[dependabot]

Bumps the python-minor-and-patch group with 18 updates:

Package	From	To
markupsafe	3.0.3	3.0.4
sqlalchemy	2.0.48	2.1.8
alembic	1.16.5	1.20.1
anyio	4.14.2	4.16.0
charset-normalizer	3.5.1	3.5.2
cryptography	50.0.0	50.0.2
google-auth-oauthlib	1.4.0	1.5.0
google-auth	2.56.3	2.62.1
google-genai	2.8.0	2.34.0
greenlet	3.5.5	3.5.6
idna	3.19	3.20
oauthlib	4.0.0	4.0.1
pycparser	3.0	3.12
pydantic	2.13.4	2.14.3
pydantic-core	2.46.4	2.50.4
python-dotenv	1.2.3	1.2.4
tenacity	9.1.4	9.2.1
typing-inspection	0.4.4	0.4.5

Updates markupsafe from 3.0.3 to 3.0.4

Release notes

Sourced from markupsafe's releases.

3.0.4

This is the MarkupSafe 3.0.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/MarkupSafe/3.0.4/ Changes: https://markupsafe.palletsprojects.com/page/changes/#version-3-0-4 Milestone: https://github.com/pallets/markupsafe/milestone/17?closed=1

• Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
• Improve performance of striptags. #521

Changelog

Sourced from markupsafe's changelog.

Version 3.0.4

Released 2026-10-02

• Build Python 3.15, armv7l, ppc64le, Android, and iOS wheels.
• Improve performance of striptags. :issue:521

Commits

• ece2607 release version 3.0.4
• 620bc80 split archs
• 73c3be1 fix wheel builds (#536)
• d8ae19e fix wheel builds
• ff1eaff Build Android and iOS wheels (#516)
• 87e64f9 build Android and iOS wheels
• bc33c55 Build ppc64le wheels (#518)
• 0ddd6ea build ppc64le wheels
• 3e07758 Build armv7l wheels (#514)
• 39b9aae build armv7l wheels
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.48 to 2.1.8

Release notes

Sourced from sqlalchemy's releases.

2.1.8

Released: November 3, 2026

general

• [general] [change] All files published to PyPI for a release, including the source distribution as well as all wheels, are now uploaded using PyPI's trusted publishing mechanism from SQLAlchemy's GitHub Actions workflow, and include a PEP 740 attestation, so that every file in a release carries provenance information. Previously, the source distribution and some wheels were uploaded without an attestation, which caused PyPI to display provenance warnings for recent releases.

  This change is also backported to: 2.0.57

  References: #13759

2.0.57

Released: November 3, 2026

general

• [general] [change] All files published to PyPI for a release, including the source distribution as well as all wheels, are now uploaded using PyPI's trusted publishing mechanism from SQLAlchemy's GitHub Actions workflow, and include a PEP 740 attestation, so that every file in a release carries provenance information. Previously, the source distribution and some wheels were uploaded without an attestation, which caused PyPI to display provenance warnings for recent releases.

  References: #13759

2.1.7

Released: November 3, 2026

orm

• [orm] [feature] Added _orm.SessionTransaction.connections and _orm.SessionTransaction.bound_connection(), which return the connections a _orm.SessionTransaction has already acquired, without acquiring a new one. This allows, for example, checking whether any connection in the transaction has been invalidated before emitting further SQL. A SAVEPOINT transaction returned by _orm.Session.begin_nested() reports only the connections used

... (truncated)

Commits

• See full diff in compare view

Updates alembic from 1.16.5 to 1.20.1

Release notes

Sourced from alembic's releases.

1.20.1

Released: October 21, 2026

bug

• [bug] [autogenerate] Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don't store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.

  References: #1085

• [bug] [autogenerate] [postgresql] Fixed rendering of the PostgreSQL ~sqlalchemy.dialects.postgresql.DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.

  References: #1360

• [bug] [autogenerate] [postgresql] Fixed false-positive "Computed default cannot be modified" warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.

  References: #1462

• [bug] [autogenerate] [postgresql] Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.

• [bug] [postgresql] Fixed bug where Operations.alter_column() against a PostgreSQL identity column would render an incomplete, invalid ALTER TABLE ... ALTER COLUMN statement with no clause at all when existing_server_default was omitted, even if there were no existing server default. Pull request courtesy Riti Grover.

... (truncated)

Commits

• See full diff in compare view

Updates anyio from 4.14.2 to 4.16.0

Release notes

Sourced from anyio's releases.

4.16.0

New features

• Added BlockingPortal.call_async() for asynchronously calling into an event loop with optional abandonment on cancellation (#1342; PR by @​davidbrochart)
• Added SOCK_SEQPACKET support to connect_unix() and create_unix_listener() (#1349; PR by @​theunkn0wn1)

Other changes

• Changed UDP sockets on the asyncio backend to make send() wait until the datagram has been passed to the operating system (#1294; PR by @​graingert)

Bug fixes

• Fixed documentation implying that use_uvloop=True falls back to the standard event loop when uvloop (winloop on Windows) is not installed, and showed how to skip the corresponding pytest backend variant when the dependency is missing (#645; PR by @​GruffElixir)
• Fixed get_current_task() on the asyncio backend raising an opaque TypeError: cannot create weak reference to 'NoneType' object instead of a clear error when called from a callback scheduled via loop.call_soon_threadsafe() (e.g. from within from_thread.run_sync()), where asyncio.current_task() is legitimately None (#773; PR by @​AmirF194)
• Fixed CancelScope on the asyncio backend swallowing a native Task.cancel() that was delivered in the same event loop iteration as the scope's own cancellation (such as a move_on_after() deadline expiring), which left the host task with a pending cancellation request that never raised CancelledError (#1214)
• Fixed UDP socket closing hanging if a datagram send was still in flight (#1237; PR by @​graingert)
• Fixed concurrent aclose_forcefully() calls on asyncio socket streams returning before the underlying socket was closed (#1273; PR by @​graingert)
• Fixed aclose() on sockets not checkpointing, and thus failing to raise a cancellation exception when called inside a cancelled scope (affected UNIX socket streams and UNIX datagram sockets on asyncio, and all sockets on Trio) (#1288; PR by @​graingert)
• Fixed aclose() on asyncio TCP socket listeners not checkpointing, and leaking the listening socket if cancelled while another task was waiting in accept() (#1289; PR by @​graingert)
• Fixed accept() on asyncio UNIX socket listeners hanging forever, and leaving the listening socket registered with the event loop, when the listener was closed by another task (#1289; PR by @​graingert)
• Fixed send() on asyncio TCP and UDP sockets returning normally, despite the data being discarded, when the socket was closed by another task (or, for TCP, the connection was lost) while send() was waiting for the operating system to accept the data (#1289; PR by @​graingert)
• Fixed SocketStream.send() on the asyncio backend handing its data to a paused transport after a previous send() was cancelled (#1299; PR by @​graingert)
• Fixed sleep() treating a negative delay (including -inf) inconsistently across backends (asyncio returned immediately; Trio raised ValueError) by raising ValueError on all backends (#1306; PR by @​BetterAndBetterII)
• Fixed create_tcp_listener() occasionally failing with a message like Could not create 2 listeners with a consistent port when an ephemeral port is requested and IPv6 is enabled and the dual-stack path is not available or a specific local host name was given (#1313)
• Fixed AsyncFile not shielding against cancellation while closing (#1314)
• Fixed TemporaryDirectory.cleanup() reacting to cancellation prematurely when the host task was already cancelled, causing the actual cleanup operation to be skipped (#1316; PR by @​Yasser-Ameur)
• Fixed a NaN deadline being accepted on asyncio while Trio raised ValueError, which silently disabled the timeout (fail_after(math.nan) returned instead of raising TimeoutError); CancelScope now rejects it on both backends (#1317; PR by @​dylanpulver)
• Fixed FileReadStream and FileWriteStream leaving files open when cancelled during context manager exit, including unflushed writes (#1318; PR by @​Kuang-xianxin)
• Fixed Condition.notify() and Condition.notify_all() failing when the underlying lock was acquired directly rather than through the condition (#1319; PR by @​GruffElixir)
• Fixed importing AnyIO with loaders that do not provide __file__, such as PyOxidizer, raising TypeError instead of falling back to eager imports (#1322; PR by @​skulitom)
• Fixed text receive streams silently discarding incomplete characters at end-of-file instead of applying the configured decoding error handler (#1339; PR by @​Aurelucien)
• Fixed Semaphore(fast_acquire=True) losing its fast-acquire behavior when instantiated outside a running event loop (#1348; PR by @​feiiiiii5)
• Fixed BlockingPortalProvider permanently failing with an AttributeError on every subsequent use if the first attempt to start its blocking portal failed (#1350; PR by @​Yasser-Ameur)
• Fixed create_udp_socket() silently ignoring the local_port argument when local_host was omitted, making the socket bind to a random ephemeral port instead of the requested one (#1351; PR by @​januththedev)
• Fixed worker threads on the asyncio backend never returning to the idle pool (and thus never being reused or pruned) when a to_thread.run_sync() call was cancelled after it had been queued for the worker but before the worker thread had picked it up (#1352; PR by @​Zac-HD)
• Fixed pytest plugin running Hypothesis async tests only on the first parametrized backend instead of each backend (#1353; PR by @​DYNOSuprovo)
• Fixed TypeError when subclassing an existing TypedAttributeSet subclass, and this subclass contains type annotations (#1358; PR by @​pasmud)
• Fixed Lock.locked() (and Condition.locked()) raising NoEventLoopError when the lock was created outside a running event loop (#1362; PR by @​00200200)
• Fixed connect_tcp() leaking a connected socket when an enclosing cancel scope was cancelled before the connection attempt task group exited (#1364; PR by @​charan-rathore)
• Fixed create_connected_udp_socket() silently ignoring local_port when local_host was not given: the local address was left unset, so the OS picked an ephemeral port instead of the requested one (#1365; PR by @​feiiiiii5)
• Fixed BlockingPortalProvider not passing the exception raised in its with block on to the start_blocking_portal() context manager it wraps (#1366; PR by @​feiiiiii5)
• Fixed anyio.itertools.islice() not consuming the first start items when stop <= start (#1372; PR by @​Rodrigo-Palma)
• Fixed BufferedByteReceiveStream.receive_exactly() and receive_until() returning buffered data after explicit closure instead of raising ClosedResourceError (#1378; PR by @​kokotatan)
• Fixed a TLS stream sending records the peer could no longer decrypt after a cancelled send() lost an already-encrypted record; the stream now raises BrokenResourceError on further use instead (#1385; PR by @​Kayvan-Zahiri)
• Fixed close() on memory object streams not waking up tasks blocked in send() or receive() on the same stream (#1391)
• Fixed anyio.itertools.product() acquiring and consuming unused input iterables when repeat=0 (#1394; PR by @​sricharanreddycheruku)
• Fixed SpooledTemporaryFile rolling over to disk on writes when max_size is zero (the default) (#1397; PR by @​fhgffy)
• Fixed Trio UDP sockets remaining open when initialization failed or was cancelled (#1400; PR by @​adenzhou1350)
• Fixed SpooledTemporaryFile.rollover() moving the current file position to the end of the file (#1401; PR by @​fhgffy)
• Fixed cancellation during temporary directory creation leaving the directory behind while its context manager is retained (#1403; PR by @​adenzhou1350)

... (truncated)

Commits

• 0ddd02d Released version 4.16.0
• 576892e Fixed certain pending tasks not woken up by the closing of memory object stre...
• 02ff4f8 Added BlockingPortal.call_async() (#1343)
• 1af29a4 Moved documentation code snippets into separate, checked files (#1445)
• f01c041 [pre-commit.ci] pre-commit autoupdate (#1448)
• 95a0143 Test with blockbuster and uvloop on Python 3.15 too
• 4d51154 Modernized the memory object stream tests
• 1e4b448 Fixed the as_connectable() example in the networking docs (#1442)
• cd21b36 Fixed TypedAttributeSet not collecting annotations from superclasses (#1358)
• b7f8c68 [pre-commit.ci] pre-commit autoupdate (#1431)
• Additional commits viewable in compare view

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Commits

• 935c29a Release 3.5.2 (#805)
• 9d3238a test: disable traefik in downstream niquests
• b4c0368 docs: write changelog entry for 3.5.2
• 717da31 chore: bump version to 3.5.2
• 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
• 41e28b6 chore: raise Cython upper bound to 3.3
• b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
• f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
• See full diff in compare view

Updates cryptography from 50.0.0 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.
.. _v50-0-1:
50.0.1 - 2026-08-25

• Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.

.. _v50-0-0:

Commits

• 4dda5c7 [50.0.x] Bump for 50.0.2 release + changelog (#15733)
• 70c881c [50.0.x] Bump pyo3 to 0.29.2 (#15731)
• a8c45c4 [50.0.x] Build abi3.abi3t wheels for CPython 3.15+ (#15496) (#15732)
• ffde75a bump for 50.0.1 + changelog (#15520)
• See full diff in compare view

Updates google-auth-oauthlib from 1.4.0 to 1.5.0

Release notes

Sourced from google-auth-oauthlib's releases.

google-cloud-compute-v1beta: v0.12.10

0.12.10 (2026-11-05)

Features

• update API sources and regenerate (#18986) (8c0f333)

grpc-google-iam-v1: v0.14.6

0.14.6 (2026-10-22)

Features

• declare support for Python 3.15 (#18737) (65c8767)
• update API sources and regenerate (#18797) (be4d954)

google-cloud-compute-v1beta: v0.12.9

0.12.9 (2026-10-15)

Features

• update API sources and regenerate (#18699) (1aa57db)

google-cloud-compute-v1beta: v0.12.8

0.12.8 (2026-10-08)

Features

• update API sources and regenerate (#18593) (d0505e8)

Changelog

Sourced from google-auth-oauthlib's changelog.

1.5.0 (2022-07-11)

Features

• support devsite notices (#222) (0da9224)

Bug Fixes

• include dependency for librarytest (#218) (420780b)

1.4.8 (2022-05-24)

Bug Fixes

• add hardcoded IAM references temporarily (#209) (5dc99d2)

1.4.7 (2022-04-12)

Bug Fixes

• add markdown header if it is missing (#203) (ccd53bd)

1.4.6 (2022-04-06)

Bug Fixes

• support parsing summary docstring that is not well formed (#200) (a1b362d)

1.4.5 (2022-03-18)

Bug Fixes

• format code snippets properly (#193) (ef7a337)

1.4.4 (2022-03-03)

Bug Fixes

• parse docstring that come without summaries (#187) (8282604)

1.4.3 (2022-02-15)

... (truncated)

Commits

• d6bed5a chore: release main (#18464)
• 78ff458 feat(gapic-generator): add schema support for resumable uploads (#18480)
• af2100a tests: add showcase to golden files (#18479)
• e1d306a fix: resolve error where google/longrunning/operations.proto is missing (#18477)
• 7871fa9 fix(gapic-generator): init mock response in version header test (#18488)
• 0b488a3 feat(bigtable): Reroute Mutations Batcher to use data client (#18200)
• 30b4f44 fix(google-auth-oauthlib): prevent ipv6 address reuse (#18463)
• 1d9f468 chore(main): release google-auth 2.59.0 (#18465)
• c7c133a chore(bigtable): Added an internal batch completed callback to the data clien...
• 8cb3c6a perf(spanner): optimize query option merging and prevent in-place mutation (#...
• Additional commits viewable in compare view

Updates google-auth from 2.56.3 to 2.62.1

Release notes

Sourced from google-auth's releases.

google-auth: v2.62.1

2.62.1 (2026-11-02)

Bug Fixes

• auth: strip -fips suffix from AWS service name in SigV4 signing (#18920) (2e1899e)
• auth: use an unencrypted key for mTLS certificate rotation (#18709) (8166325)

google-auth: v2.62.0

2.62.0 (2026-10-12)

Features

• auth: enable bound ID tokens by default on Cloud Run (#18635) (8b625c4)

Commits

• d50415c chore(main): release google-auth 2.62.1 (#18786)
• 2e1899e fix(auth): strip -fips suffix from AWS service name in SigV4 signing (#18920)
• ad03b95 perf(spanner): optimize request ID header generation and retry closures (#18408)
• 6e80b83 fix(bigtable): encode str qualifier in DeleteRangeFromColumn and allow -2**63...
• 72e5f48 docs(bigtable): add samples for sync client (#17820)
• 8aa6d4d fix(bigtable): validate DirectRow and table match in MutationsBatcher.mutate ...
• 8e0c4ab chore(bigtable): update pytest-asyncio (#18922)
• 048ef17 chore(main): release google-cloud-bigquery 3.47.0 (#18812)
• a6d7f29 chore: release main (#18891)
• deb2194 fix(google-api-core): align HTTP T3 and T4 OpenTelemetry span status and attr...
• Additional commits viewable in compare view

Updates google-genai from 2.8.0 to 2.34.0

Release notes

Sourced from google-genai's releases.

v2.34.0

2.34.0 (2026-10-29)

Features

• Add support for continuation_token and requires_continuation status (daac53e)
• Add support for Python 3.15. (cb1408b)
• Add video upscale task parameter (0456043)
• Drop support for Python 3.10 (2677298)
• interactions: Add automatic_continuation to interactions.create in the Python SDK (c85d5ae)
• interactions: Declare continuation_ids on Interaction (4bdde3a)
• Support base_url, api_version and headers in LiveConnectConfig.http_options (c0e9c54)
• Support video understanding in Gemini Developer API (34b58fd)

Bug Fixes

• interactions: Align SDK User-Agent and x-goog-api-client headers (358d249)
• Resolve PEP 563 string annotations when invoking AFC tools (4650ea1), refs #3156
• Stop per-request Authorization and X-Server-Timeout from leaking into client default headers (0584c96), refs #3158

v2.33.0

2.33.0 (2026-10-22)

Features

• Add store to GenerateContentConfig (Gemini Developer API only) and labels to LiveConnectConfig. (16a29c9)
• Add support for Python 3.15. (e1c4fc7)
• Add support for Python 3.15. (1a64450)
• client: Support httpx2 with GOOGLE_GENAI_HTTP_CLIENT configuration (87ddba1)
• Include AudioContent, DocumentContent, and VideoContent in FunctionResultSubContent (adbc79c)

Bug Fixes

• client: Skip mTLS URL rewriting for multi-regional .rep.googleapis.com endpoints and honor GOOGLE_API_USE_MTLS_ENDPOINT in Google Auth sessions (4e44c84)
• Honor an explicit zero in HttpRetryOptions delay fields (419dd89), refs #2026
• Honor HttpRetryOptions for aiohttp connection errors in async requests (ee639c6), refs #3160

Documentation

• Update unenforced JSON Schema keywords on Interactions schema fields. (c97ae02)

v2.32.0

2.32.0 (2026-10-21)

... (truncated)

Changelog

Sourced from google-genai's changelog.

2.34.0 (2026-10-29)

Features

• Add support for continuation_token and requires_continuation status (daac53e)
• Add support for Python 3.15. (cb1408b)
• Add video upscale task parameter (0456043)
• Drop support for Python 3.10 (2677298)
• interactions: Add automatic_continuation to interactions.create in the Python SDK (c85d5ae)
• interactions: Declare continuation_ids on Interaction (4bdde3a)
• Support base_url, api_version and headers in LiveConnectConfig.http_options (c0e9c54)
• Support video understanding in Gemini Developer API (34b58fd)

Bug Fixes

• interactions: Align SDK User-Agent and x-goog-api-client headers (358d249)
• Resolve PEP 563 string annotations when invoking AFC tools (4650ea1), refs #3156
• Stop per-request Authorization and X-Server-Timeout from leaking into client default headers (0584c96), refs #3158

2.33.0 (2026-10-22)

Features

• Add store to GenerateContentConfig (Gemini Developer API only) and labels to LiveConnectConfig. (16a29c9)
• Add support for Python 3.15. (e1c4fc7)
• Add support for Python 3.15. (1a64450)
• client: Support httpx2 with GOOGLE_GENAI_HTTP_CLIENT configuration (87ddba1)
• Include AudioContent, DocumentContent, and VideoContent in FunctionResultSubContent (adbc79c)

Bug Fixes

• client: Skip mTLS URL rewriting for multi-regional .rep.googleapis.com endpoints and honor GOOGLE_API_USE_MTLS_ENDPOINT in Google Auth sessions (4e44c84)
• Honor an explicit zero in HttpRetryOptions delay fields (419dd89), refs #2026
• Honor HttpRetryOptions for aiohttp connection errors in async requests (ee639c6), refs #3160

Documentation

• Update unenforced JSON Schema keywords on Interactions schema fields. (c97ae02)

2.32.0 (2026-10-21)

Features

• Add base_voice to PromptedVoice in GAOS SDK (5488643)

... (truncated)

Commits

• 0dc788c chore(main): release 2.34.0 (#3209)
• 0456043 feat: add video upscale task parameter
• c85d5ae feat(interactions): add automatic_continuation to interactions.create in the ...
• 2677298 feat: Drop support for Python 3.10
• 358d249 fix(interactions): align SDK User-Agent and x-goog-api-client headers
• 34b58fd feat: support video understanding in Gemini Developer API
• 4bdde3a feat(interactions): declare continuation_ids on Interaction
• 6e80d42 chore: export SDKs to gemini-api-oad/dist/<lang> via Copybara additional_g3_e...
• 84d9665 chore(cli): update Speakeasy OpenAPI generator to v2.952.4
• daac53e feat: Add support for continuation_token and requires_continuation status
• Additional commits viewable in compare view

Updates greenlet from 3.5.5 to 3.5.6

Changelog

Sourced from greenlet's changelog.

3.5.6 (2026-09-14)

• Correct a race condition that could lead to garbage collection unintentionally being disabled. See PR 529 <https://github.com/python-greenlet/greenlet/pull/529>_ by Yurii.

Commits

• abfe740 Preparing release 3.5.6
• e23e3e4 Change note for #529
• 8de830f Merge pull request #529 from Georggi/patch-1
• 72d7cac Merge pull request #530 from python-greenlet/dependabot/github_actions/github...
• ac01b7d Bump github/codeql-action in the github-actions group
• e18f5a6 Simplify GCDisabledGuard constructor
• 6aaf3af Back to development: 3.5.6
• See full diff in compare view

Updates idna from 3.19 to 3.20

Release notes

Sourced from idna's releases.

v3.20

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

• Update to Unicode 18.0.0.
• Better enforcement of the domain length limit in the incremental codec.
• Add support for Python 3.15.

Commits

• d55e65e Release 3.20
• 0c0824a Pre-release 3.20rc0
• bd7c316 Note Python 3.15 support in the 3.20 changelog
• b6cce85 Merge pull request #276 from kjd/unicode-18
• 9a4bc59 Update to Unicode 18.0.0
• dfab5a0 Merge branch 'python-3.15'
• 417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
• cd17392 Merge pull request #274 from kjd/fix-decode-length-check
• c5796d7 Skip the decode round-trip check for domains past encode's length limit
• d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
• Additional commits viewable in compare view

Updates oauthlib from 4.0.0 to 4.0.1

Release notes

Sourced from oauthlib's releases.

4.0.1

Security

• CVE-2026-49272 / GHSA-3jp2-3mrg-2vxc: The device code flow token endpoint did not validate the device_code parameter. A request with a known client_id and a bogus device_code could obtain a bearer token. DeviceCodeGrant.validate_token_request now calls DeviceCodeGrant.validate_device_code(), which rejects missing or unknown device codes (invalid_request / invalid_grant) and delegates the code's authorization status to the new RequestValidator.validate_device_code() hook, per RFC 8628 Section 3.5. (cherry-picked from #954)

Upgrade note for device flow integrators

Custom RequestValidator implementations using the device flow must now implement validate_device_code(client_id, code, request). Return one of the DeviceCodeGrant.DEVICE_CODE_* statuses for known codes, or None for an unknown code. When returning AUTHORIZED, the validator must also populate request.user and request.scopes from the stored authorization.

<...

Description has been truncated