Skip to content

Upgrade: Bump the python group across 1 directory with 7 updates - #401

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-9c5aca798b
Closed

Upgrade: Bump the python group across 1 directory with 7 updates#401
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/python-9c5aca798b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python group with 7 updates in the / directory:

Package From To
aiohappyeyeballs 2.6.1 2.7.1
aiohttp 3.13.3 3.14.3
attrs 25.4.0 26.1.0
idna 3.11 3.18
multidict 6.7.0 6.7.1
propcache 0.4.1 0.5.2
yarl 1.22.0 1.24.5

Updates aiohappyeyeballs from 2.6.1 to 2.7.1

Release notes

Sourced from aiohappyeyeballs's releases.

v2.7.1 (2026-07-01)

Performance Improvements

  • Use defaultdict to help with performance (#239, e10f335)

Refactoring

  • Collapse collect-then-remove pattern in utils helpers (#227, 0dd3fd1)

  • Merge identical except blocks in _connect_sock cleanup (#229, b7c186e)

  • Simplify _interleave_addrinfos family grouping (#226, fdf6548)

Detailed Changes: v2.7.0...v2.7.1

v2.7.0 (2026-05-20)

Features

Detailed Changes: v2.6.2...v2.7.0

v2.6.2 (2026-05-20)

Bug Fixes

  • Clear error on empty addr_infos in start_connection (#222, 55dd76a)

Refactoring

  • Optimize obtaining event-loop down to 1 line (#185, 02a7029)

Testing

  • Stop verify_no_lingering_tasks from leaking an event loop (#221, ce43beb)

Detailed Changes: v2.6.1...v2.6.2

Changelog

Sourced from aiohappyeyeballs's changelog.

v2.7.1 (2026-07-01)

Performance improvements

  • Use defaultdict to help with performance (e10f335)

Refactoring

  • Simplify _interleave_addrinfos family grouping (fdf6548)
  • Collapse collect-then-remove pattern in utils helpers (0dd3fd1)
  • Merge identical except blocks in _connect_sock cleanup (b7c186e)

v2.7.0 (2026-05-20)

Features

  • Add python 3.14 support (10e7d43)

v2.6.2 (2026-05-20)

Bug fixes

  • Clear error on empty addr_infos in start_connection (55dd76a)

Testing

  • Stop verify_no_lingering_tasks from leaking an event loop (ce43beb)

Refactoring

  • Optimize obtaining event-loop down to 1 line (02a7029)
Commits
  • 4dfc926 2.7.1
  • e10f335 perf: use defaultdict to help with performance (#239)
  • 338277b chore: stop tracking .DS_Store files (#251)
  • 1697869 ci: add codspeed benchmark suite for addrinfo reordering hot paths (#250)
  • d40a848 chore(deps-dev): bump starlette from 1.0.1 to 1.3.1 (#242)
  • 51d4266 chore(deps-dev): bump cryptography from 46.0.7 to 48.0.1 (#243)
  • 2df44b3 chore(pre-commit.ci): pre-commit autoupdate (#241)
  • 3e3cb61 chore(deps-dev): bump pytest from 9.0.3 to 9.1.1 (#244)
  • 922dcd7 chore(deps-ci): bump the github-actions group with 4 updates (#245)
  • 70461c5 ci: drop .github/FUNDING.yml to inherit org-wide config (#247)
  • Additional commits viewable in compare view

Updates aiohttp from 3.13.3 to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

  • Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

    Related issues and pull requests on GitHub: :issue:13180.

  • Fixed error message construction in the C HTTP parser -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:13222.

3.14.2 (2026-07-20)

Bug fixes

  • Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

    Related issues and pull requests on GitHub: :issue:5303.

  • Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

    Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

Updates attrs from 25.4.0 to 26.1.0

Release notes

Sourced from attrs's releases.

26.1.0

Highlights

The main outward change here only affects people using field transformers, but it should be a nice quality of life improvement!

Full changelog below!

Special Thanks

This release would not be possible without my generous sponsors! Thank you to all of you making sustainable maintenance possible! If you would like to join them, go to https://github.com/sponsors/hynek and check out the sweet perks!

Above and Beyond

Variomedia AG (@variomedia), Tidelift (@tidelift), Kraken Tech (@kraken-tech), Privacy Solutions GmbH (@privacy-solutions), FilePreviews (@filepreviews), Ecosystems (@ecosyste-ms), TestMu AI Open Source Office (Formerly LambdaTest) (@LambdaTest-Inc), Doist (@Doist), Daniel Fortunov (@asqui), and Kevin P. Fleming (@kpfleming).

Maintenance Sustainers

Buttondown (@buttondown), Christopher Dignam (@chdsbd), Magnus Watn (@magnuswatn), David Cramer (@dcramer), Rivo Laks (@rivol), Polar (@polarsource), Mike Fiedler (@miketheman), Duncan Hill (@cricalix), Colin Marquardt (@cmarqu), Pieter Swinkels (@swinkels), Nick Libertini (@libertininick), Brian M. Dennis (@crossjam), Celebrity News AG (@celebritynewsag), The Westervelt Company (@westerveltco), Sławomir Ehlert (@slafs), Mostafa Khalil (@khadrawy), Filip Mularczyk (@mukiblejlok), Thomas Klinger (@thmsklngr), Andreas Poehlmann (@ap--), August Trapper Bigelow (@atbigelow), Carlton Gibson (@carltongibson), and Roboflow (@roboflow).

Full Changelog

Backwards-incompatible Changes

  • Field aliases are now resolved before calling field_transformer, so transformers receive fully populated Attribute objects with usable alias values instead of None. The new Attribute.alias_is_default flag indicates whether the alias was auto-generated (True) or explicitly set by the user (False). #1509

Changes

  • Fix type annotations for attrs.validators.optional(), so it no longer rejects tuples with more than one validator. #1496
  • The attrs.validators.disabled() contextmanager can now be nested. #1513
  • Frozen classes can set on_setattr=attrs.setters.NO_OP in addition to None. #1515
  • It's now possible to pass attrs instances in addition to attrs classes to attrs.fields(). #1529

This release contains contributions from @​bysiber, @​DavidCEllis, @​finite-state-machine, @​hynek, @​veeceey, and @​vstinner.

Artifact Attestations

You can verify this release's artifact attestions using GitHub's CLI tool by downloading the sdist and wheel from PyPI and running:

$ gh attestation verify --owner python-attrs attrs-26.1.0.tar.gz

... (truncated)

Changelog

Sourced from attrs's changelog.

26.1.0 - 2026-03-19

Backwards-incompatible Changes

  • Field aliases are now resolved before calling field_transformer, so transformers receive fully populated Attribute objects with usable alias values instead of None. The new Attribute.alias_is_default flag indicates whether the alias was auto-generated (True) or explicitly set by the user (False). #1509

Changes

  • Fix type annotations for attrs.validators.optional(), so it no longer rejects tuples with more than one validator. #1496
  • The attrs.validators.disabled() contextmanager can now be nested. #1513
  • Frozen classes can set on_setattr=attrs.setters.NO_OP in addition to None. #1515
  • It's now possible to pass attrs instances in addition to attrs classes to attrs.fields(). #1529
Commits
  • 7bfc49e Prepare 26.1.0
  • 31e0286 Update test_validators.py for Python 3.15a7 (#1530)
  • 48b8611 Add instance support to attrs.fields() (#1529)
  • 3a68d49 dev: document missing git tags failure mode
  • a572c3a Allow field(on_setattr=NO_OP) on frozen classes
  • af9c510 Fix validators.disabled() to save/restore state on nesting (#1513)
  • ab7f8b2 update dev
  • ce89f5d Fix message passing in frozen errors
  • eccd966 Fix optional validator to accept tuples of len > 1 (#1496)
  • e92fe52 policies: tighten screws (#1528)
  • Additional commits viewable in compare view

Updates idna from 3.11 to 3.18

Changelog

Sourced from idna's changelog.

3.18 (2026-06-02)

  • When decoding a domain, add a display argument that will pass through invalid labels rather than raising an exception.

3.17 (2026-05-28)

  • Substantial 75% reduction in memory usage through new data structures and some optimization in processing speed.
  • Added a general 1024-character input length cap to the public validation, conversion, and codec entry points. This is well above any legitimate domain or label and guards against pathological inputs.

3.16 (2026-05-22)

  • Add a command-line interface (python -m idna, also available as the idna script). Encodes or decodes one or more domains supplied as arguments or on standard input, with options to select A-label or U-label output and control error handling.
  • Raise the minimum supported Python version to 3.9
  • Various code quality improvements

3.15 (2026-05-12)

  • Enforce DNS-length cap on individual labels early in check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.
  • Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.
  • Use raise ... from err for proper exception chaining and switch internal string formatting to f-strings.
  • Allow flit_core 4.x in the build backend.
  • Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.
  • Add Dependabot configuration for GitHub Actions.
  • Convert README and HISTORY from reStructuredText to Markdown.
  • Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.

3.14 (2026-05-10)

  • Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass

... (truncated)

Commits
  • f39ea90 Release 3.18
  • 40f4e40 Pre-release 3.18rc0
  • 1a5bf80 Merge pull request #253 from kjd/lenient-decode
  • 5bbb26f Merge branch 'master' into lenient-decode
  • c532bae Rename decode() lenient= option to display= (issue #248)
  • 0b1758b Merge pull request #252 from kjd/release-3.17
  • f48619c Release 3.17
  • 7421ba8 Pre-release 3.17rc0
  • 22ebb73 Merge pull request #251 from kjd/structure-optimizations
  • 2a7ac0a Drop redundant parallel-arrays comment from uts46data
  • Additional commits viewable in compare view

Updates multidict from 6.7.0 to 6.7.1

Release notes

Sourced from multidict's releases.

6.7.1

Bug fixes

  • Fixed slow memory leak caused by identity by adding Py_DECREF to identity value before leaving md_pop_one on success -- by :user:Vizonex.

    Related issues and pull requests on GitHub: #1284.

Changelog

Sourced from multidict's changelog.

6.7.1

(2026-01-25)

Bug fixes

  • Fixed slow memory leak caused by identity by adding Py_DECREF to identity value before leaving md_pop_one on success -- by :user:Vizonex.

    Related issues and pull requests on GitHub: :issue:1284.

Commits

Updates propcache from 0.4.1 to 0.5.2

Release notes

Sourced from propcache's releases.

0.5.2

0.5.0 and 0.5.1 were tagged earlier today but never reached PyPI: 0.5.0's deploy failed at cibuildwheel's post-build pytest on free-threaded armv7l musllinux (SIGBUS under QEMU emulation while importing the C extension), and 0.5.1's deploy hit a transient sigstore Rekor 502 during the attestation step. 0.5.2 is the first of the three to actually publish.

Features

  • Added support for newer type hints and remove Optional and Union from all annotations -- by :user:Vizonex

    Related issues and pull requests on GitHub: #193.

Removals and backward incompatible breaking changes

  • Dropped support for Python 3.9 as it has reached end of life.

    Related issues and pull requests on GitHub: #216.

Packaging updates and notes for downstreams

  • Changed the Cython build dependency from ~= 3.1.0 to >= 3.2.0, removing the upper version bound to avoid conflicts for downstream packagers -- by :user:jameshilliard and :user:gundalow.

    The upstream Cython version is pinned to 3.2.4 in the CI/CD environment.

    Related issues and pull requests on GitHub: #184, #188, #214.

  • Start building and shipping riscv64 wheels -- by :user:justeph.

    Related issues and pull requests on GitHub: #194.

  • The :pep:517 build backend now supports a new build-inplace config setting (and PROPCACHE_BUILD_INPLACE environment variable) for controlling whether to build the project in-tree or in a temporary directory. It only affects wheels and is set up to build in a temporary directory by default. It does not affect editable wheel builds; they will keep being built in-tree regardless.

    Here's an example of using this setting:

    .. code-block:: console

... (truncated)

Changelog

Sourced from propcache's changelog.

0.5.2

(2026-05-08)

No significant changes.

0.5.1

(2026-05-08)

No significant changes.

0.5.0

(2026-05-08)

Features

  • Added support for newer type hints and remove Optional and Union from all annotations -- by :user:Vizonex

    Related issues and pull requests on GitHub: :issue:193.

Removals and backward incompatible breaking changes

  • Dropped support for Python 3.9 as it has reached end of life.

    Related issues and pull requests on GitHub: :issue:216.

Packaging updates and notes for downstreams

... (truncated)

Commits

Updates yarl from 1.22.0 to 1.24.5

Changelog

Sourced from yarl's changelog.

v1.24.5

(2026-07-19)

Contributor-facing changes

  • Restricted the exhaustive IDNA default-ignorable sweep test to a native Linux x86_64 runner. It iterates roughly 140,000 code points and its result does not depend on the architecture, so running it under emulated wheel builds only added minutes and intermittently crashed the test workers -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:1806.

v1.24.4

(2026-07-19)

Packaging updates and notes for downstreams

  • Stopped installing hypothesis in the wheel-build test environment. The property-based quoting tests that need it are skipped there already, and building it from source on architectures without a prebuilt wheel (such as armv7l musllinux, where the build pulls in a Rust toolchain) was failing the wheel jobs -- by :user:bdraco.

    Related issues and pull requests on GitHub: :issue:1804.

v1.24.3

(2026-07-19)

... (truncated)

Commits
  • 0b30cb0 Release 1.24.5 (#1807)
  • 56150c8 Run the IDNA sweep test only on native Linux x86_64 (#1806)
  • 515adca Release 1.24.4 (#1805)
  • ab5dec2 Do not install hypothesis in the wheel-build test env (#1804)
  • f9d10fb Release 1.24.3 (#1803)
  • 058b7cb Test lone surrogate handling in encoded and parsed URL paths (#991)
  • a181cee Update hypothesis requirement from >=6.156.4 to >=6.157.0 in /requirements (#...
  • 28c1bcc Encode scheme-shaped path colon in relative-path builders (#1802)
  • 51e2802 Reject hosts with Unicode default-ignorable code points (#1801)
  • 3921a73 Drop lone surrogates that split a percent escape in the Cython quoter (#1752)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Upgrade: Bump the python group across 1 directory with 7 updates
c4f9512 
Bumps the python group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [aiohappyeyeballs](https://github.com/aio-libs/aiohappyeyeballs) | `2.6.1` | `2.7.1` |
| [aiohttp](https://github.com/aio-libs/aiohttp) | `3.13.3` | `3.14.3` |
| [attrs](https://github.com/python-attrs/attrs) | `25.4.0` | `26.1.0` |
| [idna](https://github.com/kjd/idna) | `3.11` | `3.18` |
| [multidict](https://github.com/aio-libs/multidict) | `6.7.0` | `6.7.1` |
| [propcache](https://github.com/aio-libs/propcache) | `0.4.1` | `0.5.2` |
| [yarl](https://github.com/aio-libs/yarl) | `1.22.0` | `1.24.5` |



Updates `aiohappyeyeballs` from 2.6.1 to 2.7.1
- [Release notes](https://github.com/aio-libs/aiohappyeyeballs/releases)
- [Changelog](https://github.com/aio-libs/aiohappyeyeballs/blob/main/CHANGELOG.md)
- [Commits](aio-libs/aiohappyeyeballs@v2.6.1...v2.7.1)

Updates `aiohttp` from 3.13.3 to 3.14.3
- [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst)
- [Commits](aio-libs/aiohttp@v3.13.3...v3.14.3)

Updates `attrs` from 25.4.0 to 26.1.0
- [Release notes](https://github.com/python-attrs/attrs/releases)
- [Changelog](https://github.com/python-attrs/attrs/blob/main/CHANGELOG.md)
- [Commits](python-attrs/attrs@25.4.0...26.1.0)

Updates `idna` from 3.11 to 3.18
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.11...v3.18)

Updates `multidict` from 6.7.0 to 6.7.1
- [Release notes](https://github.com/aio-libs/multidict/releases)
- [Changelog](https://github.com/aio-libs/multidict/blob/master/CHANGES.rst)
- [Commits](aio-libs/multidict@v6.7.0...v6.7.1)

Updates `propcache` from 0.4.1 to 0.5.2
- [Release notes](https://github.com/aio-libs/propcache/releases)
- [Changelog](https://github.com/aio-libs/propcache/blob/master/CHANGES.rst)
- [Commits](aio-libs/propcache@v0.4.1...v0.5.2)

Updates `yarl` from 1.22.0 to 1.24.5
- [Changelog](https://github.com/aio-libs/yarl/blob/master/CHANGES.rst)
- [Commits](aio-libs/yarl@v1.22.0...v1.24.5)

---
updated-dependencies:
- dependency-name: aiohappyeyeballs
  dependency-version: 2.7.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: aiohttp
  dependency-version: 3.14.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: attrs
  dependency-version: 26.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: idna
  dependency-version: '3.18'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: multidict
  dependency-version: 6.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: propcache
  dependency-version: 0.5.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: yarl
  dependency-version: 1.24.5
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Aug 18, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 18, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 18, 2026
@dependabot
dependabot Bot deleted the dependabot/pip/python-9c5aca798b branch August 18, 2026 13:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants