chore(deps): bump the uv group across 2 directories with 5 updates by dependabot[bot] · Pull Request #31 · fork-the-planet/apache___airflow

dependabot · 2026-03-26T15:47:37Z

Bumps the uv group with 4 updates in the / directory: cryptography, joserfc, pydantic-ai-slim and requests.
Bumps the uv group with 1 update in the /dev/breeze directory: requests.

Updates cryptography from 44.0.3 to 46.0.5

Changelog

Sourced from cryptography's changelog.

46.0.5 - 2026-02-10


* An attacker could create a malicious public key that reveals portions of your
  private key when using certain uncommon elliptic curves (binary curves).
  This version now includes additional security checks to prevent this attack.
  This issue only affects binary elliptic curves, which are rarely used in
  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and
  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.
  **CVE-2026-26007**
* Support for ``SECT*`` binary elliptic curves is deprecated and will be
  removed in the next release.
.. v46-0-4:
46.0.4 - 2026-01-27

Dropped support for win_arm64 wheels_.
Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.

.. _v46-0-3:

46.0.3 - 2025-10-15

* Fixed compilation when using LibreSSL 4.2.0. .. _v46-0-2:

46.0.2 - 2025-09-30

Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.4.

.. _v46-0-1:

46.0.1 - 2025-09-16

* Fixed an issue where users installing via ``pip`` on Python 3.14 development versions would not properly install a dependency. * Fixed an issue building the free-threaded macOS 3.14 wheels. .. _v46-0-0:

46.0.0 - 2025-09-16

BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been removed.

... (truncated)

Commits

06e120e bump version for 46.0.5 release (#14289)
0eebb9d EC check key on cofactor > 1 (#14287)
bedf6e1 fix openssl version on 46 branch (#14220)
e6f44fc bump for 46.0.4 and drop win arm64 due to CI issues (#14217)
c0af4dd release 46.0.3 (#13681)
99efe5a bump version for 46.0.2 (#13531)
e735cfc release 46.0.1 (#13450)
4e457ff Explicitly specify python in mac uv build invocation (#13447)
2726efd Depend on CFFI 2.0.0 or newer on Python > 3.8 (#13448)
6223062 release 46.0.0 (#13446)
Additional commits viewable in compare view

Updates joserfc from 1.5.0 to 1.6.3

Release notes

Sourced from joserfc's releases.

1.6.3

   🐞 Bug Fixes

jwe: Set max value for p2c - by @lepture (696a9)

    View changes on GitHub

1.6.2

   🐞 Bug Fixes

Class does not need to inherit object - by @lepture (4a9be)

jwe: Move size limit to DeflateZipModel - by @lepture (04211)

jwe: Auto add kid when add_recipient - by @lepture (10ac9)

jwe: Auto add kid to recipient when kid exists - by @lepture (9db7e)

    View changes on GitHub

1.6.1

   🐞 Bug Fixes

Remove duplicate code - by @lepture (2c2ca)

Improve base key method definition - by @lepture (d78b4)

Update for type hints - by @lepture (e0d4f)

jwt: Remove InvalidTokenError, ExpiredTokenError based on ClaimError - by @lepture (b71ca)

    View changes on GitHub

1.6.0

   🚀 Features

Filter_algorithms names parameter default to all algs - by @azmeuk (1034a)

Pick_random_key algorithm parameter is optional - by @azmeuk (ee046)

Filter_algorithms supports KeySet objects - by @azmeuk (775d5)

jwk: Add a derive_key method for OKPKey - by @lepture (04f59)

jwk: Add derive_key method for ECKey - by @lepture (73412)

   🐞 Bug Fixes

Remove backend parameter, it is deprecated - by @lepture (e10e1)

jwa: Improve RFC9864 check key logic - by @lepture (b8434)

jwk: Improve OKPKey implementation - by @lepture (7b8e3)

jwk: Allow import key from cryptography native key types - by @lepture (6db65)

jwk: Raise InvalidKeyCurveError when generate ECKey with invalid crv - by @lepture (c7921)

jwk: Improve generate_private_key on binding class - by @lepture (24257)

jwk: Remove useless properties on OKPKey - by @lepture (bf35f)

jws: Use JWSRegistry.guess_algorithm to replace JWSRegistry.guess_alg - by @lepture (6b34c)

jwt: Make BaseClaimsRegistry.essential_keys a property. - by @lepture (bc13e)

    View changes on GitHub

Changelog

Sourced from joserfc's changelog.

1.6.3

Released on February 25, 2026

JWE: Set a max value for p2c header.

1.6.2

Released on February 16, 2026

JWE: Auto add kid to recipient.

JWE: Use DeflateZipModel.MAX_SIZE to determine size limit.

1.6.1

Released on December 30, 2025

Deprecate InvalidTokenError, please use InvalidClaimError instead.

Convert ExpiredTokenError to inherit from ClaimError.

Improve on type hints.

1.6.0

Released on December 14, 2025

filter_algorithms names defaults to all algorithms. :pull:79.

Replace JWSRegistry.guess_alg with JWSRegistry.guess_algorithm.

filter_algorithms and guess_alg supports KeySet objects. :pull:81.

Improve generate_private_key method on Key's binding class.

Raise InvalidKeyCurveError when generating ECKey with an invalid curve.

Allow import key from cryptography native key types.

Add ECKey.derive_key and OKPKey.derive_key class methods.

Commits

f06540f chore: release 1.6.3
696a961 fix(jwe): set max value for p2c
52c6ffd chore: release 1.6.2
3b36720 chore: update deps
91c7ecd chore: update readme
9db7e44 fix(jwe): auto add kid to recipient when kid exists
1330b49 docs: add a cheatsheet recipe
10ac93f fix(jwe): auto add kid when add_recipient
224e72a chore: remove codecov token
042118c fix(jwe): move size limit to DeflateZipModel
Additional commits viewable in compare view

Updates pydantic-ai-slim from 1.38.0 to 1.56.0

Release notes

Sourced from pydantic-ai-slim's releases.

v1.56.0 (2026-02-05)

What's Changed

🚀 Features

Add Claude Opus 4.6, anthropic_effort and anthropic_thinking.type='adaptive' by @dsfaccini in pydantic/pydantic-ai#4216

Add anthropic_betas to AnthropicModelSettings by @bohdanhr in pydantic/pydantic-ai#4180

🐛 Bug Fixes

Fix Bedrock CachePoint placement with multiple trailing documents by @psg2 in pydantic/pydantic-ai#4207

Disallow downloading FileUrls pointing at the local network by default by @DouweM in pydantic/pydantic-ai#4227

Full Changelog: pydantic/pydantic-ai@v1.55.0...v1.56.0

v1.55.0 (2026-02-04)

What's Changed

🐛 Bug Fixes

Fix error when using OpenAIResponsesModel with "compatible" provider that returns reasoning_tokens as None instead by @alibeyram in pydantic/pydantic-ai#4151

Fix MultiModalContent union missing discriminator causing incorrect deserialization by @jerry-reevo in pydantic/pydantic-ai#4191

Full Changelog: pydantic/pydantic-ai@v1.54.0...v1.55.0

v1.54.0 (2026-02-04)

What's Changed

🚀 Features

Add concurrency limiting for Agents and Models by @dmontagu in pydantic/pydantic-ai#4149

Full Changelog: pydantic/pydantic-ai@v1.53.0...v1.54.0

v1.53.0 (2026-02-04)

What's Changed

🚀 Features

Infer gateway base URL from token region by @Kludex in pydantic/pydantic-ai#4192

Full Changelog: pydantic/pydantic-ai@v1.52.0...v1.53.0

v1.52.0 (2026-02-02)

What's Changed

🚀 Features

... (truncated)

Commits

d398bc9 Disallow downloading FileUrls pointing at the local network by default (#4227)
06c77f4 Iterate on auto-review prompt (#4228)
e686fbf Iterate on auto-review prompt (#4226)
69096f2 Iterate on auto-review prompt (#4225)
0b929cd Iterate on auto-review prompt (#4224)
58bee8f Iterate on auto-review prompt (#4223)
7f55e43 Iterate on auto-review prompt (#4222)
8744335 Iterate on auto-review prompt (#4220)
b6952a0 Add Claude Opus 4.6, anthropic_effort and `anthropic_thinking.type='adaptiv...
d8e8f13 Fix Auto Review on forks (#4218)
Additional commits viewable in compare view

Updates pyopenssl from 25.1.0 to 25.3.0

Changelog

Sourced from pyopenssl's changelog.

25.3.0 (2025-09-16)

Backward-incompatible changes: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Deprecations: ^^^^^^^^^^^^^

Changes: ^^^^^^^^

Maximum supported cryptography version is now 46.x.

25.2.0 (2025-09-14)

Backward-incompatible changes: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

The minimum cryptography version is now 45.0.7.

Deprecations: ^^^^^^^^^^^^^

Changes: ^^^^^^^^

pyOpenSSL now sets SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER on connections by default, matching CPython's behavior.

Added OpenSSL.SSL.Context.clear_mode.

Added OpenSSL.SSL.Context.set_tls13_ciphersuites to set the allowed TLS 1.3 ciphers.

Added OpenSSL.SSL.Connection.set_info_callback

Commits

41e7788 Prepare for a 25.3.0 release (#1448)
53b78f5 test on supported pypys (#1449)
fb1ebc1 Update CI workflow to use 'ubuntu-latest' and 'windows-latest' (#1447)
6ccf90b Prepare for a release (#1446)
5f46403 Added OpenSSL.SSL.Connection.set_info_callback (#1438)
95cf8fa Update tests to not rely on mutating contexts (#1445)
946f87e Remove fallback path for old OpenSSL (#1443)
0213311 Fix for new mypy release (#1444)
7fd0ab8 Bump actions/setup-python from 5 to 6 (#1440)
8daf0d1 Bump pypa/gh-action-pypi-publish from 1.12.4 to 1.13.0 (#1439)
Additional commits viewable in compare view

Updates requests from 2.32.5 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates requests from 2.32.5 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps the uv group with 4 updates in the / directory: [cryptography](https://github.com/pyca/cryptography), [joserfc](https://github.com/authlib/joserfc), [pydantic-ai-slim](https://github.com/pydantic/pydantic-ai) and [requests](https://github.com/psf/requests). Bumps the uv group with 1 update in the /dev/breeze directory: [requests](https://github.com/psf/requests). Updates `cryptography` from 44.0.3 to 46.0.5 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@44.0.3...46.0.5) Updates `joserfc` from 1.5.0 to 1.6.3 - [Release notes](https://github.com/authlib/joserfc/releases) - [Changelog](https://github.com/authlib/joserfc/blob/main/docs/changelog.rst) - [Commits](authlib/joserfc@1.5.0...1.6.3) Updates `pydantic-ai-slim` from 1.38.0 to 1.56.0 - [Release notes](https://github.com/pydantic/pydantic-ai/releases) - [Changelog](https://github.com/pydantic/pydantic-ai/blob/main/docs/changelog.md) - [Commits](pydantic/pydantic-ai@v1.38.0...v1.56.0) Updates `pyopenssl` from 25.1.0 to 25.3.0 - [Changelog](https://github.com/pyca/pyopenssl/blob/main/CHANGELOG.rst) - [Commits](pyca/pyopenssl@25.1.0...25.3.0) Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 46.0.5 dependency-type: indirect dependency-group: uv - dependency-name: joserfc dependency-version: 1.6.3 dependency-type: indirect dependency-group: uv - dependency-name: pydantic-ai-slim dependency-version: 1.56.0 dependency-type: indirect dependency-group: uv - dependency-name: pyopenssl dependency-version: 25.3.0 dependency-type: indirect dependency-group: uv - dependency-name: requests dependency-version: 2.33.0 dependency-type: indirect dependency-group: uv - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Mar 26, 2026

dependabot Bot mentioned this pull request Mar 26, 2026

chore(deps): bump the uv group across 1 directory with 3 updates #28

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the uv group across 2 directories with 5 updates#31

chore(deps): bump the uv group across 2 directories with 5 updates#31
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-a798b40a82

dependabot Bot commented on behalf of github Mar 26, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Mar 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

1.6.3

🐞 Bug Fixes

View changes on GitHub

1.6.2

🐞 Bug Fixes

View changes on GitHub

1.6.1

🐞 Bug Fixes

View changes on GitHub

1.6.0

🚀 Features

🐞 Bug Fixes

View changes on GitHub

1.6.3

1.6.2

1.6.1

1.6.0

v1.56.0 (2026-02-05)

What's Changed

🚀 Features

🐛 Bug Fixes

v1.55.0 (2026-02-04)

What's Changed

🐛 Bug Fixes

v1.54.0 (2026-02-04)

What's Changed

🚀 Features

v1.53.0 (2026-02-04)

What's Changed

🚀 Features

v1.52.0 (2026-02-02)

What's Changed

🚀 Features

25.3.0 (2025-09-16)

25.2.0 (2025-09-14)

v2.33.0

2.33.0 (2026-03-25)

New Contributors

2.33.0 (2026-03-25)

v2.33.0

2.33.0 (2026-03-25)

New Contributors

2.33.0 (2026-03-25)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Mar 26, 2026 •

edited

Loading