Bump the pip-production-dependencies group across 5 directories with 21 updates

[dependabot]

Bumps the pip-production-dependencies group with 21 updates in the /src directory:

Package	From	To
grpcio-health-checking	1.78.0	1.80.0
openfeature-hooks-opentelemetry	0.3.0	0.3.1
openfeature-provider-flagd	0.2.3	0.4.1
opentelemetry-distro	0.60b1	0.63b0
opentelemetry-exporter-otlp-proto-grpc	1.39.1	1.42.0
psutil	7.0.0	7.2.2
python-dotenv	1.2.1	1.2.2
python-json-logger	4.0.0	4.1.0
psycopg2-binary	2.9.11	2.9.12
openai	2.17.0	2.37.0
simplejson	3.20.2	4.1.1
flask	3.1.2	3.1.3
openfeature-provider-ofrep	0.2.0	0.3.0
opentelemetry-api	1.39.1	1.42.0
opentelemetry-instrumentation-jinja2	0.60b1	0.63b0
opentelemetry-instrumentation-requests	0.60b1	0.63b0
opentelemetry-instrumentation-system-metrics	0.60b1	0.63b0
opentelemetry-instrumentation-urllib3	0.60b1	0.63b0
opentelemetry-sdk	1.39.1	1.42.0
opentelemetry-semantic-conventions	0.60b1	0.63b0
opentelemetry-instrumentation-logging	0.60b1	0.63b0

Bumps the pip-production-dependencies group with 4 updates in the /src/llm directory: openfeature-provider-flagd, python-dotenv, python-json-logger and flask.
Bumps the pip-production-dependencies group with 13 updates in the /src/load-generator directory:

Package	From	To
openfeature-hooks-opentelemetry	0.3.0	0.3.1
opentelemetry-exporter-otlp-proto-grpc	1.39.1	1.42.0
python-json-logger	4.0.0	4.1.0
flask	3.1.2	3.1.3
openfeature-provider-ofrep	0.2.0	0.3.0
opentelemetry-api	1.39.1	1.42.0
opentelemetry-instrumentation-jinja2	0.60b1	0.63b0
opentelemetry-instrumentation-requests	0.60b1	0.63b0
opentelemetry-instrumentation-system-metrics	0.60b1	0.63b0
opentelemetry-instrumentation-urllib3	0.60b1	0.63b0
opentelemetry-sdk	1.39.1	1.42.0
opentelemetry-semantic-conventions	0.60b1	0.63b0
opentelemetry-instrumentation-logging	0.60b1	0.63b0

Bumps the pip-production-dependencies group with 11 updates in the /src/product-reviews directory:

Package	From	To
grpcio-health-checking	1.78.0	1.80.0
openfeature-hooks-opentelemetry	0.3.0	0.3.1
openfeature-provider-flagd	0.2.3	0.4.1
opentelemetry-distro	0.60b1	0.63b0
opentelemetry-exporter-otlp-proto-grpc	1.39.1	1.42.0
psutil	7.0.0	7.2.2
python-dotenv	1.2.1	1.2.2
python-json-logger	4.0.0	4.1.0
psycopg2-binary	2.9.11	2.9.12
openai	2.17.0	2.37.0
simplejson	3.20.2	4.1.1

Bumps the pip-production-dependencies group with 8 updates in the /src/recommendation directory:

Package	From	To
grpcio-health-checking	1.78.0	1.80.0
openfeature-hooks-opentelemetry	0.3.0	0.3.1
openfeature-provider-flagd	0.2.3	0.4.1
opentelemetry-distro	0.60b1	0.63b0
opentelemetry-exporter-otlp-proto-grpc	1.39.1	1.42.0
psutil	7.0.0	7.2.2
python-dotenv	1.2.1	1.2.2
python-json-logger	4.0.0	4.1.0

Updates grpcio-health-checking from 1.78.0 to 1.80.0

Updates openfeature-hooks-opentelemetry from 0.3.0 to 0.3.1

Release notes

Sourced from openfeature-hooks-opentelemetry's releases.

openfeature-hooks-opentelemetry: v0.3.1

0.3.1 (2026-02-17)

🐛 Bug Fixes

• Align TracingHook with spec (#342) (2a2127d)
• replace project.scripts with poethepoet (#335) (61add22)

Commits

• 83926de chore(main): release openfeature-hooks-opentelemetry 0.3.1 (#337)
• 2a2127d fix: Align TracingHook with spec (#342)
• c08b414 chore: align unleash pyproject.toml to others (#341)
• 8239b83 feat(provider): add aws-ssm provider (#331)
• 61add22 fix: replace project.scripts with poethepoet (#335)
• a835c77 chore: relax types-requests and update grpcio version constraints (#334)
• a345ef9 chore(main): release openfeature-provider-flagd 0.2.7 (#290)
• b9c164a fix(security): update dependency protobuf to v6.33.5 [security] (#333)
• 2feabd5 chore(main): release openfeature-provider-unleash 0.1.1 (#332)
• dcb8fad chore: add component owners
• Additional commits viewable in compare view

Updates openfeature-provider-flagd from 0.2.3 to 0.4.1

Release notes

Sourced from openfeature-provider-flagd's releases.

openfeature-provider-flagd: v0.4.1

0.4.1 (2026-04-30)

🐛 Bug Fixes

• various custom operator conformance fixes (#386) (c119a77)

✨ New Features

• flagd: extract evaluator into api, core, and testkit packages (#377) (1995534)

openfeature-provider-flagd: v0.4.0

0.4.0 (2026-04-01)

⚠ BREAKING CHANGES

• fractional bucketing improvements (#373)
• drop Python 3.9 support (#364)

chore

• drop Python 3.9 support (#364) (0ecd1d4)

✨ New Features

• fractional bucketing improvements (#373) (83c3e48)
• introduce list for fatal status codes (#362) (96a88ad)

openfeature-provider-flagd: v0.3.0

0.3.0 (2026-03-11)

⚠ BREAKING CHANGES

• graceful fallback to code default when no default variant (#347)

🐛 Bug Fixes

• replace project.scripts with poethepoet (#335) (61add22)

✨ New Features

• graceful fallback to code default when no default variant (#347) (36db67d)

openfeature-provider-flagd: v0.2.7

... (truncated)

Commits

• 5857f45 chore(main): release openfeature-provider-flagd 0.4.1 (#384)
• 3197e02 chore(main): release openfeature-flagd-api 1.0.0 (#382)
• 4f95c87 chore(main): release openfeature-flagd-core 1.0.0 (#385)
• 36c52d0 chore(deps): update dependency asserts to >=0.14.0,<0.15.0 (#357)
• c119a77 fix: various custom operator conformance fixes (#386)
• c8c9ebe chore(deps): lock file maintenance (#372)
• 6d3c5f8 chore: stabilize transitive flagd deps (#387)
• 6b7c78e fix(security): update vulnerability-updates [security] (#381)
• 1995534 feat(flagd): extract evaluator into api, core, and testkit packages (#377)
• 564eb68 fix(security): update dependency pytest to v9.0.3 [security] (#378)
• Additional commits viewable in compare view

Updates opentelemetry-distro from 0.60b1 to 0.63b0

Commits

• See full diff in compare view

Updates opentelemetry-exporter-otlp-proto-grpc from 1.39.1 to 1.42.0

Changelog

Sourced from opentelemetry-exporter-otlp-proto-grpc's changelog.

Version 1.42.0/0.63b0 (2026-05-19)

Added

• opentelemetry-api, opentelemetry-sdk: add support for 'random-trace-id' flags in W3C traceparent header trace flags. Implementations of IdGenerator that do randomly generate the 56 least significant bits, should also implement a is_trace_id_random methods that returns True. (#4854)
• logs: add exception support to Logger emit and LogRecord attributes (#4908)
• opentelemetry-exporter-otlp-proto-grpc: make retryable gRPC error codes configurable for gRPC exporters (#4917)
• opentelemetry-sdk: Add create_logger_provider/configure_logger_provider to declarative file configuration, enabling LoggerProvider instantiation from config files without reading env vars (#4990)
• opentelemetry-exporter-otlp-json-common: add 'opentelemetry-exporter-otlp-json-common' package for OTLP JSON exporters (#4996)
• opentelemetry-sdk: Add service resource detector support to declarative file configuration via detection_development.detectors[].service (#5003)
• opentelemetry-docker-tests: add docker-tests coverage of opentelemetry-exporter-otlp-proto-grpc and opentelemetry-exporter-otlp-proto-http metrics export (#5030)
• Add registry keyword argument to PrometheusMetricReader to allow passing a custom Prometheus registry (#5055)
• Add WeaverLiveCheck test util (#5088)
• opentelemetry-sdk: add load_entry_point shared utility to declarative file configuration for loading plugins via entry points; refactor propagator loading to use it (#5093)
• opentelemetry-sdk: add sampler plugin loading to declarative file configuration via the opentelemetry_sampler entry point group, matching the spec's PluginComponentProvider mechanism (#5095)
• opentelemetry-sdk: add propagator plugin loading to declarative file configuration via the opentelemetry_propagator entry point group, matching the spec's PluginComponentProvider mechanism (#5098)
• opentelemetry-sdk: add exporter plugin loading to declarative file configuration for all three signals (traces, metrics, logs) via the opentelemetry_*_exporter entry point groups, matching the spec's PluginComponentProvider mechanism (#5128)

... (truncated)

Commits

• 013045e [release/v1.42.x-0.63bx] Prepare release 1.42.0/0.63b0 (#5225)
• 1731583 ci: Enable GitHub Merge Queue support (#5209)
• 7fab34d fix(config): allow deflate for OTLP HTTP exporters (#5075)
• 0b690d2 ci: validate changelog fragment filenames (#5212)
• d4fabb4 feat(config): exporter plugin loading via entry points for declarative config...
• e19d346 feat(config): generic resource detector plugin loading for declarative config...
• 1d69bd2 sdk/metrics: copy attributes dict to prevent post-recording mutation (#5106)
• 990a611 feat(config): propagator plugin loading via entry points for declarative conf...
• 85eb40a ci: migrate unreleased changelog entries to towncrier fragments (#5213)
• 369644c docs: add new example for multi-destination exporting to Sphinx Doc (#5087)
• Additional commits viewable in compare view

Updates psutil from 7.0.0 to 7.2.2

Changelog

Sourced from psutil's changelog.

7.2.2 — 2026-01-28 ^^^^^^^^^^^^^^^^^^

Enhancements

• :gh:2705: [Linux]: :meth:Process.wait now uses pidfd_open() + poll() (no busy loop). Requires Linux >= 5.3 and Python >= 3.9.
• :gh:2705: [macOS], [BSD]: :meth:Process.wait now uses kqueue() (no busy loop).

Bug fixes

• :gh:2701, [macOS]: fix compilation error on macOS < 10.7. (patch by :user:Sergey Fedorov <barracuda156>)
• :gh:2707, [macOS]: fix potential memory leaks in error paths of :meth:Process.memory_full_info and :meth:Process.threads.
• :gh:2708, [macOS]: :meth:Process.cmdline and :meth:Process.environ may fail with OSError: [Errno 0] Undefined error (from sysctl(KERN_PROCARGS2)). They now raise :exc:AccessDenied instead.

7.2.1 — 2025-12-29 ^^^^^^^^^^^^^^^^^^

Bug fixes

• :gh:2699, [FreeBSD], [NetBSD]: :func:heap_info does not detect small allocations (<= 1K). In order to fix that, we now flush internal jemalloc cache before fetching the metrics.

7.2.0 — 2025-12-23 ^^^^^^^^^^^^^^^^^^

Enhancements

• :gh:1275: new :func:heap_info and :func:heap_trim functions, providing direct access to the platform's native C :term:heap allocator (glibc, mimalloc, libmalloc). Useful to create tools to detect memory leaks.
• :gh:2403, [Linux]: publish wheels for Linux musl.
• :gh:2680: unit tests are no longer installed / part of the distribution. They now live under tests/ instead of psutil/tests.

Bug fixes

• :gh:2684, [FreeBSD], [critical]: compilation fails on FreeBSD 14 due to missing include.
• :gh:2691, [Windows]: fix memory leak in :func:net_if_stats due to missing Py_CLEAR.

Compatibility notes

... (truncated)

Commits

• 9eea97d Pre-release
• 938ac64 Rm sphinxcontrib.googleanalytics; override layout.html
• 9dcbb7e Add sphinxcontrib-googleanalytics to requirements.txt
• 76eaf9a Try to add google analytics to doc
• de1cafa Update doc mentioning Process.wait() internal details
• bb30943 Refact can_use_pidfd_open() and can_use_kqueue()
• a571717 #2708, macos / cmdline / environ; raise AD instead of OSError(0) (#2709)
• 8b98c3e Pre-release
• 700b7e6 [macOS] fix potential leaks in error paths (#2707)
• 7cc7923 Windows / cmdline(): be more defensive in free()ing in case of error
• Additional commits viewable in compare view

Updates python-dotenv from 1.2.1 to 1.2.2

Release notes

Sourced from python-dotenv's releases.

v1.2.2

Added

• Support for Python 3.14, including the free-threaded (3.14t) build. (#)

Changed

• The dotenv run command now forwards flags directly to the specified command by @​bbc2 in theskumar/python-dotenv#607
• Improved documentation clarity regarding override behavior and the reference page.
• Updated PyPy support to version 3.11.
• Documentation for FIFO file support.
• Support for Python 3.9.

Fixed

• Improved set_key and unset_key behavior when interacting with symlinks by @​bbc2 in #790c5
• Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by @​JYOuyang in theskumar/python-dotenv#590

Breaking Changes

• dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

• In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

• dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

Misc

• skip 000 permission tests for root user by @​burnout-projects in theskumar/python-dotenv#561
• Bump actions/checkout from 5 to 6 in the github-actions group by @​dependabot[bot] in theskumar/python-dotenv#593
• Add Windows testing to CI by @​bbc2 in theskumar/python-dotenv#604
• Improve workflow efficiency with best practices by @​theskumar in theskumar/python-dotenv#609
• Remove the use of sh in tests by @​bbc2 in theskumar/python-dotenv#612

New Contributors

• @​JYOuyang made their first contribution in theskumar/python-dotenv#590
• @​burnout-projects made their first contribution in theskumar/python-dotenv#561
• @​cpackham-atlnz made their first contribution in theskumar/python-dotenv#597

Full Changelog: theskumar/python-dotenv@v1.2.1...v1.2.2

Changelog

Sourced from python-dotenv's changelog.

[1.2.2] - 2026-03-01

Added

• Support for Python 3.14, including the free-threaded (3.14t) build. (#588)

Changed

• The dotenv run command now forwards flags directly to the specified command by [@​bbc2] in #607
• Improved documentation clarity regarding override behavior and the reference page.
• Updated PyPy support to version 3.11.
• Documentation for FIFO file support.
• Dropped Support for Python 3.9.

Fixed

• Improved set_key and unset_key behavior when interacting with symlinks by [@​bbc2] in [790c5c0]
• Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by [@​JYOuyang] in #590

Breaking Changes

• dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

• In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

• dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

Commits

• 36004e0 Bump version: 1.2.1 → 1.2.2
• eb20252 docs: update changelog for v1.2.2
• 790c5c0 Merge commit from fork
• 43340da Remove the use of sh in tests (#612)
• 09d7cee docs: clarify override behavior and document FIFO support (#610)
• c8de288 ci: improve workflow efficiency with best practices (#609)
• 7bd9e3d Add Windows testing to CI (#604)
• 1baaf04 Drop Python 3.9 support and update to PyPy 3.11 (#608)
• 4a22cf8 ci: enable testing on Python 3.14t (free-threaded) (#588)
• e2e8e77 Fix license specifier (#597)
• Additional commits viewable in compare view

Updates python-json-logger from 4.0.0 to 4.1.0

Release notes

Sourced from python-json-logger's releases.

4.1.0

4.1.0 - 2026-03-29

Added

• Add support for Python 3.14, PyPy 3.11

Removed

• Remove support for Python 3.8, 3.9 (includes PyPy versions).

Changelog

Sourced from python-json-logger's changelog.

4.1.0 - 2026-03-29

Added

• Add support for Python 3.14, PyPy 3.11

Removed

• Remove support for Python 3.8, 3.9 (includes PyPy versions).

Commits

• d80c68d Release v4.1.0
• b589b2a [pyproject] Update license table to PEP 639 format
• 2bb784a Update code unlocked by Python 3.10 minimum version
• 79599b5 Drop python 3.8, 3.9 support
• 622650c [docs.contributing] Update unsupported JSON encoders
• 06165bb [tests.test_formatters] Add non-printable bytes to test_common_types_encoded
• 61f88a9 [docs.contributing] Clarify which packages have been considered and rejected
• 0add524 [docs.contributing] Clarify when we will add support for new third-party pack...
• eee9505 [pylint] Remove old command
• 8045926 [mypy] Don't ignore orjson
• Additional commits viewable in compare view

Updates psycopg2-binary from 2.9.11 to 2.9.12

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.14.
• Avoid a segfault passing more arguments than placeholders if Python is built with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
• Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 18.
• Drop support for Python 3.8.

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.13.
• Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
• Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.12.
• Drop support for Python 3.6.

What's new in psycopg 2.9.8 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Wheel package bundled with PostgreSQL 16 libpq in order to add support for recent features, such as sslcertmode.

What's new in psycopg 2.9.7 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix propagation of exceptions raised during module initialization (:ticket:[#1598](https://github.com/psycopg/psycopg2/issues/1598)).

... (truncated)

Commits

• 3a6d9d6 ci: include almalinux in whieel building
• ebca6bf chore: bump to version 3.9.12
• 0196f02 build(deps): bump pypa/cibuildwheel from 3.3.1 to 3.4.0
• d157bdc build(deps): bump docker/setup-qemu-action from 3 to 4
• 7fccc0f build(deps): bump actions/upload-artifact from 6 to 7
• d52a61e chore: bump dependency libraries
• b231d72 chore: fix building binary images
• 6d76e84 Merge pull request #1836 from psycopg/fix-1835
• f7e314c fix: overflow in malformed interval
• eb905c1 docs: replace bare except clause with except Exception
• Additional commits viewable in compare view

Updates openai from 2.17.0 to 2.37.0

Release notes

Sourced from openai's releases.

v2.37.0

2.37.0 (2026-05-13)

Full Changelog: v2.36.0...v2.37.0

Features

• api: add service_tier parameter to responses compact method (625827c)
• internal/types: support eagerly validating pydantic iterators (7e527bc)
• Remove unnecessary client_id when using workload identity provider for auth (c39ea8d)

Bug Fixes

• client: add missing f-string prefix in file type error message (c85ebd9)

v2.36.0

2.36.0 (2026-05-07)

Full Changelog: v2.35.1...v2.36.0

Features

• api: manual updates (13c639c)
• api: realtime 2 (8fe0ab8)

v2.35.1

2.35.1 (2026-05-06)

Full Changelog: v2.35.0...v2.35.1

Bug Fixes

• api: fix imagegen size enum regression (4484653)

v2.35.0

2.35.0 (2026-05-06)

Full Changelog: v2.34.0...v2.35.0

Features

• api: update image 2 (0ba55d7)
• api: manual updates (72bf67a)

Chores

• remove legacy python cli (32f36e4)
• rename legacy python cli entrypoint (a3b182d)

... (truncated)

Changelog

Sourced from openai's changelog.

2.37.0 (2026-05-13)

Full Changelog: v2.36.0...v2.37.0

Features

• api: add service_tier parameter to responses compact method (625827c)
• internal/types: support eagerly validating pydantic iterators (7e527bc)
• Remove unnecessary client_id when using workload identity provider for auth (c39ea8d)

Bug Fixes

• client: add missing f-string prefix in file type error message (c85ebd9)

2.36.0 (2026-05-07)

Full Changelog: v2.35.1...v2.36.0

Features

• api: manual updates (13c639c)
• api: realtime 2 (8fe0ab8)

2.35.1 (2026-05-06)

Full Changelog: v2.35.0...v2.35.1

Bug Fixes

• api: fix imagegen size enum regression (4484653)

2.35.0 (2026-05-06)

Full Changelog: v2.34.0...v2.35.0

Features

• api: update image 2 (0ba55d7)
• api: manual updates (72bf67a)

Chores

• remove legacy python cli (32f36e4)
• rename legacy python cli entrypoint (a3b182d)

Documentation

... (truncated)

Commits

• 658be64 Merge pull request #3213 from openai/release-please--branches--main--changes-...
• 8a7cac3 release: 2.37.0
• 9b4bf8e Merge pull request #1903 from stainless-sdks/dev/jtian/remove-unnecessary-params
• c39ea8d feat: Remove unnecessary client_id when using workload identity provider for ...
• 7e527bc feat(internal/types): support eagerly validating pydantic iterators
• 625827c feat(api): add service_tier parameter to responses compact method
• c85ebd9 fix(client): add missing f-string prefix in file type error message
• 38d75d7 Merge pull request #3205 from openai/release-please--branches--main--changes-...
• ff683ff release: 2.36.0
• 8fe0ab8 feat(api): realtime 2
• Additional commits viewable in compare view

Updates simplejson from 3.20.2 to 4.1.1

Release notes

Sourced from simplejson's releases.

v4.1.1

What's Changed

• Add Python 2.7 wheel builds for Windows platforms by @​etrepum in simplejson/simplejson#378

Full Changelog: simplejson/simplejson@v4.1.0...v4.1.1

v4.1.0

What's Changed

• Accelerate indented encoding in the C extension; release 4.1.0 by @​etrepum in simplejson/simplejson#376

Full Changelog: simplejson/simplejson@v4.0.1...v4.1.0

v4.0.1

What's Changed

• Exclude Pyodide wheels from PyPI uploads by @​etrepum in simplejson/simplejson#375

Full Changelog: simplejson/simplejson@v4.0.0...v4.0.1

v4.0.0

What's Changed

Version 4.0.0 released 2026-04-18

• simplejson 4 requires Python 2.7 or Python 3.8+. Older Python versions (2.5, 2.6, 3.0-3.7) are no longer supported. pip will not install simplejson 4 on unsupported versions.

• The C extension now uses heap types and per-module state instead of static types and global state. This is required for free-threading support and sub-interpreter isolation. The Python-level API is unchanged.

• Full support for Python 3.13+ free-threading (PEP 703). The C extension is now safe to use with the GIL disabled (python3.14t):

  • Converted all static types to heap types with per-module state
  • Added per-object critical sections to scanner and encoder
  • Added free-threading-safe dict operations for Python 3.13+
  • Unified per-module state management and templated parser simplejson/simplejson#363 simplejson/simplejson#364 simplejson/simplejson#365 simplejson/simplejson#367 simplejson/simplejson#369

• Numerous C extension memory safety fixes:

  • Fix use-after-free and leak in encoder ident handling
  • Fix NULL dereferences on OOM in module init and static string init

... (truncated)

Changelog

Sourced from simplejson's changelog.

Version 4.1.1 released 2026-04-24

• The build_wheels_py27 CI job now also builds Python 2.7 wheels for Windows AMD64 and Windows x86, joining the existing Py2.7 manylinux1 / manylinux2010 x86_64 wheels. This unblocks offline / --no-index installs on Py2.7-on-Windows (the original reporter's case), which previously had no matching binary wheel on PyPI, fell through to the sdist, and failed on the PEP 517 isolated-build step complaining that setuptools>=42 was not in the wheelhouse. simplejson/simplejson#377

Version 4.1.0 released 2026-04-22

• The C extension now accelerates encoding when indent= is set. Previously the encoder fell back to the pure-Python implementation whenever a non-None indent was passed; now the C encoder emits the newline-plus-indent prefix, the level-aware item separator, and the closing indent directly. A representative nested-dict workload benchmarks about 4-5x faster end-to-end, and the indent=0 and empty-container edge cases continue to match the Python output byte-for-byte.

• The C extension now emits PEP 678 exc.add_note() annotations on serialization failures, matching the pure-Python encoder. A chained error on {'a': [1, object(), 3]} produces the same three notes (when serializing object object, when serializing list item 1, when serializing dict item 'a') whether the speedups are loaded or not, so the add_note assertions in test_errors.py no longer need indent=2 to force the Python path.

Version 4.0.1 released 2026-04-18

• Skip uploading Pyodide/wasm wheels to PyPI, which rejects them with "unsupported platform tag 'pyodide_2024_0_wasm32'". The wheels are still built in CI and preserved as workflow artifacts. simplejson/simplejson#375

Version 4.0.0 released 2026-04-18

• simplejson 4 requires Python 2.7 or Python 3.8+. Older Python versions (2.5, 2.6, 3.0-3.7) are no longer supported. pip will not install simplejson 4 on unsupported versions.

• The C extension now uses heap types and per-module state instead of static types and global state. This is required for free-threading support and sub-interpreter isolation. The Python-level API is unchanged.

• Full support for Python 3.13+ free-threading (PEP 703). The C

... (truncated)

Commits

• 639b2ee Add Python 2.7 wheel builds for Windows platforms (#378)
• 0fd3185 Accelerate indented encoding in the C extension; release 4.1.0 (#376)
• 19b5f94 Exclude Pyodide wheels from PyPI uploads (#375)
• 1608c05 Use JSONDecodeError for out-of-range end indices in C scanstring (#374)
• 3bba179 Encoder parity fixes (for_json/_asdict) and TSan stress CI job (#373)
• 7b22d65 Error parity for the C and Python scanstring in surrogate and truncated strin...
• 825100a Release version 4.0.0: free-threading, CPython json parity, Python 2.7 fixes ...
• 0dbb9d8 C extension: dead code cleanup, fast paths for dict/list/string encoding, cor...
• e2e5f0b Add Python 3.13+ free-threading support to dict operations (#369)
• e817370 Fix free-threading (3.14t) crashes: heap types, unified per-module state, tem...
• Additional commits viewable in compare view

Updates flask from 3.1.2 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

• The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

• The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Commits

• 22d9247 release version 3.1.3
• 089cb86 Merge commit from fork
• c17f379 request context tracks session access
• 27be933 start version 3.1.3
• 4e652d3 Abort if the instance folder cannot be created (#5903)
• 3d03098 Abort if the instance folder cannot be created
• 407eb76 document using gevent for async (