Skip to content

Bump the python-dependencies group across 1 directory with 45 updates - #124

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-9e9ad7338c
Closed

Bump the python-dependencies group across 1 directory with 45 updates#124
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-dependencies-9e9ad7338c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Updates the requirements on asgiref, autobahn, boto3, botocore, cbor2, coverage, daphne, django-allauth, django-anymail, django-stubs-ext, django-stubs, django-unfold, django, djlint, feedparser, langchain-core, langgraph, langsmith, librt, markdown, mastodon-py, opentelemetry-api, opentelemetry-exporter-otlp-proto-http, opentelemetry-instrumentation-django, opentelemetry-sdk, pre-commit, pyasn1, pylint-django, pyopenssl, pytest-django, qdrant-client, ruff, s3transfer, sentence-transformers, service-identity, standardwebhooks, svix, types-deprecated, types-psycopg2, types-python-dateutil, types-pyyaml, types-requests, uuid-utils, wrapt and xxhash to permit the latest version.
Updates asgiref from 3.11.1 to 3.12.1

Changelog

Sourced from asgiref's changelog.

3.12.1 (2026-07-14)

  • Restored the previous SyncToAsync.call internal code shape, which was relied on by some APM services. (#572)

    Note, this change was available whilst maintaining the underlying fix (from #564). It does not constitute an API stability promise. Ideally APMs are not monkey patching internal APIs, and future changes will be made here if needed.

3.12.0 (2026-07-14)

  • AsyncToSync no longer captures the running event loop on instantiation. (#562)

    This resolves a series of deadlocks that users experienced after asgiref 3.9.0, particularly with pytest-asyncio. pytest-asyncio stops the event loop between tests, and long-running unawaited futures could find themselves trying to schedule work onto a stopped loop, and so would never complete. Ideally, code should be structured to await long-running futures before returning, but this change should help users experiencing issues here.

    The loop is now resolved when the callable is invoked rather than when it is created. If async_to_sync is called from within sync_to_async, the parent event loop is still used, as before.

    The possibility of deadlock therefore remains in some nested patterns. For example, an async function may call a long-running sync_to_async function that itself uses async_to_sync; if the outer function returns before the sync future completes, the parent event loop may already be stopped, and the nested calls cannot be driven to completion.

    This is not a bug in asgiref — the same patterns deadlock in plain asyncio. As above, restructure your code to await the sync_to_async future before exiting the driving coroutine.

  • Fixed an event loop deadlock when exiting ThreadSensitiveContext while its executor thread was still blocked waiting on the event loop. (#535)

  • Dropped support for EOL Python 3.9.

  • Fixed StatelessServer.run() failing on Python 3.14, where asyncio.get_event_loop() no longer creates an event loop if none exists. It now uses asyncio.run(). (#559)

  • Fixed Local leaking data between unrelated sync threads when sys.flags.thread_inherit_context is enabled (Python 3.14+), so a newly

... (truncated)

Commits
  • ef9d4b8 Releasing 3.12.1
  • 34fba63 Restore previous SyncToAsync.call internal code shape.
  • a43900c Separate mypy from tests extra.
  • 1b7c338 Releasing 3.12.0
  • 157d9d4 Renovate precommit (#552)
  • deda0d4 Test free-threading builds and fix Local data leak for thread_inherit_context...
  • a54250a Don’t capture the event loop in AsyncToSync.__init__ (#562)
  • 836356a Use asyncio.run in StatelessServer.run (#561)
  • e04afd5 Dropped support for Python 3.9. (#543)
  • 95d2430 Fixed #535: ThreadSensitiveContext.aexit blocking the event loop. (#563)
  • Additional commits viewable in compare view

Updates autobahn from 26.6.2 to 26.7.1

Release notes

Sourced from autobahn's releases.

Release v26_7_1

Official release v26_7_1

Included Platforms

  • Linux: x86_64, ARM64 (manylinux_2_34 wheels with NVX)
  • macOS: Apple Silicon ARM64 (binary wheels with NVX)
  • Windows: x86_64 (binary wheels with NVX)

Python Versions

  • CPython: 3.11, 3.12, 3.13, 3.14
  • PyPy: 3.11

Installation

pip install autobahn[all]==v26_7_1

Or download wheels directly from this release.

Build Information

  • Release Date: 2026-07-15 18:49:18 UTC
  • Total Wheels: 28
  • Source Distributions: 3

Features

Autobahn|Python provides:

  • WebSocket client and server implementations (RFC 6455)
  • WAMP client library for both Twisted and asyncio
  • NVX acceleration for high-performance networking (binary wheels)
  • Pure Python fallback wheels for maximum compatibility

Documentation

Development Build fork-ec23ef44-oberstet_autobahn_python-fix_1930-202607151609

Development build from pull request

Build Information

... (truncated)

Changelog

Sourced from autobahn's changelog.

26.7.1

Security

  • Fix WebSocket maxMessagePayloadSize being enforced against the compressed on-the-wire frame length instead of the uncompressed reassembled message size when permessage-compress (deflate/bzip2/snappy/brotli) is negotiated. A small compressed frame could inflate far beyond the configured limit and be delivered to the application (a decompression-bomb style denial-of-service; security advisory GHSA-hxp9-w8x3-p566, same class as CVE-2016-10544). The limit is now re-checked at the inflation site against the running uncompressed message size, and the connection is failed with close code 1009 (message too big) before delivery — for both the whole-message and streaming receive APIs and every compression backend. Behaviour change: a compressed message that inflates past maxMessagePayloadSize is now rejected where it previously passed; uncompressed traffic and the per-frame maxFramePayloadSize wire guard are unaffected (#1909)
  • Fix the permessage-deflate max_message_size receive cap silently truncating an over-limit message and raising a zlib error instead of cleanly rejecting it: the bounded decompress(…, max_length) left the remaining input in unconsumed_tail undrained, so the message was corrupted rather than reported. Decompression is now bounded cumulatively across frames and raises PayloadExceededError as soon as the uncompressed size would exceed the cap (#1908)
  • Make bounded decompression backend-agnostic: decompress_message_data() gains an optional max_output_len argument (documented on the PerMessageCompress base class) and every permessage-compress backend now honours it. deflate and bzip2 stop inflating once the limit is reached (native incremental cap); snappy and brotli, whose libraries expose no output-length argument, inflate the frame (already bounded on the wire by maxFramePayloadSize) and then reject — a weaker but still clean per-frame guarantee. The WebSocket receive path passes the remaining maxMessagePayloadSize budget so a compressed frame no longer expands unbounded into memory before the size check; the previous post-inflation check (#1909) remains as a backstop. Previously only deflate had any decompressed-output cap, so a snappy/bzip2/brotli frame could inflate fully into memory first (#1910)
  • Make the asyncio RawSocket receive size limit configurable, at parity with the Twisted backend. The asyncio WampRawSocketFactory now exposes setProtocolOptions(maxMessagePayloadSize=...) / resetProtocolOptions() (bounds [512, 2**24], default 16 MB), and the configured value drives both the advertised handshake length exponent and the enforced receive cap (rounded up to the next power of two), matching the Twisted factory. Previously the asyncio receive limit was hardwired to 16 MB (a dead max_size=None branch), so an asyncio WAMP peer could not tighten its RawSocket receive limit for DoS hardening and Crossbar's RawSocket max_message_size had no effect on the asyncio path (#1911)

FlatBuffers

  • Fix check_zlmdb_flatbuffers_version_in_sync() comparing the build-time version() (which is (0, 0, 0, None, None) on installed wheels, where the vendored FlatBuffers __git_version__ is unstamped) — it now compares the reliably-stamped __version__ and returns a version string. Added regression tests (#1891)
  • Make autobahn.flatbuffers.version() reliable on installed wheels: when the build-time __git_version__ is a bare commit hash or "unknown" (shallow clone / submodule absent from the sdist), version() now falls back to parsing the static vendored __version__ and returns (major, minor, patch, None, None) instead of (0, 0, 0, None, None); rich git describe detail is still returned on genuine dev/git builds. Also hardened hatch_build.py so it never stamps a non-parseable __git_version__. Return shape is unchanged (5-tuple); no API break (#1891)

Build & CI/CD

  • Add CalVer / PEP 440 version-management just recipes (file-version, bump-dev, bump-next, prep-release) mirroring Crossbar.io, and document the versioning policy in CONTRIBUTING.md (#1894)
  • Add ruff check --select ANN,UP,TCH (annotation presence, pyupgrade modern syntax, TYPE_CHECKING imports) to the just check-typing recipe so annotation/style regressions are caught in the quality-checks CI job. The existing gaps in src/autobahn/ are ratcheted via an explicit --ignore allowlist to be removed module-by-module (#1839); all other UP/TC rules are enforced immediately, and generated code is excluded. The annotation rules are scoped to this recipe via the command line rather than the global [tool.ruff.lint] select, so the repo-wide check-format gate is unaffected (#1840)
  • Fix the aarch64 CPython 3.14 wheel shipping the free-threaded ABI (cp314t) in the GIL cp314 slot (26.6.x). Root cause: manylinux images pre-install both the GIL and free-threaded 3.14 under /opt/python and prepend them to PATH, and uv resolved cpython-3.14 to the free-threaded interpreter (first on PATH). The create recipe now drops free-threaded …t/bin dirs from PATH for GIL envs so uv selects the GIL build. As defence-in-depth, just build also asserts (via _check-venv-abi) that the interpreter's GIL/free-threaded status matches the env and aborts on mismatch, so a wrong-ABI wheel can never be published. A reserved cpy314t env spec (cpython-3.14t) is added for a future free-threaded wheel variant (#1875)
  • Bump the .cicd (wamp-cicd) submodule to include exact CPython ABI-tag matching in the shared check-release-fileset release-gate action, so a wrong-ABI wheel (e.g. cp314t in the cp314 slot) is also rejected at release-fileset validation, not only by the build-time guard above (wamp-cicd #11, completes #1875)
  • Publish musllinux_1_2 (musl libc / Alpine Linux) binary wheels with NVX acceleration for CPython 3.11–3.14 on both x86_64 and aarch64. Previously pip install autobahn on Alpine fell back to a source build that failed (the clang-built python-build-standalone interpreter's sysconfig carries a --rtlib=compiler-rt flag that Alpine's gcc rejects), so Alpine users could not install autobahn at all; the prebuilt wheels make it "just work". Built inside the official PyPA musllinux_1_2 images (gcc toolchain), tagged automatically by auditwheel, and gated by the check-release-fileset targets. PyPy-on-musl is a tracked follow-up (no official PyPA musllinux PyPy image) (#1877)
Commits

Updates boto3 from 1.43.40 to 1.43.66

Commits
  • f53e30a Merge branch 'release-1.43.66'
  • 7ac6cf8 Bumping version to 1.43.66
  • c69aee1 Add changelog entries from botocore
  • b74eb20 Merge branch 'release-1.43.65'
  • 75469d6 Merge branch 'release-1.43.65' into develop
  • d25fa39 Bumping version to 1.43.65
  • 6081dfd Add changelog entries from botocore
  • 06a2e1b Merge branch 'release-1.43.64'
  • c7b4afa Merge branch 'release-1.43.64' into develop
  • f2f83e3 Bumping version to 1.43.64
  • Additional commits viewable in compare view

Updates botocore from 1.43.40 to 1.43.66

Commits
  • 32fa450 Merge branch 'release-1.43.66'
  • 606f5ca Bumping version to 1.43.66
  • 01ee980 Update endpoints model
  • 30c7a2f Update to latest models
  • 957ec6c Merge customizations for SocialMessaging
  • d41c584 Include max attempts in the amz-sdk-request header on the initial attempt (#3...
  • 7798ec9 Remove paginator tests specific to AWS CLI (#3766)
  • f0f5280 Merge branch 'release-1.43.65'
  • 9f58af2 Merge branch 'release-1.43.65' into develop
  • 949c940 Bumping version to 1.43.65
  • Additional commits viewable in compare view

Updates cbor2 from 5.9.0 to 6.1.4

Release notes

Sourced from cbor2's releases.

6.1.4

  • Fixed frozendict deriving its hash from its keys and its values as two independent sets, so that frozendicts holding the same keys and the same values all collided regardless of how the two were paired; since the decoder builds a frozendict for every map in an immutable position, a payload keyed by such maps decoded in quadratic time (#333; PR by @​sahvx655-wq)
  • Fixed the encoder not registering bytearray values in the string reference namespace, unlike bytes and str; since the decoder registers every byte string it reads, a single bytearray desynchronised the namespace and made subsequent string references resolve to the wrong value (#332; PR by @​sahvx655-wq)
  • Fixed the decoder silently accepting an indefinite-length map whose break marker arrives after a key with no value, dropping that trailing key and returning a truncated map instead of rejecting the ill-formed input (#331; PR by @​sahvx655-wq)
  • Fixed the decoder accepting a non-byte-string payload for a positive or negative bignum (tags 2 and 3). int.from_bytes() also accepts an array (or a map, whose keys it iterates), so a tag wrapping one of those was coerced into an integer instead of being rejected as malformed (#326; PR by @​sahvx655-wq)

6.1.3

  • Fixed the decoder registering 6-byte strings in the string reference namespace at indices 65536–4294967295 where the encoder does not, desynchronising the namespace and resolving later string references to the wrong value (#313; PR by @​sahvx655-wq)
  • Fixed the IPv4/IPv6 network decoders (tags 52 and 54) silently truncating an address byte string that is longer than the address size instead of rejecting it as malformed (#309; PR by @​sahvx655-wq)
  • Fixed quadratic decoding time for indefinite-length and large definite-length byte and text strings, caused by concatenating each chunk onto the accumulated result with + instead of building the result once (#316; PR by @​sahvx655-wq)
  • Fixed datetime_as_timestamp encoding whole-second datetimes before 1970 or after 2106 as floats instead of integers, because the timestamp was narrowed through an unsigned 32-bit integer (#317; PR by @​sahvx655-wq)
  • Fixed the encoder measuring text strings by code point count instead of UTF-8 byte length when deciding whether to add them to the string reference namespace, desynchronising it from the decoder (which counts bytes) and corrupting later string references for non-ASCII strings (#314; PR by @​sahvx655-wq)
  • Fixed the decoder rejecting scoped IPv6 addresses (tag 54) with a CBORDecodeError reading invalid types in input array; the encoder emits them as [address, null, zone id] but the decoder only handled the network and interface array forms, so a scoped ~ipaddress.IPv6Address could not be decoded back (#324; PR by @​sahvx655-wq)

6.1.2

  • Fixed incorrect tracking of string references for definite-length text strings of length greater than 65536 (#308; PR by @​sahvx655-wq)
  • Fixed cbor2.load() crash caused by incorrect handling of internal read buffer extension during stream deserialization. (#307; PR by @​noderyos)

6.1.1

  • Fixed cbor2.load() returning corrupted data for payloads exceeding 4096 bytes (#304)

6.1.0

  • Added the allow_duplicate_keys parameter to CBORDecoder, load and loads (default: True). When set to False, a CBORDecodeError is raised upon encountering a duplicate key within the same map. (#283)
  • Added support for decoding from any object supporting the buffer API (e.g. memoryview or bytearray) in addition to bytes (#297)
  • Fixed compatibility issues with 32-bit systems (#300)

6.0.1

  • Fixed an error in the mutability logic during decoding, leading to values being decoded as immutable in unexpected places (#295)

6.0.0

  • No changes since v6.0.0rc1

6.0.0rc1

  • MAJOR REWRITE: The Python and C implementations of the encoder and decoder were replaced with a single, Rust-based implementation in the interest of maintainability.

    Here are some of the highlights:

    • Improved memory safety (100% safe-mode Rust)
    • Complete elimination of reference leaks
    • Support for free-threading and subinterpreters
    • Substantially improved performance
    • Improved decoder error handling where any non-base exception gets wrapped in a CBORDecodeError
    • Iterative, rather than recursive decoding, meaning the container nesting depth is limited only by the available memory, rather than the C stack size

  • BACKWARD INCOMPATIBLE Changed the signature of the tag_hook decoder callables to accept (CBORTag, immutable as arguments instead of CBORDecoder, CBORTag)

  • BACKWARD INCOMPATIBLE Changed the signature of the object_hook decoder callables to accept (Mapping[Any, Any], bool) instead of (CBORDecoder, dict[Any, Any])

  • BACKWARD INCOMPATIBLE Removed the break_marker singleton as no longer necessary

... (truncated)

Commits
  • a780f82 Bumped up the version
  • d1f0ca5 Reject non-byte-string payloads in bignum decoders (#326)
  • 7a6682b Reject indefinite-length maps missing a value for the last key (#331)
  • 693219c Register bytearrays in the string reference namespace (#332)
  • 18f9fc7 Hash frozendict by its items instead of keys and values separately (#333)
  • 18c6507 [pre-commit.ci] pre-commit autoupdate (#325)
  • 5820bd4 Bumped up the version
  • 8bb0466 Bump the github-actions group with 2 updates (#323)
  • 00e3dea Decode scoped IPv6 addresses instead of rejecting them (#324)
  • aeff00b Measure text strings by byte length in maybe_stringref (#314)
  • Additional commits viewable in compare view

Updates coverage from 7.15.0 to 7.15.4

Release notes

Sourced from coverage's releases.

7.15.4

Version 7.15.4 — 2026-08-06

  • Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn’t escaped where it’s dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare.
  • Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare.
  • Wheels are now provided for Python 3.15.

➡️  PyPI page: coverage 7.15.4. :arrow_right:  To install: python3 -m pip install coverage==7.15.4

7.15.3

Version 7.15.3 — 2026-08-02

  • Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han. Closes issue 2200.
  • A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios.
  • Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios.

➡️  PyPI page: coverage 7.15.3. :arrow_right:  To install: python3 -m pip install coverage==7.15.3

7.15.2

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically increased memory use during reporting for large projects. Now we use a different approach that is both faster and slimmer than 7.15.0. Fixes issue 2229.

➡️  PyPI page: coverage 7.15.2. :arrow_right:  To install: python3 -m pip install coverage==7.15.2

7.15.1

Version 7.15.1 — 2026-07-12

  • Fix: in the HTML report with show_contexts enabled, a context label containing </script> (for example a parametrized pytest node id) could close the inline <script> element in a file page early, injecting markup. Context labels are now fully escaped. Thanks, Rajath Mohare.
  • A number of performance improvements thanks to Paul Kehrer, in pull requests 2213, 2214, 2215, 2216, 2218, 2220, and 2221.

➡️  PyPI page: coverage 7.15.1. :arrow_right:  To install: python3 -m pip install coverage==7.15.1

Changelog

Sourced from coverage's changelog.

Version 7.15.4 — 2026-08-06

  • Fix: in the HTML report, a source file name containing a double quote (legal on POSIX) wasn't escaped where it's dropped into the href of the index and prev/next links, so it could close the attribute early and inject markup. Page URLs are now escaped. Thanks, Rajath Mohare <pull 2227_>_.

  • Fix: the LCOV report wrote file names and other fields into its line-oriented records without neutralizing control characters. A measured file whose name contained a newline (legal on POSIX) could forge extra records, inflating the coverage seen by tools that read the report. Control characters in a field are now replaced. Thanks, Rajath Mohare <pull 2226_>_.

  • Wheels are now provided for Python 3.15.

.. _pull 2226: coveragepy/coveragepy#2226 .. _pull 2227: coveragepy/coveragepy#2227

.. _changes_7-15-3:

Version 7.15.3 — 2026-08-02

  • Fix: the sysmon core is incompatible with dynamic contexts. Previously, the combination would be prevented when read from the coverage.py configuration. But using the context API as pytest-cov does, contexts would be silently dropped. Now a warning is issued, thanks to Jisang Han <pull 2234_>. Closes issue 2200.

  • A performance improvement in the low-level line number bookkeeping when combining data files, thanks to Kevin Turcios <pull 2239_>_.

  • Performance improvement in HTML reporting by reducing the number of times files have to be parsed, thanks to Kevin Turcios <pull 2240_>_.

.. _issue 2200: coveragepy/coveragepy#2200 .. _pull 2234: coveragepy/coveragepy#2234 .. _pull 2239: coveragepy/coveragepy#2239 .. _pull 2240: coveragepy/coveragepy#2240

.. _changes_7-15-2:

Version 7.15.2 — 2026-07-15

  • Fix: one of the performance improvements in 7.15.1 (pull 2215) dramatically

... (truncated)

Commits
  • 4c0e7ff docs: sample HTML for 7.15.4
  • db4cc32 docs: prep for 7.15.4
  • c33085c style: start gradual move to ruff 0.16
  • 53a0fd5 fix: neutralize control characters in lcov report fields (#2226)
  • b64d53d build: make 3.15 wheels
  • 53792ab build: show the python version for kits
  • f6b03c7 chore: make upgrade_one package=cibuildwheel
  • d9b660a chore: make upgrade
  • b128a31 docs: oops, move this entry to the correct place
  • a7a2c15 fix: escape filename urls in html report href attributes (#2227)
  • Additional commits viewable in compare view

Updates daphne from 4.2.2 to 4.2.3

Changelog

Sourced from daphne's changelog.

4.2.3 (2026-07-21)

  • Added --websocket-max-message-size and --websocket-max-frame-size CLI flags to the runserver management command for use in development.
Commits
  • 8a60e56 Bumped version and changelog for v4.2.3 release.
  • 389b9a7 Add ability to configure websocket message size when running as django dev se...
  • 0cd79c2 [pre-commit.ci] pre-commit autoupdate (#571)
  • See full diff in compare view

Updates django-allauth from 65.18.0 to 65.19.0

Commits

Updates django-anymail from 15.0 to 15.1

Release notes

Sourced from django-anymail's releases.

v15.1

Changelog

Changelog

Sourced from django-anymail's changelog.

v15.1

2026-07-30

Fixes


* **Amazon SES, Brevo:** Fix ``InvalidMailer`` error about "Unknown options"
  when used with Django 6.1 ``MAILERS`` setting.

    

  • Postmark: Raise an unsupported feature error when merge_data or
    
merge_global_data is used without a template_id. Anymail passes that
    
data to Postmark in its TemplateModel field, which is silently ignored
    
when sending through a non-template API. (Thanks to @slinkymanbyday_ for
    
reporting the issue and @Sanjays2402_ for the fix.)
    • 



Other

  • Test against prerelease versions of Django 6.1.

Deprecations


* Support for ``fail_silently`` in Anymail's email backends is being phased out,
  matching Django's deprecation of the feature. Anymail will issue a deprecation
  warning when ``fail_silently`` is used. Support for it will be dropped in a
  future release when Django 6.2 support is discontinued.

See Replacing fail_silently &lt;https://docs.djangoproject.com/en/6.1/howto/mailers-migration/#migrating-to-mailers-fail-silently&gt;_

in Django's documentation for recommendations.

Commits
  • 8c40cc4 Release 15.1
  • 7e8b81b Postmark: Handle merge_data without template_id as unsupported
  • d973c84 Update URLs to Mailjet's documentation
  • 1671948 Update readme for Django 6.1
  • 0dfc0aa Add 'docs-watch' tox environment for sphinx-autobuild
  • 232477a Deprecate fail_silently
  • e567452 Improve support for MAILERS configuration
  • e670d78 Amazon SES, Brevo: Fix compatibility with Django 6.1 MAILERS
  • 15b57e2 Update test matrix for Django 6.1 pre-release
  • 171fa38 Change black and isort to target Python 3.10
  • Additional commits viewable in compare view

Updates django-stubs-ext from 6.0.6 to 6.0.9

Commits

Updates django-stubs from 6.0.6 to 6.0.9

Commits

Updates django-unfold from 0.99.1 to 0.103.0

Release notes

Sourced from django-unfold's releases.

0.103.0

v0.103.0 (2026-08-06)

This release is published under the MIT License.

Bug Fixes

Features

Detailed Changes: 0.102.0...0.103.0

0.102.0

v0.102.0 (2026-07-27)

This release is published under the MIT License.

Bug Fixes

Features

... (truncated)

Changelog

Sourced from django-unfold's changelog.

v0.103.0 (2026-08-06)

Bug Fixes

Features

v0.102.0 (2026-07-27)

Bug Fixes

... (truncated)

Commits

@dependabot
Bump the python-dependencies group across 1 directory with 45 updates
7eaca69 
Updates the requirements on [asgiref](https://github.com/django/asgiref), [autobahn](https://github.com/crossbario/autobahn-python), [boto3](https://github.com/boto/boto3), [botocore](https://github.com/boto/botocore), [cbor2](https://github.com/agronholm/cbor2), [coverage](https://github.com/coveragepy/coveragepy), [daphne](https://github.com/django/daphne), [django-allauth](https://github.com/sponsors/pennersr), [django-anymail](https://github.com/anymail/django-anymail), [django-stubs-ext](https://github.com/typeddjango/django-stubs), [django-stubs](https://github.com/typeddjango/django-stubs), [django-unfold](https://github.com/unfoldadmin/django-unfold), [django](https://github.com/django/django), [djlint](https://github.com/djlint/djLint), [feedparser](https://github.com/kurtmckee/feedparser), [langchain-core](https://github.com/langchain-ai/langchain), [langgraph](https://github.com/langchain-ai/langgraph), [langsmith](https://github.com/langchain-ai/langsmith-sdk), [librt](https://github.com/mypyc/librt), [markdown](https://github.com/Python-Markdown/markdown), [mastodon-py](https://github.com/halcy/Mastodon.py), [opentelemetry-api](https://github.com/open-telemetry/opentelemetry-python), [opentelemetry-exporter-otlp-proto-http](https://github.com/open-telemetry/opentelemetry-python), [opentelemetry-instrumentation-django](https://github.com/open-telemetry/opentelemetry-python-contrib), [opentelemetry-sdk](https://github.com/open-telemetry/opentelemetry-python), [pre-commit](https://github.com/pre-commit/pre-commit), [pyasn1](https://github.com/pyasn1/pyasn1), [pylint-django](https://github.com/pylint-dev/pylint-django), [pyopenssl](https://github.com/pyca/pyopenssl), [pytest-django](https://github.com/pytest-dev/pytest-django), [qdrant-client](https://github.com/qdrant/qdrant-client), [ruff](https://github.com/astral-sh/ruff), [s3transfer](https://github.com/boto/s3transfer), [sentence-transformers](https://github.com/huggingface/sentence-transformers), [service-identity](https://github.com/pyca/service-identity), standardwebhooks, [svix](https://github.com/svix/svix-webhooks), [types-deprecated](https://github.com/python/typeshed), [types-psycopg2](https://github.com/python/typeshed), [types-python-dateutil](https://github.com/python/typeshed), [types-pyyaml](https://github.com/python/typeshed), [types-requests](https://github.com/python/typeshed), [uuid-utils](https://github.com/aminalaee/uuid-utils), [wrapt](https://github.com/GrahamDumpleton/wrapt) and [xxhash](https://github.com/ifduyue/python-xxhash) to permit the latest version.

Updates `asgiref` from 3.11.1 to 3.12.1
- [Changelog](https://github.com/django/asgiref/blob/main/CHANGELOG.txt)
- [Commits](django/asgiref@3.11.1...3.12.1)

Updates `autobahn` from 26.6.2 to 26.7.1
- [Release notes](https://github.com/crossbario/autobahn-python/releases)
- [Changelog](https://github.com/crossbario/autobahn-python/blob/master/docs/changelog.rst)
- [Commits](crossbario/autobahn-python@v26.6.2...v26.7.1)

Updates `boto3` from 1.43.40 to 1.43.66
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.40...1.43.66)

Updates `botocore` from 1.43.40 to 1.43.66
- [Commits](boto/botocore@1.43.40...1.43.66)

Updates `cbor2` from 5.9.0 to 6.1.4
- [Release notes](https://github.com/agronholm/cbor2/releases)
- [Commits](agronholm/cbor2@5.9.0...6.1.4)

Updates `coverage` from 7.15.0 to 7.15.4
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.0...7.15.4)

Updates `daphne` from 4.2.2 to 4.2.3
- [Changelog](https://github.com/django/daphne/blob/main/CHANGELOG.txt)
- [Commits](django/daphne@4.2.2...4.2.3)

Updates `django-allauth` from 65.18.0 to 65.19.0
- [Commits](https://github.com/sponsors/pennersr/commits)

Updates `django-anymail` from 15.0 to 15.1
- [Release notes](https://github.com/anymail/django-anymail/releases)
- [Changelog](https://github.com/anymail/django-anymail/blob/main/CHANGELOG.rst)
- [Commits](anymail/django-anymail@v15.0...v15.1)

Updates `django-stubs-ext` from 6.0.6 to 6.0.9
- [Release notes](https://github.com/typeddjango/django-stubs/releases)
- [Commits](typeddjango/django-stubs@6.0.6...6.0.9)

Updates `django-stubs` from 6.0.6 to 6.0.9
- [Release notes](https://github.com/typeddjango/django-stubs/releases)
- [Commits](typeddjango/django-stubs@6.0.6...6.0.9)

Updates `django-unfold` from 0.99.1 to 0.103.0
- [Release notes](https://github.com/unfoldadmin/django-unfold/releases)
- [Changelog](https://github.com/unfoldadmin/django-unfold/blob/main/CHANGELOG.md)
- [Commits](unfoldadmin/django-unfold@0.99.1...0.103.0)

Updates `django` from 6.0.6 to 6.1
- [Commits](django/django@6.0.6...6.1)

Updates `djlint` from 1.40.2 to 1.44.1
- [Release notes](https://github.com/djlint/djLint/releases)
- [Changelog](https://github.com/djlint/djLint/blob/master/CHANGELOG.md)
- [Commits](djlint/djLint@v1.40.2...v1.44.1)

Updates `feedparser` from 6.0.12 to 6.0.14
- [Release notes](https://github.com/kurtmckee/feedparser/releases)
- [Changelog](https://github.com/kurtmckee/feedparser/blob/main/CHANGELOG.rst)
- [Commits](kurtmckee/feedparser@v6.0.12...v6.0.14)

Updates `langchain-core` from 1.4.8 to 1.5.3
- [Release notes](https://github.com/langchain-ai/langchain/releases)
- [Commits](langchain-ai/langchain@langchain-core==1.4.8...langchain-core==1.5.3)

Updates `langgraph` from 1.2.7 to 1.2.10
- [Release notes](https://github.com/langchain-ai/langgraph/releases)
- [Commits](langchain-ai/langgraph@1.2.7...1.2.10)

Updates `langsmith` from 0.9.7 to 0.10.17
- [Release notes](https://github.com/langchain-ai/langsmith-sdk/releases)
- [Commits](langchain-ai/langsmith-sdk@v0.9.7...v0.10.17)

Updates `librt` from 0.12.0 to 0.15.0
- [Commits](mypyc/librt@v0.12.0...v0.15.0)

Updates `markdown` from 3.10.2 to 3.10.3
- [Release notes](https://github.com/Python-Markdown/markdown/releases)
- [Changelog](https://github.com/Python-Markdown/markdown/blob/master/docs/changelog.md)
- [Commits](Python-Markdown/markdown@3.10.2...3.10.3)

Updates `mastodon-py` from 2.2.1 to 2.2.2
- [Release notes](https://github.com/halcy/Mastodon.py/releases)
- [Changelog](https://github.com/halcy/Mastodon.py/blob/master/CHANGELOG.rst)
- [Commits](halcy/Mastodon.py@v2.2.1...v2.2.2)

Updates `opentelemetry-api` to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.43.0...v1.44.0)

Updates `opentelemetry-exporter-otlp-proto-http` to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.43.0...v1.44.0)

Updates `opentelemetry-instrumentation-django` to 0.65b0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python-contrib/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python-contrib/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-python-contrib/commits)

Updates `opentelemetry-sdk` to 1.44.0
- [Release notes](https://github.com/open-telemetry/opentelemetry-python/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-python/blob/main/CHANGELOG.md)
- [Commits](open-telemetry/opentelemetry-python@v1.43.0...v1.44.0)

Updates `pre-commit` from 4.6.0 to 4.6.1
- [Release notes](https://github.com/pre-commit/pre-commit/releases)
- [Changelog](https://github.com/pre-commit/pre-commit/blob/main/CHANGELOG.md)
- [Commits](pre-commit/pre-commit@v4.6.0...v4.6.1)

Updates `pyasn1` from 0.6.3 to 0.6.4
- [Release notes](https://github.com/pyasn1/pyasn1/releases)
- [Changelog](https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst)
- [Commits](pyasn1/pyasn1@v0.6.3...v0.6.4)

Updates `pylint-django` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/pylint-dev/pylint-django/releases)
- [Changelog](https://github.com/pylint-dev/pylint-django/blob/master/CHANGELOG.rst)
- [Commits](pylint-dev/pylint-django@v2.7.0...v2.8.0)

Updates `pyopenssl` from 26.2.0 to 26.4.0
- [Changelog](https://github.com/pyca/pyopenssl/blob/main/CHANGELOG.rst)
- [Commits](pyca/pyopenssl@26.2.0...26.4.0)

Updates `pytest-django` from 4.12.0 to 4.13.0
- [Release notes](https://github.com/pytest-dev/pytest-django/releases)
- [Changelog](https://github.com/pytest-dev/pytest-django/blob/main/docs/changelog.rst)
- [Commits](pytest-dev/pytest-django@v4.12.0...v4.13.0)

Updates `qdrant-client` from 1.18.0 to 1.19.0
- [Release notes](https://github.com/qdrant/qdrant-client/releases)
- [Commits](qdrant/qdrant-client@v1.18.0...v1.19.0)

Updates `ruff` from 0.15.20 to 0.16.2
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.20...0.16.2)

Updates `s3transfer` from 0.19.0 to 0.19.2
- [Changelog](https://github.com/boto/s3transfer/blob/develop/CHANGELOG.rst)
- [Commits](boto/s3transfer@0.19.0...0.19.2)

Updates `sentence-transformers` from 5.6.0 to 5.7.0
- [Release notes](https://github.com/huggingface/sentence-transformers/releases)
- [Commits](huggingface/sentence-transformers@v5.6.0...v5.7.0)

Updates `service-identity` from 24.2.0 to 26.1.0
- [Release notes](https://github.com/pyca/service-identity/releases)
- [Changelog](https://github.com/pyca/service-identity/blob/main/CHANGELOG.md)
- [Commits](pyca/service-identity@24.2.0...26.1.0)

Updates `standardwebhooks` from 1.0.1 to 1.1.0

Updates `svix` from 1.96.1 to 1.99.1
- [Release notes](https://github.com/svix/svix-webhooks/releases)
- [Changelog](https://github.com/svix/svix-webhooks/blob/main/ChangeLog.md)
- [Commits](svix/svix-webhooks@v1.96.1...v1.99.1)

Updates `types-deprecated` from 1.3.1.20260520 to 1.3.1.20260728
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-psycopg2` from 2.9.21.20260518 to 2.9.21.20260724
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-python-dateutil` from 2.9.0.20260518 to 2.9.0.20260807
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-pyyaml` from 6.0.12.20260518 to 6.0.12.20260724
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-requests` from 2.33.0.20260518 to 2.33.0.20260712
- [Commits](https://github.com/python/typeshed/commits)

Updates `uuid-utils` from 0.16.2 to 0.17.0
- [Release notes](https://github.com/aminalaee/uuid-utils/releases)
- [Commits](aminalaee/uuid-utils@0.16.2...0.17.0)

Updates `wrapt` from 2.2.2 to 2.3.0
- [Release notes](https://github.com/GrahamDumpleton/wrapt/releases)
- [Changelog](https://github.com/GrahamDumpleton/wrapt/blob/develop/docs/changes.rst)
- [Commits](GrahamDumpleton/wrapt@2.2.2...2.3.0)

Updates `xxhash` from 3.8.0 to 3.8.1
- [Release notes](https://github.com/ifduyue/python-xxhash/releases)
- [Changelog](https://github.com/ifduyue/python-xxhash/blob/master/CHANGELOG.rst)
- [Commits](ifduyue/python-xxhash@v3.8.0...v3.8.1)

---
updated-dependencies:
- dependency-name: asgiref
  dependency-version: 3.12.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: autobahn
  dependency-version: 26.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: boto3
  dependency-version: 1.43.66
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: botocore
  dependency-version: 1.43.66
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: cbor2
  dependency-version: 6.1.4
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-dependencies
- dependency-name: coverage
  dependency-version: 7.15.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: daphne
  dependency-version: 4.2.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: django-allauth
  dependency-version: 65.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: django-anymail
  dependency-version: '15.1'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: django-stubs-ext
  dependency-version: 6.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: django-stubs
  dependency-version: 6.0.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: django-unfold
  dependency-version: 0.103.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: django
  dependency-version: '6.1'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: djlint
  dependency-version: 1.44.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: feedparser
  dependency-version: 6.0.14
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: langchain-core
  dependency-version: 1.5.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: langgraph
  dependency-version: 1.2.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: langsmith
  dependency-version: 0.10.17
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: librt
  dependency-version: 0.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: markdown
  dependency-version: 3.10.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: mastodon-py
  dependency-version: 2.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: opentelemetry-api
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: python-dependencies
- dependency-name: opentelemetry-exporter-otlp-proto-http
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: python-dependencies
- dependency-name: opentelemetry-instrumentation-django
  dependency-version: 0.65b0
  dependency-type: direct:production
  dependency-group: python-dependencies
- dependency-name: opentelemetry-sdk
  dependency-version: 1.44.0
  dependency-type: direct:production
  dependency-group: python-dependencies
- dependency-name: pre-commit
  dependency-version: 4.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pyasn1
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pylint-django
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: pyopenssl
  dependency-version: 26.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: pytest-django
  dependency-version: 4.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: qdrant-client
  dependency-version: 1.19.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: ruff
  dependency-version: 0.16.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: s3transfer
  dependency-version: 0.19.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: sentence-transformers
  dependency-version: 5.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: service-identity
  dependency-version: 26.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python-dependencies
- dependency-name: standardwebhooks
  dependency-version: 1.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: svix
  dependency-version: 1.99.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: types-deprecated
  dependency-version: 1.3.1.20260728
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: types-psycopg2
  dependency-version: 2.9.21.20260724
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: types-python-dateutil
  dependency-version: 2.9.0.20260807
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: types-pyyaml
  dependency-version: 6.0.12.20260724
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: types-requests
  dependency-version: 2.33.0.20260712
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: uuid-utils
  dependency-version: 0.17.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: wrapt
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: xxhash
  dependency-version: 3.8.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 10, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 17, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/python-dependencies-9e9ad7338c branch August 17, 2026 19:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants