build(deps): bump the production-dependencies group across 1 directory with 14 updates

[dependabot]

Bumps the production-dependencies group with 14 updates in the / directory:

Package	From	To
beautifulsoup4	4.14.3	4.15.0
bleach	6.3.0	6.4.0
flask-cors	6.0.2	6.0.5
grpcio	1.80.0	1.81.1
grpcio-testing	1.80.0	1.81.1
grpcio-tools	1.80.0	1.81.1
idna	3.15	3.18
peewee	4.0.5	4.0.8
phonenumbers	9.0.30	9.0.32
pika	1.4.0	1.4.1
pymysql	1.1.3	1.2.0
pyopenssl	26.2.0	26.3.0
tqdm	4.67.3	4.68.2
pytest	9.0.3	9.1.0

Updates beautifulsoup4 from 4.14.3 to 4.15.0

Updates bleach from 6.3.0 to 6.4.0

Changelog

Sourced from bleach's changelog.

Version 6.4.0 (June 5th, 2026)

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

• Dropped support for pypy 3.10. (#764)

Security fixes

• Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

  Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.

  For example::

  import bleach payload1 = 'Click' result1 = bleach.clean(payload1) print(repr(result1))

  outputs::

  'Click'

  See the advisory for details.

• Fix GHSA-gj48-438w-jh9v.

  Fix issue where URI sanitization wasn't happening in formaction attributes.

  See the advisory for details.

Bug fixes

• Add support for pypy 3.11. (#764)

• Drop version max in tinycss2 pin. (#772)

  This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.

Commits

• f0355a7 fix: fix last release date in CHANGES
• ae4e8a2 chore: bleach 6.4.0 and final release
• 970df58 fix: uri-sanitization in formaction attributes
• 7c4867c fix: xss bypass in allowed protocol test using unicode invisible characters
• 913ab75 fix: reduce redundancy in workflow jobs
• 218c15a fix: rework pip caching
• 4f0b097 fix: fix tox platform restrictions
• e95a79d chore: update pytest
• 91539d4 Bump actions/cache from 5.0.3 to 5.0.4
• cd47b4c fix: handle left-angle-bracket that's not a tag (#733)
• Additional commits viewable in compare view

Updates flask-cors from 6.0.2 to 6.0.5

Release notes

Sourced from flask-cors's releases.

6.0.5

Supersedes 6.0.4

What's Changed

• Add MyPy Typing and modernize options parsing by @​corydolphin in corydolphin/flask-cors#409 (this broke strict type checking when using Blueprints)
• Restore Blueprint support in CORS type signatures (#410) by @​corydolphin in corydolphin/flask-cors#411

Full Changelog: corydolphin/flask-cors@6.0.3...6.0.5

6.0.4

What's Changed

• Add MyPy Typing by @​corydolphin in corydolphin/flask-cors#409

Full Changelog: corydolphin/flask-cors@6.0.3...6.0.4

6.0.3

What's Changed

• Derive package version from git tag via setuptools-scm by @​corydolphin in corydolphin/flask-cors#405
• Improve CI/CD security with least privilege and build separation by @​corydolphin in corydolphin/flask-cors#406

Full Changelog: corydolphin/flask-cors@6.0.2...6.0.3

6.0.3-pre

What's Changed

• Derive package version from git tag via setuptools-scm by @​corydolphin in corydolphin/flask-cors#405
• Improve CI/CD security with least privilege and build separation by @​corydolphin in corydolphin/flask-cors#406

Full Changelog: corydolphin/flask-cors@6.0.2...6.0.3

Commits

• 91ebc49 Typing Hotfix: support blueprints in the type system
• d601665 Add strict MyPy Typing
• c8e8871 Harden release publishing workflow (#406)
• e1d4034 Derive package version from git tag via setuptools-scm (#405)
• See full diff in compare view

Updates grpcio from 1.80.0 to 1.81.1

Release notes

Sourced from grpcio's releases.

Release v1.81.1

This is release 1.81.0 (graphic) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

• [EventEngine] Fix a potential use-after-free error on Windows. (#42078)
• [ssl] Server side handshaker factory stores a map of key signers. (#42002)
• [Core] Fix completion queue shutdown race on weak memory models (ARM). (#41510)
• [EventEngine] Fix a Windows race that causes an assertion error. (#41563)
• [grpc_error] enable error_flatten experiment in OSS. (#41471)
• [Python] Trim Python2 backward compatiblity syntax - removed (object) inheritance. (#41708)

Objective-C

• [ObjC] Add receiveNextMessage to GRPCUnaryProtoCall. (#42260)

Python

• [Python] Add typing_extensions dep to aio Bazel target. (#42001)
• [Python] [Pyright] Part 1 - Pyright for src/python/grpcio/grpc/aio/_base_server.py. (#42240)
• [Python] Drop 3.9. (#42145)
• [Python] grpc-status: Relax protobuf dependency upper bound to allow 7.x. (#41948)
• [Python] [Typeguard] Part 5 - Add Typeguard SYNC Stack in tests. (#40278)
• [Python] Remove GIL from ReceiveMessageOperation.un_c method. (#41812)
• [Python] Support observability in AsyncIO stack. (#41573)

Ruby

• [Ruby] Drop support for EOL Ruby 3.1 and clean up. (#41435)
• [Ruby] Composed CallCredentials keep a reference to their source. (#41782)

Release v1.81.0

This is release 1.81.0 (graphic) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

... (truncated)

Commits

• e84a8a2 [Release] Bump version to 1.81.1 (on v1.81.x branch) (#42584)
• 4706d6a [xDS] fix use-after-free in global XdsClient map (#42559)
• 42a6b5b [Core][Release] Update BCR presubmit job definition (#42561)
• 8bdf11e [Release] Bump version to 1.81.0 (on v1.81.x branch) (#42432)
• 0029e06 Move all gRPC Session classes to the experimental namespace (#42462)
• 1f18268 [CI] Fix Asan thread_stress_test error by reducing thread count (#42424) (#42...
• ee3fed7 Backport MacOS fix cl/917004588 to v1.81.x (#42441)
• 6244f3b [Release] Bump version to 1.81.0-pre1 (on v1.81.x branch) (#42378)
• 1108777 [Release] Bump core version to 54.0.0 for upcoming release (#42321)
• 74940e8 [fix] Add back the do-while loop that handles the TSI_RESULT correctly.
• Additional commits viewable in compare view

Updates grpcio-testing from 1.80.0 to 1.81.1

Updates grpcio-tools from 1.80.0 to 1.81.1

Release notes

Sourced from grpcio-tools's releases.

Release v1.81.1

This is release 1.81.0 (graphic) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

• [EventEngine] Fix a potential use-after-free error on Windows. (#42078)
• [ssl] Server side handshaker factory stores a map of key signers. (#42002)
• [Core] Fix completion queue shutdown race on weak memory models (ARM). (#41510)
• [EventEngine] Fix a Windows race that causes an assertion error. (#41563)
• [grpc_error] enable error_flatten experiment in OSS. (#41471)
• [Python] Trim Python2 backward compatiblity syntax - removed (object) inheritance. (#41708)

Objective-C

• [ObjC] Add receiveNextMessage to GRPCUnaryProtoCall. (#42260)

Python

• [Python] Add typing_extensions dep to aio Bazel target. (#42001)
• [Python] [Pyright] Part 1 - Pyright for src/python/grpcio/grpc/aio/_base_server.py. (#42240)
• [Python] Drop 3.9. (#42145)
• [Python] grpc-status: Relax protobuf dependency upper bound to allow 7.x. (#41948)
• [Python] [Typeguard] Part 5 - Add Typeguard SYNC Stack in tests. (#40278)
• [Python] Remove GIL from ReceiveMessageOperation.un_c method. (#41812)
• [Python] Support observability in AsyncIO stack. (#41573)

Ruby

• [Ruby] Drop support for EOL Ruby 3.1 and clean up. (#41435)
• [Ruby] Composed CallCredentials keep a reference to their source. (#41782)

Release v1.81.0

This is release 1.81.0 (graphic) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

... (truncated)

Commits

• e84a8a2 [Release] Bump version to 1.81.1 (on v1.81.x branch) (#42584)
• 8bdf11e [Release] Bump version to 1.81.0 (on v1.81.x branch) (#42432)
• 6244f3b [Release] Bump version to 1.81.0-pre1 (on v1.81.x branch) (#42378)
• 820f933 [Python] Drop 3.9 (#42145)
• 451521c [Core CI] Make windows python distrib tests use ccache. (#42171)
• cb09882 [Build] Upgrade protobuf to 33.5 (#41976)
• a2bf3f1 [Release] Bump version to 1.81.0-dev (on master branch) (#41843)
• See full diff in compare view

Updates idna from 3.15 to 3.18

Changelog

Sourced from idna's changelog.

3.18 (2026-06-02)

• When decoding a domain, add a display argument that will pass through invalid labels rather than raising an exception.

3.17 (2026-05-28)

• Substantial 75% reduction in memory usage through new data structures and some optimization in processing speed.
• Added a general 1024-character input length cap to the public validation, conversion, and codec entry points. This is well above any legitimate domain or label and guards against pathological inputs.

3.16 (2026-05-22)

• Add a command-line interface (python -m idna, also available as the idna script). Encodes or decodes one or more domains supplied as arguments or on standard input, with options to select A-label or U-label output and control error handling.
• Raise the minimum supported Python version to 3.9
• Various code quality improvements

Commits

• f39ea90 Release 3.18
• 40f4e40 Pre-release 3.18rc0
• 1a5bf80 Merge pull request #253 from kjd/lenient-decode
• 5bbb26f Merge branch 'master' into lenient-decode
• c532bae Rename decode() lenient= option to display= (issue #248)
• 0b1758b Merge pull request #252 from kjd/release-3.17
• f48619c Release 3.17
• 7421ba8 Pre-release 3.17rc0
• 22ebb73 Merge pull request #251 from kjd/structure-optimizations
• 2a7ac0a Drop redundant parallel-arrays comment from uts46data
• Additional commits viewable in compare view

Updates peewee from 4.0.5 to 4.0.8

Release notes

Sourced from peewee's releases.

4.0.8

• Add BaseQuery.aexecute() - an async twin of execute() available on all query types, executing through the query's bound async database: await User.select().aexecute(), await user.tweets.aexecute(). Returns exactly what execute() returns, including result rows for DML with RETURNING. Queries remain non-awaitable; this is an ordinary coroutine method and the only async method on queries.
• Add async model methods to playhouse.pwasyncio using "a"-prefixed coroutine counterparts of the row-level Model methods (acreate, aget, aget_or_none, aget_by_id, aget_or_create, aset_by_id, adelete_by_id, abulk_create, abulk_update, asave, adelete_instance), available via the new AsyncModel / AsyncModelMixin classes. Each is a thin delegation through the greenlet bridge, so behavior is identical to the synchronous implementation. Note: the Model property of async databases now returns a base class that includes these methods - relevant only if you introspect the base class of db.Model subclasses.
• Add afetch() for explicit, awaitable lazy foreign-key resolution: user = await tweet.afetch(Tweet.user). Already-loaded relations (via join or prefetch) return immediately without a query.
• Add db.first(query, n=1) async helper.
• MissingGreenletBridge errors now include a hint describing the async APIs to use.
• The asyncio extension is no longer considered preliminary - the async APIs documented in the docs are stable. The asyncio stress test now also runs in CI.

View commits

4.0.7

• Fixes for playhouse.pwasyncio: report correct UPDATE / DELETE rowcounts on asyncpg, roll back open transactions when connections are returned to the pool, raise instead of deadlocking when querying during iterate(), and detect the MySQL / MariaDB server version.
• Additional playhouse.pwasyncio fixes: a second iterate() on a busy connection raises instead of deadlocking, asyncpg exceptions are translated to peewee exception types, registered aggregates / collations / window functions / extensions and timeout are applied to async SQLite connections, :memory: databases use a single connection, atomic() accepts transaction arguments (e.g. lock_type), postgres connection URLs and isolation_level are supported, %% in raw SQL is unescaped, and attempting a query outside the greenlet bridge no longer emits "never awaited" warnings.
• Fixes for playhouse.pydantic_utils: JSON fields validate as Any (now including the sqlite_ext JSONField), foreign keys may be included / excluded by field name or column name, server-side defaults like SQL('CURRENT_TIMESTAMP') are no longer emitted as schema defaults, and relationships keys are validated.
• Add a new cross-backend JSONField to core that provides basic operations and also more consistent behavior when reading data. By default the new core JSONField treats extracted values as JSON, which is generally the correct thing, but "text-mode" is available as a chained .as_text() method. See docs. May eventually replace the backend-specific implementations with subclasses that inherit semantics of this new field. Note: playhouse.mysql_ext.JSONField is now the core field. The old json_dumps / json_loads arguments are renamed dumps / loads, the extract() method is removed (use item-access or path()), and MySQL tables are now created with JSON columns rather than TEXT.
• Eliminate use of deprecated params when connecting to MySQL databases, thanks to @​abulgher, #3050.
• Using fromisoformat() ended up causing previously-unconverted strings (Ymd) to be converted in some cases, e.g. formatting a datetime as a str (#3051). The change I made to address this is to make explicit casts on function calls not attempt any heuristic python-value conversion. This makes it more natural to call fn.whatever().cast('text') and you predictably get text out.

View commits

4.0.6

• Add new methods to the postgres BinaryJSONField: helpers for in-place modifications (set, replace, insert, append, update).
• Also add json-path helpers to the postgres BinaryJSONField (path_exists, path_match, path_query, path_query_array, path_query_first).
• Quote path elements in SQLite's JSON field.
• Better and faster parsing of formatted date/times. Use the stdlib fromisoformat as a first attempt since it's faster and more robust.
• Ensure db.connection_context() can be nested cleanly, #3046.
• Fix potential deadlock in pool.close_all and pool.manual_close, #3047.
• Restore whitespace stripping in FixedCharField, #3048.

View commits

Changelog

Sourced from peewee's changelog.

4.0.8

• Add BaseQuery.aexecute() - an async twin of execute() available on all query types, executing through the query's bound async database: await User.select().aexecute(), await user.tweets.aexecute(). Returns exactly what execute() returns, including result rows for DML with RETURNING. Queries remain non-awaitable; this is an ordinary coroutine method and the only async method on queries.
• Add async model methods to playhouse.pwasyncio using "a"-prefixed coroutine counterparts of the row-level Model methods (acreate, aget, aget_or_none, aget_by_id, aget_or_create, aset_by_id, adelete_by_id, abulk_create, abulk_update, asave, adelete_instance), available via the new AsyncModel / AsyncModelMixin classes. Each is a thin delegation through the greenlet bridge, so behavior is identical to the synchronous implementation. Note: the Model property of async databases now returns a base class that includes these methods - relevant only if you introspect the base class of db.Model subclasses.
• Add afetch() for explicit, awaitable lazy foreign-key resolution: user = await tweet.afetch(Tweet.user). Already-loaded relations (via join or prefetch) return immediately without a query.
• Add db.first(query, n=1) async helper.
• MissingGreenletBridge errors now include a hint describing the async APIs to use.
• The asyncio extension is no longer considered preliminary - the async APIs documented in the docs are stable. The asyncio stress test now also runs in CI.

View commits

4.0.7

• Fixes for playhouse.pwasyncio: report correct UPDATE / DELETE rowcounts on asyncpg, roll back open transactions when connections are returned to the pool, raise instead of deadlocking when querying during iterate(), and detect the MySQL / MariaDB server version.
• Additional playhouse.pwasyncio fixes: a second iterate() on a busy connection raises instead of deadlocking, asyncpg exceptions are translated to peewee exception types, registered aggregates / collations / window functions / extensions and timeout are applied to async SQLite connections, :memory: databases use a single connection, atomic() accepts transaction arguments (e.g. lock_type), postgres connection URLs and isolation_level are supported, %% in raw SQL is unescaped, and attempting a query outside the greenlet bridge no longer emits "never awaited" warnings.
• Fixes for playhouse.pydantic_utils: JSON fields validate as Any (now including the sqlite_ext JSONField), foreign keys may be included / excluded by field name or column name, server-side defaults like SQL('CURRENT_TIMESTAMP') are no longer emitted as schema defaults, and relationships keys are validated.

... (truncated)

Commits

• 0a684ef 4.0.8
• df3b05b Drop 2.x compat shim for metaclass.
• 5a84747 Update readme & index
• e8bb29a Clarify docs, move up install section in asyncio
• 03dab6e Docs and readme cleanup for new asyncio interfaces
• 1f471a5 Ensure we don't rebind + fix some order-dependent tests
• 80055a5 drop decorator so it registers as a coroutine.
• 4eea98b Clarify aexecute() usages in docs.
• 0401abf Add aexecute() helper to BaseQuery
• f6f4a6b Docs and CL for asyncio facade.
• Additional commits viewable in compare view

Updates phonenumbers from 9.0.30 to 9.0.32

Commits

• facd74c Prep for 9.0.32 release
• 8ea3d6a Generated files for metadata
• 1d40b76 Merge metadata changes from upstream 9.0.32
• 43a9c86 Prep for 9.0.31 release
• 98c625e Generated files for metadata
• 9161226 Merge metadata changes from upstream 9.0.31
• See full diff in compare view

Updates pika from 1.4.0 to 1.4.1

Release notes

Sourced from pika's releases.

1.4.1

https://pypi.org/project/pika/1.4.1/ | GitHub milestone

Changelog

Sourced from pika's changelog.

1.4.1 (2026-05-22)

Merged pull requests:

• Fix Channel.close() for channels with multiple consumers #1596 (gbenson)

Commits

• 5f0ba9e Merge pull request #1597 from pika/pika-1.4.1
• 31d80a9 pika 1.4.1
• b7af301 Merge pull request #1596 from gbenson/main
• See full diff in compare view

Updates pymysql from 1.1.3 to 1.2.0

Release notes

Sourced from pymysql's releases.

v1.2.0

What's Changed

• Bump the all-dependencies group with 2 updates by @​dependabot[bot] in PyMySQL/PyMySQL#1232
• Reorganize TLS options: implement PREFERRED/REQUIRED SSL mode behavior by @​Copilot in PyMySQL/PyMySQL#1234
• Support MySQL 8 row/column alias syntax in executemany INSERT regex by @​Copilot in PyMySQL/PyMySQL#1235
• Expose SQLSTATE on MySQL protocol exceptions without changing exception formatting by @​Copilot in PyMySQL/PyMySQL#1236
• Reject non-finite decimal.Decimal query parameters (NaN, sNaN, ±Infinity) by @​Copilot in PyMySQL/PyMySQL#1237
• docs: update outdated requirements and reference links by @​Copilot in PyMySQL/PyMySQL#1239
• Prepare CHANGELOG for v1.2.0 release from v1.1.3 changes by @​Copilot in PyMySQL/PyMySQL#1238
• deprecate db and passwd again by @​methane in PyMySQL/PyMySQL#1240
• deprecate reconnect in Connection.ping() by @​methane in PyMySQL/PyMySQL#1241
• Deprecate Connection.set_charset() at runtime and document warning behavior by @​Copilot in PyMySQL/PyMySQL#1243
• Release v1.2.0 by @​methane in PyMySQL/PyMySQL#1244

New Contributors

• @​Copilot made their first contribution in PyMySQL/PyMySQL#1234

Full Changelog: PyMySQL/PyMySQL@v1.1.3...v1.2.0

Changelog

Sourced from pymysql's changelog.

v1.2.0

Release date: 2026-05-19

Breaking changes

• Connection.ping() change the default to not reconnect and deprecate reconnect argument. Create a new connection if you want to reconnect. (#1241)

• Error classes in Cursor class are removed. (#1240)

• connect() arguments db and passwd now emit DeprecationWarning. Use database and password instead. (#1240)

• Reorganize TLS connection behavior.

  • PyMySQL uses TLS by default when server supports it. Use ssl_disabled=True to prohibit SSL. (#1213)

  • When ssl_verify_cert=True, ssl_verify_identity=True, an ssl.SSLContext is passed, or when any other SSL option is configured, the connection requires SSL and raises OperationalError (CR_SSL_CONNECTION_ERROR) if the server doesn't support it. (#1234)

Other changes

• Support MySQL 8 row/column alias syntax in executemany INSERT regex. (#1235)
• Expose SQLSTATE on MySQL protocol exceptions without changing exception formatting. (#1236)
• Reject non-finite decimal.Decimal query parameters (NaN, sNaN, ±Infinity). (#1237)
• Connection.set_charset(charset) now emits DeprecationWarning.

Commits

• 0f1c324 use ubuntu-latest for pypi publishing
• 53b16b2 Release v1.2.0 (#1244)
• 637fe7e Deprecate Connection.set_charset() at runtime and document warning behavior...
• 23ca04a add AGENTS.md
• 7349a44 deprecate reconnect in Connection.ping() (#1241)
• ad5c50c update CHANGELOG
• c963edb Deprecation and removals (#1240)
• af6b9b4 Prepare CHANGELOG for v1.2.0 release from v1.1.3 changes (#1238)
• c7bf73f docs: update outdated requirements and reference links (#1239)
• c532b8d Reject non-finite decimal.Decimal query parameters (NaN, sNaN, `±Infini...
• Additional commits viewable in compare view

Updates pyopenssl from 26.2.0 to 26.3.0

Changelog

Sourced from pyopenssl's changelog.

26.3.0 (2026-06-12)

Backward-incompatible changes: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Dropped support for Python 3.8.
• The minimum cryptography version is now 49.0.0.
• Removed deprecated OpenSSL.crypto.X509Req, OpenSSL.crypto.dump_certificate_request, and OpenSSL.crypto.load_certificate_request. cryptography.x509 should be used instead.
• OpenSSL.SSL.Connection.set_session now raises ValueError if the Session was obtained from a Connection that was using a different Context than this one. OpenSSL requires (but does not verify) that sessions only be re-used with a compatible SSL_CTX, so this contract is now enforced.

Deprecations: ^^^^^^^^^^^^^

• Deprecated OpenSSL.crypto.PKey.generate_key and OpenSSL.crypto.PKey.check. The key generation and loading APIs in cryptography should be used instead.
• Deprecated OpenSSL.crypto.dump_privatekey. The serialization APIs on cryptography private key types should be used instead.
• Deprecated all the mutable APIs on OpenSSL.crypto.X509: set_version, set_pubkey, sign, set_serial_number, gmtime_adj_notAfter, gmtime_adj_notBefore, set_notBefore, set_notAfter, set_issuer, and set_subject. cryptography.x509.CertificateBuilder should be used instead.
• Deprecated OpenSSL.SSL.Context.set_passwd_cb. Users should decrypt and load their private keys themselves, with cryptography's key loading APIs, and then call OpenSSL.SSL.Context.use_privatekey.
• Deprecated OpenSSL.crypto.X509Name, as well as the remaining APIs that consume or return it: OpenSSL.crypto.X509.get_issuer, OpenSSL.crypto.X509.get_subject, and OpenSSL.SSL.Context.set_client_ca_list. The APIs in cryptography.x509 should be used instead.

Changes: ^^^^^^^^

• OpenSSL.SSL.Connection.get_client_ca_list now takes an as_cryptography keyword-argument. When True is passed then cryptography.x509.Name are returned, instead of OpenSSL.crypto.X509Name. In the future, passing False (the default) will be deprecated.

Commits

• a34aa1d Prepare 26.3.0 release (#1515)
• 24db880 Deprecate X509Name and the remaining APIs that consume or return it (#1514)
• 1dc08be Add as_cryptography parameter to Connection.get_client_ca_list (#1508)
• 55653a5 Require cryptography 49, drop Python 3.8 (#1513)
• 9bad760 Remove deprecated CSR functionality (#1507)
• 98ca874 Enforce that Session is only re-used with the Context it came from (#1512)
• cbcb1da Deprecate Context.set_passwd_cb (#1511)
• 3b9d07d Deprecate all the mutable APIs on X509 (#1510)
• e096920 Deprecate PKey.generate_key, PKey.check, and dump_privatekey (#1509)
• 7079d6d Fix zizmor findings in GitHub Actions workflows (#1506)
• Additional commits viewable in compare view

Updates tqdm from 4.67.3 to 4.68.2

Release notes

Sourced from tqdm's releases.

tqdm v4.68.2 stable

• revert accidental change to ascii default (fixes #1760)
  • UnicodeEncodeError: 'charmap' codec can't encode characters in position 6-7: character maps to <undefined> can be fixed by installing tqdm!=4.68.0,!=4.68.1
• misc docs updates
  • fix links
  • replace stray rst -> md syntax
  • consistent "progress bar" terminology (#1737)
• tests: fix coverage (fixes #1760)

tqdm v4.68.1 stable

• set name of monitor thread (#1669, #1752 <- #1435)
• fix monitor thread atexit deadlock (#1751 <- #528, #627, #1435, #1564)
• docs: minor copyediting

tqdm v4.68.0 stable

• utils: simplify terminal size detection (#1760)
• contrib
  • itertools (#1760)
    • add chain, permutations, combinations, combinations_with_replacement, batched
    • add product(repeat=1) keyword argument (#1428)
  • fix discord, telegram error handling
  • fix discord, slack, telegram format for total=None
• soft-deprecate tqdm.utils.envwrap -> envwrap
• benchmarks: fix asv
• misc linting
• misc framework updates
  • CI: migrate manual job to pre-commit.ci
  • bump workflow actions & pre-commit hooks

Commits

• 4b33952 revert accidental change to tqdm(ascii) default
• b10848f docs: fix links
• 85b62dd docs: replace stray rst -> md
• d2fb04a docs: mention OpenAI sponsorship
• 85940f9 docs: consistent progress bar terminology
• 9dbb36b tests: fix coverage
• 67cf355 Merge pull request #1751 from jaltmayerpizzorno/fix-atexit-monitor-deadlock
• cfa4a85 minor docstring updates
• f83290c Fix TMonitor deadlock at interpreter shutdown
• 59029c3 Set name for tqdm monitor thread (#1752)
• Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.0

Release notes

Sourced from pytest's releases.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

• #14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

  If this is undesirable, move the fixture definition to a conftest.py file if possible.

  Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

• #10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

  See 10819 and 14011.

• #12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown to request a fixture that was not already requested is now deprecated and will become an error in pytest 10.

  See dynamic-fixture-request-during-teardown for details.

• #13409: Using non-~collections.abc.Collection iterables (such as generators, iterators, or custom iterable objects) for the argvalues parameter in @pytest.mark.parametrize <pytest.mark.parametrize ref> and metafunc.parametrize <pytest.Metafunc.parametrize> is now deprecated.

  These iterables get exhausted after the first iteration, leading to tests getting unexpectedly skipped in cases such as running pytest.main() multiple times, using class-level parametrize decorators, or collecting tests multiple times.

  See parametrize-iterators for details and suggestions.

• #13946: The private config.inicfg attribute is now deprecated. Use config.getini() <pytest.Config.getini> to access configuration values instead.

  See config-inicfg for more details.

• #14004: Passing baseid to ~pytest.FixtureDef or nodeid strings to fixture registration APIs is now deprecated. These are internal pytest APIs that are used by some plugins.

  Use the node parameter instead for fixture scoping. This enables more robust node-based matching instead of string prefix matching. If you've used nodeid=None, pass node=session instead.

  This will be removed in pytest 10.

• #14335: The method of configuring hooks using markers, deprecated since pytest 7.2, is now scheduled to be removed in pytest 10. See hook-markers for more details.

• #14434: The --pastebin option is now deprecated.

... (truncated)

Commits

• b2522cf Prepare release version 9.1.0
• 368d2fc [refactor] Tighten SetComparisonFunction to Iterator[str] (#14587)
• ff77cd8 [refactor] Make base assertion comparisons return an iterator instead of a li...
• 0d8491a build(deps): Bump actions/stale from 10.2.0 to 10.3.0
• 4a809d9 Merge pull request #14568 from pytest-dev/register-fixture
• 5dfa385 Fix recursion traceback test to cover all styles (#14582)
• f52ff0c Add pytest.register_fixture
• a8ac094 Merge pull request #14567 from pytest-dev/more-visibility-deprecate
• e5620cd [pre-commit.ci] pre-commit autoupdate (#14577)
• 2ce9c6d Merge pull request #14540 from minbang930/fix-14533-doctest-module-fixtures
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependab...

Description has been truncated