chore(deps): bump the uv group across 1 directory with 5 updates

[dependabot]

Bumps the uv group with 5 updates in the / directory:

Package	From	To
joserfc	1.6.4	1.6.8
cryptography	46.0.7	48.0.1
mistune	3.2.1	3.3.0
python-engineio	4.13.1	4.13.2
soupsieve	2.8.3	2.8.4

Updates joserfc from 1.6.4 to 1.6.8

Release notes

Sourced from joserfc's releases.

1.6.8

• Reject empty OctKey.

Full Changelog: authlib/joserfc@1.6.7...1.6.8

1.6.7

   🐞 Bug Fixes

• jws: Validate payload size for b64=false  -  by @​lepture (4d4ea)
• typing: Accept any Collection for algorithms, not just list  -  by @​jonathangreen (102a7)
• typing: Use cast for type hints  -  by @​lepture (75d9f)

    View changes on GitHub

1.6.5

No significant changes

    View changes on GitHub

Changelog

Sourced from joserfc's changelog.

1.6.8

Released on May 27, 2026

• Reject empty OctKey.

1.6.7

Released on May 23, 2026

• Update for type hints.

1.6.6

Released on May 18, 2026

• JWS: validate payload size when b64=false.

1.6.5

Released on May 3, 2026

• JWS: increase registry's payload max size.

Commits

• ea1d9e3 chore: release 1.6.8
• 86d0091 Reject empty oct key material and empty HMAC keys at sign/verify entry
• 1e5b94d chore: release 1.6.7
• 75d9f95 fix(typing): use cast for type hints
• 6d24037 Merge pull request #98 from jonathangreen/algorithms-accept-collection
• 102a7a7 fix(typing): accept any Collection for algorithms, not just list
• 8b869e8 chore: release 1.6.6
• 00d599b chore: update actions
• 9186561 Merge pull request #97 from authlib/fix-b64
• 4d4ea2e fix(jws): validate payload size for b64=false
• Additional commits viewable in compare view

Updates cryptography from 46.0.7 to 48.0.1

Changelog

Sourced from cryptography's changelog.

48.0.1 - 2026-06-09

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.
.. _v48-0-0:
48.0.0 - 2026-05-04

• BACKWARDS INCOMPATIBLE: Support for Python 3.8 has been removed. cryptography now requires Python 3.9 or later.

• BACKWARDS INCOMPATIBLE: Loading an X.509 CRL whose inner TBSCertList.signature algorithm does not match the outer signatureAlgorithm now raises ValueError. Previously, such CRLs were parsed successfully and only rejected during signature validation.

• Added support for :doc:/hazmat/primitives/asymmetric/mlkem and :doc:/hazmat/primitives/asymmetric/mldsa when using OpenSSL 3.5.0 or later, in addition to the existing AWS-LC and BoringSSL support. This means post-quantum algorithms are now available to users of our wheels.

  • Note: Going forward, we do not guarantee that all functionality in cryptography will be available when building against OpenSSL. See :doc:/statements/state-of-openssl for more information.

.. _v47-0-0:

47.0.0 - 2026-04-24

* Support for Python 3.8 is deprecated and will be removed in the next
  ``cryptography`` release.
* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves
  (``SECT*`` classes) has been removed. These curves are rarely used and
  have additional security considerations that make them undesirable.
* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.
  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC
  continue to be supported.
* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 4.1.
* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or
  keys with unsupported explicit curve encodings now raises
  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of
  ``ValueError``. This change affects
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,
  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,
  and :meth:`~cryptography.x509.Certificate.public_key` when called on
  certificates with unsupported public key algorithms.
</tr></table> 

... (truncated)

Commits

• de987ce 48.0.1 version bump and changelog (#14996)
• 8e03e30 bump for 48.0.0 release (#14796)
• 295e0d2 Add AGENTS.md with CLAUDE.md symlink (#14794)
• 104a2de Bump BoringSSL, OpenSSL, AWS-LC in CI (#14793)
• 67ec1e5 call check_length early on AesSiv::encrypt (#14792)
• b2da57a changelog for mldsa/mlkem for openssl (#14791)
• 3cf44ad ML-KEM OpenSSL support (#14781)
• 2e31639 ML-DSA OpenSSL support (#14773)
• 5affe5a fix rust nightly clippy (#14790)
• 2e73ca4 bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (#1...
• Additional commits viewable in compare view

Updates mistune from 3.2.1 to 3.3.0

Release notes

Sourced from mistune's releases.

v3.3.0

   🐞 Bug Fixes

• Resolve O(n^2) DoS in parse_link_text (CWE-400)  -  by bhanugoudm041 (b6b49)
• Resolve O(n^2) DoS in parse_link_text (CWE-400)-Type handling/testing done  -  by bhanugoudm041 (b3af8)
• block: Avoid quadratic ref link scans  -  by @​lepture (2b04d)
• cli: Add entrypoint and utf-8 output  -  by @​lepture (2f244)
• directives: Constrain include targets  -  by @​lepture (1bef3)
• formatting: Avoid quadratic marker scans  -  by @​lepture (96d0f)
• image: Validate figure width option  -  by @​lepture (e3e51)
• inline: Avoid bracket parsing DoS  -  by @​lepture (25f25)
• math: Reject currency patterns and cross-line matches in inline math  -  by @​geopanther (566e1)
• math: Support display and backtick math  -  by @​lepture (1141e)
• renderer: Render plugin list and table nodes  -  by @​lepture (614b0)
• renderer: Block encoded unsafe URL schemes  -  by @​lepture (c7101)
• toc: Avoid generated id collisions  -  by @​lepture (c4093)

   🏎 Performance

• Improve performance  -  by @​lepture (bf95c)

    View changes on GitHub

Changelog

Sourced from mistune's changelog.

Version 3.3.0

Released on Jun 21, 2026

• Improve CommonMark compatibility and parser performance.
• Add command line entrypoint with UTF-8 output.
• Support display and backtick math.
• Render plugin list and table nodes in Markdown renderer.
• Escape leading block markers in Markdown renderer.
• Fix RST renderer for block quotes nested in lists.
• Avoid generated heading ID collisions in TOC.
• Harden URL, image, figure, and include directive handling.
• Fix quadratic scans in inline links, reference links, and formatting markers.
• Fix math escaping, currency pattern matching, and cross-line matching.

Commits

• 15c3b79 chore: release 3.3.0
• bdc01ad tests: increase run time on pypy
• 7cf1814 tests: increase run time for pypy
• 6dfdc3d tests: add more tests
• 17c50f6 chore: fix mypy issues
• 63abe4b chore: use ruff check and format
• e6c1b18 chore: resolve mypy issues
• dcf8902 test(math): cover escaped math output
• c4093c4 fix(toc): avoid generated id collisions
• e3e51de fix(image): validate figure width option
• Additional commits viewable in compare view

Updates python-engineio from 4.13.1 to 4.13.2

Release notes

Sourced from python-engineio's releases.

Release 4.13.2

See CHANGES.md for release notes.

Changelog

Sourced from python-engineio's changelog.

python-engineio change log

Release 4.13.3 - 2026-06-20

• Make sure client disconnects when write loop exits #455 (commit)
• Address flaky unit test #444 (commit)
• Stop using codecov service, since it has been failing for a long time (commit)

Release 4.13.2 - 2026-05-21

• Prevent unnecessary resource allocations #441 (commit)
• Add zizmor to CI builds #437 (commit)

Release 4.13.1 - 2026-02-06

• Document that a process can have only one custom JSON module (commit)
• Switch to Furo documentation template (commit)

Release 4.13.0 - 2025-12-24

• Apply escaping rules when parsing cookie values (commit)
• Several minor improvements to the aiohttp integration #419 (commit) (thanks PaulWasTaken!)
• Clarify logging behavior in documentation #421 (commit) (thanks ZipFile!)
• Address deprecation warnings #422 (commit)
• Add 3.14 and pypy-3.11 CI builds (commit)
• Drop Python 3.8 and 3.9 from CI builds (commit)

Release 4.12.3 - 2025-09-28

• Reset client queue upon disconnection #414 (commit)
• Support ['*'] in addition to '*' in the cors_allowed_origins option #410 (commit) (thanks Wu Clan!)

Release 4.12.2 - 2025-06-04

• Support new monkey-patched gevent Queue class in the client #403 (commit)
• Better support of the ASGI spec when interpreting WebSocket events #405 (commit) (thanks Eric Zhang!)

Release 4.12.1 - 2025-05-11

• Accept empty binary values in the async server #404 (commit)
• Add SPDX license identifier #401 (commit) (thanks Marc Mueller!)

Release 4.12.0 - 2025-04-12

• Optimize packet parsing to avoid unnecessary calls to JSON parser #399 (commit)
• Pass environ as a second argument to callable option cors_allowed_origins #398 (commit) (thanks wft-swas!)

Release 4.11.2 - 2024-12-29

• Fix incorrect disconnection reason reported when browser page is closed (commit)

... (truncated)

Commits

• b698159 Release 4.13.2
• ceeeb5e prevent unnecessary resource allocation (#441)
• eb771e0 tox configuration
• 74c3a0b Bump qs and body-parser in /examples/client/javascript (#440) #nolog
• e2278e1 Bump qs and body-parser in /examples/server/javascript (#439) #nolog
• a35f46d remove unnecessary build dependency
• 8963cca Bump ujson from 5.4.0 to 5.12.1 in /examples/server/sanic (#438) #nolog
• 68eb36a add zizmor to ci (#437)
• 9cf6b72 Bump aiohttp from 3.13.3 to 3.13.4 in /examples/server/aiohttp (#435) #nolog
• 1d08ca3 Bump path-to-regexp from 0.1.12 to 0.1.13 in /examples/client/javascript (#43...
• Additional commits viewable in compare view

Updates soupsieve from 2.8.3 to 2.8.4

Release notes

Sourced from soupsieve's releases.

2.8.4

• FIX: Fix another inefficient attribute pattern (@​mauriceng98).
• FIX: Limit total number of selectors processed in a pattern to prevent massive selector requests (@​mauriceng98).

Commits

• 28108ab Limit excessive selectors
• ef18872 Fix test for Windows
• eb43976 Merge commit from fork
• 3a661b2 Fix typo in pseudo-classes.md (#294)
• 0cb533d Update hatchling version requirement in pyproject.toml (#290)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.