Skip to content

Bump the python-minor-patch group across 1 directory with 9 updates - #231

Merged
sebastian-luna-valero merged 2 commits into
masterfrom
dependabot/pip/python-minor-patch-800c37c6fd
Oct 2, 2026
Merged

Bump the python-minor-patch group across 1 directory with 9 updates#231
sebastian-luna-valero merged 2 commits into
masterfrom
dependabot/pip/python-minor-patch-800c37c6fd

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 9 updates in the / directory:

Package From To
click 8.1.7 8.5.0
click-option-group 0.5.6 0.5.9
tabulate 0.9.0 0.10.0
requests 2.33.0 2.34.2
pyjwt 2.8.0 2.15.0
jsonpath-ng 1.6.0 1.8.0
pyyaml 6.0.1 6.0.3
jsonschema 4.19.2 4.26.0
hvac 2.0.0 2.4.0

Updates click from 8.1.7 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

  • Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
  • Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
  • {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
  • confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
  • {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
  • Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). #3581
  • style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
  • The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
  • unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681
  • Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

  • Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637
  • Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
  • {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473
  • confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653
  • Fix test failures when using pytest >= 9.1. {pr}3656
  • {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642
  • Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). {pr}3581
  • style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. {pr}3677
  • The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). {issue}2819 {pr}3678
  • unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. {pr}3681
  • Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call time. {pr}3641
  • {func}get_binary_stream and {func}get_text_stream are deprecated and will be removed in Click 9.0. {issue}3481 {pr}3695
  • The following click.utils names were never intentionally public and are now private (_-prefixed). The old names remain available with a DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,

... (truncated)

Commits
  • 8b19813 Release version 8.5.0
  • 2c8cd3a Add FAQ entry about UnicodeEncodeError on Windows (#3778)
  • 131c86a Add FAQ entry about UnicodeEncodeError on Windows
  • e1fd594 Add support of pathlib.Path to edit (#3781)
  • a1d8785 Add support of pathlib.Path to edit
  • 2103e15 Forward all user's parameters set in PAGER and improve flag detection (#3777)
  • a6256bf Forwards all user's parameters set in PAGER
  • 61b69e9 Resolve the pager command once, in _pager_contextmanager (#3776)
  • 9835b0f Resolve the pager command once, in _pager_contextmanager
  • f36d58b Refactor pager stream handling (#3767)
  • Additional commits viewable in compare view

Updates click-option-group from 0.5.6 to 0.5.9

Release notes

Sourced from click-option-group's releases.

click-option-group v0.5.9

What's Changed

Full Changelog: click-contrib/click-option-group@v0.5.8...v0.5.9

click-option-group v0.5.8

What's Changed

Full Changelog: click-contrib/click-option-group@v0.5.7...v0.5.8

v0.5.7

  • Add return type Decorator (PR #68)
  • Update CI/CD config and Python versions (PR #69)
  • Fix tests for click>=8.1.8 (PR #70)
Changelog

Sourced from click-option-group's changelog.

v0.5.9 (09.10.2025)

  • Fix use of mypy while maintaining pyright compatibility (PR #73)

v0.5.8 (01.10.2025)

  • Fix some types for pyright linter (PR #72)

v0.5.7 (24.03.2025)

  • Add return type Decorator (PR #68)
  • Update CI/CD config and Python versions (PR #69)
  • Fix tests for click>=8.1.8 (PR #70)
Commits
  • 476fdc0 Bump version to v0.5.9
  • 2acefa8 Merge pull request #73 from adamtheturtle/fix-mypy-and-pyright
  • 4501cb4 Fix use of mypy while maintaining pyright compatibility
  • 56105d2 Update changelog for v0.5.8
  • a243273 Update "release" CI pipeline
  • f6e2e46 Merge pull request #72 from adamtheturtle/pyright
  • 913d7df Add type hint to inner decorator functions
  • 3194f62 Fix some errors I hit while using this library with pyright
  • 89c3508 Merge pull request #71 from click-contrib/release-pipeline
  • cae8518 enable creating release in release pipeline
  • Additional commits viewable in compare view

Updates tabulate from 0.9.0 to 0.10.0

Changelog

Sourced from tabulate's changelog.

  • 0.10.0: Add support for Python 3.11, 3.12, 3.13, 3.14. Drop support for Python 3.7, 3.8, 3.9. PRESERVE_STERILITY global is replaced with preserve_sterility function argument. New formatting options: headersglobalalign, headersalign, colglobalalign. New output format: colon_grid (Pandoc grid_tables with alignment) Various bug fixes. Improved error messages.
Commits
  • 3b4cd50 update HOWTOPUBLISH
  • 35ee0f6 update mini-benchmark table
  • 37ac76e restore tabulate.version
  • 37e1ed0 move # nowa: E931 to a different line (flake8)
  • 7bacc90 run pre-commit hooks (black)
  • 1b69704 Remove spurious cast in string interpolation
  • 4d535af Use specific noqa directives
  • 76c3d37 Remove spurious space from error message
  • 13508e7 Unnecessary list call
  • 69f67cd Do not call getattr with a constant value
  • Additional commits viewable in compare view

Updates requests from 2.33.0 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

Updates pyjwt from 2.8.0 to 2.15.0

Release notes

Sourced from pyjwt's releases.

2.15.0

See the 2.15.0 changelog for complete release details.

2.14.0

See the 2.14.0 changelog for the complete release details and related security advisories.

2.13.0

PyJWT 2.13.0 — Security Release

This release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.

Security

  • GHSA-xgmm-8j9v-c9wx — JWK JSON accepted as HMAC secret (algorithm confusion). HMACAlgorithm.prepare_key previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in algorithms=[…] and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. Reported by @​aradona91.

  • GHSA-jq35-7prp-9v3f — Algorithm allow-list bypass with PyJWK / PyJWKClient. When verifying with a PyJWK, the caller's algorithms=[…] allow-list was checked against the token header alg as a string only; actual verification used the algorithm bound to the PyJWK. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header alg to match the PyJWK's algorithm before verification. Reported by @​sushi-gif.

  • GHSA-w7vc-732c-9m39 — DoS via base64 decode of unused payload segment when b64=false. For detached-payload JWS (b64=false), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied detached_payload. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. Reported by @​thesmartshadow.

  • GHSA-993g-76c3-p5m4 — PyJWKClient accepts non-HTTP(S) URIs. PyJWKClient.fetch_data passed its URI to urllib.request.urlopen, which by default also handles file://, ftp://, and data: schemes. An application that fed an attacker-influenced URI into PyJWKClient could be coerced into reading local files or reaching other unintended schemes. PyJWKClient now rejects any URI whose scheme isn't http or https. Reported by @​KEIJOT.

  • GHSA-fhv5-28vv-h8m8 — PyJWKClient cache wiped on fetch error. A finally-block put(jwk_set=None) cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. Reported by @​eddieran.

Fixed

  • Reject empty HMAC keys outright in HMACAlgorithm.prepare_key with InvalidKeyError instead of accepting them with only a warning. Defends against the os.getenv("JWT_SECRET", "") footgun. Thanks to @​SnailSploit and @​spartan8806 for the reports.
  • Forward per-call options (including enforce_minimum_key_length) from PyJWT.decode through to PyJWS._verify_signature. The option was previously silently dropped between the two layers, so it only took effect when set on the PyJWT instance. Thanks to @​WLUB for the report.
  • RFC 7797 §3 compliance for b64=false: the encoder now auto-adds "b64" to crit, and the decoder rejects tokens that set b64=false without listing it in crit. Thanks to @​MachineLearning-Nerd for the report.

Changed

  • Migrate the dev, docs, and tests package extras to dependency groups, by @​kurtmckee in #1152.

Upgrade notes

Most fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:

  • Empty HMAC keys now raise. If your app passed "" or b"" as a secret (often via a missing env var, e.g. os.getenv("JWT_SECRET", "")), encode/decode will now raise InvalidKeyError. This is the intended behavior — fix the configuration.
  • PyJWK decoding now requires the token's alg to match the JWK's algorithm. Previously a mismatch was silently honored if the header alg appeared in the allow-list. Tokens that relied on this mismatch will now fail with InvalidAlgorithmError.
  • PyJWKClient now rejects non-HTTP(S) URIs at construction time. Tests or dev environments that fetched JWKS from file:// URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct PyJWKSet.from_dict(...) directly).
  • b64=false tokens are now strictly RFC 7515 / 7797 compliant. Tokens with a non-empty compact-form payload segment, or that omit "b64" from crit, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.
  • enforce_minimum_key_length set per-call now takes effect. Callers who passed options={"enforce_minimum_key_length": True} to jwt.decode() previously got no enforcement; they will now get InvalidKeyError on undersized keys, as documented.

Full changelog: jpadilla/pyjwt@2.12.1...2.13.0

2.12.1

What's Changed

... (truncated)

Changelog

Sourced from pyjwt's changelog.

v2.15.0 <https://github.com/jpadilla/pyjwt/compare/2.14.0...2.15.0>__

Security


- Wrap recursion errors from deeply nested JWT payloads in ``DecodeError``
  instead of exposing a raw ``RecursionError``.

Added



- Support Python 3.15 by @kytta in `[#1202](https://github.com/jpadilla/pyjwt/issues/1202) &lt;https://github.com/jpadilla/pyjwt/pull/1202&gt;`__

Changed




    

  • JWKSetCache now stores the parsed PyJWKSet rather than the raw JWKS
payload, so a cache hit no longer re-parses every key. JWKSetCache.put()
accepts either form and raises PyJWKSetError for anything else. As a
result, PyJWKClient.get_jwk_set() returns the same PyJWKSet instance
for as long as it stays cached, rather than a freshly built one per call in
[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;__
    • 

  • PyJWKClient.fetch_data() now raises
PyJWKClientError(&quot;The JWKS endpoint did not return a JSON object&quot;) when
the endpoint response is not a JSON object, instead of returning it for
get_jwk_set() to reject. Callers reaching the JWKS through
get_jwk_set() see the same error as before in
[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;__
    • 



Fixed



- Return cached ``PyJWKSet`` values from ``PyJWKClient.get_jwk_set()`` instead
  of raising ``PyJWKClientError(&quot;The JWKS endpoint did not return a JSON
  object&quot;)``. ``JWKSetCache.put()`` documents ``PyJWKSet`` as the cached value,
  so callers pre-populating the cache to avoid a network round-trip could not
  read it back in `[#914](https://github.com/jpadilla/pyjwt/issues/914) &lt;https://github.com/jpadilla/pyjwt/issues/914&gt;`__ and
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__
- ``PyJWKClient.get_jwk_set()`` now caches the key set it returns, so a
  ``fetch_data()`` override that filters or transforms the JWKS is no longer
  undone by the next cache hit in
  `[#1208](https://github.com/jpadilla/pyjwt/issues/1208) &lt;https://github.com/jpadilla/pyjwt/pull/1208&gt;`__
- Raise the documented ``PyJWTError`` subclass instead of leaking a
  ``TypeError`` when the ``exp``, ``nbf``, or ``iat`` claim decodes to a
  non-numeric, non-string value such as a list, dict, or ``null``.
- Reject OKP JWK private keys when their public ``x`` component does not
  match the private ``d`` component.
- Treat malformed JWK Set members as unusable keys rather than letting
  ``AttributeError`` or ``TypeError`` escape ``PyJWKSet``. A member that is not
&lt;/tr&gt;&lt;/table&gt; 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>

<ul>

<li><a href="https://github.com/jpadilla/pyjwt/commit/1d41a6478e1562e68ff667fcd703356acf085f68&quot;&gt;&lt;code&gt;1d41a64&lt;/code&gt;&lt;/a> chore: prepare 2.15.0 release</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/9bc06658f875b9b40091539140bbbdc4639161c3&quot;&gt;&lt;code&gt;9bc0665&lt;/code&gt;&lt;/a> fix: make recursive payload tests deterministic</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/5fde08a6cf906aa7698de2d6391d88b73006b17b&quot;&gt;&lt;code&gt;5fde08a&lt;/code&gt;&lt;/a> fix: normalize recursive JWT payload errors</li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/171062d2d734315272a901100aa4b109f2fc3c19&quot;&gt;&lt;code&gt;171062d&lt;/code&gt;&lt;/a> utils: mention bytes in force_bytes type error (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1173&quot;&gt;#1173&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/c9d4d5375bf464ef363506fed9eb6e7f33217ab6&quot;&gt;&lt;code&gt;c9d4d53&lt;/code&gt;&lt;/a> docs/conf: drop duplicate 'and' from read() docstring (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1174&quot;&gt;#1174&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/2763752196113e1473b0ed7905aa6034aedfbe53&quot;&gt;&lt;code&gt;2763752&lt;/code&gt;&lt;/a> Add support for Python 3.15 (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1202&quot;&gt;#1202&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/4adcd02722f5011c60079d3978dfc167b9a8eaa5&quot;&gt;&lt;code&gt;4adcd02&lt;/code&gt;&lt;/a> Catch http.client.HTTPException in PyJWKClient.fetch_data (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1201&quot;&gt;#1201&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/9e501d993b4d3e7dba14bdb1722b1d993ac75097&quot;&gt;&lt;code&gt;9e501d9&lt;/code&gt;&lt;/a> fix: correct docstring typo in _validate_jti (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1179&quot;&gt;#1179&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/4047c44d51950ffda15f40054508d3f17c43b1e2&quot;&gt;&lt;code&gt;4047c44&lt;/code&gt;&lt;/a> docs: clarify JWK certificate member handling (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1212&quot;&gt;#1212&lt;/a&gt;)&lt;/li>

<li><a href="https://github.com/jpadilla/pyjwt/commit/f4e2b59f543cc82d46d9d69922bba59e804216b9&quot;&gt;&lt;code&gt;f4e2b59&lt;/code&gt;&lt;/a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/jpadilla/pyjwt/issues/1210&quot;&gt;#1210&lt;/a&gt;)&lt;/li>

<li>Additional commits viewable in <a href="https://github.com/jpadilla/pyjwt/compare/2.8.0...2.15.0&quot;&gt;compare view</a></li>

</ul>

</details>


<br />


Updates jsonpath-ng from 1.6.0 to 1.8.0



Release notes

Sourced from jsonpath-ng's releases.




v1.8.0


Added


    

  • Support Python 3.13 and 3.14
    • 

  • Typing for IDE autocomplete
    • 

  • Support for EMOJI and CJK Unicode
    • 

  • Support for DatumInContext in-place updating
    • 

  • Support equality checking of Operation instances
    • 

  • Support string serialization of Union and Intersect instances
    • 

  • Support comma-separated indices
    • 

  • Add typings for IDE autocomplete
    • 



Changed


    

  • Rename ExtentedJsonPathParser
    • 

  • Remove ply dependency
    • 



Fixed


    

  • Fix False and None values
    • 

  • Fix single constant case
    • 

  • Update field filter to resolve wildcard path issue
    • 

  • Vendor copy of ply and remove pickle support from the vendored copy to resolve CVE-2025-56005
    • 

  • Fix string serialization throughout the library to enforce roundtrip parsing consistency.

      

    • Fields are more conservatively enclosed in quotion marks
This fixes serialization and re-parsing of "00", '%', '0@' and "&'".
      • 

    • Operation instances can now be serialized.
This fixes serialization of 0-@ and A -A.
      • 

    • SortedThis instances can now be serialized and re-parsed.
This fixes serialization of 0[/0].
      • 

    • Child precedence is now preserved using parentheses during serialization.
This ensures that serialized strings like a..b[c] serialize and re-parse identically.
      • 

    

    • 

  • Fix parsing and string serialization of numeric-only identifiers.
This fixes parsing of 10, which was parsed as two separate fields.
    • 

  • Fix equality checks for SortedThis instances.
    • 

  • Fix bool filter type to handle None values
    • 



Removed


    

  • Python 3.8 and 3.9 no longer supported
    • 



v1.7.0


    

  • Allow raw numeric values to be used as keys
    • 

  • Add wherenot
    • 

  • Added EZRegex pattern for the split extension regex
    • 

  • Added negative and * indecies and quotes to Split parameters
    • 

  • Typo: duplicate line removed.
    • 

  • Added path extension that exposes datum's path from the jsonpath expression itself.
    • 

  • Remove Python 3.7 support
    • 

  • Only construct the parse table once
    • 

  • updated test for jsonpath.py changes
    • 

  • fix for Updating a json object fails if the value of a key is boolean #73
    • 

  • Add Codespaces configuration
    • 

  • Add .editorconfig
    • 






... (truncated)





Changelog

Sourced from jsonpath-ng's changelog.




1.8.0 - 2026-02-24


Added


    

  • Support Python 3.13 and 3.14
    • 

  • Typing for IDE autocomplete
    • 

  • Support for EMOJI and CJK Unicode
    • 

  • Support for DatumInContext in-place updating
    • 

  • Support equality checking of Operation instances
    • 

  • Support string serialization of Union and Intersect instances
    • 

  • Support comma-separated indices
    • 

  • Add typings for IDE autocomplete
    • 



Changed


    

  • Rename ExtentedJsonPathParser
    • 

  • Remove ply dependency
    • 



Fixed


    

  • Fix False and None values
    • 

  • Fix single constant case
    • 

  • Update field filter to resolve wildcard path issue
    • 

  • Vendor copy of ply and remove pickle support from the vendored copy to resolve CVE-2025-56005
    • 

  • Fix string serialization throughout the library to enforce roundtrip parsing consistency.

      

    • Fields are more conservatively enclosed in quotion marks
This fixes serialization and re-parsing of "00", '%', '0@' and "&'".
      • 

    • Operation instances can now be serialized.
This fixes serialization of 0-@ and A -A.
      • 

    • SortedThis instances can now be serialized and re-parsed.
This fixes serialization of 0[/0].
      • 

    • Child precedence is now preserved using parentheses during serialization.
This ensures that serialized strings like a..b[c] serialize and re-parse identically.
      • 

    

    • 

  • Fix parsing and string serialization of numeric-only identifiers.
This fixes parsing of 10, which was parsed as two separate fields.
    • 

  • Fix equality checks for SortedThis instances.
    • 

  • Fix bool filter type to handle None values
    • 



Removed


    

  • Python 3.8 and 3.9 no longer supported
    • 








Commits

    

  • e59ead3 Release v1.8.0
    • 

  • ee53af8 Update setup.py
    • 

  • 485ffb3 Update requirements.txt
    • 

  • e00121b Fix a number of bugs uncovered by roundtrip testing
    • 

  • eeed776 Remove pickle support in ply modules
    • 

  • 314401c Vendor ply as it is no longer maintained
    • 

  • a44b275 Bump github/codeql-action from 3 to 4
    • 

  • 9878070 Bump actions/checkout from 5 to 6
    • 

  • 0ff6edd Test with Python 3.14
    • 

  • 3fb3558 Remove official support for Python 3.8 and 3.9
    • 

  • Additional commits viewable in compare view
    • 







Updates pyyaml from 6.0.1 to 6.0.3



Release notes

Sourced from pyyaml's releases.




6.0.3


What's Changed


    

  • Support for Python 3.14 and free-threading (experimental).
    • 



Full Changelog: https://github.com/yaml/pyyaml/compare/6.0.2...6.0.3


6.0.2


What's Changed


    

  • Support for Cython 3.x and Python 3.13.
    • 



Full Changelog: https://github.com/yaml/pyyaml/compare/6.0.1...6.0.2


6.0.2rc1


    

  • Support for extension build with Cython 3.x
    • 

  • Support for Python 3.13
    • 

  • Added PyPI wheels for musllinux on aarch64
    • 








Changelog

Sourced from pyyaml's changelog.




6.0.3 (2025-09-25)


    

  • yaml/pyyaml#864 -- Support for Python 3.14 and free-threading (experimental)
    • 



6.0.2 (2024-08-06)








Commits






Updates jsonschema from 4.19.2 to 4.26.0



Release notes

Sourced from jsonschema's releases.




v4.26.0



What's Changed



New Contributors



Full Changelog: https://github.com/python-jsonschema/jsonschema/compare/v4.25.1...v4.26.0


v4.25.1



What's Changed






... (truncated)





Changelog

Sourced from jsonschema's changelog.




v4.26.0


    

  • Decrease import time by delaying importing of urllib.request (#1416).
    • 



v4.25.1<...

Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Oct 2, 2026
@dependabot dependabot Bot changed the title Bump the python-minor-patch group with 9 updates Bump the python-minor-patch group across 1 directory with 9 updates Oct 2, 2026
@dependabot
dependabot Bot force-pushed the dependabot/pip/python-minor-patch-800c37c6fd branch from c6e6504 to 8fa29f2 Compare October 2, 2026 14:35
@dependabot
Bump the python-minor-patch group across 1 directory with 9 updates
7a115a6 
Bumps the python-minor-patch group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [click](https://github.com/pallets/click) | `8.1.7` | `8.5.0` |
| [click-option-group](https://github.com/click-contrib/click-option-group) | `0.5.6` | `0.5.9` |
| [tabulate](https://github.com/astanin/python-tabulate) | `0.9.0` | `0.10.0` |
| [requests](https://github.com/psf/requests) | `2.33.0` | `2.34.2` |
| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.8.0` | `2.15.0` |
| [jsonpath-ng](https://github.com/h2non/jsonpath-ng) | `1.6.0` | `1.8.0` |
| [pyyaml](https://github.com/yaml/pyyaml) | `6.0.1` | `6.0.3` |
| [jsonschema](https://github.com/python-jsonschema/jsonschema) | `4.19.2` | `4.26.0` |
| [hvac](https://github.com/hvac/hvac) | `2.0.0` | `2.4.0` |



Updates `click` from 8.1.7 to 8.5.0
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.1.7...8.5.0)

Updates `click-option-group` from 0.5.6 to 0.5.9
- [Release notes](https://github.com/click-contrib/click-option-group/releases)
- [Changelog](https://github.com/click-contrib/click-option-group/blob/master/CHANGELOG.md)
- [Commits](click-contrib/click-option-group@v0.5.6...v0.5.9)

Updates `tabulate` from 0.9.0 to 0.10.0
- [Changelog](https://github.com/astanin/python-tabulate/blob/master/CHANGELOG)
- [Commits](astanin/python-tabulate@v0.9.0...v0.10.0)

Updates `requests` from 2.33.0 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.0...v2.34.2)

Updates `pyjwt` from 2.8.0 to 2.15.0
- [Release notes](https://github.com/jpadilla/pyjwt/releases)
- [Changelog](https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst)
- [Commits](jpadilla/pyjwt@2.8.0...2.15.0)

Updates `jsonpath-ng` from 1.6.0 to 1.8.0
- [Release notes](https://github.com/h2non/jsonpath-ng/releases)
- [Changelog](https://github.com/jsonpath-ng/jsonpath-ng/blob/master/CHANGELOG.md)
- [Commits](jsonpath-ng/jsonpath-ng@v1.6.0...v1.8.0)

Updates `pyyaml` from 6.0.1 to 6.0.3
- [Release notes](https://github.com/yaml/pyyaml/releases)
- [Changelog](https://github.com/yaml/pyyaml/blob/6.0.3/CHANGES)
- [Commits](yaml/pyyaml@6.0.1...6.0.3)

Updates `jsonschema` from 4.19.2 to 4.26.0
- [Release notes](https://github.com/python-jsonschema/jsonschema/releases)
- [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst)
- [Commits](python-jsonschema/jsonschema@v4.19.2...v4.26.0)

Updates `hvac` from 2.0.0 to 2.4.0
- [Release notes](https://github.com/hvac/hvac/releases)
- [Changelog](https://github.com/hvac/hvac/blob/main/CHANGELOG.md)
- [Commits](hvac/hvac@v2.0.0...v2.4.0)

---
updated-dependencies:
- dependency-name: click
  dependency-version: 8.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: click-option-group
  dependency-version: 0.5.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: hvac
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: jsonpath-ng
  dependency-version: 1.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: jsonschema
  dependency-version: 4.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pyjwt
  dependency-version: 2.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pyyaml
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: tabulate
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/python-minor-patch-800c37c6fd branch from 8fa29f2 to 7a115a6 Compare October 2, 2026 14:39
@sebastian-luna-valero
sebastian-luna-valero merged commit 5997101 into master Oct 2, 2026
4 checks passed
@dependabot
dependabot Bot deleted the dependabot/pip/python-minor-patch-800c37c6fd branch October 2, 2026 14:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sebastian-luna-valero sebastian-luna-valero sebastian-luna-valero approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@sebastian-luna-valero