Skip to content
This repository was archived by the owner on Sep 15, 2026. It is now read-only.

chore(deps): bump the python-minor-patch group across 1 directory with 9 updates - #219

Merged
Uno-Takashi merged 1 commit into
mainfrom
dependabot/uv/main/python-minor-patch-f521bdd524
Sep 15, 2026
Merged

chore(deps): bump the python-minor-patch group across 1 directory with 9 updates#219
Uno-Takashi merged 1 commit into
mainfrom
dependabot/uv/main/python-minor-patch-f521bdd524

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 9, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-minor-patch group with 8 updates in the / directory:

Package From To
django 6.0.8 6.1.1
django-unfold 0.104.1 0.105.0
pydantic 2.13.4 2.13.5
gunicorn 26.0.0 26.2.0
cryptography 50.0.0 50.0.1
ruff 0.16.3 0.16.6
djangorestframework-stubs 3.18.0 3.18.1
pipdeptree 4.2.1 4.2.3

Updates django from 6.0.8 to 6.1.1

Commits
  • 249b13d [6.1.x] Bumped version for 6.1.1 release.
  • 5f26fa8 [6.1.x] Added release date for 6.1.1.
  • fdcf78a [6.1.x] Added remaining community package mentions to the documentation.
  • 7241568 [6.1.x] Fixed #37222 -- Fixed QuerySet.distinct() crash on duplicated selecti...
  • ef3fc80 [6.1.x] Fixed #37312, Refs #36605 -- Fixed annotation preservation and key se...
  • b09cb6b [6.1.x] Clarified scope of object-level admin view permissions.
  • a6d3aa2 [6.1.x] Corrected heading hierarchy in the admin actions documentation.
  • 9031d41 [6.1.x] Clarified object-level permission checks in admin actions.
  • fc805c6 [6.1.x] Fixed #37311 -- Prevented consumption of rhs iterators in annotation ...
  • 4b0185a [6.1.x] Fixed #37300 -- Preserved parent instance hints on custom Prefetch qu...
  • Additional commits viewable in compare view

Updates django-unfold from 0.104.1 to 0.105.0

Release notes

Sourced from django-unfold's releases.

0.105.0

v0.105.0 (2026-09-04)

This release is published under the MIT License.

Bug Fixes

Documentation

Features

... (truncated)

Changelog

Sourced from django-unfold's changelog.

v0.105.0 (2026-09-04)

Bug Fixes

Documentation

Features

... (truncated)

Commits

Updates django-prometheus from 2.5.0 to 2.6.0.dev4

Changelog

Sourced from django-prometheus's changelog.

Changelog

v2.6.0 - UNRELEASED

  • Add support for Django 6.1.
  • TBD
Commits

Updates pydantic from 2.13.4 to 2.13.5

Release notes

Sourced from pydantic's releases.

v2.13.5 (2026-08-28)

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Changelog

Sourced from pydantic's changelog.

v2.13.5 (2026-08-28)

GitHub release

What's Changed

Fixes

  • Allow reuse of validators when plugins are set by @​Viicos in #13535
  • Fix missing GC traversal on some pydantic-core struct fields by @​Viicos in #13624
  • Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer by @​Viicos in #13629
  • Count validated model fields once in smart unions by @​tamird in #13731
Commits
  • 001dea0 Bump pypa/gh-action-pypi-publish action to v1.14.2
  • 558379f Bump twine to v7.0.0
  • 2cfd5d3 Do not check for docs build
  • a735bee Fix more Clippy lints
  • 7eed4a1 Fix Clippy 0.1.95 warnings
  • b353bbb Prepare release v2.13.5
  • 63d2ccc Count validated model fields once in smart unions
  • a53ec2e Speed up PyPy CI tests
  • d65e0f9 Workaround circular import error in Mypy
  • 47a6dbf Fix missing GC traversal in pydantic-core for GeneralFieldsSerializer
  • Additional commits viewable in compare view

Updates gunicorn from 26.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

  • Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits
  • 36f2a3c gunicorn 26.2.0
  • cbba350 test: cover the h2c edge paths that had none
  • 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
  • 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
  • 5853551 Merge pull request #3712 from Rotzbua/patch-1
  • 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
  • 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
  • 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
  • 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
  • 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
  • Additional commits viewable in compare view

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.

.. _v50-0-0:

Commits

Updates ruff from 0.16.3 to 0.16.6

Release notes

Sourced from ruff's releases.

0.16.6

Release Notes

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Changelog

Sourced from ruff's changelog.

0.16.6

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

... (truncated)

Commits

Updates djangorestframework-stubs from 3.18.0 to 3.18.1

Release notes

Sourced from djangorestframework-stubs's releases.

3.18.1

This release dropped Python 3.10 support, following django-stubs upstream (requires Python 3.11+ now).

What's Changed

Housekeeping

Full Changelog: typeddjango/djangorestframework-stubs@3.18.0...3.18.1

Commits
  • 11062a8 Version 3.18.1 release (#1050)
  • 1d74bea Lock file maintenance
  • fd11a58 Fix ManyRelatedField type parameters & relation field default/initial t...
  • fd54923 Fix PrimaryKeyRelatedField pk_field attribute & parameter type (#1047)
  • 3336102 [pre-commit.ci] pre-commit autoupdate (#1046)
  • e4c9d11 Lock file maintenance
  • 3410442 Bump sqlparse from 0.5.5 to 0.6.0 (#1042)
  • 36692fc [pre-commit.ci] pre-commit autoupdate (#1041)
  • 5247f84 Update astral-sh/setup-uv action to v10.0.1 (#1040)
  • 603aa12 Fix remaining items in stubtest allowlist_todo.txt and remove the file (#1039)
  • Additional commits viewable in compare view

Updates pipdeptree from 4.2.1 to 4.2.3

Release notes

Sourced from pipdeptree's releases.

4.2.3

What's Changed

Full Changelog: tox-dev/pipdeptree@4.2.2...4.2.3

4.2.2

What's Changed

Full Changelog: tox-dev/pipdeptree@4.2.1...4.2.2

Changelog

Sourced from pipdeptree's changelog.

Features - 4.2.3

  • Publish Windows arm64 wheels. Every Windows wheel was built for AMD64, so pip and uv fell back to the source distribution on Windows on ARM, where building the Rust extension needs a local cargo and MSVC toolchain. The cp310 abi3 wheel and the free-threaded cp314t and cp315t wheels now ship for that platform too; PyPy publishes no Windows arm64 interpreter, so pp311 stays AMD64 only. (:issue:693)

4.2.2 (2026-08-26)

Bug fixes - 4.2.2

  • Run under an interpreter built from a git checkout. Such a build reports its version with a trailing plus (3.13.5+), which PEP 440 reads as an empty local segment and rejects, so every run stopped with found a `+` indicating the start of a local component in a version. The trailing plus is now dropped, and a marker value that still fails to parse names the interpreter versions it came from. (:issue:656)
  • Stop warning about the console-script launcher on Windows. Python puts the running pipdeptree.exe on sys.path, and every file on the search path counted as an archive, so each run reported unsupported archives on the search path. Only files whose suffix is .egg, .pyz, .pyzw, .whl or .zip are now reported. (:issue:669)
  • Replace the removed nab-python dependency with nab-project. (:issue:681)

Packaging updates - 4.2.2

  • Build the wheels for each interpreter beside each other in CI, rather than one after another in a single job, and let the macOS builds share one Cargo target directory. The wheel matrix used to hold a pull request for 17 minutes. (:issue:648)

4.2.0 (2026-07-31)

Features - 4.2.0

  • Publish cp315t wheels, so a free-threaded 3.15 installs a wheel instead of compiling the Rust extension. (:issue:644)

Bug fixes - 4.2.0

  • Publish Linux aarch64 wheels. 4.1.0 shipped none, so pip and uv fell back to the source distribution on ARM64 hosts, where building the Rust extension needs a local cargo and C toolchain. (:issue:640)
  • Build from source on a free-threaded interpreter. The package asked for the limited API unconditionally and meson-python refuses to pair it with a free-threaded CPython, so the source build stopped before it started. (:issue:643)

Packaging updates - 4.2.0

... (truncated)

Commits
  • 63f1b33 release 4.2.3
  • a00b3ad [pre-commit.ci] pre-commit autoupdate (#694)
  • aa1fe4f 👷 ci(dist): build Windows arm64 wheels (#695)
  • d39803f release 4.2.2
  • bb671c8 👷 ci(release): report a missing release token (#692)
  • d0421c3 build(deps): bump taiki-e/install-action from 2.86.1 to 2.86.3 in the github-...
  • e51a0cc [pre-commit.ci] pre-commit autoupdate (#690)
  • 67aea4d 👷 ci: derive the wheel toolchain from rust-toolchain.toml (#689)
  • 89d7361 build(deps): bump rust-toolchain from 1.97 to 1.98 in the rust-toolchain grou...
  • b313166 build(deps): bump toml from 1.1.3+spec-1.1.0 to 1.1.4+spec-1.1.0 in the cargo...
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the python-minor-patch group across 1 directory wit…
f50b3e9 
…h 9 updates

Bumps the python-minor-patch group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [django](https://github.com/django/django) | `6.0.8` | `6.1.1` |
| [django-unfold](https://github.com/unfoldadmin/django-unfold) | `0.104.1` | `0.105.0` |
| [pydantic](https://github.com/pydantic/pydantic) | `2.13.4` | `2.13.5` |
| [gunicorn](https://github.com/benoitc/gunicorn) | `26.0.0` | `26.2.0` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.0` | `50.0.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.16.3` | `0.16.6` |
| [djangorestframework-stubs](https://github.com/typeddjango/djangorestframework-stubs) | `3.18.0` | `3.18.1` |
| [pipdeptree](https://github.com/tox-dev/pipdeptree) | `4.2.1` | `4.2.3` |



Updates `django` from 6.0.8 to 6.1.1
- [Commits](django/django@6.0.8...6.1.1)

Updates `django-unfold` from 0.104.1 to 0.105.0
- [Release notes](https://github.com/unfoldadmin/django-unfold/releases)
- [Changelog](https://github.com/unfoldadmin/django-unfold/blob/main/CHANGELOG.md)
- [Commits](unfoldadmin/django-unfold@0.104.1...0.105.0)

Updates `django-prometheus` from 2.5.0 to 2.6.0.dev4
- [Release notes](https://github.com/korfuri/django-prometheus/releases)
- [Changelog](https://github.com/django-commons/django-prometheus/blob/master/CHANGELOG.md)
- [Commits](https://github.com/korfuri/django-prometheus/commits)

Updates `pydantic` from 2.13.4 to 2.13.5
- [Release notes](https://github.com/pydantic/pydantic/releases)
- [Changelog](https://github.com/pydantic/pydantic/blob/v2.13.5/HISTORY.md)
- [Commits](pydantic/pydantic@v2.13.4...v2.13.5)

Updates `gunicorn` from 26.0.0 to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@26.0.0...26.2.0)

Updates `cryptography` from 50.0.0 to 50.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.0...50.0.1)

Updates `ruff` from 0.16.3 to 0.16.6
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.3...0.16.6)

Updates `djangorestframework-stubs` from 3.18.0 to 3.18.1
- [Release notes](https://github.com/typeddjango/djangorestframework-stubs/releases)
- [Commits](typeddjango/djangorestframework-stubs@3.18.0...3.18.1)

Updates `pipdeptree` from 4.2.1 to 4.2.3
- [Release notes](https://github.com/tox-dev/pipdeptree/releases)
- [Changelog](https://github.com/tox-dev/pipdeptree/blob/main/docs/changelog.rst)
- [Commits](tox-dev/pipdeptree@4.2.1...4.2.3)

---
updated-dependencies:
- dependency-name: django
  dependency-version: 6.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: django-unfold
  dependency-version: 0.105.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: django-prometheus
  dependency-version: 2.6.0.dev4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: pydantic
  dependency-version: 2.13.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-minor-patch
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: ruff
  dependency-version: 0.16.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: djangorestframework-stubs
  dependency-version: 3.18.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
- dependency-name: pipdeptree
  dependency-version: 4.2.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-minor-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Sep 9, 2026
@Uno-Takashi
Uno-Takashi merged commit 5c6296c into main Sep 15, 2026
18 checks passed
@Uno-Takashi
Uno-Takashi deleted the dependabot/uv/main/python-minor-patch-f521bdd524 branch September 15, 2026 06:29
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Uno-Takashi