Skip to content

deps(deps): bump the python-minor-and-patch group across 1 directory with 12 updates - #807

Closed
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/uv/python-minor-and-patch-c35ffc63b3
Closed

deps(deps): bump the python-minor-and-patch group across 1 directory with 12 updates#807
dependabot[bot] wants to merge 1 commit into
devfrom
dependabot/uv/python-minor-and-patch-c35ffc63b3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-minor-and-patch group with 12 updates in the / directory:

Package From To
simplejson 4.1.1 4.1.2
django-flexible-reports 0.4.2 0.5.0
django-tables2 3.0.0 3.0.1
nh3 0.3.6 0.3.7
cryptography 50.0.0 50.0.1
crispy-bootstrap5 2026.3 2026.9
xhtml2pdf 0.2.17 0.2.18
gunicorn 26.0.0 26.2.0
django-oauth-toolkit 3.4.0 3.4.1
pytest-rerunfailures 16.5 16.6.1
ruff 0.16.3 0.16.6
djlint 1.44.2 1.45.0

Updates simplejson from 4.1.1 to 4.1.2

Release notes

Sourced from simplejson's releases.

v4.1.2

What's Changed

New Contributors

Full Changelog: simplejson/simplejson@v4.1.1...v4.1.2

Changelog

Sourced from simplejson's changelog.

Version 4.1.2 released 2026-08-26

Version 4.1.1 released 2026-04-24

  • The build_wheels_py27 CI job now also builds Python 2.7 wheels for Windows AMD64 and Windows x86, joining the existing Py2.7 manylinux1 / manylinux2010 x86_64 wheels. This unblocks offline / --no-index installs on Py2.7-on-Windows (the original reporter's case), which previously had no matching binary wheel on PyPI, fell through to the sdist, and failed on the PEP 517 isolated-build step complaining that setuptools>=42 was not in the wheelhouse. simplejson/simplejson#377

Version 4.1.0 released 2026-04-22

  • The C extension now accelerates encoding when indent= is set. Previously the encoder fell back to the pure-Python implementation whenever a non-None indent was passed; now the C encoder emits the newline-plus-indent prefix, the level-aware item separator, and the closing indent directly. A representative nested-dict workload benchmarks about 4-5x faster end-to-end, and the indent=0 and empty-container edge cases continue to match the Python output byte-for-byte.

  • The C extension now emits PEP 678 exc.add_note() annotations on serialization failures, matching the pure-Python encoder. A chained error on {'a': [1, object(), 3]} produces the same three notes (when serializing object object, when serializing list item 1, when serializing dict item 'a') whether the speedups are loaded or not, so the add_note assertions in test_errors.py no longer need indent=2 to force the Python path.

Version 4.0.1 released 2026-04-18

  • Skip uploading Pyodide/wasm wheels to PyPI, which rejects them with "unsupported platform tag 'pyodide_2024_0_wasm32'". The wheels are still built in CI and preserved as workflow artifacts. simplejson/simplejson#375

... (truncated)

Commits
  • d1fe71a Add missing changelog entries (#384)
  • aa1f2c4 Update CHANGES for v4.1.2 (#383)
  • b84ad54 Report the comma position for illegal trailing comma errors (#382)
  • b0fe1ef Handle non-finite Decimals like floats in the encoder (fixes #149) (#381)
  • fa8feea Report the offending char, not the backslash, for invalid \X escapes (#380)
  • bded822 Fix control character error position when content precedes the control char (...
  • See full diff in compare view

Updates django-flexible-reports from 0.4.2 to 0.5.0

Release notes

Sourced from django-flexible-reports's releases.

v0.5.0

  • Added Report.set_order_by(*fields), a third render-time setter alongside set_base_queryset() and set_context(). It overrides the ordering stored on every table of the report for one render, and takes ORM field names rather than the column labels ColumnOrder uses — so a report can be sorted by a field that no column displays, which the stored ordering cannot express. ColumnOrder is left untouched and keeps serving as the default; calling the setter with no arguments falls back to it.
Changelog

Sourced from django-flexible-reports's changelog.

0.5.0 (2026-08-19)

  • Added Report.set_order_by(*fields), a third render-time setter alongside set_base_queryset() and set_context(). It overrides the ordering stored on every table of the report for one render, and takes ORM field names rather than the column labels ColumnOrder uses — so a report can be sorted by a field that no column displays, which the stored ordering cannot express. ColumnOrder is left untouched and keeps serving as the default; calling the setter with no arguments falls back to it.
Commits
  • a9ee294 release: 0.5.0
  • e3b2183 Merge pull request #14 from mpasternak/feat/set-order-by
  • dbf4c2b test: pin header-click ordering against the set_order_by override
  • 31ec542 feat: Report.set_order_by() overrides a report's stored ordering
  • See full diff in compare view

Updates django-tables2 from 3.0.0 to 3.0.1

Changelog

Sourced from django-tables2's changelog.

3.0.1 (2026-08-29)

  • Add support for Django 6.1
  • Remove support for Python 3.10
Commits

Updates nh3 from 0.3.6 to 0.3.7

Release notes

Sourced from nh3's releases.

v0.3.7

What's Changed

New Contributors

Full Changelog: messense/nh3@v0.3.6...v0.3.7

Commits
  • 74f36b8 Bump pyo3 from 0.29.0 to 0.29.2 (#140)
  • 5cb1a16 Update ammonia and bump version to 0.3.7
  • 5bc937a Bump ammonia from 4.1.3 to 4.1.4 (#139)
  • 5816c84 Bump actions/setup-python from 6 to 7 in the github-actions group (#138)
  • 7718812 Bump ammonia from 4.1.2 to 4.1.3 (#137)
  • 567c411 Validate tag_attribute_values conflict with attributes (#135)
  • c23021c Don’t depend on deprecated pyo3/generate-import-lib feature (#136)
  • 0343d0b Bump actions/checkout from 6 to 7 in the github-actions group (#132)
  • 0573fe4 Expose ammonia's id_prefix option via id_prefix kwarg (#134)
  • See full diff in compare view

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.

.. _v50-0-0:

Commits

Updates crispy-bootstrap5 from 2026.3 to 2026.9

Release notes

Sourced from crispy-bootstrap5's releases.

2026.9 (2026-09-02)

  • Confirmed support for Django 6.1.
Changelog

Sourced from crispy-bootstrap5's changelog.

2026.9 (2026-09-02)

  • Confirmed support for Django 6.1.
Commits

Updates xhtml2pdf from 0.2.17 to 0.2.18

Release notes

Sourced from xhtml2pdf's releases.

v0.2.18

  • Support ReportLab 5 and Python 3.10-3.14, fix 14 bugs, harden the test suite

Widen the ReportLab constraint to >=4.0.4,<6 and raise the Python floor to 3.10, after validating empirically that ReportLab 5 does not change rendering: references built with one ReportLab major and compared against a render from the other produce zero pixel differences across all 23 testrender fixtures, in both directions and down to the declared 4.0.4 floor. The CI matrix now covers Python 3.10 to 3.14 against both ReportLab majors.

The only behavioural regression in ReportLab 5 is rl_config.trustedHosts=None changing from "every host is trusted" to "no host is trusted", which makes open_for_read refuse every URL and data: URI. That default is deliberate SSRF hardening and is left untouched; PmlImageReader falls back to xhtml2pdf's own fetcher instead.

The ReportLab 5 assessment also surfaced that the rendering comparison could never fail. CI regenerated the reference from the same commit and the same ReportLab immediately before comparing, and tox passed --nofail. Removing --nofail alone would not have helped: ImageMagick compare exits 1 when images differ and exec_cmd treated that as a fatal error, aborting on the first differing page before the HTML report was written. A cross-version job now builds the reference with one ReportLab major and renders with the other, in both directions.

Bug fixes:

  • @​page name:left / @​page name:right now work. A stray sys.exit() in PmlBaseDoc.handle_nextPageTemplate terminated the calling process, and the vendored PTCycle predated ReportLab's next_value protocol, so the alternating left/right page feature had never worked. ReportLab's own PTCycle is used now.
  • Temporary files are no longer shared between threads. TmpFiles subclasses threading.local but declared files as a class attribute, so one request's cleanFiles() closed files another request was still reading.
  • The WSGI middleware produces PDFs. PisaMiddleware.filter wrote PDF bytes into a StringIO, and the response buffer rejected the bytes chunks that PEP 3333 requires applications to yield.
  • pisaPDF.addFromString() works; it passed an unsupported capacity keyword to getFile() and appended raw bytes where PdfReader needs a file-like object.
  • pisaFileObject accepts bytes and pathlib.Path, as its type hints claimed. Both raised AttributeError, swallowed into a silent None.
  • data: URIs are parsed per RFC 2397. The percent-encoded form, which is the usual way inline SVG is written, was rejected outright.
  • HTTP responses follow redirects (bounded to 5 hops), accept any 2xx status rather than the literal "200 OK" reason phrase, close their connection, and log a warning instead of a debug message on failure.
  • Plain HTTP requests honour the configured http_timeout; it was only applied to HTTPS connections, so plain HTTP could hang indefinitely.
  • pisaTempFile(capacity=-1) keeps its buffer in memory, as documented. len(buffer) > capacity is true for any buffer when capacity is negative, so

... (truncated)

Commits
  • 19071d0 Keep the logo the header used to lose without a word
  • b8f7c99 Answer ruff and mypy, and uncover what an untyped node was hiding
  • 4159417 Merge branch 'fix/remaining-findings' into development
  • 4d338e3 Write down the behaviours that cost an afternoon each
  • 7feb418 Remove the tags that were never implemented, and read two attributes
  • 1cade61 Make the arguments of pisaDocument mean what they say
  • 7d36d26 Let a document be encrypted, and say why it cannot also be signed
  • f79ab77 Make the form controls carry what the markup gives them
  • 8f5be05 Fit a chart to the canvas it was given, and the canvas to the frame
  • 1759953 Fade a background image instead of flattening its transparency
  • Additional commits viewable in compare view

Updates gunicorn from 26.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

  • Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits
  • 36f2a3c gunicorn 26.2.0
  • cbba350 test: cover the h2c edge paths that had none
  • 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
  • 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
  • 5853551 Merge pull request #3712 from Rotzbua/patch-1
  • 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
  • 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
  • 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
  • 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
  • 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
  • Additional commits viewable in compare view

Updates django-oauth-toolkit from 3.4.0 to 3.4.1

Release notes

Sourced from django-oauth-toolkit's releases.

3.4.1

This release is dominated by security hardening of redirect URI matching, token revocation and refresh token handling. Several entries below change behavior that was previously accepted, and they are spread across Fixed and Security: the "Upgrading to 3.4.1" section of the Upgrading guide collects everything you need to act on in one place, so start there. Of particular note: redirect URIs are now matched exactly per RFC 9700 §2.1, so a request may no longer carry query parameters, path parameters, credentials or a fragment that the registered URI does not have; REFRESH_TOKEN_EXPIRE_SECONDS, where set, is now enforced when a refresh token is presented rather than only by the cleartokens sweep; and the built-in templates now link a stylesheet shipped with the package instead of a CDN, so run collectstatic or the pages render unstyled.

Added

  • #681 Redirect URI mismatches are now diagnosed on the oauth2_provider logger at DEBUG, reporting the requested URI, every registered candidate it was compared against, and which component of each one differed (scheme, hostname, port, path, query). The same detail is emitted for post_logout_redirect_uri and for the token endpoint's comparison against the URI recorded on the grant. The error response is unchanged: the registered URIs are never disclosed to the requester, only to the server's log. See "Debugging redirect URI mismatches" in the documentation. Note that AbstractApplication.redirect_uri_allowed() and post_logout_redirect_uri_allowed() now call the new check_redirect_to_uri_allowed() (same verdict, plus the mismatch reasons) instead of redirect_to_uri_allowed(), so code that wrapped or patched the latter to influence those methods must target the former.
  • #634 A system check (oauth2_provider.W011) that warns when the AccessToken and RefreshToken models are swapped into different apps, and a new "Extending the token models" documentation section explaining how to swap the interrelated token models together.
  • #1623 Documentation ("Content Security Policy and the authorization form") on completing the authorization-code flow under a strict form-action Content Security Policy, which Chromium enforces against the post-authorization redirect to the client's redirect_uri.
  • #410 Documentation ("Resource scope syntax") clarifying that TokenHasResourceScope checks each required_scopes entry suffixed with the READ_SCOPE/WRITE_SCOPE setting value (defaults read/write, e.g. music:read, music:write), so a bare music scope is rejected; with the default settings-based scopes backend the suffixed scopes must be declared in SCOPES.
  • #1157 An "Upgrading" documentation page collecting the breaking changes and upgrade steps for every release that needs them — 2.0, 3.0 and this release — linked from the documentation index, so upgrade guidance is discoverable outside the CHANGELOG. A release that asks nothing of you has no section there, so a gap between two versions is an answer rather than an omission.
  • #452 Documentation ("Custom scopes backend") explaining how to replace the default settings-driven scopes backend via SCOPES_BACKEND_CLASS, including a worked model-based example that stores scopes in the database.
  • #1045 Tutorial ("Managing applications and tokens in the Django admin") walking through the admin site for applications and issued tokens, including client-secret hashing, credential masking, and that tokens cannot be created by hand.
  • #403 Translatable (gettext_lazy) verbose_name labels on every field of the Application, Grant, AccessToken, RefreshToken, IDToken and DeviceGrant models, so the Django admin and the authorization UI can be localized. Migration

... (truncated)

Changelog

Sourced from django-oauth-toolkit's changelog.

[3.4.1] - 2026-08-21

This release is dominated by security hardening of redirect URI matching, token revocation and refresh token handling. Several entries below change behavior that was previously accepted, and they are spread across Fixed and Security: the "Upgrading to 3.4.1" section of the Upgrading guide collects everything you need to act on in one place, so start there. Of particular note: redirect URIs are now matched exactly per RFC 9700 §2.1, so a request may no longer carry query parameters, path parameters, credentials or a fragment that the registered URI does not have; REFRESH_TOKEN_EXPIRE_SECONDS, where set, is now enforced when a refresh token is presented rather than only by the cleartokens sweep; and the built-in templates now link a stylesheet shipped with the package instead of a CDN, so run collectstatic or the pages render unstyled.

Added

  • #681 Redirect URI mismatches are now diagnosed on the oauth2_provider logger at DEBUG, reporting the requested URI, every registered candidate it was compared against, and which component of each one differed (scheme, hostname, port, path, query). The same detail is emitted for post_logout_redirect_uri and for the token endpoint's comparison against the URI recorded on the grant. The error response is unchanged: the registered URIs are never disclosed to the requester, only to the server's log. See "Debugging redirect URI mismatches" in the documentation. Note that AbstractApplication.redirect_uri_allowed() and post_logout_redirect_uri_allowed() now call the new check_redirect_to_uri_allowed() (same verdict, plus the mismatch reasons) instead of redirect_to_uri_allowed(), so code that wrapped or patched the latter to influence those methods must target the former.
  • #634 A system check (oauth2_provider.W011) that warns when the AccessToken and RefreshToken models are swapped into different apps, and a new "Extending the token models" documentation section explaining how to swap the interrelated token models together.
  • #1623 Documentation ("Content Security Policy and the authorization form") on completing the authorization-code flow under a strict form-action Content Security Policy, which Chromium enforces against the post-authorization redirect to the client's redirect_uri.
  • #410 Documentation ("Resource scope syntax") clarifying that TokenHasResourceScope checks each required_scopes entry suffixed with the READ_SCOPE/WRITE_SCOPE setting value (defaults read/write, e.g. music:read, music:write), so a bare music scope is rejected; with the default settings-based scopes backend the suffixed scopes must be declared in SCOPES.
  • #1157 An "Upgrading" documentation page collecting the breaking changes and upgrade steps for every release that needs them — 2.0, 3.0 and this release — linked from the documentation index, so upgrade guidance is discoverable outside the CHANGELOG. A release that asks nothing of you has no section there, so a gap between two versions is an answer rather than an omission.
  • #452 Documentation ("Custom scopes backend") explaining how to replace the default settings-driven scopes backend via SCOPES_BACKEND_CLASS, including a worked model-based example that stores scopes in the database.
  • #1045 Tutorial ("Managing applications and tokens in the Django admin") walking through the admin site for applications and issued tokens, including client-secret hashing, credential masking, and that tokens cannot be created by hand.
  • #403 Translatable (gettext_lazy) verbose_name labels on every field of the Application, Grant, AccessToken, RefreshToken, IDToken and DeviceGrant models, so the Django admin and the authorization UI can be localized. Migration

... (truncated)

Commits
  • db6c4f5 chore: 3.4.1 release (#1820)
  • 9c70975 fix: enforce device grant confirmation ownership (#1819)
  • 28bf64c perf: revoke refresh token families as a set on reuse detection (#1810)
  • f797b8a fix(validators): stop honoring revoked refresh tokens in the grace window (#1...
  • 11024a0 chore(deps): bump cryptography in the uv group across 1 directory (#1807)
  • 1e19d4d Log why a redirect URI failed to match (#1814)
  • 4f18e0e feat(templates): serve default styles from a bundled stylesheet (#1815)
  • ae05be9 feat(models): make model field labels translatable (#1812)
  • 2b1a322 fix(models): associate Application validation errors with their fields (#1811)
  • 0915396 fix(dcr): honour hashed token storage for registration access tokens (#1799)
  • Additional commits viewable in compare view

Updates pytest-rerunfailures from 16.5 to 16.6.1

Changelog

Sourced from pytest-rerunfailures's changelog.

16.6.1 (2026-09-03)

Bug Fixes +++++++++

  • Ensure teardown reports are passed to pytest_runtest_logreport for rerun attempts. ([#237](https://github.com/pytest-dev/pytest-rerunfailures/issues/237) <https://github.com/pytest-dev/pytest-rerunfailures/issues/237>_)
  • Prevent superseded built-in subtest failures from remaining in the final test result when rerunning tests with pytest-xdist. ([#350](https://github.com/pytest-dev/pytest-rerunfailures/issues/350) <https://github.com/pytest-dev/pytest-rerunfailures/issues/350>_)
  • Restore module, class, and session scoped fixture teardown when a flaky marker condition is falsy. ([#351](https://github.com/pytest-dev/pytest-rerunfailures/issues/351) <https://github.com/pytest-dev/pytest-rerunfailures/issues/351>_)
  • Restore module, class, and session scoped fixture teardown when an error raised during teardown rules out a re-run. ([#356](https://github.com/pytest-dev/pytest-rerunfailures/issues/356) <https://github.com/pytest-dev/pytest-rerunfailures/issues/356>_)
  • Keep module, class, and session scoped fixtures alive across re-runs of a test whose call phase failed through subtests only. ([#357](https://github.com/pytest-dev/pytest-rerunfailures/issues/357) <https://github.com/pytest-dev/pytest-rerunfailures/issues/357>_)
  • Authenticate xdist StatusDB connections with a per-session token. ([#358](https://github.com/pytest-dev/pytest-rerunfailures/issues/358) <https://github.com/pytest-dev/pytest-rerunfailures/issues/358>_)
  • Ensure negative rerun counts do not skip the initial test execution. ([#359](https://github.com/pytest-dev/pytest-rerunfailures/issues/359) <https://github.com/pytest-dev/pytest-rerunfailures/issues/359>_)

Misc ++++

  • Replace deprecated Config.getvalue() calls with Config.getoption(). ([#345](https://github.com/pytest-dev/pytest-rerunfailures/issues/345) <https://github.com/pytest-dev/pytest-rerunfailures/issues/345>_)

16.6 (2026-08-17)

Features ++++++++

  • Add a repeatable --rerun-exclude-path option to exclude test files or directories from reruns. ([#232](https://github.com/pytest-dev/pytest-rerunfailures/issues/232) <https://github.com/pytest-dev/pytest-rerunfailures/issues/232>_)

Bug Fixes +++++++++

  • Fix a regression in version 16.5 which made --pdb unusable even when no reruns were configured. (`#342

... (truncated)

Commits
  • dad07a7 Preparing release 16.6.1
  • 968fb6c Prevent negative reruns from skipping initial execution (#360)
  • 367df90 Keep higher-scoped fixtures alive across re-runs of failed subtests (#357)
  • 69ac0a7 Authenticate xdist StatusDB connections (#358)
  • 20decd3 Restore higher-scoped teardown when a teardown error rules out a re-run (#356)
  • 84af73d Fix subtest rerun reporting with xdist (#352)
  • d784cdd Test with pytest-xdist on CI (#354)
  • 9f85e06 Restore higher-scoped teardown when a flaky condition is falsy (#351)
  • eab650f Test rerun-except for setup errors (#349)
  • 0b0843a Fix only_rerun marker precedence test (#348)
  • Additional commits viewable in compare view

Updates ruff from 0.16.3 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Commits

Updates djlint from 1.44.2 to 1.45.0

Release notes

Sourced from djlint's releases.

v1.45.0

Feature

  • New rule H043 reports a <button> written without a type. A type written inside a template block, as in <button {% if a %}type="button"{% endif %}>, counts.
  • New rule H044 reports a header row holding both th and td cells. The empty td that opens a two-axis table's header row is allowed.
  • New rule H045 reports an <iframe> with no accessible name. title, aria-label and aria-labelledby all count, as does a name written by a template tag.
  • New rule H046 reports a positive tabindex. 0 and -1 are left alone, as is a value written by a template tag.
  • New rule H047 reports aria-hidden="true" on an element that takes focus. Hiding a decorative icon is not reported, nor is a disabled control or one with tabindex="-1".
  • New rule H048 reports an aria- attribute that ARIA does not define, such as a misspelled aria-lable. Framework bindings like :aria-label are left alone.
  • New rule H049 reports a viewport that stops the page being zoomed, by user-scalable=no or a maximum-scale below 2.
  • New rule H050 reports an element html no longer defines, such as <center>, <font>, <marquee> or <strike>. Only the opening tag is reported, and a custom element whose name merely starts with one, such as <font-picker>, is left alone.
  • New rule H051 reports a role ARIA does not define for markup, such as role="buton". The roles DPUB-ARIA and GRAPHICS-ARIA add count, abstract ones such as landmark do not, and a value written by a template tag or a framework binding such as :role is left alone.
  • New rule H052 reports a <meta http-equiv="refresh"> that reloads or redirects on a timer, which fails WCAG 2.2.1. A delay of zero is an immediate redirect rather than a timer and is not reported.
  • New option --quote-style / quote_style sets the quotes djLint writes inside template tags, double (the default) or single, and T002 follows it, so {% include 'a.html' %} is no longer reported in a project that writes single quote...

    Description has been truncated

@dependabot
deps(deps): bump the python-minor-and-patch group across 1 directory …
b0a8967 
…with 12 updates

Bumps the python-minor-and-patch group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [simplejson](https://github.com/simplejson/simplejson) | `4.1.1` | `4.1.2` |
| [django-flexible-reports](https://github.com/mpasternak/django-flexible-reports) | `0.4.2` | `0.5.0` |
| [django-tables2](https://github.com/jieter/django-tables2) | `3.0.0` | `3.0.1` |
| [nh3](https://github.com/messense/nh3) | `0.3.6` | `0.3.7` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.0` | `50.0.1` |
| [crispy-bootstrap5](https://github.com/django-crispy-forms/crispy-bootstrap5) | `2026.3` | `2026.9` |
| [xhtml2pdf](https://github.com/xhtml2pdf/xhtml2pdf) | `0.2.17` | `0.2.18` |
| [gunicorn](https://github.com/benoitc/gunicorn) | `26.0.0` | `26.2.0` |
| [django-oauth-toolkit](https://github.com/django-oauth/django-oauth-toolkit) | `3.4.0` | `3.4.1` |
| [pytest-rerunfailures](https://github.com/pytest-dev/pytest-rerunfailures) | `16.5` | `16.6.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.3` | `0.16.6` |
| [djlint](https://github.com/djlint/djLint) | `1.44.2` | `1.45.0` |



Updates `simplejson` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/simplejson/simplejson/releases)
- [Changelog](https://github.com/simplejson/simplejson/blob/main/CHANGES.txt)
- [Commits](simplejson/simplejson@v4.1.1...v4.1.2)

Updates `django-flexible-reports` from 0.4.2 to 0.5.0
- [Release notes](https://github.com/mpasternak/django-flexible-reports/releases)
- [Changelog](https://github.com/mpasternak/django-flexible-reports/blob/master/HISTORY.md)
- [Commits](mpasternak/django-flexible-reports@v0.4.2...v0.5.0)

Updates `django-tables2` from 3.0.0 to 3.0.1
- [Changelog](https://github.com/jieter/django-tables2/blob/master/CHANGELOG.md)
- [Commits](jieter/django-tables2@v3.0.0...v3.0.1)

Updates `nh3` from 0.3.6 to 0.3.7
- [Release notes](https://github.com/messense/nh3/releases)
- [Commits](messense/nh3@v0.3.6...v0.3.7)

Updates `cryptography` from 50.0.0 to 50.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.0...50.0.1)

Updates `crispy-bootstrap5` from 2026.3 to 2026.9
- [Release notes](https://github.com/django-crispy-forms/crispy-bootstrap5/releases)
- [Changelog](https://github.com/django-crispy-forms/crispy-bootstrap5/blob/main/CHANGELOG.md)
- [Commits](django-crispy-forms/crispy-bootstrap5@2026.3...2026.9)

Updates `xhtml2pdf` from 0.2.17 to 0.2.18
- [Release notes](https://github.com/xhtml2pdf/xhtml2pdf/releases)
- [Commits](xhtml2pdf/xhtml2pdf@v0.2.17...v0.2.18)

Updates `gunicorn` from 26.0.0 to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@26.0.0...26.2.0)

Updates `django-oauth-toolkit` from 3.4.0 to 3.4.1
- [Release notes](https://github.com/django-oauth/django-oauth-toolkit/releases)
- [Changelog](https://github.com/django-oauth/django-oauth-toolkit/blob/master/CHANGELOG.md)
- [Commits](django-oauth/django-oauth-toolkit@3.4.0...3.4.1)

Updates `pytest-rerunfailures` from 16.5 to 16.6.1
- [Changelog](https://github.com/pytest-dev/pytest-rerunfailures/blob/master/CHANGES.rst)
- [Commits](pytest-dev/pytest-rerunfailures@16.5...16.6.1)

Updates `ruff` from 0.16.3 to 0.16.6
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.3...0.16.6)

Updates `djlint` from 1.44.2 to 1.45.0
- [Release notes](https://github.com/djlint/djLint/releases)
- [Changelog](https://github.com/djlint/djLint/blob/master/CHANGELOG.md)
- [Commits](djlint/djLint@v1.44.2...v1.45.0)

---
updated-dependencies:
- dependency-name: simplejson
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: django-flexible-reports
  dependency-version: 0.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: django-tables2
  dependency-version: 3.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: nh3
  dependency-version: 0.3.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: crispy-bootstrap5
  dependency-version: '2026.9'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: xhtml2pdf
  dependency-version: 0.2.18
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: django-oauth-toolkit
  dependency-version: 3.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: pytest-rerunfailures
  dependency-version: 16.6.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
- dependency-name: ruff
  dependency-version: 0.16.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-and-patch
- dependency-name: djlint
  dependency-version: 1.45.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Sep 7, 2026
@mpasternak mpasternak mentioned this pull request Sep 8, 2026
Merged
mpasternak added a commit that referenced this pull request Sep 10, 2026
@mpasternak @claude
deps: zbiorcza aktualizacja 8 PR-ów dependabota (uv + actions + yarn)…
bf0df75 
… — zamyka 4 CVE i odblokowuje pip-audit (#809)

* ci(deps): zbiorczy bump akcji GitHub (PR-y #806, #805, #788)

Trzy PR-y dependabota z ekosystemu github-actions, scalone recznie zamiast
mergowania po kolei. Wszystkie to podmiana SHA przy zachowanym pinowaniu
do commita + komentarz z tagiem (polityka repo: akcje pinowane po SHA,
nie po ruchomym tagu).

* anthropics/claude-code-action 1.0.193 -> 1.0.216  (#806)
  .github/workflows/claude.yml
* actions/deploy-pages 5.0.0 -> 5.0.1               (#805)
  .github/workflows/docs.yml
* docker/setup-buildx-action 4.2.0 -> 4.3.0         (#788)
  build-docker-images.yml (2x), promote.yml,
  release-candidate.yml, tests.yml

Weryfikacja: po podmianie w drzewie nie zostal ani jeden ze starych SHA
(grep po .github/ pusty).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011aZqYiv56cwAudG2CPS3k5

* build(deps): postcss-selector-parser 7.1.1 -> 7.1.5 (PR #798)

Zaleznosc przechodnia (przez postcss-modules-*), wiec `yarn upgrade
postcss-selector-parser` jej nie rusza — podniesiony wpis w yarn.lock
wprost, wersja/resolved/integrity wziete z PR-a dependabota.

Weryfikacja: `yarn install --frozen-lockfile` przechodzi (lock rozwiazuje
sie bez zmian, integrity zgadza sie z tarballem z rejestru), a
node_modules/postcss-selector-parser/package.json raportuje 7.1.5.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011aZqYiv56cwAudG2CPS3k5

* deps: grupa python-minor-and-patch + pypdf/webob/uvicorn + sync pinu ruffa

Cztery PR-y dependabota z ekosystemu uv, scalone recznie w jedna zmiane.
Powod: kazdy z nich rusza uv.lock, wiec mergowanie po kolei wymusza
rebase i osobny przebieg CI dla kazdego kolejnego.

Grupa python-minor-and-patch (#807), 12 pakietow:

  simplejson              4.1.1  -> 4.1.2
  django-flexible-reports 0.4.2  -> 0.5.0
  django-tables2          3.0.0  -> 3.0.1
  nh3                     0.3.6  -> 0.3.7
  cryptography           50.0.0  -> 50.0.1   (tylko lock)
  crispy-bootstrap5      2026.3  -> 2026.9
  xhtml2pdf              0.2.17  -> 0.2.18
  gunicorn               26.0.0  -> 26.2.0
  django-oauth-toolkit    3.4.0  -> 3.4.1
  pytest-rerunfailures     16.5  -> 16.6.1
  ruff                   0.16.3  -> 0.16.6
  djlint                 1.44.2  -> 1.45.0   (tylko lock)

Pozostale trzy PR-y:

  uvicorn[standard]      0.52.3  -> 0.52.4   (#790)
  pypdf                  6.15.0  -> 6.16.1   (#799)
  webob                  1.8.10  -> 1.8.11   (#794)

BEZPIECZENSTWO — pypdf i webob zamykaja 4 fixable CVE, ktore od kilku
dni wywalaja gate `pip-audit` (job "pip-audit scan"), blokujac takze
niezwiazane PR-y (m.in. #804):

  pypdf 6.15.0  CVE-2026-84309 / -84310 / -84311   fix: 6.16.1
  webob 1.8.10  CVE-2026-54770                     fix: 1.8.11

Weryfikacja lokalna, dokladnie ta komenda co w CI (uv export --no-dev |
pip-audit --disable-pip --no-deps): przed zmiana "Found 4 known
vulnerabilities in 2 packages", po zmianie "No known vulnerabilities
found".

RUFF — bump 0.16.3 -> 0.16.6 wymaga rownoleglej zmiany rev w
.pre-commit-config.yaml. To sa dwa fizycznie rozne binaria (pre-commit
buduje wlasne srodowisko z wheela spod `rev:`), a dependabot tego
sprzezenia nie widzi, bo sledzi tylko ekosystem uv. Pilnuje tego bramka
bin/check-ruff-pin-sync.py — sam PR #807 by ja wywalil. Po synchronizacji
skrypt zwraca 0.

Ruff 0.16.6 nie wnosi nowych naruszen: na tym drzewie 0.16.3 i 0.16.6
daja identyczny wynik — 122 errors z tym samym rozkladem regul oraz
124 pliki do reformatu. Caly ten dlug jest pre-existing na dev i zgodnie
z konwencja repo (lint changed-files-only) zostaje nietkniety.

COOLDOWN — `uv lock --upgrade-package` celuje w najnowsze wydanie, co po
cichu omija 3-dniowy cooldown z .github/dependabot.yml (ochrona przed
atakami typu LiteLLM). Dwa pakiety przestrzelilo i zostaly przypiete do
wersji, ktore odlezaly swoje:

  djlint  1.46.1 wydany dzis (2026-09-08) -> przypiety 1.45.0 (2026-09-03)
  pypdf   6.18.0 wydany wczoraj           -> przypiety 6.16.1 (2026-08-14)

WERSJA uv UZYTA DO PRZELICZENIA LOCKA — celowo `uv@0.11.29`, czyli pin
z CI (setup-uv w jobach `lockfile` / `lint` / `pip-audit`), a NIE lokalne
uv 0.11.14 ani 0.11.15 z hooka uv-pre-commit. Powod: przy przeliczaniu
locka starsze uv rozpisuje marker `platform_python_implementation !=
'PyPy'` na cala rozwiazana grafe zaleznosci — 13 wystapien rosnie do ~700,
a diff uv.lock puchnie z ~500 do ~1900 linii czystego szumu. Wersje
pakietow wychodza identyczne (sprawdzone: 367 pakietow, zero roznic
w parach nazwa/wersja), wiec to wylacznie metadane, ale zasmiecaja
review pliku, ktory trzeba czytac uwaznie. Zweryfikowane empirycznie:
to samo `--upgrade-package simplejson` na czystym dev daje 700 markerow
pod 0.11.14 i 0.11.15, a 13 pod 0.11.29.

    UWAGA: komentarz przy hooku uv-pre-commit w .pre-commit-config.yaml
    ("Trzymaj z grubsza w parze z wersja uv w uzyciu (obecnie 0.11.14)")
    jest wiec juz nieaktualny i doradza dokladnie to, co produkuje churn.
    Lock na dev pochodzi z nowszego uv. Aktualizacja tego komentarza
    i pinu hooka to osobna zmiana, poza zakresem tego PR-a.

Reszta lockfile bez zmian — uzyty celowany `--upgrade-package` dla 15
pakietow, nie zbiorczy `uv lock --upgrade`. Diff uv.lock to 15 zmian
wersji + ich sdist/wheels, 11 linii `requires-dist` (lustro zmian
w pyproject.toml) i jedna usunieta zaleznosc `packaging`, ktora gunicorn
26.2.0 porzucil u siebie.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011aZqYiv56cwAudG2CPS3k5

* docs(deps): udokumentuj `[tool.uv] environments` + zrownaj dolna granice z requires-python

Linia `environments` w [tool.uv] jest load-bearing, a stala bez slowa
wyjasnienia. Wjechala commitem 0f3f049 o wiadomosci "Prepare fix,
maybe" (2025-10-14) — razem z `urllib3>=2.2.3` i `vcrpy>=6.0.2`, i to
byl wlasnie ten fix, tylko nigdzie nieopisany. Odtworzenie powodu
zajelo osobne sledztwo, wiec zapisuje je przy samej linii.

POWOD HISTORYCZNY. uv robi universal resolution: jeden lock ma byc
poprawny dla kazdej platformy i kazdego interpretera, takze takiego,
ktorego nigdy nie uruchomimy. vcrpy 6.0.2 deklarowalo:

    urllib3;   platform_python_implementation != "PyPy" and python_version >= "3.10"
    urllib3<2; platform_python_implementation == "PyPy"

czyli galaz PyPy zadala urllib3<2, nie do pogodzenia z urllib3>=2.2.3.
Wykluczenie PyPy kasuje te galaz i odblokowuje rezolucje.

STAN OBECNY — zweryfikowany, nie zgadniety. Przeskanowany caly graf
z uv.lock (364 pakiety z rejestru, 3 pominiete jako editable/git, zero
bledow pobrania metadanych). Warunki `== "PyPy"` wystepuja w czterech
miejscach:

    celery 5.6.3           brotlipy>=0.7.0  extra == "brotli"
    fonttools 4.62.1       munkres          extra == "all"
    fonttools 4.62.1       munkres          extra == "interpolatable"
    jaraco-functools 4.4.0 mypy<1.19        extra == "type"

Wszystkie cztery siedza za extrasami, ktorych nie wlaczamy — brotlipy,
munkres ani mypy nie wystepuja w uv.lock, a z fonttools bierzemy
wylacznie extra `woff`. vcrpy 8.3.0 nie ma juz swojego warunku.

Zdjecie wykluczenia daje dzis DOKLADNIE te same wersje: 367 pakietow,
zero roznic w parach nazwa/wersja. Zostaje mimo to — kosztuje 13 linii
resolution-markers w naglowku locka i chroni przed powtorka klasy
problemu, ktora juz raz zablokowala rezolucje. Bez niego cryptography,
pynacl i uvicorn[standard] odzyskuja markery PyPy na krawedziach do
cffi/uvloop, wiec lock i tak nie robi sie prostszy.

DOLNA GRANICA. `python_version >= '3.10'` -> `>= '3.11'`. Byla martwa
(przeciecie z requires-python = ">=3.11,<3.15" i tak dawalo 3.11), ale
mylnie sugerowala wsparcie dla 3.10. uv.lock po tej zmianie jest
BIT W BIT identyczny (`uv lock` nie ruszyl pliku, `uv lock --check`
przechodzi) — to zmiana czysto opisowa.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011aZqYiv56cwAudG2CPS3k5

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
@dependabot @github

dependabot Bot commented on behalf of github Sep 10, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Sep 10, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/python-minor-and-patch-c35ffc63b3 branch September 10, 2026 11:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants