CHANGELOG.md.

Release v40.37.0

See CHANGELOG.md.

Release v40.36.0

See CHANGELOG.md.

Release v40.35.0

See CHANGELOG.md.

Release v40.34.0

See CHANGELOG.md.

Release v40.33.2

See CHANGELOG.md.

Release v40.33.1

See CHANGELOG.md.

Release v40.33.0

See CHANGELOG.md.

Release v40.32.0

See CHANGELOG.md.

Changelog

Sourced from faker's changelog.

v40.43.0 - 2026-10-09

Add es_CO bank provider (#2453). Thanks @saratobonr.

Add es_CO internet provider (#2455). Thanks @saratobonr.

v40.42.0 - 2026-10-09

Fix: generate fa_IR and mk_MK IBANs with the correct BBAN length (#2451). Thanks @anandghegde.

Catch NotImplementedError when documenting unimplemented formatters (#2461). Thanks @ekanshul.

Catch NotImplementedError in Documentor.get_provider_formatters (#2462). Thanks @kdmadeit.

v40.41.0 - 2026-10-05

Fix: update vi_VN address formats, administrative units, and postcodes (#2433). Thanks @hmtrii.

v40.40.0 - 2026-09-28

Fix: generate valid CNP birth dates in ro_RO ssn() (#2431). Thanks @chuenchen309.

Add boundary tests for text(max_nb_chars) (#2439). Thanks @saimoon504.

Clarify in the docs that text() max_nb_chars is an upper bound (#2438). Thanks @saimoon504.

v40.39.0 - 2026-09-14

Fix: compute Norwegian MOD11 check digit so no_NO iban() passes stdnum validation (#2415). Thanks @CedricConday.

v40.38.0 - 2026-09-01

Add si_LK (Sinhala, Sri Lanka) person provider (#2430). Thanks @RavinduPabasara.

v40.37.0 - 2026-08-20

Fix: generate structurally valid Irish IBANs for en_IE (#2411). Thanks @CedricConday.

Add Pillow as an optional dependency (#2442). Thanks @suliuzh.

v40.36.0 - 2026-07-24

Fix: correct uk_UA bban_format to 6 digits + 19 letters so iban() generates valid Ukrainian IBANs (#2417). Thanks @CedricConday.

v40.35.0 - 2026-07-22

Fix: add correct bban_format so ru_RU iban() generates valid Russian IBANs (#2416). Thanks @CedricConday.

v40.34.0 - 2026-07-22

Fix: correct BBAN length so da_DK iban() generates valid Danish IBANs (#2409). Thanks @CedricConday.

v40.33.2 - 2026-07-22

Validate positive=True against a non-positive max_value in pydecimal (#2428). Thanks @Sreekant13.

... (truncated)

Commits

df289bf Bump version: 40.42.0 → 40.43.0
7593afa 📝 Update CHANGELOG.md
4d178fe Add es_CO internet provider (#2455)
d4861a9 Add es_CO bank provider (#2453)
a4563c8 Bump version: 40.41.0 → 40.42.0
db94c7b 📝 Update CHANGELOG.md
a832d8b Catch NotImplementedError in Documentor.get_provider_formatters (#2462)
06db7eb Catch NotImplementedError when documenting unimplemented formatters (#2461)
e9b9ae8 fix(fa_IR, mk_MK): generate IBANs with the correct BBAN length (#2451)
72e2fa4 Bump version: 40.40.0 → 40.41.0
Additional commits viewable in compare view

Updates pytest-django from 4.12.0 to 4.14.0

Release notes

Sourced from pytest-django's releases.

v4.14.0

https://pytest-django.readthedocs.io/en/stable/changelog.html#v4-14-0-2026-08-10

v4.13.0

https://pytest-django.readthedocs.io/en/latest/changelog.html#v4-13-0-2026-08-06

Changelog

Sourced from pytest-django's changelog.

v4.14.0 (2026-08-10)

Compatibility ^^^^^^^^^^^^^

Restored (unofficial) support for Django 5.0 and Django 5.1.

Improvements ^^^^^^^^^^^^

Added a django extra to the package. By depending on this extra (e.g. pip install pytest-django[django]), the dependency resolver will ensure you get a version of pytest-django that is compatible with your version of Django (lower bound only). At least from now on...

v4.13.0 (2026-08-06)

Compatibility ^^^^^^^^^^^^^

Dropped support for Django 4.2 and 5.1.

Improvements ^^^^^^^^^^^^

Export pytest_django.Settings from the top-level pytest_django module so the :fixture:settings fixture can be type-annotated ([#1257](https://github.com/pytest-dev/pytest-django/issues/1257) <https://github.com/pytest-dev/pytest-django/issues/1257>__).

Bugfixes ^^^^^^^^

Fixed type hints of assert methods to match actual signature (PR [#1271](https://github.com/pytest-dev/pytest-django/issues/1271) <https://github.com/pytest-dev/pytest-django/pull/1271>__)

Handled Django 6.2's ImproperlyConfigured (in addition to ImportError) when the configured DJANGO_SETTINGS_MODULE cannot be imported, so pytest-django still shows its guidance message.

Fixed django_db(transaction=True) tests being set up twice, which repeated the serialized_rollback restore and the fixtures load, and sent setting_changed and post_migrate twice when available_apps is set.

Fixed --help/--version failing with AppRegistryNotReady (surfaced as a could not load initial conftests warning) when a conftest.py imports Django models at the top level. Django is now set up even when --help/--version are passed, before the initial conftests are loaded for these options ([#1152](https://github.com/pytest-dev/pytest-django/issues/1152) <https://github.com/pytest-dev/pytest-django/issues/1152>__).

Commits

1a6b612 Release 4.14.0
fffb11d docs: remove $ for consistency
e8c0606 docs: move the django extra explanation
b66deb6 tests: strict import to make pyright happy
823db39 tests: fix wrong type (typing only)
a1eaf5d Drop django<5 message asserts compat
2ea1423 Fix _pre_setup_ran_eagerly on Django 5.0 and 5.1
903429c Add django extra to ensure Django dependency compatible lower bound
9661589 docs: prefer newer pytest config TOML format
7646196 docs: remove needless comment
Additional commits viewable in compare view

Updates django-stubs from 6.0.7 to 6.1.2

Commits

fa03b48 Version 6.1.2 release (#3681)
3568355 Update dependency mypy to >=1.13,<2.5 (#3680)
46cd7de Update dependency pyrefly to v1.3.2 (#3677)
de0b49c [pre-commit.ci] pre-commit autoupdate (#3675)
c7b59a0 Update dependency ty to v0.0.83 (#3671)
e3a1189 Update astral-sh/setup-uv action to v10.2.0 (#3672)
f0a186a Update int128/hide-comment-action action to v1.75.0 (#3669)
63161ef [pre-commit.ci] pre-commit autoupdate (#3667)
dc01854 Update dependency psycopg to v3.3.6 (#3668)
d563832 Update dependency ty to v0.0.82 (Description has been truncated

…7 updates Bumps the minor-and-patch group with 17 updates in the / directory: | Package | From | To | | --- | --- | --- | | [boto3](https://github.com/boto/boto3) | `1.43.49` | `1.43.113` | | [django-bootstrap5](https://github.com/zostera/django-bootstrap5) | `26.2` | `26.4` | | [django-htmx](https://github.com/adamchainz/django-htmx) | `1.28.0` | `1.29.0` | | [django-markdownfield](https://github.com/dmptrluke/django-markdownfield) | `0.20.2` | `0.21.1` | | [django-oauth-toolkit](https://github.com/django-oauth/django-oauth-toolkit) | `3.3.0` | `3.4.1` | | [flower](https://github.com/mher/flower) | `2.0.1` | `2.2.0` | | [faker](https://github.com/joke2k/faker) | `40.31.0` | `40.43.0` | | [pytest-django](https://github.com/pytest-dev/pytest-django) | `4.12.0` | `4.14.0` | | [django-stubs](https://github.com/typeddjango/django-stubs) | `6.0.7` | `6.1.2` | | [djlint](https://github.com/djlint/djLint) | `1.40.7` | `1.46.4` | | [mkdocs-git-revision-date-localized-plugin](https://github.com/timvink/mkdocs-git-revision-date-localized-plugin) | `1.5.3` | `1.6.0` | | [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.7.6` | `9.7.7` | | [django-test-plus](https://github.com/revsys/django-test-plus) | `2.4.1` | `2.7.0` | | [pytest-lazy-fixtures](https://github.com/dev-petrov/pytest-lazy-fixtures) | `1.4.0` | `1.4.1` | | [pgcli](https://github.com/dbcli/pgcli) | `4.5.0` | `4.7.1` | | [ruff](https://github.com/astral-sh/ruff) | `0.15.21` | `0.17.0` | | [tenacity](https://github.com/jd/tenacity) | `9.1.4` | `9.2.1` | Updates `boto3` from 1.43.49 to 1.43.113 - [Release notes](https://github.com/boto/boto3/releases) - [Commits](boto/boto3@1.43.49...1.43.113) Updates `django-bootstrap5` from 26.2 to 26.4 - [Changelog](https://github.com/zostera/django-bootstrap5/blob/main/CHANGELOG.md) - [Commits](zostera/django-bootstrap5@v26.2...v26.4) Updates `django-htmx` from 1.28.0 to 1.29.0 - [Changelog](https://github.com/adamchainz/django-htmx/blob/main/docs/changelog.rst) - [Commits](adamchainz/django-htmx@1.28.0...1.29.0) Updates `django-markdownfield` from 0.20.2 to 0.21.1 - [Changelog](https://github.com/dmptrluke/django-markdownfield/blob/master/CHANGELOG.md) - [Commits](dmptrluke/django-markdownfield@v0.20.2...v0.21.1) Updates `django-oauth-toolkit` from 3.3.0 to 3.4.1 - [Release notes](https://github.com/django-oauth/django-oauth-toolkit/releases) - [Changelog](https://github.com/django-oauth/django-oauth-toolkit/blob/master/CHANGELOG.md) - [Commits](django-oauth/django-oauth-toolkit@3.3.0...3.4.1) Updates `flower` from 2.0.1 to 2.2.0 - [Release notes](https://github.com/mher/flower/releases) - [Commits](mher/flower@v2.0.1...v2.2.0) Updates `faker` from 40.31.0 to 40.43.0 - [Release notes](https://github.com/joke2k/faker/releases) - [Changelog](https://github.com/joke2k/faker/blob/master/CHANGELOG.md) - [Commits](joke2k/faker@v40.31.0...v40.43.0) Updates `pytest-django` from 4.12.0 to 4.14.0 - [Release notes](https://github.com/pytest-dev/pytest-django/releases) - [Changelog](https://github.com/pytest-dev/pytest-django/blob/main/docs/changelog.rst) - [Commits](pytest-dev/pytest-django@v4.12.0...v4.14.0) Updates `django-stubs` from 6.0.7 to 6.1.2 - [Release notes](https://github.com/typeddjango/django-stubs/releases) - [Commits](typeddjango/django-stubs@6.0.7...6.1.2) Updates `djlint` from 1.40.7 to 1.46.4 - [Release notes](https://github.com/djlint/djLint/releases) - [Changelog](https://github.com/djlint/djLint/blob/master/CHANGELOG.md) - [Commits](djlint/djLint@v1.40.7...v1.46.4) Updates `mkdocs-git-revision-date-localized-plugin` from 1.5.3 to 1.6.0 - [Release notes](https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/releases) - [Commits](timvink/mkdocs-git-revision-date-localized-plugin@v1.5.3...v1.6.0) Updates `mkdocs-material` from 9.7.6 to 9.7.7 - [Release notes](https://github.com/squidfunk/mkdocs-material/releases) - [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG) - [Commits](squidfunk/mkdocs-material@9.7.6...9.7.7) Updates `django-test-plus` from 2.4.1 to 2.7.0 - [Release notes](https://github.com/revsys/django-test-plus/releases) - [Changelog](https://github.com/revsys/django-test-plus/blob/main/CHANGELOG.md) - [Commits](revsys/django-test-plus@2.4.1...2.7.0) Updates `pytest-lazy-fixtures` from 1.4.0 to 1.4.1 - [Release notes](https://github.com/dev-petrov/pytest-lazy-fixtures/releases) - [Commits](dev-petrov/pytest-lazy-fixtures@1.4.0...1.4.1) Updates `pgcli` from 4.5.0 to 4.7.1 - [Release notes](https://github.com/dbcli/pgcli/releases) - [Changelog](https://github.com/dbcli/pgcli/blob/main/changelog.rst) - [Commits](dbcli/pgcli@v4.5.0...v4.7.1) Updates `ruff` from 0.15.21 to 0.17.0 - [Release notes](https://github.com/astral-sh/ruff/releases) - [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md) - [Commits](astral-sh/ruff@0.15.21...0.17.0) Updates `tenacity` from 9.1.4 to 9.2.1 - [Release notes](https://github.com/jd/tenacity/releases) - [Commits](jd/tenacity@9.1.4...9.2.1) --- updated-dependencies: - dependency-name: boto3 dependency-version: 1.43.109 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: django-bootstrap5 dependency-version: '26.3' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: django-htmx dependency-version: 1.29.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: django-markdownfield dependency-version: 0.21.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: django-oauth-toolkit dependency-version: 3.4.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: django-stubs dependency-version: 6.1.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: django-test-plus dependency-version: 2.6.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: djlint dependency-version: 1.46.4 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: faker dependency-version: 40.41.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: flower dependency-version: 2.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: mkdocs-git-revision-date-localized-plugin dependency-version: 1.6.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: mkdocs-material dependency-version: 9.7.7 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: pgcli dependency-version: 4.7.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: pytest-django dependency-version: 4.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: pytest-lazy-fixtures dependency-version: 1.4.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: minor-and-patch - dependency-name: ruff dependency-version: 0.16.10 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch - dependency-name: tenacity dependency-version: 9.2.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: minor-and-patch ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file minor PRs that should result in a minor version bump (new small features) python:uv Pull requests that update python:uv code labels Oct 14, 2026

dependabot Bot force-pushed the dependabot/uv/minor-and-patch-62167701d7 branch from 69f9a18 to 56e792f Compare October 21, 2026 04:57

Navigation Menu

Repository navigation

build(deps): bump the minor-and-patch group across 1 directory with 17 updates - #517

build(deps): bump the minor-and-patch group across 1 directory with 17 updates#517
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/minor-and-patch-62167701d7

dependabot Bot commented on behalf of github Oct 14, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

26.4 (2026-10-11)

26.3 (2026-08-28)

1.29.0 (2026-08-06)

0.21.1

Changed

0.21.0

Changed

3.4.1

Added

[3.4.1] - 2026-08-21

Added

v2.2.0

Security

Features

Performance and reliability

Bug fixes

Release v40.43.0

Release v40.42.0

Release v40.41.0

Release v40.40.0

Release v40.39.0

Release v40.38.0

Release v40.37.0

Release v40.36.0

Release v40.35.0

Release v40.34.0

Release v40.33.2

Release v40.33.1

Release v40.33.0

Release v40.32.0

v4.14.0

v4.13.0

v4.14.0 (2026-08-10)

v4.13.0 (2026-08-06)

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 14, 2026 •

edited

Loading