Skip to content

Bump the python-dependencies group across 1 directory with 17 updates#35

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-8cfafc9355
Closed

Bump the python-dependencies group across 1 directory with 17 updates#35
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-8cfafc9355

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 17 updates in the / directory:

Package From To
alembic 1.18.4 1.18.5
autobahn 25.12.2 26.6.2
cbor2 6.1.2 6.1.3
certifi 2026.5.20 2026.6.17
cffi 2.0.0 2.1.0
charset-normalizer 3.4.7 3.4.9
click 8.4.1 8.4.2
croniter 6.2.2 6.2.3
greenlet 3.5.1 3.5.3
humanize 4.15.0 4.16.0
msgpack 1.2.0 1.2.1
pyasn1 0.6.3 0.6.4
sentry-sdk 2.63.0 2.64.0
setuptools 82.0.1 83.0.0
treq 25.5.0 26.7.0
txaio 25.12.2 26.6.1
typing-extensions 4.15.0 4.16.0

Updates alembic from 1.18.4 to 1.18.5

Release notes

Sourced from alembic's releases.

1.18.5

Released: June 25, 2026

usecase

  • [usecase] [commands] Added --splice support to the merge() command. Previously, the merge command would suggest using --splice when attempting to merge non-head revisions, but the flag was not actually accepted by the command. The splice parameter is now available in both the command-line interface and the command.merge() function, matching the existing support in command.revision(). Pull request courtesy Kadir Can Ozden.

    References: #1712

  • [usecase] [environment] Added ScriptDirectory.get_heads.consider_depends_on parameter to ScriptDirectory.get_heads(). When set to True, head revisions that are also a dependency of another revision via depends_on are excluded from the result, matching the effective heads that would be present in the alembic_version table after running all upgrades.

    References: #1806

bug

  • [bug] [autogenerate] Fixed rendering of dialect keyword arguments containing ~sqlalchemy.schema.Column objects within sequences, such as postgresql_include. These were previously rendered using repr(), producing invalid Python in the generated migration scripts. Column objects within list or tuple values are now correctly rendered as their string column names. Pull request courtesy Ajay Singh.

    References: #1258

  • [bug] [mysql] Implemented type comparison for ENUM datatypes on MySQL, which checks that the individual enum values are equivalent. If additional entries are on either side, this generates a diff. Changes of order do not generate a diff. Pull request courtesy Furkan Köykıran.

    References: #1745, #779

  • [bug] [operations] Fixed bug where the inline_references parameter of Operations.add_column() did not include foreign key referential actions such as ON DELETE, ON UPDATE, DEFERRABLE, INITIALLY, and MATCH when rendering the inline REFERENCES clause.

... (truncated)

Commits

Updates autobahn from 25.12.2 to 26.6.2

Release notes

Sourced from autobahn's releases.

Development Build fork-ae666ac5-oberstet_autobahn_python-fix_1877-202607021413

Development build from pull request

Build Information

  • Commit: c103d73f
  • Build Date: 2026-07-02 14:17:59 UTC
  • Release Type: development

Included Platforms

  • Linux: x86_64, ARM64 (manylinux wheels + pure Python fallbacks)
  • macOS: Apple Silicon ARM64
  • Windows: x86_64

Python Versions

  • CPython: 3.11, 3.12, 3.13, 3.14
  • PyPy: 3.11

Installation

Download the appropriate wheel for your platform:

pip install <downloaded-wheel-file>

Artifact Inventory

  • Total Wheels: 20
  • Source Distributions: 3

Development Build fork-725dbb0e-oberstet_autobahn_python-fix_1877-202607021131

Development build from pull request

Build Information

  • Commit: c103d73f
  • Build Date: 2026-07-02 11:35:46 UTC
  • Release Type: development

Included Platforms

  • Linux: x86_64, ARM64 (manylinux wheels + pure Python fallbacks)
  • macOS: Apple Silicon ARM64
  • Windows: x86_64

... (truncated)

Changelog

Sourced from autobahn's changelog.

26.6.2

WAMP Cryptosign

  • Fix import autobahn.wamp.cryptosign raising TypeError: unsupported operand type(s) for |: 'str' and 'NoneType' on CPython 3.11/3.12/3.13 when crypto support (nacl) is installed. A ruff UP007 autofix in 26.6.1 (#1843) had rewritten Optional["ISecurityModule"] to "ISecurityModule" | None in a module that lacks from __future__ import annotations, so the string forward-reference union was evaluated eagerly at class-definition time (CPython 3.14 was unaffected because PEP 649 defers annotation evaluation). The regression broke WAMP-cryptosign and any importer with crypto dependencies present (e.g. xbr, Crossbar.io) on CPython < 3.14. Added from __future__ import annotations to cryptosign.py to defer annotation evaluation (#1878)

Build & CI/CD

  • Add an import smoke test that imports every public autobahn submodule with the crypto extras installed, so eager-evaluation annotation regressions like #1878 are caught in CI on all supported Python versions (#1878)

26.6.1

WAMP RawSocket

  • Fix the Twisted WampRawSocketProtocol raising TransportLost out of dataReceived when the opening handshake fails before a WAMP session is attached (e.g. an invalid magic byte from a port scanner). abort() now tears down the transport whenever a transport is present - rather than only when a session is open - so a failed handshake closes the connection cleanly with a single warning instead of an "Unhandled Error" stack trace, and handshake processing stops instead of continuing past the abort. The asyncio backend already behaved correctly; cross-backend regression tests were added for both. Thanks to @​karel-un for the report (#1850)

WAMP Serialization

  • py-ubjson (unmaintained, sdist-only) is no longer an unconditional dependency. A base pip install autobahn — and the wheels-only / cross-arch case from #1849 (pip download --only-binary :all: --platform ...) — now resolves entirely from binary wheels (#1849)
  • The WAMP ubjson serializer is now backed by the maintained bjdata (Binary JData) package, provided as the OPTIONAL autobahn[serialization] extra (it also pulls in numpy), keeping both out of a minimal install (#1849)
  • bjdata is published sdist-only (no PyPI wheels) and is currently CPython-only: on PyPy its sdist build pulls an unbuildable numpy (upstream NeuroJSON/pybj#6), so the ubjson serializer is unavailable on PyPy - use cbor/msgpack there. On CPython without a compiler, set PYBJDATA_NO_EXTENSION=1 for a pure-Python build. For wheels-only or cross-arch deployments, also prefer cbor/msgpack (#1849)
  • ⚠️ Wire-level change to watch out for: bjdata's octet-level encoding is NOT identical to the previous py-ubjson/UBJSON bytes (different integer markers, little-endian). The WAMP serializer id remains ubjson for transport negotiation. The wamp-proto UBJSON test vectors will be regenerated in a follow-up PR after this release; until then the ubjson serializer is excluded from the byte-vector conformance suite (round-trip and cross-serializer coverage retained) (#1849)

FlatBuffers

  • Bump vendored FlatBuffers from v25.9.23 to v25.12.19, restoring the version-sync with zlmdb 26.6.1 (#1853)
  • Commit the binary schemas (reflection.bfbs, wamp.bfbs) to the source tree and ship them as-is; the package build no longer runs flatc, which fixes cross-compilation from the PyPI sdist (e.g. Buildroot/Yocto/aarch64) (#1853)
  • Add just generate-reflection to regenerate the committed binary schemas with a version-matched flatc built from deps/flatbuffers (#1853)
  • Add just check-flatbuffers-sync and a unit test exercising check_zlmdb_flatbuffers_version_in_sync() (#1853)
  • Delete two orphaned generated files, Kdf.py and ChannelBinding.py, left in src/autobahn/wamp/gen/wamp/proto/ after the schema renamed those tables to KDF and TLSChannelBinding. Their case-insensitive collisions with the current KDF.py / TLSChannelBinding.py broke git clone and directory copies on case-insensitive filesystems (APFS/macOS, some Docker setups). They are no longer produced by flatc, and the verification from #1830 now keeps such orphans from recurring. Thanks to @​dcki for the report (#1828)

Build & CI/CD

  • Bump shared .ai (wamp-ai) and .cicd (wamp-cicd) submodules to match zlmdb exactly (#1853)
  • Fix scripts/update_flatbuffers.sh git-version capture for submodule checkouts (.git is a file, not a directory) (#1853)
  • Bump the .cicd (wamp-cicd) submodule to pick up the script/shell-injection fix in the shared identifiers.yml reusable workflow (untrusted GitHub event fields are now passed via env: as quoted data with a fail-closed branch-name allowlist) (#1856)
  • Fail wheel builds hard when NVX was requested (AUTOBAHN_USE_NVX) but the CFFI extension did not compile, instead of silently degrading to a pure-Python (py3-none-any) wheel. A transient native-compile crash (e.g. a gcc SIGSEGV under QEMU ARM64 emulation) now aborts the build with a non-zero exit so CI can retry it, rather than uploading a structurally valid but unintended artifact. Building with AUTOBAHN_USE_NVX=0 still produces a pure-Python wheel as before (#1856)
  • Fix NVX native-extension builds breaking under cross-compilation (e.g. Buildroot/Yocto for aarch64), where the cross toolchain rejected the host-only -march=native flag (unknown value 'native' for '-march'). The default architecture target is now the portable baseline for all build contexts (wheels, local source installs, and cross-compilation), with -march=native available opt-in via AUTOBAHN_ARCH_TARGET=native. The target architecture is detected via sysconfig.get_platform() so the correct baseline is chosen when cross-compiling. Thanks to @​jameshilliard for the original report and approach (#1834, #1835)
  • Fail the just build-all recipe (non-zero exit) when any per-interpreter wheel build fails, naming the interpreter(s). Previously a failed build was silently swallowed, producing a green wheels job with a missing wheel that was only caught downstream by strict release fileset validation (#1859)
  • Cap cbor2 < 6 on PyPy/Windows only (via environment markers), keeping cbor2 6.x everywhere else. cbor2 6.x is Rust/pyo3-only with no PyPy/Windows wheel and no pure-Python fallback, so it cannot be installed on PyPy/Windows; the 5.x line ships a pure-Python wheel (and runs at near-native speed on PyPy). This unblocks building and installing autobahn on PyPy/Windows (#1859)
  • Build and publish the missing CPython 3.12 and 3.14 manylinux_*_aarch64 (ARM64) wheels. The per-version ARM64 build matrix (added in commit 3d856f5 to deduplicate wheels) only covered cp311 and cp313, so no cp312 aarch64 wheel was ever published (and cp314 was never added) - e.g. pip download autobahn --platform manylinux_2_34_aarch64 for CPython 3.12 found no matching distribution. The strict release fileset manifest shared the same gap and so could not catch it; it now requires the cp312/cp314 aarch64 wheels (fail-closed). Thanks to @​norrisjeremy for the report (#1848)
  • Make the release fileset symmetric across all four platforms: every supported interpreter (cp311, cp312, cp313, cp314, pypy311) is now required on macOS/arm64, Linux/x86_64, Linux/aarch64, and Windows/amd64. The macOS job already built all interpreters via just build-all, but the manifest only required cp313/cp314/pypy311, so the cp311/cp312 macOS wheels were built and then dropped as "extra" rather than published; they are now kept and required (#1848)
  • Remove orphaned/attic files left over from the pre-justfile/uv CI/CD system: Makefile.orig, Dockerfile.wheels, mypy.ini, test-docker-builds.sh, versions.sh, deploy.sh, .prettierrc.json, .coveragerc, docs/DOCKER_BUILDS.md, docker/README.md and the pyinstaller/ PyInstaller hooks, plus the unused pyinstaller dev dependency. The .coveragerc omit = */test/*.py setting was preserved by migrating it to [tool.coverage.run] in pyproject.toml (so coverage still excludes in-package test modules), and the stale DOCKER_BUILDS.md entry was dropped from the Sphinx exclude_patterns. mypy is unaffected: the typing recipe already passes --config-file pyproject-static-typing.toml explicitly. setuptools was added explicitly to the dev extra: it is required by cffi's ffi.compile() to build the NVX extensions in an editable install on Python >= 3.12 (stdlib distutils was removed in 3.12) and had been pulled in only transitively via the removed pyinstaller (#1831)
  • Fix the FlatBuffers generated-code verification so it actually detects drift. The build-fbs recipe now uses the vendored, version-matched flatc bundled in the venv (${VENV_PATH}/bin/flatc) instead of an arbitrary system flatc, and the CI job runs just clean-fbs before just build-fbs so orphaned/stale generated files no longer survive in both the before and after states (previously they matched checksums and went undetected). On drift the job now fails with an actionable, categorized table - content differs (regenerate & commit, e.g. after a vendored-flatc bump), orphan / not generated (delete), new, not committed (commit) - derived from git status of the regenerated tree (#1830)
Commits

Updates cbor2 from 6.1.2 to 6.1.3

Release notes

Sourced from cbor2's releases.

6.1.3

  • Fixed the decoder registering 6-byte strings in the string reference namespace at indices 65536–4294967295 where the encoder does not, desynchronising the namespace and resolving later string references to the wrong value (#313; PR by @​sahvx655-wq)
  • Fixed the IPv4/IPv6 network decoders (tags 52 and 54) silently truncating an address byte string that is longer than the address size instead of rejecting it as malformed (#309; PR by @​sahvx655-wq)
  • Fixed quadratic decoding time for indefinite-length and large definite-length byte and text strings, caused by concatenating each chunk onto the accumulated result with + instead of building the result once (#316; PR by @​sahvx655-wq)
  • Fixed datetime_as_timestamp encoding whole-second datetimes before 1970 or after 2106 as floats instead of integers, because the timestamp was narrowed through an unsigned 32-bit integer (#317; PR by @​sahvx655-wq)
  • Fixed the encoder measuring text strings by code point count instead of UTF-8 byte length when deciding whether to add them to the string reference namespace, desynchronising it from the decoder (which counts bytes) and corrupting later string references for non-ASCII strings (#314; PR by @​sahvx655-wq)
  • Fixed the decoder rejecting scoped IPv6 addresses (tag 54) with a CBORDecodeError reading invalid types in input array; the encoder emits them as [address, null, zone id] but the decoder only handled the network and interface array forms, so a scoped ~ipaddress.IPv6Address could not be decoded back (#324; PR by @​sahvx655-wq)
Commits
  • 5820bd4 Bumped up the version
  • 8bb0466 Bump the github-actions group with 2 updates (#323)
  • 00e3dea Decode scoped IPv6 addresses instead of rejecting them (#324)
  • aeff00b Measure text strings by byte length in maybe_stringref (#314)
  • 1c827f1 Encode whole-second datetime timestamps as integers across full range (#317)
  • 791172c Worked around coveralls not working with Homebrew 6
  • 32f66ee [pre-commit.ci] pre-commit autoupdate (#322)
  • 1d5054e Switched to quarterly pre-commit updates
  • c348bbf [pre-commit.ci] pre-commit autoupdate (#319)
  • 6625bc1 Optimized bytestring and text string decoding (#316)
  • Additional commits viewable in compare view

Updates certifi from 2026.5.20 to 2026.6.17

Commits

Updates cffi from 2.0.0 to 2.1.0

Release notes

Sourced from cffi's releases.

v2.1.0

  • Added support for Python 3.15 and support for C extensions generated by CFFI to target the new abi3t free-threaded ABI.
  • Dropped support for Python 3.9.
  • Added cffi-gen-src CLI to generate CFFI C extension source for alternate build backend support.
  • Fixed crashes inside __delitem__.
  • Fixed "string too big" error under MSVC.
  • Fixed mingw builds.
  • Added support for arm64 iOS wheels.
Commits
  • d9f6f70 New release 2.1.0
  • 02a7b0e Misc pre-2.1 release/packaging cleanup (#253)
  • 1362e5d Move cffi-gen-src release note to 2.1.0 notes
  • a797055 Make error message when embedding version test fails more friendly
  • f1f40a8 Update changelog
  • dc62c93 Delete missed cp39 Windows builds
  • a341180 Update version numbers to prepare for v2.1 release
  • 9f04d85 Mark test using inet_ntoa as thread-unsafe
  • 5f12702 Fix flaky pytest-run-parallel CI crash
  • 26b3d3a Merge branch 'main' into integrate-buildtool
  • Additional commits viewable in compare view

Updates charset-normalizer from 3.4.7 to 3.4.9

Release notes

Sourced from charset-normalizer's releases.

Version 3.4.9

3.4.9 (2026-07-07)

Fixed

  • Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

Version 3.4.8

3.4.8 (2026-07-06)

Fixed

  • Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)
  • Unnecessary json import at runtime (#753)
  • Inverse capitalization not seen by noise detector (#731)

Changed

  • No longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.
  • Micro-optimizations in our noise / coherence measurements.
  • No longer using regex search by default for our preemptive charset mark algorithm.
  • Raised upperbound of setuptools to v83.
  • Raised upperbound of mypy(c) to v2.1.

Removed

  • Redundant UTF7 BOM marker (#730)
Changelog

Sourced from charset-normalizer's changelog.

3.4.9 (2026-07-07)

Fixed

  • Regression in our fallback path leading to a decode error. (#771) We've yanked 3.4.8 as a result of that bug.

3.4.8 (2026-07-06)

Fixed

  • Wall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (#742)
  • Unnecessary json import at runtime (#753)
  • Inverse capitalization not seen by noise detector (#731)

Changed

  • No longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.
  • Micro-optimizations in our noise / coherence measurements.
  • No longer using regex search by default for our preemptive charset mark algorithm.
  • Raised upperbound of setuptools to v83.
  • Raised upperbound of mypy(c) to v2.1.

Removed

  • Redundant UTF7 BOM marker (#730)
Commits
  • cc68407 Merge pull request #772 from jawah/fix-regression-fallback-path
  • 152b923 chore: release 3.4.9
  • 2bc2607 fix: unicodedecodeerror in fallback path
  • be252d7 chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (#767)
  • 71c7bdd chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (#768)
  • aeea391 chore(deps): bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (#758)
  • a6f8feb Merge pull request #770 from jawah/unblock-ci
  • 528e16c chore: add osv-scanner.toml
  • 5993498 chore: ast_serialize musl missing prebuilt riscv,s390x,ppc64le
  • aa2ddd8 Release 3.4.8 (#766)
  • Additional commits viewable in compare view

Updates click from 8.4.1 to 8.4.2

Release notes

Sourced from click's releases.

8.4.2

This is the Click 8.4.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.4.2/ Changes: https://click.palletsprojects.com/page/changes/#version-8-4-2 Milestone: https://github.com/pallets/click/milestone/34

  • Fix Fish shell completion broken in 8.4.0 by #3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. #3502 #3043 #3504 #3508
  • Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. #3509
  • A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. #3059 #3507
  • echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. #3242 #2542 #3534
  • echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from #3482. #3449 #3533
  • Fix CLI usage symopsis for optional arguments producing double square brackets [[a|b|c]]... whose type already brackets their metavar. #3578
  • {func}version_option resolves a package_name that does not match an installed distribution as an import (top-level module) name via {func}importlib.metadata.packages_distributions. Packages whose top-level module name differs from their distribution name (PIL vs Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the box. #2331 #1884 #3125 #3582
Changelog

Sourced from click's changelog.

Version 8.4.2

Released 2026-06-24

  • Fix Fish shell completion broken in 8.4.0 by {pr}3126. Newlines and tabs in option help text are now escaped, keeping the original completion format while still supporting multi-line help. {issue}3502 {issue}3043 {pr}3504 {pr}3508
  • Deprecated commands and options with empty or missing help text no longer render a stray leading space before the (DEPRECATED) label. {pr}3509
  • A {class}Group with invoke_without_command=True marks its subcommand as optional in the usage help, showing [COMMAND] instead of COMMAND. {issue}3059 {pr}3507
  • echo_via_pager flushes after each write, so passing a generator streams output to the pager incrementally instead of staying hidden until the pipe buffer fills. {issue}3242 {issue}2542 {pr}3534
  • echo_via_pager and get_pager_file no longer close a borrowed stdout stream when no external pager runs, completing the partial I/O operation on closed file fix from {pr}3482. {issue}3449 {pr}3533
  • Fix CLI usage symopsis for optional arguments producing double square brackets [[a|b|c]]... whose type already brackets their metavar. {pr}3578
  • {func}version_option resolves a package_name that does not match an installed distribution as an import (top-level module) name via {func}importlib.metadata.packages_distributions. Packages whose top-level module name differs from their distribution name (PIL vs Pillow, jwt vs PyJWT) no longer raise RuntimeError out of the box. {issue}2331 {issue}1884 {issue}3125 {pr}3582
Commits
  • b2e30a1 Release version 8.4.2
  • 7a16b20 Fix package_name resolution when module differs from distribution name (#3582)
  • bec5928 Fix package_name resolution when top-level module differs from distribution...
  • 916883a Fix tests to not rely on -Wdefault option (#3591)
  • 09195f6 Fix double-bracketing of choices in synopsis (#3578)
  • 1557e26 Check for warning exception with idiomatic context manager
  • d9ff133 Static typing improvements in click.shell_completion (#3460)
  • 762c97e Fix double-bracketing of choices in synopsis
  • 8929d39 Convert changes to markdown. (#3559)
  • 237be50 Move changes headings down a level.
  • Additional commits viewable in compare view

Updates croniter from 6.2.2 to 6.2.3

Changelog

Sourced from croniter's changelog.

6.2.3 (2026-07-02)

Features and Improvements

- Fix quadratic expansion of comma-separated range lists for a large speed-up on expressions with many ranges. [1d79fc6, [#231](https://github.com/pallets-eco/croniter/issues/231), @alhudz]

Bugfixes


- Reject a zero step (e.g. ``5-5/0``) in equal and reversed cron ranges instead of silently accepting it. [ab27767, [#232](https://github.com/pallets-eco/croniter/issues/232), @alhudz]
- Fix ``expand_from_start_time`` month low-bound off-by-one so stepped month ranges start on the correct month. [f329964, [#235](https://github.com/pallets-eco/croniter/issues/235), @alhudz]

Packaging




    

  • Fix zizmor-reported security findings in GitHub Actions workflows. [ed19f94, #230]
    • 

  • Bump pinned build and CI dependencies via dependabot.
    • 

  • Upgrade locked development and build dependencies (uv lock --upgrade).
Commits
  • 22b59e0 Prepare for release 6.2.3 (#236)
  • ab27767 reject zero step in equal and reversed cron ranges (#232)
  • f329964 fix expand_from_start_time month low bound off-by-one (#235)
  • 9810279 Bump the github-actions group with 2 updates (#233)
  • d051aaf Bump hatchling from 1.29.0 to 1.30.1 in the pip-dependencies group (#234)
  • 1d79fc6 fix quadratic expansion of comma-separated range lists (#231)
  • ed19f94 Fix zizmor-reported security findings in GitHub Actions workflows (#230)
  • 82657c3 Bump trove-classifiers in the pip-dependencies group (#229)
  • 8e13827 Bump the github-actions group with 2 updates (#228)
  • e55d70b Bump trove-classifiers in the pip-dependencies group across 1 directory (#225)
  • Additional commits viewable in compare view

Updates greenlet from 3.5.1 to 3.5.3

Changelog

Sourced from greenlet's changelog.

3.5.3 (2026-06-26)

  • Fix a crash on free-threaded builds when multiple greenlets were holding a critical section on an object and the GIL for the thread was dropped. See issue 513 <https://github.com/python-greenlet/greenlet/issues/513>_. Thanks to ddorian.

3.5.2 (2026-06-17)

  • The minimum supported version of Python 3.15 is now 3.15b2.
  • Fix some garbage-collection related crashes on free-threaded Python 3.15. Thanks to Kumar Aditya in PR [#511](https://github.com/python-greenlet/greenlet/issues/511) <https://github.com/python-greenlet/greenlet/pull/511>_.
  • Improve garbage collection of greenlets. This mostly applies to Python 3.15. Thanks to Kumar Aditya in PR [#512](https://github.com/python-greenlet/greenlet/issues/512) <https://github.com/python-greenlet/greenlet/pull/512>_.
Commits
  • 6ee8c2c Preparing release 3.5.3
  • 6ec0bbb Merge pull request #514 from python-greenlet/issue513-preserve-crit-section
  • c03a7e6 Py3.13+: Preserve thread state critical_section to prevent crash on free-thre...
  • bc10829 Speed up manylinux test runs by only running the core checks; only start many...
  • c2db75d Back to development: 3.5.3
  • 0b64e9c Preparing release 3.5.2
  • 3e28d27 Add change note for #512 [skip ci]
  • 6563c5e Merge pull request #512 from kumaraditya303/ft-mem
  • ab6eff6 add ignore for win 3.10
  • 41f5349 revert back to fails_leakcheck_on_py314_or_less
  • Additional commits viewable in compare view

Updates humanize from 4.15.0 to 4.16.0

Release notes

Sourced from humanize's releases.

4.16.0

Added

Changed

Fixed

Commits
  • 3c577d7 Add test for exact googol (10**100) in intword() (#304)
  • 52609bf Drop experimental Python 3.13 free-threaded (#336)
  • 8a47cb4 Lazy imports for Python 3.15+ (#335)
  • 823ad60 Fix naturalsize() rounding rollover at unit boundaries (#329)
  • 7574e0c Carry metric() to the next SI prefix when rounding reaches 1000 (#328)
  • c2c410c Stop printing two minus signs in fractional for a negative mixed number (#320)
  • 976484a Fix typo in i18n.activate() docstring (#325)
  • d333afd Update release-drafter/release-drafter action to v7.3.1 (#324)
  • d07d77e Update dependency mypy to v2 (#323)
  • 15eb4cc Update github-actions (#322)
  • Additional commits viewable in compare view

Updates msgpack from 1.2.0 to 1.2.1

Release notes

Sourced from msgpack's releases.

v1.2.1

What's Changed

Full Changelog: msgpack/msgpack-python@v1.2.0...v1.2.1

Changelog

Sourced from msgpack's changelog.

1.2.1

Release Date: 2026-06-19

Fix a segfault when calling Unpacker.unpack() or Unpacker.skip() after an unpacking failure. But note that reusing the same Unpacker instance after an unpacking failure is not supported. Please create a new Unpacker instance instead. GHSA-6v7p-g79w-8964

Commits

Updates pyasn1 from 0.6.3 to 0.6.4

Release notes

Sourced from pyasn1's releases.

Release 0.6.4

This is a security release.

  • CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.
  • CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.
  • CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.__float__() for values with large base-10 exponents.
  • Pinned PyPI publish GitHub Action to an immutable commit.

All changes are noted in the CHANGELOG.

Changelog

Sourced from pyasn1's changelog.

Revision 0.6.4, released 08-07-2026

  • CVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU. Arcs are now accumulated in linear time; decoded values are unchanged (thanks for reporting, tynus2)
  • CVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits), matching the OID arc limit introduced in 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory; longer tag IDs are now rejected with PyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag (thanks for reporting, mikeappsec) IDs due to the integer-to-string conversion limit (Python 3.11+)
  • CVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in Real.float() for values with large base-10 exponents. Conversion no longer materializes huge intermediate integers; values too large to represent as a Python float raise OverflowError promptly, and prettyPrint() renders them as '' as before. Also fixed base-10 mantissa normalization to use exact integer arithmetic; mantissas larger than 2**53 could previously lose precision through float division (thanks for reporting, gvozdila)
  • Pinned PyPI publish GitHub Action to an immutable commit [pr #113](pyasn1/pyasn1#113)
Commits
  • 72e4803 Prepare release 0.6.4
  • 0c19eeb Pin PyPI publish action to immutable commit (#113)
  • 45bdb19 Merge c...

    Description has been truncated

@dependabot
Bump the python-dependencies group across 1 directory with 17 updates
04853dd 
Bumps the python-dependencies group with 17 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [alembic](https://github.com/sqlalchemy/alembic) | `1.18.4` | `1.18.5` |
| [autobahn](https://github.com/crossbario/autobahn-python) | `25.12.2` | `26.6.2` |
| [cbor2](https://github.com/agronholm/cbor2) | `6.1.2` | `6.1.3` |
| [certifi](https://github.com/certifi/python-certifi) | `2026.5.20` | `2026.6.17` |
| [cffi](https://github.com/python-cffi/cffi) | `2.0.0` | `2.1.0` |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.7` | `3.4.9` |
| [click](https://github.com/pallets/click) | `8.4.1` | `8.4.2` |
| [croniter](https://github.com/pallets-eco/croniter) | `6.2.2` | `6.2.3` |
| [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.1` | `3.5.3` |
| [humanize](https://github.com/python-humanize/humanize) | `4.15.0` | `4.16.0` |
| [msgpack](https://github.com/msgpack/msgpack-python) | `1.2.0` | `1.2.1` |
| [pyasn1](https://github.com/pyasn1/pyasn1) | `0.6.3` | `0.6.4` |
| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.63.0` | `2.64.0` |
| [setuptools](https://github.com/pypa/setuptools) | `82.0.1` | `83.0.0` |
| [treq](https://github.com/twisted/treq) | `25.5.0` | `26.7.0` |
| [txaio](https://github.com/crossbario/txaio) | `25.12.2` | `26.6.1` |
| [typing-extensions](https://github.com/python/typing_extensions) | `4.15.0` | `4.16.0` |



Updates `alembic` from 1.18.4 to 1.18.5
- [Release notes](https://github.com/sqlalchemy/alembic/releases)
- [Changelog](https://github.com/sqlalchemy/alembic/blob/main/CHANGES)
- [Commits](https://github.com/sqlalchemy/alembic/commits)

Updates `autobahn` from 25.12.2 to 26.6.2
- [Release notes](https://github.com/crossbario/autobahn-python/releases)
- [Changelog](https://github.com/crossbario/autobahn-python/blob/master/docs/changelog.rst)
- [Commits](crossbario/autobahn-python@v25.12.2...v26.6.2)

Updates `cbor2` from 6.1.2 to 6.1.3
- [Release notes](https://github.com/agronholm/cbor2/releases)
- [Commits](agronholm/cbor2@6.1.2...6.1.3)

Updates `certifi` from 2026.5.20 to 2026.6.17
- [Commits](certifi/python-certifi@2026.05.20...2026.06.17)

Updates `cffi` from 2.0.0 to 2.1.0
- [Release notes](https://github.com/python-cffi/cffi/releases)
- [Commits](python-cffi/cffi@v2.0.0...v2.1.0)

Updates `charset-normalizer` from 3.4.7 to 3.4.9
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.7...3.4.9)

Updates `click` from 8.4.1 to 8.4.2
- [Release notes](https://github.com/pallets/click/releases)
- [Changelog](https://github.com/pallets/click/blob/main/CHANGES.md)
- [Commits](pallets/click@8.4.1...8.4.2)

Updates `croniter` from 6.2.2 to 6.2.3
- [Release notes](https://github.com/pallets-eco/croniter/releases)
- [Changelog](https://github.com/pallets-eco/croniter/blob/main/CHANGELOG.rst)
- [Commits](pallets-eco/croniter@6.2.2...6.2.3)

Updates `greenlet` from 3.5.1 to 3.5.3
- [Changelog](https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst)
- [Commits](python-greenlet/greenlet@3.5.1...3.5.3)

Updates `humanize` from 4.15.0 to 4.16.0
- [Release notes](https://github.com/python-humanize/humanize/releases)
- [Commits](python-humanize/humanize@4.15.0...4.16.0)

Updates `msgpack` from 1.2.0 to 1.2.1
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.2.0...v1.2.1)

Updates `pyasn1` from 0.6.3 to 0.6.4
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4)

Updates `sentry-sdk` from 2.63.0 to 2.64.0
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.63.0...2.64.0)

Updates `setuptools` from 82.0.1 to 83.0.0
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v82.0.1...v83.0.0)

Updates `treq` from 25.5.0 to 26.7.0
- [Release notes](https://github.com/twisted/treq/releases)
- [Changelog](https://github.com/twisted/treq/blob/trunk/CHANGELOG.rst)
- [Commits](twisted/treq@treq-25.5.0...treq-26.7.0)

Updates `txaio` from 25.12.2 to 26.6.1
- [Release notes](https://github.com/crossbario/txaio/releases)
- [Changelog](https://github.com/crossbario/txaio/blob/master/docs/changelog.rst)
- [Commits](crossbario/txaio@v25.12.2...v26.6.1)

Updates `typing-extensions` from 4.15.0 to 4.16.0
- [Release notes](https://github.com/python/typing_extensions/releases)
- [Changelog](https://github.com/python/typing_extensions/blob/main/CHANGELOG.md)
- [Commits](python/typing_extensions@4.15.0...4.16.0)

---
updated-dependencies:
- dependency-name: alembic
  dependency-version: 1.18.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: autobahn
  dependency-version: 26.6.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-dependencies
- dependency-name: cbor2
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: certifi
  dependency-version: 2026.6.17
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: cffi
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: charset-normalizer
  dependency-version: 3.4.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: click
  dependency-version: 8.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: croniter
  dependency-version: 6.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: greenlet
  dependency-version: 3.5.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: humanize
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: msgpack
  dependency-version: 1.2.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pyasn1
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: sentry-sdk
  dependency-version: 2.64.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: setuptools
  dependency-version: 83.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-dependencies
- dependency-name: treq
  dependency-version: 26.7.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-dependencies
- dependency-name: txaio
  dependency-version: 26.6.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-dependencies
- dependency-name: typing-extensions
  dependency-version: 4.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 9, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Jul 20, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/python-dependencies-8cfafc9355 branch July 20, 2026 22:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants