chore(deps): Update python-dependencies#1045
Merged
EntchenEric merged 1 commit intomasterfrom Mar 31, 2026
Merged
Conversation
Contributor
Author
Branch automerge failureThis PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.
|
renovate
bot
changed the title
renovate
bot
force-pushed
the
renovate/python-dependencies
branch
3 times, most recently
from
8cb2bf0 to
45d0f92
Compare
renovate
bot
force-pushed
the
renovate/python-dependencies
branch
6 times, most recently
from
01baafa to
385d1b2
Compare
renovate
bot
force-pushed
the
renovate/python-dependencies
branch
9 times, most recently
from
7e4ab99 to
a8640cc
Compare
renovate
bot
force-pushed
the
renovate/python-dependencies
branch
2 times, most recently
from
b16f1c7 to
292445e
Compare
2000Arion
approved these changes
Dec 18, 2025
renovate
bot
force-pushed
the
renovate/python-dependencies
branch
3 times, most recently
from
119de14 to
a95737e
Compare
renovate
bot
force-pushed
the
renovate/python-dependencies
branch
8 times, most recently
from
9d2c559 to
5af9c35
Compare
renovate
bot
force-pushed
the
renovate/python-dependencies
branch
6 times, most recently
from
dc1bc39 to
6b57d00
Compare
renovate
bot
force-pushed
the
renovate/python-dependencies
branch
10 times, most recently
from
4bc01b8 to
0621fdd
Compare
renovate
bot
force-pushed
the
renovate/python-dependencies
branch
5 times, most recently
from
7355946 to
2a2a5c6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==2.8.1→==2.9.0==2.12.0→==2.12.1==3.13.3→==3.13.4==4.11.0→==4.13.0==4.14.2→==4.14.3==2026.1.4→==2026.2.25==3.4.4→==3.4.6==2.6.4→==2.7.1==4.61.0→==4.62.1==0.12.0→==0.13.0==4.25.1→==4.26.0==8.6.3→==8.8.0==1.4.9→==1.5.0==3.10.7→==3.10.8==3.1.4→==3.2.0==1.3.0→==1.4.1==6.7.0→==6.7.1==0.10.2→==0.10.4==2.3.4→==2.4.4==0.8.5→==0.8.6==4.5.0→==4.9.4==3.2.5→==3.3.2==1.2.1→==1.2.2==2.33.0→==2.33.1==0.29.0→==0.30.0==1.16.3→==1.17.1==2.8→==2.8.3==1.4.0→==1.5.1==4.67.1→==4.67.3==0.2.14→==0.6.0==2.0.1→==2.1.2==1.22.0→==1.23.0Release Notes
pygithub/pygithub (PyGithub)
v2.9.0Compare Source
Notable changes
Lazy PyGithub objects
The notion of lazy objects has been added to some PyGithub classes in version 2.6.0. This release now makes all
CompletableGithubObjects optionally lazy (if useful). See PyGithub/PyGithub#3403 for a complete list.In lazy mode, getting a PyGithub object does not send a request to the GitHub API. Only accessing methods and properties sends the necessary requests to the GitHub API:
All PyGithub classes that implement
CompletableGithubObjectsupport lazy mode (if useful). This is only useful for classes that have methods creating, changing, or getting objects.By default, PyGithub objects are not lazy.
PyGithub objects with a paginated property
The GitHub API has the "feature" of paginated properties. Some objects returned by the API have a property that allows for pagination. Fetching subsequent pages of that property means fetching the entire object (with all other properties) and the specified page of the paginated property. Iterating over the paginated property means fetching all other properties multiple times. Fortunately, the allowed size of each page (
per_pageis usually 300, in contrast to the "usual"per_pagemaximum of 100).Objects with paginated properties:
This PR makes iterating those paginated properties use the configured
per_pagesetting.It further allows to specify an individual
per_pagewhen either retrieving such objects, or fetching paginated properties.See Classes with paginated properties for details.
Drop Python 3.8 support due to End-of-Life
Python 3.8 reached its end-of-life September 6, 2024. Support has been removed with this release.
Deprecations
deleteofReactionis deprecated, useIssueComment.delete_reaction,PullRequestComment.delete_reaction,CommitComment.delete_reactionorIssue.delete_reactioninstead.Issue.assigneeand parameterIssue.edit(assignee=…)are deprecated,use
Issue.assigneesandIssue.edit(assignees=…)instead.Organization.edit_hookis deprecated, useOrganization.get_hook(id).edit(…)instead.If you need to avoid
Organization.get_hook(id)to fetch theHookobject from Github API,use a lazy Github instance:
Team.add_to_membersandTeam.remove_from_membersare deprecated,use
Team.add_membershiporTeam.remove_membershipinstead.New Features
Improvements
api.by @EnricoMi in PyGithub/PyGithub#3419throwoption toWorkflow.create_dispatchto raise exceptions by @dblanchette in PyGithub/PyGithub#2966GETurl or_links.selfas object url by @EnricoMi in PyGithub/PyGithub#3421typeparameter to get_issues by @nrysk in PyGithub/PyGithub#3381Bug Fixes
PaginatedList.totalCountreturning 0 with GitHub deprecation notices by @odedperezcodes in PyGithub/PyGithub#3382Maintenance
Reaction.deleteby @iarspider in PyGithub/PyGithub#3435Issue.assigneeby @EnricoMi in PyGithub/PyGithub#3366Orginization.edit_hookby @EnricoMi in PyGithub/PyGithub#3404Team.add_to_membersandTeam.remove_from_membersby @EnricoMi in PyGithub/PyGithub#3368New Contributors
Full Changelog: PyGithub/PyGithub@v2.8.0...v2.9.0
jpadilla/pyjwt (PyJWT)
v2.12.1Compare Source
Changed
Remove algorithm requirement from JWT API, instead relying on JWS API for enforcement, by @luhn in
#​975 <https://github.com/jpadilla/pyjwt/pull/975>__Use
Sequencefor parameter types rather thanListwhere applicable by @imnotjames in#​970 <https://github.com/jpadilla/pyjwt/pull/970>__Add JWK support to JWT encode by @luhn in
#​979 <https://github.com/jpadilla/pyjwt/pull/979>__Encoding and decoding payloads using the
nonealgorithm by @jpadilla in#c2629f6 <https://github.com/jpadilla/pyjwt/commit/c2629f66c593459e02616048443231ccbe18be16>__Before:
.. code-block:: pycon
After:
.. code-block:: pycon
Added validation for 'sub' (subject) and 'jti' (JWT ID) claims in tokens by @Divan009 in
#​1005 <https://github.com/jpadilla/pyjwt/pull/1005>__Refactor project configuration files from
setup.cfgtopyproject.tomlby @cleder in#​995 <https://github.com/jpadilla/pyjwt/pull/995>__Ruff linter and formatter changes by @gagandeepp in
#​1001 <https://github.com/jpadilla/pyjwt/pull/1001>__Drop support for Python 3.8 (EOL) by @kkirsche in
#​1007 <https://github.com/jpadilla/pyjwt/pull/1007>__Fixed
#​972 <https://github.com/jpadilla/pyjwt/pull/972>__#​973 <https://github.com/jpadilla/pyjwt/pull/973>__#​992 <https://github.com/jpadilla/pyjwt/pull/992>__#​980 <https://github.com/jpadilla/pyjwt/pull/980>__#​993 <https://github.com/jpadilla/pyjwt/pull/993>__pyproject.tomlinpre-commitby @cleder in#​1002 <https://github.com/jpadilla/pyjwt/pull/1002>__#​1003 <https://github.com/jpadilla/pyjwt/pull/1003>__aio-libs/aiohttp (aiohttp)
v3.13.4Compare Source
===================
Features
Added
max_headersparameter to limit the number of headers that should be read from a response -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11955.Added a
dns_cache_max_sizeparameter toTCPConnectorto limit the size of the cache -- by :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12106.Bug fixes
Fixed server hanging indefinitely when chunked transfer encoding chunk-size
does not match actual data length. The server now raises
TransferEncodingErrorinstead of waiting forever for data that willnever arrive -- by :user:
Fridayai700.Related issues and pull requests on GitHub:
:issue:
10596.Fixed access log timestamps ignoring daylight saving time (DST) changes. The
previous implementation used :py:data:
time.timezonewhich is a constant anddoes not reflect DST transitions -- by :user:
nightcityblade.Related issues and pull requests on GitHub:
:issue:
11283.Fixed
RuntimeError: An event loop is runningerror when usingaiohttp.GunicornWebWorkeror
aiohttp.GunicornUVLoopWebWorkeron Python >=3.14.-- by :user:
Tasssadar.Related issues and pull requests on GitHub:
:issue:
11701.Fixed :exc:
ValueErrorwhen creating a TLS connection withClientTimeout(total=0)by converting0toNonebefore passing tossl_handshake_timeoutin :py:meth:asyncio.loop.start_tls-- by :user:veeceey.Related issues and pull requests on GitHub:
:issue:
11859.Restored :py:meth:
~aiohttp.BodyPartReader.decodeas a synchronous methodfor backward compatibility. The method was inadvertently changed to async
in 3.13.3 as part of the decompression bomb security fix. A new
:py:meth:
~aiohttp.BodyPartReader.decode_itermethod is now availablefor non-blocking decompression of large payloads using an async generator.
Internal aiohttp code uses the async variant to maintain security protections.
Changed multipart processing chunk sizes from 64 KiB to 256KiB, to better
match aiohttp internals
-- by :user:
bdracoand :user:Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
11898.Fixed false-positive :py:class:
DeprecationWarningfor passingenable_cleanup_closed=Trueto :py:class:~aiohttp.TCPConnectorspecifically on Python 3.12.7.-- by :user:
Robsdedude.Related issues and pull requests on GitHub:
:issue:
11972.Fixed _sendfile_fallback over-reading beyond requested count -- by :user:
bysiber.Related issues and pull requests on GitHub:
:issue:
12096.Fixed digest auth dropping challenge fields with empty string values -- by :user:
bysiber.Related issues and pull requests on GitHub:
:issue:
12097.ClientConnectorCertificateError.os_errorno longer raises :exc:AttributeError-- by :user:
themylogin.Related issues and pull requests on GitHub:
:issue:
12136.Adjusted pure-Python request header value validation to align with RFC 9110 control-character handling, while preserving lax response parser behavior, and added regression tests for Host/header control-character cases.
-- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12231.Rejected duplicate singleton headers (
Host,Content-Type,Content-Length, etc.) in the C extension HTTP parser to matchthe pure Python parser behaviour, preventing potential host-based
access control bypasses via parser differentials
-- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12240.Aligned the pure-Python HTTP request parser with the C parser by splitting
comma-separated and repeated
Connectionheader values for keep-alive,close, and upgrade handling -- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12249.Improved documentation
Documented :exc:
asyncio.TimeoutErrorforWebSocketResponse.receive()and related methods -- by :user:
veeceey.Related issues and pull requests on GitHub:
:issue:
12042.Packaging updates and notes for downstreams
Upgraded llhttp to 3.9.1 -- by :user:
Dreamsorcerer.Related issues and pull requests on GitHub:
:issue:
12069.Contributor-facing changes
The benchmark CI job now runs only in the upstream repository -- by :user:
Cycloctane.It used to always fail in forks, which this change fixed.
Related issues and pull requests on GitHub:
:issue:
11737.Fixed flaky performance tests by using appropriate fixed thresholds that account for CI variability -- by :user:
rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
11992.Miscellaneous internal changes
Fixed
test_invalid_idnato work withidna3.11 by using an invalid character (\u0080) that is rejected byyarlduring URL construction -- by :user:rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12027.Fixed race condition in
test_data_fileon Python 3.14 free-threaded builds -- by :user:rodrigobnogueira.Related issues and pull requests on GitHub:
:issue:
12170.agronholm/anyio (anyio)
v4.13.0Compare Source
ttlparameter to theanyio.functools.lru_cachewrapper (#1073; PR by @Graeme22)IO[bytes]instead of justBinaryIO(#1078)anyio.Pathnot being compatible with Python 3.15 due to the removal ofpathlib.Path.is_reserved()and the addition ofpathlib.Path.__vfspath__()(#1061; PR by @veeceey)BrokenResourceErrorraised by the asyncioSocketStreamnot having the original exception as its cause (#1055; PR by @veeceey)TypeErrorraised when using "func" as a parameter name inpytest.mark.parametrizewhen using the pytest plugin (#1068; PR by @JohnnyDeuss)anyiomarker added programmatically viapytest_collection_modifyitems(#422; PR by @chbndrhnns)CancelScopeon asyncio when they are contained in an exception group alongside non-cancellation exceptions (#1091; PR by @gschaffner)Condition.wait()not passing on a notification when the task is cancelled but already received a notificationv4.12.1Compare Source
NoCurrentAsyncBackendexception (since v4.12.0) to instead raise the publicNoEventLoopErrorexception (#1048)anyio.functools.lru_cachenot working with instance methods (#1042)v4.12.0Compare Source
functoolsmodule (#1001)uvloop=Trueon Windows via the winloop implementation (#960; PR by @Vizonex)anyio.lowlevel.RunVar(#1003)__all__declarations to public submodules (anyio.lowleveletc.) (#1009)CapacityLimiterto zero (#1019; requires Python 3.10 or later when using Trio)case_sensitiveandrecurse_symlinksalong with support for path-like objects toanyio.Path.glob()andanyio.Path.rglob()(#1033; PR by @northisup)sniffioas a direct dependency and added theget_available_backends()function (#1021)Process.stdin.send()not raisingClosedResourceErrorandBrokenResourceErroron asyncio. Previously, a non-AnyIO exception was raised in such cases (#671; PR by @gschaffner)Process.stdin.send()not checkpointing before writing data on asyncio (#1002; PR by @gschaffner)FuturefromBlockingPortal.start_task_soon()would sometimes not cancel the async function (#1011; PR by @gschaffner)RuntimeError: Set changed size during iterationwhile shutting down the process pool when using the asyncio backend (#985)certifi/python-certifi (certifi)
v2026.2.25Compare Source
jawah/charset_normalizer (charset-normalizer)
v3.4.6Compare Source
Changed
charset_normalizer.mdfor higher performance. Removedeligible(..)andfeed(...)in favor of
feed_info(...).UNICODE_RANGES_COMBINEDusing Unicode blocks v17.Fixed
--normalizewriting to wrong path when passing multiple files in. (#702)Misc
v3.4.5Compare Source
Changed
setuptoolsconstraint tosetuptools>=68,<=82.Fixed
Misc
query_yes_nofunction (inside CLI) to avoid using ambiguous licensed code.cd.pysubmodule into mypyc optional compilation to reduce further the performance impact.fonttools/fonttools (fonttools)
v4.62.1Compare Source
v4.62.0Compare Source
fonttools diffcommand for comparing font files, imported from thefdiffproject and heavily reworked (#1190, #4007, #4009, #4011, #4013, #4019).VariableScalarinterpolation bug with non-linear avar mappings. Also decoupleVariableScalarfrom compiled fonts, allowing it to work with designspace data before compilation (#3938, #4054).VariableScalaraxis ordering and iterative delta rounding to match fontc behavior (#4053).ConditionsetStatementto fix glyphsLib round-tripping (fontra/fontra-glyphs#130, #4057).0xFFFFinstead of0for missing nameIDs incvfeature params (#4010, #4012).CmapSubtable.__lt__()TypeErroron Python 3 when subtables share the same encoding record, and add compile-time validation for unique encoding records (#4035, #4055).glyphObject=None(#4030, #4031).SegmentToPointPenedge case: only remove a duplicate final point onclosePath()if it is an on-curve point (#4014, #4015).eval()withsafeEval()inparseBlendList()to prevent arbitrary code execution from crafted TTX files (#4039, #4040).META,SING,GMAP,GPKG) (#4044).getSubModelnot forwardingextrapolate/axisRanges; check location uniqueness after stripping zeros (#4047).--variable-fontsfilter inbuild_many; remove dead code and fix comments (#4048).unbuildreturn types consistent; validatemapCLI coordinates (#4051).ColorLibErrorwhen base glyphs are missing from glyphMap, instead of a confusingKeyError(#4041).fvartable dependency (#4017).nametable dependency (#4018).saveXMLregression with empty table lists, clarify docstring (#4025, #4026, #4056).libmfor Cython extensions using math functions (#4028, #4029).DSIG,DefaultTable,ttProgram(#4033).v4.61.1Compare Source
avar2full instancing (#4002).setupOS2()default params globally polluted (#3996, #3997).pydantic/jiter (jiter)
v0.13.0Compare Source
What's Changed
Full Changelog: pydantic/jiter@v0.12.0...v0.13.0
python-jsonschema/jsonschema (jsonschema)
v4.26.0Compare Source
=======
urllib.request(#1416).jupyter/jupyter_client (jupyter_client)
v8.8.0Compare Source
(Full Changelog)
Enhancements made
Maintenance and upkeep improvements
Documentation improvements
Contributors to this release
The following people contributed discussions, new ideas, code and documentation contributions, and review.
See our definition of contributors.
(GitHub contributors page for this release)
@Carreau (activity) | @ccordoba12 (activity) | @fleming79
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.