chore: bump the python-dependencies group across 1 directory with 3 updates

[dependabot]

Bumps the python-dependencies group with 3 updates in the / directory: django, gunicorn and djlint.

Updates django from 6.1 to 6.1.1

Commits

• 249b13d [6.1.x] Bumped version for 6.1.1 release.
• 5f26fa8 [6.1.x] Added release date for 6.1.1.
• fdcf78a [6.1.x] Added remaining community package mentions to the documentation.
• 7241568 [6.1.x] Fixed #37222 -- Fixed QuerySet.distinct() crash on duplicated selecti...
• ef3fc80 [6.1.x] Fixed #37312, Refs #36605 -- Fixed annotation preservation and key se...
• b09cb6b [6.1.x] Clarified scope of object-level admin view permissions.
• a6d3aa2 [6.1.x] Corrected heading hierarchy in the admin actions documentation.
• 9031d41 [6.1.x] Clarified object-level permission checks in admin actions.
• fc805c6 [6.1.x] Fixed #37311 -- Prevented consumption of rhs iterators in annotation ...
• 4b0185a [6.1.x] Fixed #37300 -- Preserved parent instance hints on custom Prefetch qu...
• Additional commits viewable in compare view

Updates gunicorn from 26.1.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

Commits

• 36f2a3c gunicorn 26.2.0
• cbba350 test: cover the h2c edge paths that had none
• 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
• 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
• 5853551 Merge pull request #3712 from Rotzbua/patch-1
• 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
• 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
• 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
• 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
• 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
• Additional commits viewable in compare view

Updates djlint from 1.44.2 to 1.45.0

Release notes

Sourced from djlint's releases.

v1.45.0

Feature

• New rule H043 reports a <button> written without a type. A type written inside a template block, as in <button {% if a %}type="button"{% endif %}>, counts.
• New rule H044 reports a header row holding both th and td cells. The empty td that opens a two-axis table's header row is allowed.
• New rule H045 reports an <iframe> with no accessible name. title, aria-label and aria-labelledby all count, as does a name written by a template tag.
• New rule H046 reports a positive tabindex. 0 and -1 are left alone, as is a value written by a template tag.
• New rule H047 reports aria-hidden="true" on an element that takes focus. Hiding a decorative icon is not reported, nor is a disabled control or one with tabindex="-1".
• New rule H048 reports an aria- attribute that ARIA does not define, such as a misspelled aria-lable. Framework bindings like :aria-label are left alone.
• New rule H049 reports a viewport that stops the page being zoomed, by user-scalable=no or a maximum-scale below 2.
• New rule H050 reports an element html no longer defines, such as <center>, <font>, <marquee> or <strike>. Only the opening tag is reported, and a custom element whose name merely starts with one, such as <font-picker>, is left alone.
• New rule H051 reports a role ARIA does not define for markup, such as role="buton". The roles DPUB-ARIA and GRAPHICS-ARIA add count, abstract ones such as landmark do not, and a value written by a template tag or a framework binding such as :role is left alone.
• New rule H052 reports a <meta http-equiv="refresh"> that reloads or redirects on a timer, which fails WCAG 2.2.1. A delay of zero is an immediate redirect rather than a timer and is not reported.
• New option --quote-style / quote_style sets the quotes djLint writes inside template tags, double (the default) or single, and T002 follows it, so {% include 'a.html' %} is no longer reported in a project that writes single quotes. Html attributes stay with H008.
• New option --sort-attributes / sort_attributes orders a tag's attributes by name, with id first and class second. A tag whose attributes are guarded by a template tag, as in <div {% if x %}a="1"{% endif %} b="2">, keeps the order it was written in.
• New option --name-endblocks / name_endblocks writes the block's name into the {% endblock %} that closes it, where the block spans several lines, making T003 fixable by running the formatter. A block opened and closed on one line is left alone.
• New option --no-indent-inner-html / no_indent_inner_html leaves <head> and <body> at the same indent as the <html> that holds them, matching the default VS Code html formatter.
• New option --keep-br-inline / keep_br_inline keeps <br> on the line of the text it breaks instead of giving it a line of its own. <hr> is unaffected, and the default is unchanged.
• New option --prefer-configuration lets the file named by --configuration override the project's own pyproject.toml or .djlintrc, which have always won where the two set the same thing. The default is unchanged.
• Single quoted attribute values are rewritten to double quotes, as H008 asks, so <div class='a'> becomes <div class="a">. Only the names the rule reports are touched, and a value holding a double quote of its own keeps its single quotes.
• Attribute names that H010 reports are lowercased by the formatter, so <div CLASS="a"> is fixed rather than only reported. A name the rule does not know, such as an svg viewBox, keeps its case, and --ignore-case turns it off.
• Formatting writes an entity reference as the character it names, so © becomes ©, which is what H023 asks for. Entities that carry syntax or template meaning are left as written, as are <pre>, <textarea>, <script> and <style> bodies, and --no-entity-formatting turns it off.
• The type that html5 already assumes is dropped, as H024 asks, so <script type="text/javascript"> becomes <script>, and the same for <style> and a stylesheet <link>. A type that means something, such as type="module", is kept.
• A form's method is lowercased, so method="POST" becomes method="post", which is what H029 asks for. A tag written inside a template tag's string is left alone.

Changed

• H031 is gone: the keywords meta tag it asked for no longer affects ranking, and bing treats it as a spam signal.
• H035 is gone; H017 already covers meta.
• H036 reports only two uses of <br>: a run of two or more, and a break against the inside edge of a block element. Breaks that are part of the content, such as in a postal address, are left alone, and the rule is on by default.
• T002 is on by default, and --reformat now writes the quotes it asks for, rewriting tag arguments and conditions such as {% if x == 'a' %} to the --quote-style in force. A string already holding the quote it would be rewritten to is left alone.
• T028 is off by default: the whitespace it strips can be whitespace that renders, so alt="{%- if brand -%}Acme{%- endif -%} logo" comes out as Acmelogo. It stays available with --include=T028.
• H014 counts blank lines the way the formatter does, so --max-blank-lines 2 and --preserve-blank-lines no longer produce files the linter then rejects. A line holding only whitespace counts as blank, and the report points at the first blank line rather than the content line above it.
• H020 leaves alone an element whose empty form carries meaning, such as a blank <option> holding a select open.
• H023 no longer reports an entity for an invisible character, such as ‌, in named, decimal or hex form.
• --ignore-case applies to the linter as well as the formatter, so H009 and H010 stay quiet when it is set.
• --profile=all honours every profile's exclude list, so T028 no longer fires on django markup to recommend {%- if -%}, which django rejects.
• A GitHub annotation names the column as well as the line, so it lands on the tag rather than the start of the line.

Fix

• Markup inside an attribute value is no longer read as a tag, so <p title="a<br>b"> is not reported: affects D004, J004, H006, H011, H013, H017, H018, H019, H020, H021, H022, H036 and H043.
• D004, H019 and H021 see attributes written after a template tag containing a >, so the inline style in <div {% if n > 5 %}id="a"{% endif %} style="color:red"> is checked.
• Rules check the opening tag of <script>, <style>, <pre> and <textarea>, which used to be skipped along with the body, so H024, D004, H008, H010, H011, H012 and H037 can see their attributes. Only the body is skipped now, and its contents are never read as markup.
• D018 and J018 no longer report a link that already uses a url tag, such as <a href="{% url 'profile' %}" data-src="lazy">; a value now has to look like a path. /static/ and /media/ assets are left to {% static %} rather than reported as routes.
• H005 reports <html lang="">, and its message asks for a non-empty lang.
• H005 and H007 ignore custom elements whose name starts with html, such as <html-midi-player>.
• H007 reports a missing doctype in a file that opens with something it does not recognise, such as an <?xml ... ?> declaration.
• H008 leaves single quoted values holding a double quote alone, such as title='{% translate "Delete" %}'. An attribute that merely ends in a known name, such as data-title, is no longer treated as that attribute.
• H009 reports exactly the elements the formatter lowercases, so --reformat always clears it: <IMG>, <INPUT> and <NAV> are now reported, and G, PATH, NAME and CACHE are not. An uppercase name inside an attribute value, as in <p title="x <DIV y">, is no longer read as a tag.

... (truncated)

Changelog

Sourced from djlint's changelog.

[1.45.0] - 2026-09-03

Feature

• New rule H043 reports a <button> written without a type. A type written inside a template block, as in <button {% if a %}type="button"{% endif %}>, counts.
• New rule H044 reports a header row holding both th and td cells. The empty td that opens a two-axis table's header row is allowed.
• New rule H045 reports an <iframe> with no accessible name. title, aria-label and aria-labelledby all count, as does a name written by a template tag.
• New rule H046 reports a positive tabindex. 0 and -1 are left alone, as is a value written by a template tag.
• New rule H047 reports aria-hidden="true" on an element that takes focus. Hiding a decorative icon is not reported, nor is a disabled control or one with tabindex="-1".
• New rule H048 reports an aria- attribute that ARIA does not define, such as a misspelled aria-lable. Framework bindings like :aria-label are left alone.
• New rule H049 reports a viewport that stops the page being zoomed, by user-scalable=no or a maximum-scale below 2.
• New rule H050 reports an element html no longer defines, such as <center>, <font>, <marquee> or <strike>. Only the opening tag is reported, and a custom element whose name merely starts with one, such as <font-picker>, is left alone.
• New rule H051 reports a role ARIA does not define for markup, such as role="buton". The roles DPUB-ARIA and GRAPHICS-ARIA add count, abstract ones such as landmark do not, and a value written by a template tag or a framework binding such as :role is left alone.
• New rule H052 reports a <meta http-equiv="refresh"> that reloads or redirects on a timer, which fails WCAG 2.2.1. A delay of zero is an immediate redirect rather than a timer and is not reported.
• New option --quote-style / quote_style sets the quotes djLint writes inside template tags, double (the default) or single, and T002 follows it, so {% include 'a.html' %} is no longer reported in a project that writes single quotes. Html attributes stay with H008.
• New option --sort-attributes / sort_attributes orders a tag's attributes by name, with id first and class second. A tag whose attributes are guarded by a template tag, as in <div {% if x %}a="1"{% endif %} b="2">, keeps the order it was written in.
• New option --name-endblocks / name_endblocks writes the block's name into the {% endblock %} that closes it, where the block spans several lines, making T003 fixable by running the formatter. A block opened and closed on one line is left alone.
• New option --no-indent-inner-html / no_indent_inner_html leaves <head> and <body> at the same indent as the <html> that holds them, matching the default VS Code html formatter.
• New option --keep-br-inline / keep_br_inline keeps <br> on the line of the text it breaks instead of giving it a line of its own. <hr> is unaffected, and the default is unchanged.
• New option --prefer-configuration lets the file named by --configuration override the project's own pyproject.toml or .djlintrc, which have always won where the two set the same thing. The default is unchanged.
• Single quoted attribute values are rewritten to double quotes, as H008 asks, so <div class='a'> becomes <div class="a">. Only the names the rule reports are touched, and a value holding a double quote of its own keeps its single quotes.
• Attribute names that H010 reports are lowercased by the formatter, so <div CLASS="a"> is fixed rather than only reported. A name the rule does not know, such as an svg viewBox, keeps its case, and --ignore-case turns it off.
• Formatting writes an entity reference as the character it names, so © becomes ©, which is what H023 asks for. Entities that carry syntax or template meaning are left as written, as are <pre>, <textarea>, <script> and <style> bodies, and --no-entity-formatting turns it off.
• The type that html5 already assumes is dropped, as H024 asks, so <script type="text/javascript"> becomes <script>, and the same for <style> and a stylesheet <link>. A type that means something, such as type="module", is kept.
• A form's method is lowercased, so method="POST" becomes method="post", which is what H029 asks for. A tag written inside a template tag's string is left alone.

Changed

• H031 is gone: the keywords meta tag it asked for no longer affects ranking, and bing treats it as a spam signal.
• H035 is gone; H017 already covers meta.
• H036 reports only two uses of <br>: a run of two or more, and a break against the inside edge of a block element. Breaks that are part of the content, such as in a postal address, are left alone, and the rule is on by default.
• T002 is on by default, and --reformat now writes the quotes it asks for, rewriting tag arguments and conditions such as {% if x == 'a' %} to the --quote-style in force. A string already holding the quote it would be rewritten to is left alone.
• T028 is off by default: the whitespace it strips can be whitespace that renders, so alt="{%- if brand -%}Acme{%- endif -%} logo" comes out as Acmelogo. It stays available with --include=T028.
• H014 counts blank lines the way the formatter does, so --max-blank-lines 2 and --preserve-blank-lines no longer produce files the linter then rejects. A line holding only whitespace counts as blank, and the report points at the first blank line rather than the content line above it.
• H020 leaves alone an element whose empty form carries meaning, such as a blank <option> holding a select open.
• H023 no longer reports an entity for an invisible character, such as ‌, in named, decimal or hex form.
• --ignore-case applies to the linter as well as the formatter, so H009 and H010 stay quiet when it is set.
• --profile=all honours every profile's exclude list, so T028 no longer fires on django markup to recommend {%- if -%}, which django rejects.
• A GitHub annotation names the column as well as the line, so it lands on the tag rather than the start of the line.

Fix

• Markup inside an attribute value is no longer read as a tag, so <p title="a<br>b"> is not reported: affects D004, J004, H006, H011, H013, H017, H018, H019, H020, H021, H022, H036 and H043.
• D004, H019 and H021 see attributes written after a template tag containing a >, so the inline style in <div {% if n > 5 %}id="a"{% endif %} style="color:red"> is checked.
• Rules check the opening tag of <script>, <style>, <pre> and <textarea>, which used to be skipped along with the body, so H024, D004, H008, H010, H011, H012 and H037 can see their attributes. Only the body is skipped now, and its contents are never read as markup.
• D018 and J018 no longer report a link that already uses a url tag, such as <a href="{% url 'profile' %}" data-src="lazy">; a value now has to look like a path. /static/ and /media/ assets are left to {% static %} rather than reported as routes.
• H005 reports <html lang="">, and its message asks for a non-empty lang.
• H005 and H007 ignore custom elements whose name starts with html, such as <html-midi-player>.
• H007 reports a missing doctype in a file that opens with something it does not recognise, such as an <?xml ... ?> declaration.
• H008 leaves single quoted values holding a double quote alone, such as title='{% translate "Delete" %}'. An attribute that merely ends in a known name, such as data-title, is no longer treated as that attribute.

... (truncated)

Commits

• cbd8491 add .codegraph to gitignore
• e06310d remove .codegraph/.gitignore
• e0142b7 v1.45.0
• 0a11806 docs: cut the unreleased changelog down to what a user sees change
• 4c54bd9 chore(deps): update pre-commit hook zizmorcore/zizmor-pre-commit to v1.30.0 (...
• 935b2ee chore(deps): lock file maintenance (#2448)
• ded85c4 perf: rule a line out of the block-opening search when it holds no markup
• a525cb2 perf: build the indenter's configured patterns once instead of per file
• c12e4da feat: report obsolete elements, unknown aria roles and a timed meta refresh
• 55dbe80 perf: let the aria rules rule a tag out before parsing its attributes
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions