Skip to content

Bump the production-dependencies group across 1 directory with 6 updates - #26

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/production-dependencies-c197e65d0c
Open

Bump the production-dependencies group across 1 directory with 6 updates#26
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/production-dependencies-c197e65d0c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Bumps the production-dependencies group with 6 updates in the / directory:

Package From To
bip-utils 2.12.1 2.12.2
redis 8.0.1 8.1.0
hiredis 3.4.0 3.4.1
django 5.2.16 5.2.17
djangorestframework 3.17.1 3.18.1
gunicorn 26.0.0 26.2.0

Updates bip-utils from 2.12.1 to 2.12.2

Release notes

Sourced from bip-utils's releases.

Version 2.12.2

  • Add support for cbor2 6.x. cbor2 6.x removed CBORDecodeValueError and CBORDecodeError is not a subclass of ValueError anymore. Decoding is now based on CBORDecodeError, so an invalid CBOR encoding always results in a ValueError as documented, with any supported cbor2 version.
  • Fix py-sr25519-bindings dependency for Python 3.7 and 3.8.
Changelog

Sourced from bip-utils's changelog.

2.12.2

  • Add support for cbor2 6.x. cbor2 6.x removed CBORDecodeValueError and CBORDecodeError is not a subclass of ValueError anymore. Decoding is now based on CBORDecodeError, so an invalid CBOR encoding always results in a ValueError as documented, with any supported cbor2 version.
  • Fix py-sr25519-bindings dependency for Python 3.7 and 3.8.
Commits

Updates redis from 8.0.1 to 8.1.0

Release notes

Sourced from redis's releases.

8.1.0

Changes

✨ Highlights

Async maintenance notifications

redis-py now supports server-pushed maintenance notifications in the asyncio stack for both standalone and cluster clients, bringing the async client to parity with the sync implementation. When a Redis deployment signals maintenance events (such as node migration or failover windows), the async client reacts through the maintenance-notifications handler (redis/maint_notifications.py and its async integration under redis/asyncio/), allowing applications to adapt connection handling during maintenance without downtime. (#4177)

Expanded command coverage

This release adds a batch of new command surfaces across core data types and modules:

  • Lists — LMOVEM / BLMOVEM for moving multiple elements between lists (#4174).
  • Sets — SDIFFCARD and SUNIONCARD cardinality commands (#4171).
  • Streams — MAXCOUNT / MAXSIZE options for XREAD and XREADGROUP (#4173).
  • Time Series — TS.READ (#4170), TS.QUERYLABELS (#4197), TS.NRANGE / TS.NREVRANGE (#4163), and an exclude_empty (EXCLUDEEMPTY) option for TS.MRANGE / TS.MREVRANGE (#4188).
  • Search — FT.ALIASLIST (#4198) and a COLLECT reducer for aggregations (#4179).
  • Sentinel — replica sentinel aliases (#4127).

🚀 New Features

  • Add replica sentinel aliases (#4127)
  • Add TS.NRANGE and TS.NREVRANGE support to the timeseries command surface (#4163)
  • feat: add TS.READ command support to the timeseries module (#4170)
  • feat: add SDIFFCARD and SUNIONCARD command support (#4171)
  • feat: add MAXCOUNT/MAXSIZE support to XREAD and XREADGROUP (#4173)
  • feat: add LMOVEM and BLMOVEM commands for moving multiple list elements (#4174)
  • feat: add async maintenance-notifications support for standalone and cluster clients (#4177)
  • feat: add COLLECT reducer support to search aggregations (#4179)
  • feat: add exclude_empty (EXCLUDEEMPTY) option to TS.MRANGE and TS.MREVRANGE (#4188)
  • feat: add TS.QUERYLABELS support to the timeseries command surface (#4197)
  • feat: add FT.ALIASLIST support (#4198)

⚠️ Experimental

  • feat: add client-side HIMPORT fieldset support for standalone and cluster clients (#4205)

The feature considered unstable and public API might be changed in the future minor version

🐛 Bug Fixes

  • fix: detect closed pooled connection without consuming pending push data (RESP3 + hiredis) (#4156)
  • Fix Sentinel pool capacity loss after failover (#4193)

... (truncated)

Commits
  • e013126 Testing with 8.10 GA (#4227)
  • 059d1e9 Fixed TS.NRANGE commands to correctly apply aggregators (#4225)
  • d486a0a Fix FIELDNAME alias dropping first character of un-prefixed fields (#4224)
  • fb93104 feat: add client-side HIMPORT fieldset support for standalone and cluster cli...
  • 9197609 Fix lat/lon swap in search querystring geo() helper (#4223)
  • 14714a0 fix: Fixed double decoding issue with unquote() (#4222)
  • 227280a Update lib version to 8.1.0
  • 88d16d0 Decode ACL LOG string values on the default RESP3 legacy callback (#4201)
  • 599fd75 feat: add FT.ALIASLIST support (#4198)
  • 71e275e test: add VectorField RERANK serialization tests for sync and async search (#...
  • Additional commits viewable in compare view

Updates hiredis from 3.4.0 to 3.4.1

Release notes

Sourced from hiredis's releases.

3.4.1

This is a security fix release. All users of hiredis-py 3.4.x are strongly encouraged to upgrade.

🔒 Security Fixes

Updates the bundled hiredis C library to v1.4.1, which fixes:

  • redis/hiredis#1340
  • redis/hiredis#1341

Acknowledgements

Vulnerability discovered by He Huang (hehuang@swin.edu.au), Swinburne University of Technology, Melbourne, Australia; discovered using NexusSan.

Commits

Updates django from 5.2.16 to 5.2.17

Commits
  • e802ada [5.2.x] Bumped version for 5.2.17 release.
  • b9adb81 [5.2.x] Fixed CVE-2026-15920 -- Made display_for_field() validate URLs before...
  • ba80833 [5.2.x] Fixed CVE-2026-15830 -- Mitigated potential DoS via nested geometry c...
  • c72a5db [5.2.x] Fixed CVE-2026-15337 -- Mitigated potential DoS in check_for_language().
  • 115ffd0 [5.2.x] Fixed CVE-2026-15307 -- Blocked raster strings and dicts in spatial l...
  • ec5ced4 [5.2.x] Fixed #36770 -- Fixed incomplete mocking in SQLiteInMemoryTestDbs.
  • 02369b5 [5.2.x] Allowed the full Python test matrix to run on GitHub Actions.
  • 686072f [5.2.x] Added stub release notes and release date for 5.2.17.
  • cd5ad8c [5.2.x] Bumped minimum setuptools version to 83.
  • 3e389b7 [5.2.x] Closed temporary files in GDALRasterTests.
  • Additional commits viewable in compare view

Updates djangorestframework from 3.17.1 to 3.18.1

Release notes

Sourced from djangorestframework's releases.

3.18.1

What's Changed

Bug fixes

Other changes

New Contributors

Full Changelog: encode/django-rest-framework@3.18.0...3.18.1

3.18.0

What's Changed

Breaking changes

Features

Bug fixes

Other changes

New Contributors

... (truncated)

Commits
  • dd23495 Prepare release 3.18.1 (#10036)
  • cb1fb66 Install gettext in prepare-release
  • 858f1fc Reject non-finite values (nan, inf) in FloatField (#9998)
  • ea695cd Ensure translations are up to date when preparing release
  • 0406c6e Update pygments requirement from >=2.17,<2.21 to ==2.21.* in the optional gro...
  • 8c92e89 Expand deprecation classes and review deprecation policy (#10034)
  • 3157a6a Update pytest config to native TOML format from v9 (#10035)
  • 4f77428 Fixing issue #9484 (#10033)
  • f17d70f Fix int64 format detection for negative IntegerField minimums in Open API s...
  • 5668281 Add a compatibility setting for ListSerializer error formats (#10027)
  • Additional commits viewable in compare view

Updates gunicorn from 26.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

  • Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits
  • 36f2a3c gunicorn 26.2.0
  • cbba350 test: cover the h2c edge paths that had none
  • 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
  • 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
  • 5853551 Merge pull request #3712 from Rotzbua/patch-1
  • 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
  • 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
  • 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
  • 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
  • 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the production-dependencies group across 1 directory with 6 updates
176a139 
Bumps the production-dependencies group with 6 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [bip-utils](https://github.com/ebellocchia/bip_utils) | `2.12.1` | `2.12.2` |
| [redis](https://github.com/redis/redis-py) | `8.0.1` | `8.1.0` |
| [hiredis](https://github.com/redis/hiredis-py) | `3.4.0` | `3.4.1` |
| [django](https://github.com/django/django) | `5.2.16` | `5.2.17` |
| [djangorestframework](https://github.com/encode/django-rest-framework) | `3.17.1` | `3.18.1` |
| [gunicorn](https://github.com/benoitc/gunicorn) | `26.0.0` | `26.2.0` |



Updates `bip-utils` from 2.12.1 to 2.12.2
- [Release notes](https://github.com/ebellocchia/bip_utils/releases)
- [Changelog](https://github.com/ebellocchia/bip_utils/blob/master/CHANGELOG.md)
- [Commits](ebellocchia/bip_utils@v2.12.1...v2.12.2)

Updates `redis` from 8.0.1 to 8.1.0
- [Release notes](https://github.com/redis/redis-py/releases)
- [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES)
- [Commits](redis/redis-py@v8.0.1...v8.1.0)

Updates `hiredis` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/redis/hiredis-py/releases)
- [Changelog](https://github.com/redis/hiredis-py/blob/master/CHANGELOG.md)
- [Commits](redis/hiredis-py@v3.4.0...v3.4.1)

Updates `django` from 5.2.16 to 5.2.17
- [Commits](django/django@5.2.16...5.2.17)

Updates `djangorestframework` from 3.17.1 to 3.18.1
- [Release notes](https://github.com/encode/django-rest-framework/releases)
- [Commits](encode/django-rest-framework@3.17.1...3.18.1)

Updates `gunicorn` from 26.0.0 to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@26.0.0...26.2.0)

---
updated-dependencies:
- dependency-name: bip-utils
  dependency-version: 2.12.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: redis
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: hiredis
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: django
  dependency-version: 5.2.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: djangorestframework
  dependency-version: 3.18.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants