Skip to content

Bump the python-dependencies group across 1 directory with 36 updates - #115

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-f47596626d
Closed

Bump the python-dependencies group across 1 directory with 36 updates#115
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-f47596626d

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on asgiref, autobahn, boto3, botocore, cbor2, coverage, daphne, django-stubs-ext, django-stubs, django-unfold, django, djlint, langchain-core, langgraph, langsmith, librt, opentelemetry-api, opentelemetry-exporter-otlp-proto-http, opentelemetry-instrumentation-django, opentelemetry-sdk, pre-commit, pyasn1, pylint-django, pyopenssl, ruff, s3transfer, sentence-transformers, service-identity, standardwebhooks, svix, types-psycopg2, types-python-dateutil, types-pyyaml, types-requests, uuid-utils and xxhash to permit the latest version.
Updates asgiref from 3.11.1 to 3.12.1

Changelog

Sourced from asgiref's changelog.

3.12.1 (2026-07-14)

  • Restored the previous SyncToAsync.call internal code shape, which was relied on by some APM services. (#572)

    Note, this change was available whilst maintaining the underlying fix (from #564). It does not constitute an API stability promise. Ideally APMs are not monkey patching internal APIs, and future changes will be made here if needed.

3.12.0 (2026-07-14)

  • AsyncToSync no longer captures the running event loop on instantiation. (#562)

    This resolves a series of deadlocks that users experienced after asgiref 3.9.0, particularly with pytest-asyncio. pytest-asyncio stops the event loop between tests, and long-running unawaited futures could find themselves trying to schedule work onto a stopped loop, and so would never complete. Ideally, code should be structured to await long-running futures before returning, but this change should help users experiencing issues here.

    The loop is now resolved when the callable is invoked rather than when it is created. If async_to_sync is called from within sync_to_async, the parent event loop is still used, as before.

    The possibility of deadlock therefore remains in some nested patterns. For example, an async function may call a long-running sync_to_async function that itself uses async_to_sync; if the outer function returns before the sync future completes, the parent event loop may already be stopped, and the nested calls cannot be driven to completion.

    This is not a bug in asgiref — the same patterns deadlock in plain asyncio. As above, restructure your code to await the sync_to_async future before exiting the driving coroutine.

  • Fixed an event loop deadlock when exiting ThreadSensitiveContext while its executor thread was still blocked waiting on the event loop. (#535)

  • Dropped support for EOL Python 3.9.

  • Fixed StatelessServer.run() failing on Python 3.14, where asyncio.get_event_loop() no longer creates an event loop if none exists. It now uses asyncio.run(). (#559)

  • Fixed Local leaking data between unrelated sync threads when sys.flags.thread_inherit_context is enabled (Python 3.14+), so a newly

... (truncated)

Commits
  • ef9d4b8 Releasing 3.12.1
  • 34fba63 Restore previous SyncToAsync.call internal code shape.
  • a43900c Separate mypy from tests extra.
  • 1b7c338 Releasing 3.12.0
  • 157d9d4 Renovate precommit (#552)
  • deda0d4 Test free-threading builds and fix Local data leak for thread_inherit_context...
  • a54250a Don’t capture the event loop in AsyncToSync.__init__ (#562)
  • 836356a Use asyncio.run in StatelessServer.run (#561)
  • e04afd5 Dropped support for Python 3.9. (#543)
  • 95d2430 Fixed #535: ThreadSensitiveContext.aexit blocking the event loop. (#563)
  • Additional commits viewable in compare view

Updates autobahn from 26.6.2 to 26.7.1

Release notes

Sourced from autobahn's releases.

Release v26_7_1

Official release v26_7_1

Included Platforms

  • Linux: x86_64, ARM64 (manylinux_2_34 wheels with NVX)
  • macOS: Apple Silicon ARM64 (binary wheels with NVX)
  • Windows: x86_64 (binary wheels with NVX)

Python Versions

  • CPython: 3.11, 3.12, 3.13, 3.14
  • PyPy: 3.11

Installation

pip install autobahn[all]==v26_7_1

Or download wheels directly from this release.

Build Information

  • Release Date: 2026-07-15 18:49:18 UTC
  • Total Wheels: 28
  • Source Distributions: 3

Features

Autobahn|Python provides:

  • WebSocket client and server implementations (RFC 6455)
  • WAMP client library for both Twisted and asyncio
  • NVX acceleration for high-performance networking (binary wheels)
  • Pure Python fallback wheels for maximum compatibility

Documentation

Development Build fork-ec23ef44-oberstet_autobahn_python-fix_1930-202607151609

Development build from pull request

Build Information

... (truncated)

Changelog

Sourced from autobahn's changelog.

26.7.1

Security

  • Fix WebSocket maxMessagePayloadSize being enforced against the compressed on-the-wire frame length instead of the uncompressed reassembled message size when permessage-compress (deflate/bzip2/snappy/brotli) is negotiated. A small compressed frame could inflate far beyond the configured limit and be delivered to the application (a decompression-bomb style denial-of-service; security advisory GHSA-hxp9-w8x3-p566, same class as CVE-2016-10544). The limit is now re-checked at the inflation site against the running uncompressed message size, and the connection is failed with close code 1009 (message too big) before delivery — for both the whole-message and streaming receive APIs and every compression backend. Behaviour change: a compressed message that inflates past maxMessagePayloadSize is now rejected where it previously passed; uncompressed traffic and the per-frame maxFramePayloadSize wire guard are unaffected (#1909)
  • Fix the permessage-deflate max_message_size receive cap silently truncating an over-limit message and raising a zlib error instead of cleanly rejecting it: the bounded decompress(…, max_length) left the remaining input in unconsumed_tail undrained, so the message was corrupted rather than reported. Decompression is now bounded cumulatively across frames and raises PayloadExceededError as soon as the uncompressed size would exceed the cap (#1908)
  • Make bounded decompression backend-agnostic: decompress_message_data() gains an optional max_output_len argument (documented on the PerMessageCompress base class) and every permessage-compress backend now honours it. deflate and bzip2 stop inflating once the limit is reached (native incremental cap); snappy and brotli, whose libraries expose no output-length argument, inflate the frame (already bounded on the wire by maxFramePayloadSize) and then reject — a weaker but still clean per-frame guarantee. The WebSocket receive path passes the remaining maxMessagePayloadSize budget so a compressed frame no longer expands unbounded into memory before the size check; the previous post-inflation check (#1909) remains as a backstop. Previously only deflate had any decompressed-output cap, so a snappy/bzip2/brotli frame could inflate fully into memory first (#1910)
  • Make the asyncio RawSocket receive size limit configurable, at parity with the Twisted backend. The asyncio WampRawSocketFactory now exposes setProtocolOptions(maxMessagePayloadSize=...) / resetProtocolOptions() (bounds [512, 2**24], default 16 MB), and the configured value drives both the advertised handshake length exponent and the enforced receive cap (rounded up to the next power of two), matching the Twisted factory. Previously the asyncio receive limit was hardwired to 16 MB (a dead max_size=None branch), so an asyncio WAMP peer could not tighten its RawSocket receive limit for DoS hardening and Crossbar's RawSocket max_message_size had no effect on the asyncio path (#1911)

FlatBuffers

  • Fix check_zlmdb_flatbuffers_version_in_sync() comparing the build-time version() (which is (0, 0, 0, None, None) on installed wheels, where the vendored FlatBuffers __git_version__ is unstamped) — it now compares the reliably-stamped __version__ and returns a version string. Added regression tests (#1891)
  • Make autobahn.flatbuffers.version() reliable on installed wheels: when the build-time __git_version__ is a bare commit hash or "unknown" (shallow clone / submodule absent from the sdist), version() now falls back to parsing the static vendored __version__ and returns (major, minor, patch, None, None) instead of (0, 0, 0, None, None); rich git describe detail is still returned on genuine dev/git builds. Also hardened hatch_build.py so it never stamps a non-parseable __git_version__. Return shape is unchanged (5-tuple); no API break (#1891)

Build & CI/CD

  • Add CalVer / PEP 440 version-management just recipes (file-version, bump-dev, bump-next, prep-release) mirroring Crossbar.io, and document the versioning policy in CONTRIBUTING.md (#1894)
  • Add ruff check --select ANN,UP,TCH (annotation presence, pyupgrade modern syntax, TYPE_CHECKING imports) to the just check-typing recipe so annotation/style regressions are caught in the quality-checks CI job. The existing gaps in src/autobahn/ are ratcheted via an explicit --ignore allowlist to be removed module-by-module (#1839); all other UP/TC rules are enforced immediately, and generated code is excluded. The annotation rules are scoped to this recipe via the command line rather than the global [tool.ruff.lint] select, so the repo-wide check-format gate is unaffected (#1840)
  • Fix the aarch64 CPython 3.14 wheel shipping the free-threaded ABI (cp314t) in the GIL cp314 slot (26.6.x). Root cause: manylinux images pre-install both the GIL and free-threaded 3.14 under /opt/python and prepend them to PATH, and uv resolved cpython-3.14 to the free-threaded interpreter (first on PATH). The create recipe now drops free-threaded …t/bin dirs from PATH for GIL envs so uv selects the GIL build. As defence-in-depth, just build also asserts (via _check-venv-abi) that the interpreter's GIL/free-threaded status matches the env and aborts on mismatch, so a wrong-ABI wheel can never be published. A reserved cpy314t env spec (cpython-3.14t) is added for a future free-threaded wheel variant (#1875)
  • Bump the .cicd (wamp-cicd) submodule to include exact CPython ABI-tag matching in the shared check-release-fileset release-gate action, so a wrong-ABI wheel (e.g. cp314t in the cp314 slot) is also rejected at release-fileset validation, not only by the build-time guard above (wamp-cicd #11, completes #1875)
  • Publish musllinux_1_2 (musl libc / Alpine Linux) binary wheels with NVX acceleration for CPython 3.11–3.14 on both x86_64 and aarch64. Previously pip install autobahn on Alpine fell back to a source build that failed (the clang-built python-build-standalone interpreter's sysconfig carries a --rtlib=compiler-rt flag that Alpine's gcc rejects), so Alpine users could not install autobahn at all; the prebuilt wheels make it "just work". Built inside the official PyPA musllinux_1_2 images (gcc toolchain), tagged automatically by auditwheel, and gated by the check-release-fileset targets. PyPy-on-musl is a tracked follow-up (no official PyPA musllinux PyPy image) (#1877)
Commits

Updates boto3 from 1.43.40 to 1.43.56

Commits
  • 72a153d Merge branch 'release-1.43.56'
  • b1b9ff3 Bumping version to 1.43.56
  • c7d2f6e Add changelog entries from botocore
  • 2a09bb6 Merge branch 'release-1.43.55'
  • cad396b Merge branch 'release-1.43.55' into develop
  • ffe76ba Bumping version to 1.43.55
  • 74d20c9 Add changelog entries from botocore
  • c073381 Merge branch 'release-1.43.54'
  • 5e554e5 Merge branch 'release-1.43.54' into develop
  • 2ad1683 Bumping version to 1.43.54
  • Additional commits viewable in compare view

Updates botocore from 1.43.40 to 1.43.56

Commits

Updates cbor2 from 5.9.0 to 6.1.3

Release notes

Sourced from cbor2's releases.

6.1.3

  • Fixed the decoder registering 6-byte strings in the string reference namespace at indices 65536–4294967295 where the encoder does not, desynchronising the namespace and resolving later string references to the wrong value (#313; PR by @​sahvx655-wq)
  • Fixed the IPv4/IPv6 network decoders (tags 52 and 54) silently truncating an address byte string that is longer than the address size instead of rejecting it as malformed (#309; PR by @​sahvx655-wq)
  • Fixed quadratic decoding time for indefinite-length and large definite-length byte and text strings, caused by concatenating each chunk onto the accumulated result with + instead of building the result once (#316; PR by @​sahvx655-wq)
  • Fixed datetime_as_timestamp encoding whole-second datetimes before 1970 or after 2106 as floats instead of integers, because the timestamp was narrowed through an unsigned 32-bit integer (#317; PR by @​sahvx655-wq)
  • Fixed the encoder measuring text strings by code point count instead of UTF-8 byte length when deciding whether to add them to the string reference namespace, desynchronising it from the decoder (which counts bytes) and corrupting later string references for non-ASCII strings (#314; PR by @​sahvx655-wq)
  • Fixed the decoder rejecting scoped IPv6 addresses (tag 54) with a CBORDecodeError reading invalid types in input array; the encoder emits them as [address, null, zone id] but the decoder only handled the network and interface array forms, so a scoped ~ipaddress.IPv6Address could not be decoded back (#324; PR by @​sahvx655-wq)

6.1.2

  • Fixed incorrect tracking of string references for definite-length text strings of length greater than 65536 (#308; PR by @​sahvx655-wq)
  • Fixed cbor2.load() crash caused by incorrect handling of internal read buffer extension during stream deserialization. (#307; PR by @​noderyos)

6.1.1

  • Fixed cbor2.load() returning corrupted data for payloads exceeding 4096 bytes (#304)

6.1.0

  • Added the allow_duplicate_keys parameter to CBORDecoder, load and loads (default: True). When set to False, a CBORDecodeError is raised upon encountering a duplicate key within the same map. (#283)
  • Added support for decoding from any object supporting the buffer API (e.g. memoryview or bytearray) in addition to bytes (#297)
  • Fixed compatibility issues with 32-bit systems (#300)

6.0.1

  • Fixed an error in the mutability logic during decoding, leading to values being decoded as immutable in unexpected places (#295)

6.0.0

  • No changes since v6.0.0rc1

6.0.0rc1

  • MAJOR REWRITE: The Python and C implementations of the encoder and decoder were replaced with a single, Rust-based implementation in the interest of maintainability.

    Here are some of the highlights:

    • Improved memory safety (100% safe-mode Rust)
    • Complete elimination of reference leaks
    • Support for free-threading and subinterpreters
    • Substantially improved performance
    • Improved decoder error handling where any non-base exception gets wrapped in a CBORDecodeError
    • Iterative, rather than recursive decoding, meaning the container nesting depth is limited only by the available memory, rather than the C stack size

  • BACKWARD INCOMPATIBLE Changed the signature of the tag_hook decoder callables to accept (CBORTag, immutable as arguments instead of CBORDecoder, CBORTag)

  • BACKWARD INCOMPATIBLE Changed the signature of the object_hook decoder callables to accept (Mapping[Any, Any], bool) instead of (CBORDecoder, dict[Any, Any])

  • BACKWARD INCOMPATIBLE Removed the break_marker singleton as no longer necessary

  • BACKWARD INCOMPATIBLE Removed the CBORDecodeValueError exception, instead chaining ValueError or TypeError to a CBORDecodeError

  • BACKWARD INCOMPATIBLE Changed the decoding of semantic tag 261 to yield an IPv4Interface or IPv6Interface if the address contains host bits

  • BACKWARD INCOMPATIBLE Removed the individual decoding functions from the API as they were mistakenly called directly by users. Please open an issue if you need them back.

... (truncated)

Commits
  • 5820bd4 Bumped up the version
  • 8bb0466 Bump the github-actions group with 2 updates (#323)
  • 00e3dea Decode scoped IPv6 addresses instead of rejecting them (#324)
  • aeff00b Measure text strings by byte length in maybe_stringref (#314)
  • 1c827f1 Encode whole-second datetime timestamps as integers across full range (#317)
  • 791172c Worked around coveralls not working with Homebrew 6
  • 32f66ee [pre-commit.ci] pre-commit autoupdate (#322)
  • 1d5054e Switched to quarterly pre-commit updates
  • c348bbf [pre-commit.ci] pre-commit autoupdate (#319)
  • 6625bc1 Optimized bytestring and text string decoding (#316)
  • Additional commits viewable in compare view

Updates coverage from 7.15.0 to 7.15.2

Release notes

Sourced from coverage's releases.

7.15.2

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

➡️  PyPI page: coverage 7.15.2. :arrow_right:  To install: python3 -m pip install coverage==7.15.2

7.15.1

Version 7.15.1 — 2026-07-12

  • Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare.
  • A number of performance improvements thanks to Paul Kehrer, in pull requests 2213, 2214, 2215, 2216, 2218, 2220, and 2221.

➡️  PyPI page: coverage 7.15.1. :arrow_right:  To install: python3 -m pip install coverage==7.15.1

Changelog

Sourced from coverage's changelog.

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229_.

.. _issue 2229: coveragepy/coveragepy#2229

.. _changes_7-15-1:

Version 7.15.1 — 2026-07-12

  • Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare <pull 2224_>_.

  • A number of performance improvements thanks to Paul Kehrer, in pull requests 2213 <pull 2213_>, 2214 <pull 2214_>, 2215 <pull 2215_>, 2216 <pull 2216_>, 2218 <pull 2218_>, 2220 <pull 2220_>, and 2221 <pull 2221_>_.

.. _pull 2213: coveragepy/coveragepy#2213 .. _pull 2214: coveragepy/coveragepy#2214 .. _pull 2215: coveragepy/coveragepy#2215 .. _pull 2216: coveragepy/coveragepy#2216 .. _pull 2218: coveragepy/coveragepy#2218 .. _pull 2220: coveragepy/coveragepy#2220 .. _pull 2221: coveragepy/coveragepy#2221 .. _pull 2224: coveragepy/coveragepy#2224

.. _changes_7-15-0:

Commits
  • 50d8659 docs: sample HTML for 7.15.2
  • b5eed20 docs: prep for 7.15.2
  • 78cab6e fix: reduce memory use during reporting. #2229 (#2231)
  • b4c1fda build: bump version to 7.15.2
  • da63bed docs: sample HTML for 7.15.1
  • bc35e64 docs: prep for 7.15.1
  • 182b010 perf: resolve sysmon branch events lazily, one pair at a time (#2221)
  • ee271ee perf: compute multiline maps cheaply in the sysmon core (#2220)
  • 1441b96 chore: bump the action-dependencies group with 6 updates (#2225)
  • dd80635 fix: escape context labels in html report inline script block (#2224)
  • Additional commits viewable in compare view

Updates daphne from 4.2.2 to 4.2.3

Changelog

Sourced from daphne's changelog.

4.2.3 (2026-07-21)

  • Added --websocket-max-message-size and --websocket-max-frame-size CLI flags to the runserver management command for use in development.
Commits
  • 8a60e56 Bumped version and changelog for v4.2.3 release.
  • 389b9a7 Add ability to configure websocket message size when running as django dev se...
  • 0cd79c2 [pre-commit.ci] pre-commit autoupdate (#571)
  • See full diff in compare view

Updates django-stubs-ext from 6.0.6 to 6.0.7

Commits

Updates django-stubs from 6.0.6 to 6.0.7

Commits

Updates django-unfold from 0.99.1 to 0.102.0

Release notes

Sourced from django-unfold's releases.

0.102.0

v0.102.0 (2026-07-27)

This release is published under the MIT License.

Bug Fixes

Features

Detailed Changes: 0.101.0...0.102.0

0.101.0

v0.101.0 (2026-07-17)

This release is published under the MIT License.

Bug Fixes

... (truncated)

Changelog

Sourced from django-unfold's changelog.

v0.102.0 (2026-07-27)

Bug Fixes

Features

... (truncated)

Commits

Updates django from 6.0.6 to 6.0.7

Commits
  • e2a4246 [6.0.x] Bumped version for 6.0.7 release.
  • a5de13f [6.0.x] Fixed CVE-2026-53878 -- Prevented newlines from being accepted in Dom...
  • 38dfbd2 [6.0.x] Fixed CVE-2026-53877 -- Prevented heap buffer over-read when creating...
  • 64f9a2b [6.0.x] Fixed CVE-2026-48588 -- Prevented caching of responses that set cooki...
  • c26957a [6.0.x] Fixed flatpages synopsis in docs.
  • 0b60f44 [6.0.x] Added FILE_UPLOAD_DIRECTORY_PERMISSIONS to docs settings index.
  • d928e30 [6.0.x] Fixed #37172 -- Linked to upload handlers section in FILE_UPLOAD_* se...
  • e18935c [6.0.x] Fixed #37158 -- Reordered the contribution checklist sections.
  • 490eb9c [6.0.x] Fixed document referenced in multiple toctrees warning in docs/intern...
  • 748a9b5 [6.0.x] Fixed duplicate target name in docs/internals/howto-release-django.txt.
  • Additional commits viewable in compare view

Updates djlint from 1.40.2 to 1.43.0

Release notes

Sourced from djlint's releases.

v1.43.0

Feature

  • New --stdin-filename option gives content piped in on stdin (djlint -) its real path, so per-file-ignores matches against that name and linter messages report it. Per-file ignores were previously dead for piped input, since nothing matches the name -. Path separators are normalized as they are for files on disk.

Fix

  • An apostrophe inside a template tag nested in an attribute value (title="{% translate "You don't have permission" %}") no longer swallows the rest of the document, which made H025 report every enclosing element as an orphan. A template tag in a value is now skipped whole unless it holds a >, so a quoted literal like a="{{" is still left alone.
  • A line that starts with a closing tag and ends with a whole tag (</span>tail<textarea>y</textarea>) unindents again; everything after it stayed one level too deep.
  • A template block tag followed by a whole html tag on the same line ({% endif %} <td class="x">y</td>) indents as a block tag again, so {% endif %} unindents and {% else %} aligns with its {% if %}. A line only takes that shape once the tag fits on one line, so reformatting an already formatted file moved it.
  • A tag opened after the end of a verbatim block on the same line (</pre> <span>x) is tracked again; its closing tag took a level from a tag opened before the block, dedenting that tag's siblings.
  • A template control block written across lines is kept that way when it opens against a tag (<div>{% if x %}), and the choice is no longer applied to the wrong block. Blocks were paired with the source by position, which does not line up with the expanded html; they are now matched by tag and contents.
  • A tag whose style, srcset, data-srcset or sizes value was written over several lines is no longer spread over multiple lines and pulled back together on the next run. max_attribute_length is now measured against what is written out, not against padding that the rewrite drops.
  • A <pre> or <textarea> opened on a line that also holds a self-contained comment (<pre>x<!--c-->) is recognized as opening a verbatim block again. Its contents were re-indented instead of left alone, and the closing </pre> gained an indent level on every run - unbounded whitespace growth inside preformatted text.
  • A closing tag that starts its line no longer dedents when the tag it closes was opened after text on an earlier line (text <b>bold / </b> tail). The loss accumulated, so a document repeating that shape drifted further left with each occurrence. A closing tag with nothing to pair against still dedents as before.
  • A < inside a one-line <script>, <style>, <textarea> or <title> no longer counts as a tag when indenting. <script>var a = '<span>'</script> left a phantom open <span> on the tag stack, leaving everything after it one level too deep.
  • An inline element that opens after text on its line and closes on a later line no longer dedents everything that follows it by one level (text <b>bold / more</b> tail inside a <p><...

    Description has been truncated

@dependabot
Bump the python-dependencies group across 1 directory with 36 updates
a25aaa7 
Updates the requirements on [asgiref](https://github.com/django/asgiref), [autobahn](https://github.com/crossbario/autobahn-python), [boto3](https://github.com/boto/boto3), [botocore](https://github.com/boto/botocore), [cbor2](https://github.com/agronholm/cbor2), [coverage](https://github.com/coveragepy/coveragepy), [daphne](https://github.com/django/daphne), [django-stubs-ext](https://github.com/typeddjango/django-stubs), [django-stubs](https://github.com/typeddjango/django-stubs), [django-unfold](https://github.com/unfoldadmin/django-unfold), [django](https://github.com/django/django), [djlint](https://github.com/djlint/djLint), [langchain-core](https://github.com/langchain-ai/langchain), [langgraph](https://github.com/langchain-ai/langgraph), [langsmith](https://github.com/langchain-ai/langsmith-sdk), [librt](https://github.com/mypyc/librt), [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python), [opentelemetry-exporter-otlp-proto-http](https://github.com/open-telemetry/opentelemetry-python), [opentelemetry-instrumentation-django](https://github.com/open-telemetry/opentelemetry-python-contrib), [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python), [pre-commit](https://github.com/pre-commit/pre-commit), [pyasn1](https://github.com/pyasn1/pyasn1), [pylint-django](https://github.com/pylint-dev/pylint-django), [pyopenssl](https://github.com/pyca/pyopenssl), [ruff](https://github.com/astral-sh/ruff), [s3transfer](https://github.com/boto/s3transfer), [sentence-transformers](https://github.com/huggingface/sentence-transformers), [service-identity](https://github.com/pyca/service-identity), standardwebhooks, [svix](https://github.com/svix/svix-webhooks), [types-psycopg2](https://github.com/python/typeshed), [types-python-dateutil](https://github.com/python/typeshed), [types-pyyaml](https://github.com/python/typeshed), [types-requests](https://github.com/python/typeshed), [uuid-utils](https://github.com/aminalaee/uuid-utils) and [xxhash](https://github.com/ifduyue/python-xxhash) to permit the latest version.

Updates `asgiref` from 3.11.1 to 3.12.1
- [Changelog](https://github.com/django/asgiref/blob/main/CHANGELOG.txt)
- [Commits](django/asgiref@3.11.1...3.12.1)

Updates `autobahn` from 26.6.2 to 26.7.1
- [Release notes](https://github.com/crossbario/autobahn-python/releases)
- [Changelog](https://github.com/crossbario/autobahn-python/blob/master/docs/changelog.rst)
- [Commits](crossbario/autobahn-python@v26.6.2...v26.7.1)

Updates `boto3` from 1.43.40 to 1.43.56
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.40...1.43.56)

Updates `botocore` from 1.43.40 to 1.43.56
- [Commits](boto/botocore@1.43.40...1.43.56)

Updates `cbor2` from 5.9.0 to 6.1.3
- [Release notes](https://github.com/agronholm/cbor2/releases)
- [Commits](agronholm/cbor2@5.9.0...6.1.3)

Updates `coverage` from 7.15.0 to 7.15.2
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.0...7.15.2)

Updates `daphne` from 4.2.2 to 4.2.3
- [Changelog](https://github.com/django/daphne/blob/main/CHANGELOG.txt)
- [Commits](django/daphne@4.2.2...4.2.3)

Updates `django-stubs-ext` from 6.0.6 to 6.0.7
- [Release notes](https://github.com/typeddjango/django-stubs/releases)
- [Commits](typeddjango/django-stubs@6.0.6...6.0.7)

Updates `django-stubs` from 6.0.6 to 6.0.7
- [Release notes](https://github.com/typeddjango/django-stubs/releases)
- [Commits](typeddjango/django-stubs@6.0.6...6.0.7)

Updates `django-unfold` from 0.99.1 to 0.102.0
- [Release notes](https://github.com/unfoldadmin/django-unfold/releases)
- [Changelog](https://github.com/unfoldadmin/django-unfold/blob/main/CHANGELOG.md)
- [Commits](unfoldadmin/django-unfold@0.99.1...0.102.0)

Updates `django` from 6.0.6 to 6.0.7
- [Commits](django/django@6.0.6...6.0.7)

Updates `djlint` from 1.40.2 to 1.43.0
- [Release notes](https://github.com/djlint/djLint/releases)
- [Changelog](https://github.com/djlint/djLint/blob/master/CHANGELOG.md)
- [Commits](djlint/djLint@v1.40.2...v1.43.0)

Updates `langchain-core` from 1.4.8 to 1.5.1
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-core==1.4.8...langchain-core==1.5.1)

Updates `langgraph` from 1.2.7 to 1.2.9
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](langchain-ai/langgraph@1.2.7...1.2.9)

Updates `langsmith` from 0.9.7 to 0.10.10
- [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases)
- [Commits](langchain-ai/langsmith-sdk@v0.9.7...v0.10.10)

Updates `librt` from 0.12.0 to 0.13.0
- [Commits](mypyc/librt@v0.12.0...v0.13.0)

Updates `opentelemetry-api` to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.43.0...v1.44.0)

Updates `opentelemetry-exporter-otlp-proto-http` to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.43.0...v1.44.0)

Updates `opentelemetry-instrumentation-django` to 0.65b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-sdk` to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.43.0...v1.44.0)

Updates `pre-commit` from 4.6.0 to 4.6.1
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.0...v4.6.1)

Updates `pyasn1` from 0.6.3 to 0.6.4
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4)

Updates `pylint-django` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/pylint-dev/pylint-django/releases)
- [Changelog](https://github.com/pylint-dev/pylint-django/blob/master/CHANGELOG.rst)
- [Commits](pylint-dev/pylint-django@v2.7.0...v2.8.0)

Updates `pyopenssl` from 26.2.0 to 26.3.0
- [Changelog](https://github.com/pyca/pyopenssl/blob/main/CHANGELOG.rst)
- [Commits](pyca/pyopenssl@26.2.0...26.3.0)

Updates `ruff` from 0.15.20 to 0.16.0
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.16.0)

Updates `s3transfer` from 0.19.0 to 0.19.2
- [Changelog](https://github.com/boto/s3transfer/blob/develop/CHANGELOG.rst)
- [Commits](boto/s3transfer@0.19.0...0.19.2)

Updates `sentence-transformers` from 5.6.0 to 5.6.1
- [Release notes](https://github.com/huggingface/sentence-transformers/releases)
- [Commits](huggingface/sentence-transformers@v5.6.0...v5.6.1)

Updates `service-identity` from 24.2.0 to 26.1.0
- [Release notes](https://github.com/pyca/service-identity/releases)
- [Changelog](https://github.com/pyca/service-identity/blob/main/CHANGELOG.md)
- [Commits](pyca/service-identity@24.2.0...26.1.0)

Updates `standardwebhooks` from 1.0.1 to 1.1.0

Updates `svix` from 1.96.1 to 1.99.1
- [Release notes](https://github.com/svix/svix-webhooks/releases)
- [Changelog](https://github.com/svix/svix-webhooks/blob/main/ChangeLog.md)
- [Commits](svix/svix-webhooks@v1.96.1...v1.99.1)

Updates `types-psycopg2` from 2.9.21.20260518 to 2.9.21.20260724
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-python-dateutil` from 2.9.0.20260518 to 2.9.0.20260716
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-pyyaml` from 6.0.12.20260518 to 6.0.12.20260724
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-requests` from 2.33.0.20260518 to 2.33.0.20260712
- [Commits](https://github.com/python/typeshed/commits)

Updates `uuid-utils` from 0.16.2 to 0.17.0
- [Release notes](https://github.com/aminalaee/uuid-utils/releases)
- [Commits](aminalaee/uuid-utils@0.16.2...0.17.0)

Updates `xxhash` from 3.8.0 to 3.8.1
- [Release notes](https://github.com/ifduyue/python-xxhash/releases)
- [Changelog](https://github.com/ifduyue/python-xxhash/blob/master/CHANGELOG.rst)
- [Commits](ifduyue/python-xxhash@v3.8.0...v3.8.1)

---
updated-dependencies:
- dependency-name: asgiref
  dependency-version: 3.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: autobahn
  dependency-version: 26.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: boto3
  dependency-version: 1.43.56
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: botocore
  dependency-version: 1.43.56
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: cbor2
  dependency-version: 6.1.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-dependencies
- dependency-name: coverage
  dependency-version: 7.15.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: daphne
  dependency-version: 4.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: django-stubs-ext
  dependency-version: 6.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: django-stubs
  dependency-version: 6.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: django-unfold
  dependency-version: 0.102.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: django
  dependency-version: 6.0.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: djlint
  dependency-version: 1.43.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: langchain-core
  dependency-version: 1.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: langgraph
  dependency-version: 1.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: langsmith
  dependency-version: 0.10.10
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: librt
  dependency-version: 0.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: opentelemetry-api
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: python-dependencies
- dependency-name: opentelemetry-exporter-otlp-proto-http
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: python-dependencies
- dependency-name: opentelemetry-instrumentation-django
  dependency-version: 0.65b0
  dependency-type: direct:production
  dependency-group: python-dependencies
- dependency-name: opentelemetry-sdk
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: python-dependencies
- dependency-name: pre-commit
  dependency-version: 4.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pyasn1
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pylint-django
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: pyopenssl
  dependency-version: 26.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: ruff
  dependency-version: 0.16.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: s3transfer
  dependency-version: 0.19.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: sentence-transformers
  dependency-version: 5.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: service-identity
  dependency-version: 26.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-dependencies
- dependency-name: standardwebhooks
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: svix
  dependency-version: 1.99.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: types-psycopg2
  dependency-version: 2.9.21.20260724
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: types-python-dateutil
  dependency-version: 2.9.0.20260716
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: types-pyyaml
  dependency-version: 6.0.12.20260724
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: types-requests
  dependency-version: 2.33.0.20260712
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: uuid-utils
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: xxhash
  dependency-version: 3.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Jul 27, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 3, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 3, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/python-dependencies-f47596626d branch August 3, 2026 17:57
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants