Bump the pip group across 7 directories with 7 updates by dependabot[bot] · Pull Request #2025 · materialsproject/MPContribs

dependabot · 2026-04-20T21:30:07Z

Bumps the pip group with 5 updates in the /mpcontribs-api/requirements directory:

Package	From	To
cryptography	`46.0.3`	`46.0.7`
orjson	`3.11.5`	`3.11.6`
pillow	`12.1.0`	`12.2.0`
requests	`2.32.5`	`2.33.0`
tornado	`6.5.4`	`6.5.5`

Bumps the pip group with 4 updates in the /mpcontribs-client/requirements directory: orjson, pillow, requests and ujson.
Bumps the pip group with 6 updates in the /mpcontribs-kernel-gateway/requirements directory:

Package	From	To
orjson	`3.11.5`	`3.11.6`
pillow	`12.1.0`	`12.2.0`
requests	`2.32.5`	`2.33.0`
tornado	`6.5.4`	`6.5.5`
ujson	`5.11.0`	`5.12.0`
pytest	`9.0.2`	`9.0.3`

Bumps the pip group with 4 updates in the /mpcontribs-lux directory: orjson, pillow, requests and pytest.
Bumps the pip group with 4 updates in the /mpcontribs-lux/requirements directory: orjson, pillow, requests and pytest.
Bumps the pip group with 5 updates in the /mpcontribs-portal/requirements directory:

Package	From	To
orjson	`3.11.5`	`3.11.6`
pillow	`12.1.0`	`12.2.0`
requests	`2.32.5`	`2.33.0`
tornado	`6.5.4`	`6.5.5`
ujson	`5.11.0`	`5.12.0`

Bumps the pip group with 3 updates in the /mpcontribs-serverless/dependencies directory: pillow, requests and ujson.

Updates cryptography from 46.0.3 to 46.0.7

Changelog

Sourced from cryptography's changelog.

46.0.7 - 2026-04-07
* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be
  passed to APIs that accept Python buffers, which could lead to buffer
  overflow. **CVE-2026-39892**
* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.
.. _v46-0-6:
46.0.6 - 2026-03-25
SECURITY ISSUE: Fixed a bug where name constraints were not applied to peer names during verification when the leaf certificate contains a wildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug, including those used by the Web PKI. Credit to Oleh Konko (1seal) for reporting the issue. CVE-2026-34073

.. _v46-0-5:

46.0.5 - 2026-02-10
* An attacker could create a malicious public key that reveals portions of your
  private key when using certain uncommon elliptic curves (binary curves).
  This version now includes additional security checks to prevent this attack.
  This issue only affects binary elliptic curves, which are rarely used in
  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and
  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.
  **CVE-2026-26007**
* Support for ``SECT*`` binary elliptic curves is deprecated and will be
  removed in the next release.
.. v46-0-4:
46.0.4 - 2026-01-27
Dropped support for win_arm64 wheels_.

Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.

.. _v46-0-3:

Commits

622d672 46.0.7 release (#14602)
91d7288 Cherry-pick #14542 (#14543)
06e120e bump version for 46.0.5 release (#14289)
0eebb9d EC check key on cofactor > 1 (#14287)
bedf6e1 fix openssl version on 46 branch (#14220)
e6f44fc bump for 46.0.4 and drop win arm64 due to CI issues (#14217)
See full diff in compare view

Updates orjson from 3.11.5 to 3.11.6

Release notes

Sourced from orjson's releases.

3.11.6

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Changelog

Sourced from orjson's changelog.

3.11.6 - 2026-01-29

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Commits

ec02024 3.11.6
d581687 build, clippy misc
4105b29 writer::num
62bb185 Fix sporadic crash on serializing object close
d860078 PyRef idiom refactors
343ae2f Deserializer, Utf8Buffer
7835f58 PyBytesRef and other input refactor
71e0516 PyStrRef
1096df4 MSRV 1.89
b718e75 Drop support for python3.9
Additional commits viewable in compare view

Updates pillow from 12.1.0 to 12.2.0

Release notes

Sourced from pillow's releases.

12.2.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

Documentation

Update 12.2.0 release notes #9522 [@hugovk]

Add loader plugins: AMOS abk, Atari Degas, 40+ more obscure formats via Netpbm #9482 [@bitplane]

Update Python versions #9515 [@radarhere]

Jeffrey A. Clark -> Jeffrey 'Alex' Clark #9513 [@aclark4life]

Add release notes for #9394, #9419 and #9456 #9467 [@radarhere]

Add Amiga Workbench .info loader to 3rd party plugins list #9459 [@bitplane]

Merge PFM documentation into PPM #9434 [@radarhere]

Update macOS tested Pillow versions #9431 [@radarhere]

Fix CVE number #9430 [@hugovk]

Dependencies

Update xz to 5.8.3 #9523 [@radarhere]

Update libjpeg-turbo to 3.1.4.1 #9507 [@radarhere]

Update libpng to 1.6.56 #9499 [@radarhere]

Update freetype to 2.14.3 #9485 [@radarhere]

Updated libavif to 1.4.1 #9479 [@radarhere]

Updated harfbuzz to 13.2.1 #9461 [@radarhere]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Update harfbuzz to 13.0.1 #9453 [@radarhere]

Update libavif to 1.4.0 #9460 [@radarhere]

Update freetype to 2.14.2 #9449 [@radarhere]

Update actions/download-artifact action to v8 #9451 [@renovate[bot]]

Updated libpng to 1.6.55 #9425 [@radarhere]

Testing

Cleanup .spider extension in the same test where it is added #9517 [@radarhere]

Run tests in parallel via tox for 3.5x speedup #9516 [@hugovk]

Enable colour in CI logs #9486 [@hugovk]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Simplify TGA test code #9477 [@radarhere]

Update tests to check for ValueError when encoding an empty image #9464 [@radarhere]

Upgrade CI from macos-15-intel to macos-26-intel #9454 [@hugovk]

Add check-case-conflict hook #9446 [@radarhere]

Specify platform when pulling docker image #9440 [@radarhere]

GHA: Cache libavif and webp builds for Ubuntu #9437 [@hugovk]

Update macOS tested Pillow versions #9431 [@radarhere]

Other changes

Check calloc return value #9527 [@radarhere]

Check all allocs in the Arrow tree #9488 [@wiredfool]

Reject non-numeric elements inside list coords #9526 [@hugovk]

Move variable declaration inside define #9525 [@radarhere]

... (truncated)

Commits

3c41c09 12.2.0 version bump
cdaa29e Check calloc return value (#9527)
585b2f5 Check calloc return value
ecf011e Check all allocs in the Arrow tree (#9488)
cf6de8c Reject non-numeric elements inside list coords (#9526)
ffdcede Update 12.2.0 release notes (#9522)
7929d77 Added security release notes (#149)
c4f7aa5 Added security release notes
22cdb5f Move variable declaration inside define (#9525)
fc15b3b Resize tall images vertically first (#9524)
Additional commits viewable in compare view

Updates requests from 2.32.5 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates tornado from 6.5.4 to 6.5.5

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2 releases/v3.2.1 releases/v3.2.0 releases/v3.1.1

... (truncated)

Commits

7d64650 Merge pull request #3586 from bdarnell/update-cibw
d05d59b build: Bump cibuildwheel to 3.4.0
c2f4673 Merge pull request #3585 from bdarnell/release-655
e5f1aa4 Release notes and version bump for v6.5.5
78a046f httputil: Add CRLF to _FORBIDDEN_HEADER_CHARS_RE
24a2d96 web: Validate characters in all cookie attributes.
119a195 httputil: Add limits on multipart form data parsing
See full diff in compare view

Updates orjson from 3.11.5 to 3.11.6

Release notes

Sourced from orjson's releases.

3.11.6

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Changelog

Sourced from orjson's changelog.

3.11.6 - 2026-01-29

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Commits

ec02024 3.11.6
d581687 build, clippy misc
4105b29 writer::num
62bb185 Fix sporadic crash on serializing object close
d860078 PyRef idiom refactors
343ae2f Deserializer, Utf8Buffer
7835f58 PyBytesRef and other input refactor
71e0516 PyStrRef
1096df4 MSRV 1.89
b718e75 Drop support for python3.9
Additional commits viewable in compare view

Updates pillow from 12.1.0 to 12.2.0

Release notes

Sourced from pillow's releases.

12.2.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

Documentation

Update 12.2.0 release notes #9522 [@hugovk]

Add loader plugins: AMOS abk, Atari Degas, 40+ more obscure formats via Netpbm #9482 [@bitplane]

Update Python versions #9515 [@radarhere]

Jeffrey A. Clark -> Jeffrey 'Alex' Clark #9513 [@aclark4life]

Add release notes for #9394, #9419 and #9456 #9467 [@radarhere]

Add Amiga Workbench .info loader to 3rd party plugins list #9459 [@bitplane]

Merge PFM documentation into PPM #9434 [@radarhere]

Update macOS tested Pillow versions #9431 [@radarhere]

Fix CVE number #9430 [@hugovk]

Dependencies

Update xz to 5.8.3 #9523 [@radarhere]

Update libjpeg-turbo to 3.1.4.1 #9507 [@radarhere]

Update libpng to 1.6.56 #9499 [@radarhere]

Update freetype to 2.14.3 #9485 [@radarhere]

Updated libavif to 1.4.1 #9479 [@radarhere]

Updated harfbuzz to 13.2.1 #9461 [@radarhere]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Update harfbuzz to 13.0.1 #9453 [@radarhere]

Update libavif to 1.4.0 #9460 [@radarhere]

Update freetype to 2.14.2 #9449 [@radarhere]

Update actions/download-artifact action to v8 #9451 [@renovate[bot]]

Updated libpng to 1.6.55 #9425 [@radarhere]

Testing

Cleanup .spider extension in the same test where it is added #9517 [@radarhere]

Run tests in parallel via tox for 3.5x speedup #9516 [@hugovk]

Enable colour in CI logs #9486 [@hugovk]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Simplify TGA test code #9477 [@radarhere]

Update tests to check for ValueError when encoding an empty image #9464 [@radarhere]

Upgrade CI from macos-15-intel to macos-26-intel #9454 [@hugovk]

Add check-case-conflict hook #9446 [@radarhere]

Specify platform when pulling docker image #9440 [@radarhere]

GHA: Cache libavif and webp builds for Ubuntu #9437 [@hugovk]

Update macOS tested Pillow versions #9431 [@radarhere]

Other changes

Check calloc return value #9527 [@radarhere]

Check all allocs in the Arrow tree #9488 [@wiredfool]

Reject non-numeric elements inside list coords #9526 [@hugovk]

Move variable declaration inside define #9525 [@radarhere]

... (truncated)

Commits

3c41c09 12.2.0 version bump
cdaa29e Check calloc return value (#9527)
585b2f5 Check calloc return value
ecf011e Check all allocs in the Arrow tree (#9488)
cf6de8c Reject non-numeric elements inside list coords (#9526)
ffdcede Update 12.2.0 release notes (#9522)
7929d77 Added security release notes (#149)
c4f7aa5 Added security release notes
22cdb5f Move variable declaration inside define (#9525)
fc15b3b Resize tall images vertically first (#9524)
Additional commits viewable in compare view

Updates requests from 2.32.5 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates ujson from 5.11.0 to 5.12.0

Release notes

Sourced from ujson's releases.

5.12.0

Added

Update license field (#693) @wagenrace

Build wheels for GraalPy (#685) @timfel

Changed

Drop support for Python 3.9 (#686) @hugovk

Fixed

Fix memory leak parsing large integers (ultrajson/ultrajson@4baeb95) @bwoodsend

Fix buffer overflow/infinite loop from indent handling (#709) @bwoodsend

Remove upper bound of setuptools for PyPy (#704) @hugovk

Commits

4baeb95 Fix memory leak parsing large integers
486bd45 Fix buffer overflow/infinite loop from indent handling
a465ed7 Add leak detection to tests
32ebf66 Remove upper bound of setuptools for PyPy (#704)
6bf41bd Remove upper bound of setuptools for PyPy
4a4fd73 chore(deps): update github-actions
d708b05 Add security policy (#699)
3d66f4d Add security policy
8f23cce [pre-commit.ci] pre-commit autoupdate (#698)
2696fc3 [pre-commit.ci] pre-commit autoupdate
Additional commits viewable in compare view

Updates orjson from 3.11.5 to 3.11.6

Release notes

Sourced from orjson's releases.

3.11.6

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Changelog

Sourced from orjson's changelog.

3.11.6 - 2026-01-29

Changed

orjson now includes code licensed under the Mozilla Public License 2.0 (MPL-2.0).

Drop support for Python 3.9.

ABI compatibility with CPython 3.15 alpha 5.

Build now depends on Rust 1.89 or later instead of 1.85.

Fixed

Fix sporadic crash serializing deeply nested list of dict.

Commits

ec02024 3.11.6
d581687 build, clippy misc
4105b29 writer::num
62bb185 Fix sporadic crash on serializing object close
d860078 PyRef idiom refactors
343ae2f Deserializer, Utf8Buffer
7835f58 PyBytesRef and other input refactor
71e0516 PyStrRef
1096df4 MSRV 1.89
b718e75 Drop support for python3.9
Additional commits viewable in compare view

Updates pillow from 12.1.0 to 12.2.0

Release notes

Sourced from pillow's releases.

12.2.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

Documentation

Update 12.2.0 release notes #9522 [@hugovk]

Add loader plugins: AMOS abk, Atari Degas, 40+ more obscure formats via Netpbm #9482 [@bitplane]

Update Python versions #9515 [@radarhere]

Jeffrey A. Clark -> Jeffrey 'Alex' Clark #9513 [@aclark4life]

Add release notes for #9394, #9419 and #9456 #9467 [@radarhere]

Add Amiga Workbench .info loader to 3rd party plugins list #9459 [@bitplane]

Merge PFM documentation into PPM #9434 [@radarhere]

Update macOS tested Pillow versions #9431 [@radarhere]

Fix CVE number #9430 [@hugovk]

Dependencies

Update xz to 5.8.3 #9523 [@radarhere]

Update libjpeg-turbo to 3.1.4.1 #9507 [@radarhere]

Update libpng to 1.6.56 #9499 [@radarhere]

Update freetype to 2.14.3 #9485 [@radarhere]

Updated libavif to 1.4.1 #9479 [@radarhere]

Updated harfbuzz to 13.2.1 #9461 [@radarhere]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Update harfbuzz to 13.0.1 #9453 [@radarhere]

Update libavif to 1.4.0 #9460 [@radarhere]

Update freetype to 2.14.2 #9449 [@radarhere]

Update actions/download-artifact action to v8 #9451 [@renovate[bot]]

Updated libpng to 1.6.55 #9425 [@radarhere]

Testing

Cleanup .spider extension in the same test where it is added #9517 [@radarhere]

Run tests in parallel via tox for 3.5x speedup #9516 [@hugovk]

Enable colour in CI logs #9486 [@hugovk]

Update Ghostscript to 10.7.0 #9469 [@radarhere]

Simplify TGA test code #9477 [@radarhere]

Update tests to check for ValueError when encoding an empty image #9464 [@radarhere]

Upgrade CI from macos-15-intel to macos-26-intel #9454 [@hugovk]

Add check-case-conflict hook #9446 [@radarhere]

Specify platform when pulling docker image #9440 [@radarhere]

GHA: Cache libavif and webp builds for Ubuntu #9437 [@hugovk]

Update macOS tested Pillow versions #9431 [@radarhere]

Other changes

Check calloc return value #9527 [@radarhere]

Check all allocs in the Arrow tree #9488 [@wiredfool]

Reject non-numeric elements inside list coords #9526 [@hugovk]

Move variable declaration inside define #9525 [@radarhere]

... (truncated)

Commits

3c41c09 12.2.0 version bump
cdaa29e Check calloc return value (#9527)
585b2f5 Check calloc return value
ecf011e Check all allocs in the Arrow tree (#9488)
cf6de8c Reject non-numeric elements inside list coords (#9526)
ffdcede Update 12.2.0 release notes (#9522)
7929d77 Added security release notes (#149)
c4f7aa5 Added security release notes
22cdb5f Move variable declaration inside define (#9525)
fc15b3b Resize tall images vertically first (#9524)
Additional commits viewable in compare view

Updates requests from 2.32.5 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

AnnouncementsDescription has been truncated

Bumps the pip group with 5 updates in the /mpcontribs-api/requirements directory: | Package | From | To | | --- | --- | --- | | [cryptography](https://github.com/pyca/cryptography) | `46.0.3` | `46.0.7` | | [orjson](https://github.com/ijl/orjson) | `3.11.5` | `3.11.6` | | [pillow](https://github.com/python-pillow/Pillow) | `12.1.0` | `12.2.0` | | [requests](https://github.com/psf/requests) | `2.32.5` | `2.33.0` | | [tornado](https://github.com/tornadoweb/tornado) | `6.5.4` | `6.5.5` | Bumps the pip group with 4 updates in the /mpcontribs-client/requirements directory: [orjson](https://github.com/ijl/orjson), [pillow](https://github.com/python-pillow/Pillow), [requests](https://github.com/psf/requests) and [ujson](https://github.com/ultrajson/ultrajson). Bumps the pip group with 6 updates in the /mpcontribs-kernel-gateway/requirements directory: | Package | From | To | | --- | --- | --- | | [orjson](https://github.com/ijl/orjson) | `3.11.5` | `3.11.6` | | [pillow](https://github.com/python-pillow/Pillow) | `12.1.0` | `12.2.0` | | [requests](https://github.com/psf/requests) | `2.32.5` | `2.33.0` | | [tornado](https://github.com/tornadoweb/tornado) | `6.5.4` | `6.5.5` | | [ujson](https://github.com/ultrajson/ultrajson) | `5.11.0` | `5.12.0` | | [pytest](https://github.com/pytest-dev/pytest) | `9.0.2` | `9.0.3` | Bumps the pip group with 4 updates in the /mpcontribs-lux directory: [orjson](https://github.com/ijl/orjson), [pillow](https://github.com/python-pillow/Pillow), [requests](https://github.com/psf/requests) and [pytest](https://github.com/pytest-dev/pytest). Bumps the pip group with 4 updates in the /mpcontribs-lux/requirements directory: [orjson](https://github.com/ijl/orjson), [pillow](https://github.com/python-pillow/Pillow), [requests](https://github.com/psf/requests) and [pytest](https://github.com/pytest-dev/pytest). Bumps the pip group with 5 updates in the /mpcontribs-portal/requirements directory: | Package | From | To | | --- | --- | --- | | [orjson](https://github.com/ijl/orjson) | `3.11.5` | `3.11.6` | | [pillow](https://github.com/python-pillow/Pillow) | `12.1.0` | `12.2.0` | | [requests](https://github.com/psf/requests) | `2.32.5` | `2.33.0` | | [tornado](https://github.com/tornadoweb/tornado) | `6.5.4` | `6.5.5` | | [ujson](https://github.com/ultrajson/ultrajson) | `5.11.0` | `5.12.0` | Bumps the pip group with 3 updates in the /mpcontribs-serverless/dependencies directory: [pillow](https://github.com/python-pillow/Pillow), [requests](https://github.com/psf/requests) and [ujson](https://github.com/ultrajson/ultrajson). Updates `cryptography` from 46.0.3 to 46.0.7 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@46.0.3...46.0.7) Updates `orjson` from 3.11.5 to 3.11.6 - [Release notes](https://github.com/ijl/orjson/releases) - [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md) - [Commits](ijl/orjson@3.11.5...3.11.6) Updates `pillow` from 12.1.0 to 12.2.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.1.0...12.2.0) Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `tornado` from 6.5.4 to 6.5.5 - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.4...v6.5.5) Updates `orjson` from 3.11.5 to 3.11.6 - [Release notes](https://github.com/ijl/orjson/releases) - [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md) - [Commits](ijl/orjson@3.11.5...3.11.6) Updates `pillow` from 12.1.0 to 12.2.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.1.0...12.2.0) Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `ujson` from 5.11.0 to 5.12.0 - [Release notes](https://github.com/ultrajson/ultrajson/releases) - [Commits](ultrajson/ultrajson@5.11.0...5.12.0) Updates `orjson` from 3.11.5 to 3.11.6 - [Release notes](https://github.com/ijl/orjson/releases) - [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md) - [Commits](ijl/orjson@3.11.5...3.11.6) Updates `pillow` from 12.1.0 to 12.2.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.1.0...12.2.0) Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `tornado` from 6.5.4 to 6.5.5 - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.4...v6.5.5) Updates `ujson` from 5.11.0 to 5.12.0 - [Release notes](https://github.com/ultrajson/ultrajson/releases) - [Commits](ultrajson/ultrajson@5.11.0...5.12.0) Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) Updates `orjson` from 3.11.5 to 3.11.6 - [Release notes](https://github.com/ijl/orjson/releases) - [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md) - [Commits](ijl/orjson@3.11.5...3.11.6) Updates `pillow` from 12.0.0 to 12.2.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.1.0...12.2.0) Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) Updates `orjson` from 3.11.5 to 3.11.6 - [Release notes](https://github.com/ijl/orjson/releases) - [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md) - [Commits](ijl/orjson@3.11.5...3.11.6) Updates `pillow` from 12.0.0 to 12.2.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.1.0...12.2.0) Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `pytest` from 9.0.2 to 9.0.3 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.2...9.0.3) Updates `orjson` from 3.11.5 to 3.11.6 - [Release notes](https://github.com/ijl/orjson/releases) - [Changelog](https://github.com/ijl/orjson/blob/master/CHANGELOG.md) - [Commits](ijl/orjson@3.11.5...3.11.6) Updates `pillow` from 12.1.0 to 12.2.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.1.0...12.2.0) Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `tornado` from 6.5.4 to 6.5.5 - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.4...v6.5.5) Updates `ujson` from 5.11.0 to 5.12.0 - [Release notes](https://github.com/ultrajson/ultrajson/releases) - [Commits](ultrajson/ultrajson@5.11.0...5.12.0) Updates `pillow` from 10.3.0 to 12.2.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.1.0...12.2.0) Updates `requests` from 2.32.3 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `ujson` from 5.5.0 to 5.12.0 - [Release notes](https://github.com/ultrajson/ultrajson/releases) - [Commits](ultrajson/ultrajson@5.11.0...5.12.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 46.0.7 dependency-type: direct:production dependency-group: pip - dependency-name: orjson dependency-version: 3.11.6 dependency-type: direct:production dependency-group: pip - dependency-name: pillow dependency-version: 12.2.0 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: tornado dependency-version: 6.5.5 dependency-type: direct:production dependency-group: pip - dependency-name: orjson dependency-version: 3.11.6 dependency-type: direct:production dependency-group: pip - dependency-name: pillow dependency-version: 12.2.0 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: ujson dependency-version: 5.12.0 dependency-type: direct:production dependency-group: pip - dependency-name: orjson dependency-version: 3.11.6 dependency-type: direct:production dependency-group: pip - dependency-name: pillow dependency-version: 12.2.0 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: tornado dependency-version: 6.5.5 dependency-type: direct:production dependency-group: pip - dependency-name: ujson dependency-version: 5.12.0 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: orjson dependency-version: 3.11.6 dependency-type: direct:production dependency-group: pip - dependency-name: pillow dependency-version: 12.2.0 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: orjson dependency-version: 3.11.6 dependency-type: direct:production dependency-group: pip - dependency-name: pillow dependency-version: 12.2.0 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: pytest dependency-version: 9.0.3 dependency-type: direct:production dependency-group: pip - dependency-name: orjson dependency-version: 3.11.6 dependency-type: direct:production dependency-group: pip - dependency-name: pillow dependency-version: 12.2.0 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: tornado dependency-version: 6.5.5 dependency-type: direct:production dependency-group: pip - dependency-name: ujson dependency-version: 5.12.0 dependency-type: direct:production dependency-group: pip - dependency-name: pillow dependency-version: 12.2.0 dependency-type: indirect dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: indirect dependency-group: pip - dependency-name: ujson dependency-version: 5.12.0 dependency-type: indirect dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-04-23T16:36:27Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Apr 20, 2026

dependabot Bot closed this Apr 23, 2026

dependabot Bot deleted the dependabot/pip/mpcontribs-api/requirements/pip-2942ceb696 branch April 23, 2026 16:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Bump the pip group across 7 directories with 7 updates#2025

Bump the pip group across 7 directories with 7 updates#2025
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/mpcontribs-api/requirements/pip-2942ceb696

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Apr 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

3.11.6

Changed

Fixed

3.11.6 - 2026-01-29

Changed

Fixed

12.2.0

Documentation

Dependencies

Testing

Other changes

v2.33.0

2.33.0 (2026-03-25)

New Contributors

2.33.0 (2026-03-25)

Release notes

3.11.6

Changed

Fixed

3.11.6 - 2026-01-29

Changed

Fixed

12.2.0

Documentation

Dependencies

Testing

Other changes

v2.33.0

2.33.0 (2026-03-25)

New Contributors

2.33.0 (2026-03-25)

5.12.0

Added

Changed

Fixed

3.11.6

Changed

Fixed

3.11.6 - 2026-01-29

Changed

Fixed

12.2.0

Documentation

Dependencies

Testing

Other changes

v2.33.0

2.33.0 (2026-03-25)

Uh oh!

dependabot Bot commented on behalf of github Apr 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Apr 20, 2026 •

edited

Loading