build(deps): bump the production-dependencies group across 1 directory with 15 updates by dependabot[bot] · Pull Request #280 · smswithoutborders/RelaySMS-Gateway-Server

dependabot · 2026-07-13T21:23:54Z

Bumps the production-dependencies group with 15 updates in the / directory:

Package	From	To
beautifulsoup4	`4.14.3`	`4.15.0`
bleach	`6.3.0`	`6.4.0`
flask-cors	`6.0.2`	`6.0.5`
grpcio	`1.80.0`	`1.82.1`
grpcio-testing	`1.80.0`	`1.82.1`
grpcio-tools	`1.80.0`	`1.82.1`
idna	`3.15`	`3.18`
peewee	`4.0.5`	`4.2.2`
phonenumbers	`9.0.30`	`9.0.34`
pika	`1.4.0`	`1.4.1`
pymysql	`1.1.3`	`1.2.0`
pyopenssl	`26.2.0`	`26.3.0`
tqdm	`4.67.3`	`4.68.4`
websockets	`16.0`	`16.1`
pytest	`9.0.3`	`9.1.1`

Updates beautifulsoup4 from 4.14.3 to 4.15.0

Updates bleach from 6.3.0 to 6.4.0

Changelog

Sourced from bleach's changelog.

Version 6.4.0 (June 5th, 2026)

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

Dropped support for pypy 3.10. (#764)

Security fixes

Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.

For example::

import bleach payload1 = 'Click' result1 = bleach.clean(payload1) print(repr(result1))

outputs::

'Click'

See the advisory for details.

Fix GHSA-gj48-438w-jh9v.

Fix issue where URI sanitization wasn't happening in formaction attributes.

See the advisory for details.

Bug fixes

Add support for pypy 3.11. (#764)

Drop version max in tinycss2 pin. (#772)

This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.

Commits

f0355a7 fix: fix last release date in CHANGES
ae4e8a2 chore: bleach 6.4.0 and final release
970df58 fix: uri-sanitization in formaction attributes
7c4867c fix: xss bypass in allowed protocol test using unicode invisible characters
913ab75 fix: reduce redundancy in workflow jobs
218c15a fix: rework pip caching
4f0b097 fix: fix tox platform restrictions
e95a79d chore: update pytest
91539d4 Bump actions/cache from 5.0.3 to 5.0.4
cd47b4c fix: handle left-angle-bracket that's not a tag (#733)
Additional commits viewable in compare view

Updates flask-cors from 6.0.2 to 6.0.5

Release notes

Sourced from flask-cors's releases.

6.0.5

Supersedes 6.0.4

What's Changed

Add MyPy Typing and modernize options parsing by @corydolphin in corydolphin/flask-cors#409 (this broke strict type checking when using Blueprints)

Restore Blueprint support in CORS type signatures (#410) by @corydolphin in corydolphin/flask-cors#411

Full Changelog: corydolphin/flask-cors@6.0.3...6.0.5

6.0.4

What's Changed

Add MyPy Typing by @corydolphin in corydolphin/flask-cors#409

Full Changelog: corydolphin/flask-cors@6.0.3...6.0.4

6.0.3

What's Changed

Derive package version from git tag via setuptools-scm by @corydolphin in corydolphin/flask-cors#405

Improve CI/CD security with least privilege and build separation by @corydolphin in corydolphin/flask-cors#406

Full Changelog: corydolphin/flask-cors@6.0.2...6.0.3

6.0.3-pre

What's Changed

Derive package version from git tag via setuptools-scm by @corydolphin in corydolphin/flask-cors#405

Improve CI/CD security with least privilege and build separation by @corydolphin in corydolphin/flask-cors#406

Full Changelog: corydolphin/flask-cors@6.0.2...6.0.3

Commits

91ebc49 Typing Hotfix: support blueprints in the type system
d601665 Add strict MyPy Typing
c8e8871 Harden release publishing workflow (#406)
e1d4034 Derive package version from git tag via setuptools-scm (#405)
See full diff in compare view

Updates grpcio from 1.80.0 to 1.82.1

Release notes

Sourced from grpcio's releases.

Release v1.82.1

This is release gRPC Core 1.82.1 (glacier).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

What's Changed

Python

[Backport][v1.82.x][Python] Update lower bound for protobuf from 6.33.5 to 7.35.1 by @asheshvidyut in grpc/grpc#42920

Full Changelog: grpc/grpc@v1.82.0...v1.82.1

Release v1.82.0

This is release gRPC Core 1.82.0 (glacier).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes. This is release 1.82.0 (glacier) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

[call creds] Add support for looking up and attaching regional access boundary policy metadata. (#41594)

Unregister CFStream callbacks during endpoint shutdown. (#42211)

Fix fd 0 incorrectly treated as invalid across POSIX socket code. (#41764)

[xDS] enable new ORCA-to-LRS propagation behavior (gRFC A85). (#42411)

[RetryFilter::LegacyCallData]: avoid tripping abseil nullopt assertion. (#42405)

[xds] Implement A114: WRR support for custom backend metrics. (#41750)

PHP

[Backport][v1.82.x][PHP] Add PIE support for PHP extention. (#42873)

Python

Added 2026-07-12: CAUTION! This gRPC Python release 1.82.0 was yanked from PyPI on 2026-07-07 due to issue grpc/grpc#42906.

[Python] [Pyright] Part 2 - Pyright for src/python/grpcio/grpc/aio/_call.py. (#42272)

... (truncated)

Commits

acccf84 [Release] Bump version to 1.82.1 (on v1.82.x branch) (#42924)
4f356a0 [Backport][v1.82.x][Python] Update lower bound for protobuf from 6.33.5 to 7....
742600a [Release] Bump version to 1.82.0 (on v1.82.x branch) (#42876)
1a59ee2 [Backport][v1.82.x][PHP] Add PIE support for PHP extention (#42873)
6c34462 [Release] Bump version to 1.82.0-pre2 (on v1.82.x branch) (#42789)
0ddb577 [Backport][v1.82.x] Memory optimization experiments (#42788)
b3580d6 [Backport][v1.82.x][PSM interop] adds python kokoro config file for regional ...
d8183a8 [Backport][v1.82.x][PSM interop] adds kokoro config file for regional TD test...
f3289ea [Release] Bump version to 1.82.0-pre1 (on v1.82.x branch) (#42639)
9a7455f [Release] Bump core version to 55.0.0 for upcoming release (#42626)
Additional commits viewable in compare view

Updates grpcio-testing from 1.80.0 to 1.82.1

Updates grpcio-tools from 1.80.0 to 1.82.1

Release notes

Sourced from grpcio-tools's releases.

Release v1.82.1

This is release gRPC Core 1.82.1 (glacier).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes.

What's Changed

Python

[Backport][v1.82.x][Python] Update lower bound for protobuf from 6.33.5 to 7.35.1 by @asheshvidyut in grpc/grpc#42920

Full Changelog: grpc/grpc@v1.82.0...v1.82.1

Release v1.82.0

This is release gRPC Core 1.82.0 (glacier).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes. This is release 1.82.0 (glacier) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

[call creds] Add support for looking up and attaching regional access boundary policy metadata. (#41594)

Unregister CFStream callbacks during endpoint shutdown. (#42211)

Fix fd 0 incorrectly treated as invalid across POSIX socket code. (#41764)

[xDS] enable new ORCA-to-LRS propagation behavior (gRFC A85). (#42411)

[RetryFilter::LegacyCallData]: avoid tripping abseil nullopt assertion. (#42405)

[xds] Implement A114: WRR support for custom backend metrics. (#41750)

PHP

[Backport][v1.82.x][PHP] Add PIE support for PHP extention. (#42873)

Python

Added 2026-07-12: CAUTION! This gRPC Python release 1.82.0 was yanked from PyPI on 2026-07-07 due to issue grpc/grpc#42906.

[Python] [Pyright] Part 2 - Pyright for src/python/grpcio/grpc/aio/_call.py. (#42272)

... (truncated)

Commits

acccf84 [Release] Bump version to 1.82.1 (on v1.82.x branch) (#42924)
4f356a0 [Backport][v1.82.x][Python] Update lower bound for protobuf from 6.33.5 to 7....
742600a [Release] Bump version to 1.82.0 (on v1.82.x branch) (#42876)
6c34462 [Release] Bump version to 1.82.0-pre2 (on v1.82.x branch) (#42789)
f3289ea [Release] Bump version to 1.82.0-pre1 (on v1.82.x branch) (#42639)
3618643 [Core] Upgrade to protobuf 35 (#42512)
05ffa92 [Core] Upgrade protobuf to 34 (#42191)
c75da17 Fix typos (#42398)
9cde6ba [Release] Bump version to 1.82.0-dev (on master branch) (#42362)
f440d36 [Python] Fix windows build escape characters (#42339)
Additional commits viewable in compare view

Updates idna from 3.15 to 3.18

Changelog

Sourced from idna's changelog.

3.18 (2026-06-02)

When decoding a domain, add a display argument that will pass through invalid labels rather than raising an exception.

3.17 (2026-05-28)

Substantial 75% reduction in memory usage through new data structures and some optimization in processing speed.

Added a general 1024-character input length cap to the public validation, conversion, and codec entry points. This is well above any legitimate domain or label and guards against pathological inputs.

3.16 (2026-05-22)

Add a command-line interface (python -m idna, also available as the idna script). Encodes or decodes one or more domains supplied as arguments or on standard input, with options to select A-label or U-label output and control error handling.

Raise the minimum supported Python version to 3.9

Various code quality improvements

Commits

f39ea90 Release 3.18
40f4e40 Pre-release 3.18rc0
1a5bf80 Merge pull request #253 from kjd/lenient-decode
5bbb26f Merge branch 'master' into lenient-decode
c532bae Rename decode() lenient= option to display= (issue #248)
0b1758b Merge pull request #252 from kjd/release-3.17
f48619c Release 3.17
7421ba8 Pre-release 3.17rc0
22ebb73 Merge pull request #251 from kjd/structure-optimizations
2a7ac0a Drop redundant parallel-arrays comment from uts46data
Additional commits viewable in compare view

Updates peewee from 4.0.5 to 4.2.2

Release notes

Sourced from peewee's releases.

4.2.2

Change Field.__hash__ again... fml. Use (model_cls, field name).

Fix Metadata.remove_ref() removing the wrong foreign-key when a model has multiple foreign-keys to the same target, as list.remove() matched the first entry via the overloaded Field.__eq__.

Fix a scalar subquery nested inside a function, Case or Cast collapsing to its alias in an UPDATE ... SET value and in ON CONFLICT DO UPDATE, as qualify_names() wrapped the value at SCOPE_COLUMN.

Fix namedtuples() on a query-builder (Table) query raising ValueError when a column name is not a valid identifier. The plain NamedTupleCursorWrapper now passes rename=True, matching the model path.

Fix outer joins in a joined model graph not hydrating a missing related object as None, so accessing the attribute raised AttributeError. The outer-join test had regressed to endswith('OUTER') (never true). It now also recognizes FULL JOIN and LEFT JOIN LATERAL.

Fix ModelSelect.select_extend() mutating its receiver's default-projection flag, so a base Model.select() reused as a subquery stopped collapsing to its primary key. It now flags the returned clone, matching select().

Fix distinct(True) and distinct(False) not clearing a prior distinct(*columns), so the query kept rendering DISTINCT ON (...) instead of a plain DISTINCT or no distinct at all.

Fix Postgres get_indexes() shredding an expression index whose key contains a comma, e.g. COALESCE(a, 0) split into two bogus columns. It joined the per-key definitions into a comma-delimited string and split on the comma. It now reads the key array directly.

Fix an empty insert (Model.insert(), insert({})) emitting DEFAULT VALUES and dropping python-side field defaults, inconsistent with a partial insert which backfills them. A model with no python defaults still uses DEFAULT VALUES.

View commits

4.2.1

Can't ship a stub that's not complete. Missed moving server_side_cursor() helper into the core psycopg helper.

View commits

4.2.0

Add django-style filter lookups: contains, startswith, endswith, between, is_null, not_in and iregexp.

Fix SQLite index value inlining to apply properly.

Fix PostgresqlDatabase(isolation_level=...) having no effect on transactions. Previously only atomic(isolation_level=...) worked.

Fix Ordering.collate() dropping the nulls= ordering.

Fix double-escaping of backticks in MySQL get_indexes().

Honor the windows= parameter of the Select constructor.

Remove vestigial Python 2 compat (reraise(), __div__, __nonzero__) and assorted dead internal code.

Remove TimestampField.local_to_utc() and TimestampField.utc_to_local().

Select.columns() no longer accepts and ignores keyword arguments.

Remove unused Metadata.get_rel_for_model().

Fix SelectBase.exists() ignoring its database argument.

Fix CursorWrapper indexing: cursor[n] raised IndexError for uncached rows and cursor[0] fetched the entire result set.

Fix .namedtuples() crashing on selected columns that are not valid Python identifiers.

Preserve materialized= when compounding CTEs via union()/union_all().

Fix ManyToManyField reads when the through-model foreign keys use the '!' backref sentinel.

Fix connection pooling with the mariadb connector - pooled connections were discarded on every checkout.

Fix sqliteq stop() to drain the write queue and return True.

Fix apsw aggregate registration binding every name to the last-registered aggregate class.

Fix two NameErrors in cysqlite_ext: blob_open() and progress().

Fix pwiz emitting an invalid attr= keyword instead of on_delete/on_update for reflected foreign keys.

Fix dataset infinite loop on self-referential foreign keys, crash on headerless CSV import, thaw() validating against export rather than import formats, and the importer mutating live model metadata.

Fix model_to_dict to honor only=/exclude= for many-to-many fields, fix resolve_multimodel_query on queries with narrowed selections.

Fix signals.Model.save(True) reporting created=False when force_insert is passed positionally.

Fix CompressedField crashing on str values.

Fix psycopg3 server-side cursors (missing withhold) and CockroachDB run_transaction retry detection under psycopg3.

Async queries are now logged to the peewee logger.

... (truncated)

Changelog

Sourced from peewee's changelog.

4.2.2

Change Field.__hash__ again... fml. Use (model_cls, field name).

Fix Metadata.remove_ref() removing the wrong foreign-key when a model has multiple foreign-keys to the same target, as list.remove() matched the first entry via the overloaded Field.__eq__.

Fix a scalar subquery nested inside a function, Case or Cast collapsing to its alias in an UPDATE ... SET value and in ON CONFLICT DO UPDATE, as qualify_names() wrapped the value at SCOPE_COLUMN.

Fix namedtuples() on a query-builder (Table) query raising ValueError when a column name is not a valid identifier. The plain NamedTupleCursorWrapper now passes rename=True, matching the model path.

Fix outer joins in a joined model graph not hydrating a missing related object as None, so accessing the attribute raised AttributeError. The outer-join test had regressed to endswith('OUTER') (never true). It now also recognizes FULL JOIN and LEFT JOIN LATERAL.

Fix ModelSelect.select_extend() mutating its receiver's default-projection flag, so a base Model.select() reused as a subquery stopped collapsing to its primary key. It now flags the returned clone, matching select().

Fix distinct(True) and distinct(False) not clearing a prior distinct(*columns), so the query kept rendering DISTINCT ON (...) instead of a plain DISTINCT or no distinct at all.

Fix Postgres get_indexes() shredding an expression index whose key contains a comma, e.g. COALESCE(a, 0) split into two bogus columns. It joined the per-key definitions into a comma-delimited string and split on the comma. It now reads the key array directly.

Fix an empty insert (Model.insert(), insert({})) emitting DEFAULT VALUES and dropping python-side field defaults, inconsistent with a partial insert which backfills them. A model with no python defaults still uses DEFAULT VALUES.

View commits

4.2.1

Can't ship a stub that's not complete. Missed moving server_side_cursor() helper into the core psycopg helper.

View commits

4.2.0

Add django-style filter lookups: contains, startswith, endswith, between, is_null, not_in and iregexp.

Fix SQLite index value inlining to apply properly.

Fix PostgresqlDatabase(isolation_level=...) having no effect on transactions. Previously only atomic(isolation_level=...) worked.

Fix Ordering.collate() dropping the nulls= ordering.

Fix double-escaping of backticks in MySQL get_indexes().

Honor the windows= parameter of the Select constructor.

... (truncated)

Commits

bf18304 4.2.2
8fe254d Ensure we apply field defaults if no data is provided.
8bb94a6 Better impl of get indexes for PG
a72a977 Fix calling simple distinct() not clearing previous setting.
fe3f01a Ensure select_extend() doesn't mutate base before cloning.
8009c89 Ensure we properly set None on absent relation in join graph
c6d8862 Fix namedtuples() on plain cursor
516e563 Update stub
7b5deb2 CL update
f62902e Ensure that subqueries inside fn/case/cast render correctly.
Additional commits viewable in compare view

Updates phonenumbers from 9.0.30 to 9.0.34

Commits

671b53f Prep for 9.0.34 release
b1f3bb2 Generated files for metadata
20eecc2 Merge metadata changes from upstream 9.0.34
fdcad9b README.md: use pyproject-build tool
0efec90 Fix lint
6400333 Prep for 9.0.33 release
4419992 Generated files for metadata
2e01d60 Merge metadata changes from upstream 9.0.33
bdee3ff Merge code changes from upstream v9.0.33
facd74c Prep for 9.0.32 release
Additional commits viewable in compare view

Updates pika from 1.4.0 to 1.4.1

Release notes

Sourced from pika's releases.

1.4.1

https://pypi.org/project/pika/1.4.1/ | GitHub milestone

Changelog

Sourced from pika's changelog.

1.4.1 (2026-05-22)

Merged pull requests:

Fix Channel.close() for channels with multiple consumers #1596 (gbenson)

Commits

5f0ba9e Merge pull request #1597 from pika/pika-1.4.1
31d80a9 pika 1.4.1
b7af301 Merge pull request #1596 from gbenson/main
See full diff in compare view

Updates pymysql from 1.1.3 to 1.2.0

Release notes

Sourced from pymysql's releases.

v1.2.0

What's Changed

Bump the all-dependencies group with 2 updates by @dependabot[bot] in PyMySQL/PyMySQL#1232

Reorganize TLS options: implement PREFERRED/REQUIRED SSL mode behavior by @Copilot in PyMySQL/PyMySQL#1234

Support MySQL 8 row/column alias syntax in executemany INSERT regex by @Copilot in PyMySQL/PyMySQL#1235

Expose SQLSTATE on MySQL protocol exceptions without changing exception formatting by @Copilot in PyMySQL/PyMySQL#1236

Reject non-finite decimal.Decimal query parameters (NaN, sNaN, ±Infinity) by @Copilot in PyMySQL/PyMySQL#1237

docs: update outdated requirements and reference links by @Copilot in PyMySQL/PyMySQL#1239

Prepare CHANGELOG for v1.2.0 release from v1.1.3 changes by @Copilot in PyMySQL/PyMySQL#1238

deprecate db and passwd again by @methane in PyMySQL/PyMySQL#1240

deprecate reconnect in Connection.ping() by @methane in PyMySQL/PyMySQL#1241

Deprecate Connection.set_charset() at runtime and document warning behavior by @Copilot in PyMySQL/PyMySQL#1243

Release v1.2.0 by @methane in PyMySQL/PyMySQL#1244

New Contributors

@Copilot made their first contribution in PyMySQL/PyMySQL#1234

Full Changelog: PyMySQL/PyMySQL@v1.1.3...v1.2.0

Changelog

Sourced from pymysql's changelog.

v1.2.0

Release date: 2026-05-19

Breaking changes

Connection.ping() change the default to not reconnect and deprecate reconnect argument. Create a new connection if you want to reconnect. (#1241)

Error classes in Cursor class are removed. (#1240)

connect() arguments db and passwd now emit DeprecationWarning. Use database and password instead. (#1240)

Reorganize TLS connection behavior.

PyMySQL uses TLS by default when server supports it. Use ssl_disabled=True to prohibit SSL. (#1213)

When ssl_verify_cert=True, ssl_verify_identity=True, an ssl.SSLContext is passed, or when any other SSL option is configured, the connection requires SSL and raises OperationalError (CR_SSL_CONNECTION_ERROR) if the server doesn't support it. (#1234)

Other changes

Support MySQL 8 row/column alias syntax in executemany INSERT regex. (#1235)

Expose SQLSTATE on MySQL protocol exceptions without changing exception formatting. (#1236)

Reject non-finite decimal.Decimal query parameters (NaN, sNaN, ±Infinity). (#1237)

Connection.set_charset(charset) now emits DeprecationWarning.

Commits

0f1c324 use ubuntu-latest for pypi publishing
53b16b2 Release v1.2.0 (#1244)
637fe7e Deprecate Connection.set_charset() at runtime and document warning behavior...
23ca04a add AGENTS.md
7349a44 deprecate reconnect in Connection.ping() (#1241)
ad5c50c update CHANGELOG
c963edb Deprecation and removals (#1240)
af6b9b4 Prepare CHANGELOG for v1.2.0 release from v1.1.3 changes (#1238)
c7bf73f docs: update outdated requirements and reference links (#1239)
c532b8d Reject non-finite decimal.Decimal query parameters (NaN, sNaN, `±Infini...
Additional commits viewable in compare view

Updates pyopenssl from 26.2.0 to 26.3.0

Changelog

Sourced from pyopenssl's changelog.

26.3.0 (2026-06-12)

Backward-incompatible changes: ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Dropped support for Python 3.8.

The minimum cryptography version is now 49.0.0.

Removed deprecated OpenSSL.crypto.X509Req, OpenSSL.crypto.dump_certificate_request, and OpenSSL.crypto.load_certificate_request. cryptography.x509 should be used instead.

OpenSSL.SSL.Connection.set_session now raises ValueError if the Session was obtained from a Connection that was using a different Context than this one. OpenSSL requires (but does not verify) that sessions only be re-used with a compatible SSL_CTX, so this contract is now enforced.

Deprecations: ^^^^^^^^^^^^^

Deprecated OpenSSL.crypto.PKey.generate_key and OpenSSL.crypto.PKey.check. The key generation and loading APIs in cryptography should be used instead.

Deprecated OpenSSL.crypto.dump_privatekey. The serialization APIs on cryptography private key types should be used instead.

Deprecated all the mutable APIs on OpenSSL.crypto.X509: set_version, set_pubkey, sign, set_serial_number, gmtime_adj_notAfter, gmtime_adj_notBefore, set_notBefore, set_notAfter, set_issuer, and set_subject. cryptography.x509.CertificateBuilder should be used instead.

Deprecated OpenSSL.SSL.Context.set_passwd_cb. Users should decrypt and load their private keys themselves, with cryptography's key loading APIs, and then call OpenSSL.SSL.Context.use_privatekey.

Deprecated OpenSSL.crypto.X509Name, as well as the remaining APIs that consume or return it: OpenSSL.crypto.X509.get_issuer, OpenSSL.crypto.X509.get_subject, and OpenSSL.SSL.Context.set_client_ca_list. The APIs in cryptography.x509 should be used instead.

Changes: ^^^^^^^^

OpenSSL.SSL.Connection.get_client_ca_list now takes an as_cryptography keyword-argument. When True is passed then cryptography.x509.Name are returned, instead of OpenSSL.crypto.X509Name. In the future, passing False (the default) will be deprecated.

Commits

a34aa1d Prepare 26.3.0 release (#1515)
24db880 Deprecate X509Name and the remaining APIs that consume or return it (#1514)
1dc08be Add as_cryptography parameter to Connection.get_client_ca_list (#1508)
55653a5 Require cryptography 49, drop Python 3.8 (#1513)
9bad760 Remove deprecated CSR functionality (#1507)
98ca874 Enforce that Session is only re-used with the Context it came from (#1512)
cbcb1da Deprecate Context.set_passwd_cb (#1511)
3b9d07d Deprecate all the mutable APIs on X509 (#1510)
e096920 Deprecate PKey.generate_key, PKey.check, and dump_privatekey (#1509)
7079d6d Fix zizmor findings in GitHub Actions workflows (#1506)
Additional commits viewable in compare view

Updates tqdm from 4.67.3 to 4.68.4

Release notes

Sourced from tqdm's releases.

tqdm v4.68.4 stable

trim to ncols even when '{bar}' not in bar_format (#1717, #1767 <- #1658)

fix tqdm.write when stdout=None (#1768)

tqdm v4.68.3 stable

utils: delay os.get_terminal_size (#1763 <- #1760)

autonotebook: support QtConsole, Spyder, JupyterLite (#1763, #1628, #1559 <- #1283, #1098, #512)

minor docs updates

fix typo (#1762)

use git-fame

misc minor framework updates

fix & update CI build

pre-commit: add docs & metadata generation

move tox.ini -> pyproject.toml, move tox-gh-actions -> tox-gh

add Python 3.14, drop 3.7 support

tqdm v4.68.2 stable

revert accidental change to ascii default (fixes #1760)

UnicodeEncodeError: 'charmap' codec can't encode characters in position 6-7: character maps to <undefined> can be fixed by installing tqdm!=4.68.0,!=4.68.1

misc docs updates

fix links

replace stray rst -> md syntax

consistent "progress bar" terminology (#1737)

tests: fix coverage (fixes #1760)

tqdm v4.68.1 stable

set name of monitor thread (#1669, #1752 <- #1435)

fix monitor thread atexit deadlock (#1751 <- #528, #627, #1435, #1564)

docs: minor copyediting

tqdm v4.68.0 stable

utils: simplify terminal size detection (#1760)

contrib

itertools (#1760)

add chain, permutations, combinations, combinations_with_replacement, batched

add product(repeat=1) keyword argument (#1428)

fix discord, telegram error handling

fix discord, slack, telegram format for total=None

soft-deprecate tqdm.utils.envwrap -> envwrap

benchmarks: fix asv

misc linting

misc framework updates

CI: migrate manual job to pre-commit.ci

bump workflow actions & pre-commit hooks

Commits

53d096e bump version, merge pull request #1768 from its-Sohan/fix/write-stdout-none
74ff992 fix: prevent tqdm.write from crashing when sys.stdout is none
3757d0d Merge pull requests #1717 and #1767 (fixes #1658)
55156ce fix: apply disp_trim to all format_meter return paths (#1658)
9aff609 bump version, merge pull request #1763 from tqdm/jupyterlite
9872f80 drop date from snap version str to fix pydantic
b829334 support QtConsole, Spyder, JupyterLite
6fa4867 delay os.get_terminal_size
748e107 lint
e6e29eb move tox.ini -> pyproject.toml
Additional commits viewable in compare view

Updates websockets from 16.0 to 16.1

Release notes

Sourced from websockets's releases.

16.1

See https://websockets.readthedocs.io/en/stable/project/changelog.html for details.

Commits

4df6f90 Release version 16.1.
7c69eca Increase timeout for building wheels.
493864e Complete and review changelog.
73ff538 Temporarily remove the trio implementation (again).
77f7d71 Shorten changelog and docstring for previous commit.
84859e1 Add text argument to broadcast() to force the frame type
1a38f5a Document research on removing a workaround.
99431ee Apply code style to docs/conf.py.
bf97b98 Fix typos in tests.
21a3418 Fix typos in comments
Additional commits viewable in compare view

Updates pytest from 9.0.3 to 9.1.1

Release notes

Sourced from pytest's releases.

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

#14220: Fixed a logic bug in pytest.RaisesGroup which would might cause it to display incorrect "It matches FooError() which was paired with BarError" messages.

#14591: Fixed a regression in pytest 9.1.0 which caused overriding a parametrized fixture with an indirect @pytest.mark.parametrize to fail with "duplicate parametrization of '<fixture name>'".

#14606: Fixed list-item typing errors from mypy in @pytest.mark.parametrize <pytest.mark.parametrize ref> argvalues parameter.

#14608: Fixed a regression in pytest 9.1.0 where conftest.py files located in <invocation dir>/test* were no longer loaded as initial conftests when invoked without arguments. This could cause certain hooks (like pytest_addoption) in these files to not fire.

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

#14533: When using --doctest-modules, autouse fixtures with module, package or session scope that are defined inline in Python test modules (not plugins or conftests) will now possibly execute twice.

If this is undesirable, move the fixture definition to a conftest.py file if possible.

Technical explanation for those interested: When using --doctest-modules, pytest possibly collects Python modules twice, once as pytest.Module and once as a DoctestModule (depending on the configuration). Due to improvements in pytest's fixture implementation, if e.g. the DoctestModule collects a fixture, it is now visible to it only, and not to the Module. This means that both need to register the fixtures independently.

Deprecations (removal in next major release)

#10819: Added a deprecation warning for class-scoped fixtures defined as instance methods (without @classmethod). Such fixtures set attributes on a different instance than the test methods use, leading to unexpected behavior. Use @classmethod decorator instead -- by yastcher.

See 10819 and 14011.

#12882: Calling request.getfixturevalue() <pytest.FixtureRequest.getfixturevalue> during teardown ...
Description has been truncated

…y with 15 updates Bumps the production-dependencies group with 15 updates in the / directory: | Package | From | To | | --- | --- | --- | | [beautifulsoup4](https://www.crummy.com/software/BeautifulSoup/bs4/) | `4.14.3` | `4.15.0` | | [bleach](https://github.com/mozilla/bleach) | `6.3.0` | `6.4.0` | | [flask-cors](https://github.com/corydolphin/flask-cors) | `6.0.2` | `6.0.5` | | [grpcio](https://github.com/grpc/grpc) | `1.80.0` | `1.82.1` | | [grpcio-testing](https://grpc.io) | `1.80.0` | `1.82.1` | | [grpcio-tools](https://github.com/grpc/grpc) | `1.80.0` | `1.82.1` | | [idna](https://github.com/kjd/idna) | `3.15` | `3.18` | | [peewee](https://github.com/coleifer/peewee) | `4.0.5` | `4.2.2` | | [phonenumbers](https://github.com/daviddrysdale/python-phonenumbers) | `9.0.30` | `9.0.34` | | [pika](https://github.com/pika/pika) | `1.4.0` | `1.4.1` | | [pymysql](https://github.com/PyMySQL/PyMySQL) | `1.1.3` | `1.2.0` | | [pyopenssl](https://github.com/pyca/pyopenssl) | `26.2.0` | `26.3.0` | | [tqdm](https://github.com/tqdm/tqdm) | `4.67.3` | `4.68.4` | | [websockets](https://github.com/python-websockets/websockets) | `16.0` | `16.1` | | [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` | Updates `beautifulsoup4` from 4.14.3 to 4.15.0 Updates `bleach` from 6.3.0 to 6.4.0 - [Changelog](https://github.com/mozilla/bleach/blob/main/CHANGES) - [Commits](mozilla/bleach@v6.3.0...v6.4.0) Updates `flask-cors` from 6.0.2 to 6.0.5 - [Release notes](https://github.com/corydolphin/flask-cors/releases) - [Changelog](https://github.com/corydolphin/flask-cors/blob/main/CHANGELOG.md) - [Commits](corydolphin/flask-cors@6.0.2...6.0.5) Updates `grpcio` from 1.80.0 to 1.82.1 - [Release notes](https://github.com/grpc/grpc/releases) - [Commits](grpc/grpc@v1.80.0...v1.82.1) Updates `grpcio-testing` from 1.80.0 to 1.82.1 Updates `grpcio-tools` from 1.80.0 to 1.82.1 - [Release notes](https://github.com/grpc/grpc/releases) - [Commits](grpc/grpc@v1.80.0...v1.82.1) Updates `idna` from 3.15 to 3.18 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.15...v3.18) Updates `peewee` from 4.0.5 to 4.2.2 - [Release notes](https://github.com/coleifer/peewee/releases) - [Changelog](https://github.com/coleifer/peewee/blob/master/CHANGELOG.md) - [Commits](coleifer/peewee@4.0.5...4.2.2) Updates `phonenumbers` from 9.0.30 to 9.0.34 - [Commits](daviddrysdale/python-phonenumbers@v9.0.30...v9.0.34) Updates `pika` from 1.4.0 to 1.4.1 - [Release notes](https://github.com/pika/pika/releases) - [Changelog](https://github.com/pika/pika/blob/1.4.1/CHANGELOG.md) - [Commits](pika/pika@1.4.0...1.4.1) Updates `pymysql` from 1.1.3 to 1.2.0 - [Release notes](https://github.com/PyMySQL/PyMySQL/releases) - [Changelog](https://github.com/PyMySQL/PyMySQL/blob/main/CHANGELOG.md) - [Commits](PyMySQL/PyMySQL@v1.1.3...v1.2.0) Updates `pyopenssl` from 26.2.0 to 26.3.0 - [Changelog](https://github.com/pyca/pyopenssl/blob/main/CHANGELOG.rst) - [Commits](pyca/pyopenssl@26.2.0...26.3.0) Updates `tqdm` from 4.67.3 to 4.68.4 - [Release notes](https://github.com/tqdm/tqdm/releases) - [Commits](tqdm/tqdm@v4.67.3...v4.68.4) Updates `websockets` from 16.0 to 16.1 - [Release notes](https://github.com/python-websockets/websockets/releases) - [Commits](python-websockets/websockets@16.0...16.1) Updates `pytest` from 9.0.3 to 9.1.1 - [Release notes](https://github.com/pytest-dev/pytest/releases) - [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst) - [Commits](pytest-dev/pytest@9.0.3...9.1.1) --- updated-dependencies: - dependency-name: beautifulsoup4 dependency-version: 4.15.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: bleach dependency-version: 6.4.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: flask-cors dependency-version: 6.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: grpcio dependency-version: 1.82.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: grpcio-testing dependency-version: 1.82.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: grpcio-tools dependency-version: 1.82.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: idna dependency-version: '3.18' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: peewee dependency-version: 4.2.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: phonenumbers dependency-version: 9.0.34 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: pika dependency-version: 1.4.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: production-dependencies - dependency-name: pymysql dependency-version: 1.2.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: pyopenssl dependency-version: 26.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: tqdm dependency-version: 4.68.4 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: websockets dependency-version: '16.1' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies - dependency-name: pytest dependency-version: 9.1.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: production-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added the dependencies Pull requests that update a dependency file label Jul 13, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

build(deps): bump the production-dependencies group across 1 directory with 15 updates#280

build(deps): bump the production-dependencies group across 1 directory with 15 updates#280
dependabot[bot] wants to merge 1 commit into
stagingfrom
dependabot/pip/staging/production-dependencies-3897e7cc09

dependabot Bot commented on behalf of github Jul 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Version 6.4.0 (June 5th, 2026)

6.0.5

What's Changed

6.0.4

What's Changed

6.0.3

What's Changed

6.0.3-pre

What's Changed

Release v1.82.1

What's Changed

Python

Release v1.82.0

Core

PHP

Python

Release v1.82.1

What's Changed

Python

Release v1.82.0

Core

PHP

Python

3.18 (2026-06-02)

3.17 (2026-05-28)

3.16 (2026-05-22)

4.2.2

4.2.1

4.2.0

4.2.2

4.2.1

4.2.0

1.4.1

1.4.1 (2026-05-22)

v1.2.0

What's Changed

New Contributors

v1.2.0

Breaking changes

Other changes

26.3.0 (2026-06-12)

tqdm v4.68.4 stable

tqdm v4.68.3 stable

tqdm v4.68.2 stable

tqdm v4.68.1 stable

tqdm v4.68.0 stable

16.1

9.1.1

pytest 9.1.1 (2026-06-19)

Bug fixes

9.1.0

pytest 9.1.0 (2026-06-13)

Removals and backward incompatible breaking changes

Deprecations (removal in next major release)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jul 13, 2026 •

edited

Loading