Skip to content

build(deps): bump the minor-and-patch group across 1 directory with 12 updates - #496

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/minor-and-patch-af38535641
Open

build(deps): bump the minor-and-patch group across 1 directory with 12 updates#496
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/minor-and-patch-af38535641

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 26, 2026

Copy link
Copy Markdown
Contributor

Bumps the minor-and-patch group with 12 updates in the / directory:

Package From To
boto3 1.43.49 1.43.74
django-htmx 1.28.0 1.29.0
django-oauth-toolkit 3.3.0 3.4.0
flower 2.0.1 2.1.0
faker 40.31.0 40.36.0
pytest-django 4.12.0 4.14.0
django-stubs 6.0.7 6.1.0
djlint 1.40.7 1.44.2
mkdocs-material 9.7.6 9.7.7
django-test-plus 2.4.1 2.6.2
pytest-lazy-fixtures 1.4.0 1.4.1
ruff 0.15.21 0.16.3

Updates boto3 from 1.43.49 to 1.43.74

Commits
  • 2092299 Merge branch 'release-1.43.74'
  • 69fda4d Bumping version to 1.43.74
  • ee5ec70 Add changelog entries from botocore
  • 97c19e9 Merge branch 'release-1.43.73'
  • 5abe90c Merge branch 'release-1.43.73' into develop
  • a08d771 Bumping version to 1.43.73
  • 0cdfdc2 Add changelog entries from botocore
  • a3fc41f Merge branch 'release-1.43.72'
  • 2ec791c Merge branch 'release-1.43.72' into develop
  • 27a2636 Bumping version to 1.43.72
  • Additional commits viewable in compare view

Updates django-htmx from 1.28.0 to 1.29.0

Changelog

Sourced from django-htmx's changelog.

1.29.0 (2026-08-06)

  • Vendor some stable htmx extensions, named per their htmx 4 versions: htmx-2-compat, hx-browser-indicator, hx-download, hx-head, hx-optimistic, hx-preload, hx-prompt, hx-ptag, hx-sse, hx-targets, hx-upsert, and hx-ws. Render their script tags with the new extensions argument of the htmx_script :doc:template tags \<template_tags>, which selects the extension files matching the htmx version in use:

    .. code-block:: django

    {% htmx_script version=4 extensions="hx-sse,hx-ws" %}

    hx-head, hx-preload, hx-sse, and hx-ws are available for both htmx versions 2 and 4; the rest are htmx 4 only.

    The special name htmax renders htmx 4’s htmax bundle of htmx plus its most popular extensions, in place of the plain htmx script:

    .. code-block:: django

    {% htmx_script version=4 extensions="htmax" %}

    PR [#614](https://github.com/adamchainz/django-htmx/issues/614) <https://github.com/adamchainz/django-htmx/pull/614>. Thanks to Rex Zhang for initial work in PR [#575](https://github.com/adamchainz/django-htmx/issues/575) <https://github.com/adamchainz/django-htmx/pull/575/commits>.

  • Upgrade the vendored htmx 2 to version 2.0.10 <https://github.com/bigskysoftware/htmx/blob/master/CHANGELOG.md#2010---2026-04-21>__.

    PR [#594](https://github.com/adamchainz/django-htmx/issues/594) <https://github.com/adamchainz/django-htmx/pull/594>__.

  • Upgrade the vendored htmx 4 to version 4.0.0-beta6 <https://github.com/bigskysoftware/htmx/releases/tag/v4.0.0-beta6>__.

    PR [#610](https://github.com/adamchainz/django-htmx/issues/610) <https://github.com/adamchainz/django-htmx/pull/610>__.

  • Add support for the polling tags protocol of the htmx 4 |hx-ptag extension|__:

    • :attr:HtmxDetails.ptag <django_htmx.middleware.HtmxDetails.ptag> reads the HX-PTag request header directly.

    • The :func:django_htmx.http.ptag view decorator implements the protocol, with an API mirroring Django’s |etag decorator|__. It computes the current tag with the given function and, when the HX-PTag request header matches, returns a 304 (Not Modified) response without calling the view, making htmx skip the swap. Otherwise, it calls the view and sets the HX-PTag response header.

    .. |hx-ptag extension| replace:: hx-ptag extension __ https://four.htmx.org/extensions/hx-ptag

    .. |etag decorator| replace:: etag decorator __ https://docs.djangoproject.com/en/stable/topics/conditional-view-processing/

    PR [#613](https://github.com/adamchainz/django-htmx/issues/613) <https://github.com/adamchainz/django-htmx/pull/613>__.

  • Switch package build backend from setuptools to uv_build <https://docs.astral.sh/uv/concepts/build-backend/>__. This makes builds with uv about nine times faster, since uv runs the backend natively, without creating a build environment or spawning a Python process. Additionally, source distributions no longer include test files, which setuptools previously included incompletely, missing the files needed to actually run them.

Commits

Updates django-oauth-toolkit from 3.3.0 to 3.4.0

Release notes

Sourced from django-oauth-toolkit's releases.

3.4.0

The headline of this release is first-class support for the Model Context Protocol (MCP) authorization server role. MCP's authorization spec is built on a stack of modern OAuth RFCs, and this cycle landed the whole stack: Authorization Server Metadata (RFC 8414) and Protected Resource Metadata (RFC 9728) for discovery, Dynamic Client Registration (RFC 7591 / RFC 7592) and OAuth Client ID Metadata Documents (CIMD) so clients can register themselves, Resource Indicators (RFC 8707) for audience-bound access tokens, and the OAuth 2.0 Security Best Current Practice (RFC 9700) together with the RFC 9207 iss parameter. The RFC 9700 compliance gates double as a configurable OAuth 2.1 security posture — they can reject the implicit and password grants and enforce S256-only PKCE (legacy behavior by default in 3.4, scheduled to flip to compliant in 4.0). The new ALLOW_LOCALHOST_LOOPBACK setting smooths the ephemeral-port loopback callback used by native clients such as Claude Code, MCP Inspector, and mcp-remote.

Beyond MCP, the release adds a Django Ninja integration alongside the existing DRF support and support for RP-Initiated Registration, lifts the 255-character cap on refresh tokens (mirroring the access-token checksum scheme), makes cleartokens reclaim revoked refresh tokens sooner, and harmonizes Bearer Authorization header parsing across the middleware.

It also carries a batch of security fixes: an unauthenticated open redirect from the authorization endpoint (prompt=none), HS256 ID tokens being signed with the hashed client secret, cleartext tokens and codes exposed in the Django admin, client secrets written to debug logs, and predictable device-flow user_code generation. Longstanding operational bugs are fixed too, including a multi-database migrate deadlock (#1591) and duplicate unique indexes that broke fresh installs on Oracle and strict MySQL (#1656).

Before upgrading, read the breaking-changes section below: most items are makemigrations steps for swapped models, but applications using the HS256 signing algorithm now require hash_client_secret=False.

WARNING - POTENTIAL BREAKING CHANGES

  • Applications using the HS256 signing algorithm must now be configured with hash_client_secret=False. Previously such applications signed ID tokens with the hashed client secret, producing tokens that relying parties could not verify. Application.clean() now raises a ValidationError for HS256 + hash_client_secret=True, and Application.jwk_key raises ImproperlyConfigured at signing time if the secret is hashed. To migrate an affected application, recreate it (or reset its secret) with hash_client_secret=False so the plaintext secret is stored and can be used as the shared HMAC key.
  • Changes to the AbstractRefreshToken model require doing a manage.py migrate after upgrading.
  • If you use a swapped refresh token model (OAUTH2_PROVIDER_REFRESH_TOKEN_MODEL) you will need to update your custom model with manage.py makemigrations. If your table already contains refresh tokens you must also backfill token_checksum with a data migration — adapt the batched backfill loop from forwards_func in oauth2_provider/migrations/0015_refreshtoken_token_checksum.py (dropping its swapped-model guard, the early return, and resolving your own model instead) and keep the same operation order: add nullable checksum → drop the old ("token", "revoked") unique constraint → widen token to TextField → backfill → make checksum non-nullable → add the ("token_checksum", "revoked") unique constraint.
  • If you use a swapped application model (OAUTH2_PROVIDER_APPLICATION_MODEL), run

... (truncated)

Changelog

Sourced from django-oauth-toolkit's changelog.

[3.4.0] - 2026-07-23

The headline of this release is first-class support for the Model Context Protocol (MCP) authorization server role. MCP's authorization spec is built on a stack of modern OAuth RFCs, and this cycle landed the whole stack: Authorization Server Metadata (RFC 8414) and Protected Resource Metadata (RFC 9728) for discovery, Dynamic Client Registration (RFC 7591 / RFC 7592) and OAuth Client ID Metadata Documents (CIMD) so clients can register themselves, Resource Indicators (RFC 8707) for audience-bound access tokens, and the OAuth 2.0 Security Best Current Practice (RFC 9700) together with the RFC 9207 iss parameter. The RFC 9700 compliance gates double as a configurable OAuth 2.1 security posture — they can reject the implicit and password grants and enforce S256-only PKCE (legacy behavior by default in 3.4, scheduled to flip to compliant in 4.0). The new ALLOW_LOCALHOST_LOOPBACK setting smooths the ephemeral-port loopback callback used by native clients such as Claude Code, MCP Inspector, and mcp-remote.

Beyond MCP, the release adds a Django Ninja integration alongside the existing DRF support and support for RP-Initiated Registration, lifts the 255-character cap on refresh tokens (mirroring the access-token checksum scheme), makes cleartokens reclaim revoked refresh tokens sooner, and harmonizes Bearer Authorization header parsing across the middleware.

It also carries a batch of security fixes: an unauthenticated open redirect from the authorization endpoint (prompt=none), HS256 ID tokens being signed with the hashed client secret, cleartext tokens and codes exposed in the Django admin, client secrets written to debug logs, and predictable device-flow user_code generation. Longstanding operational bugs are fixed too, including a multi-database migrate deadlock (#1591) and duplicate unique indexes that broke fresh installs on Oracle and strict MySQL (#1656).

Before upgrading, read the breaking-changes section below: most items are makemigrations steps for swapped models, but applications using the HS256 signing algorithm now require hash_client_secret=False.

WARNING - POTENTIAL BREAKING CHANGES

  • Applications using the HS256 signing algorithm must now be configured with hash_client_secret=False. Previously such applications signed ID tokens with the hashed client secret, producing tokens that relying parties could not verify. Application.clean() now raises a ValidationError for HS256 + hash_client_secret=True, and Application.jwk_key raises ImproperlyConfigured at signing time if the secret is hashed. To migrate an affected application, recreate it (or reset its secret) with hash_client_secret=False so the plaintext secret is stored and can be used as the shared HMAC key.
  • Changes to the AbstractRefreshToken model require doing a manage.py migrate after upgrading.
  • If you use a swapped refresh token model (OAUTH2_PROVIDER_REFRESH_TOKEN_MODEL) you will need to update your custom model with manage.py makemigrations. If your table already contains refresh tokens you must also backfill token_checksum with a data migration — adapt the batched backfill loop from forwards_func in oauth2_provider/migrations/0015_refreshtoken_token_checksum.py (dropping its swapped-model guard, the early return, and resolving your own model instead) and keep the same operation order: add nullable checksum → drop the old ("token", "revoked") unique constraint → widen token to TextField → backfill → make checksum non-nullable → add the ("token_checksum", "revoked") unique constraint.
  • If you use a swapped application model (OAUTH2_PROVIDER_APPLICATION_MODEL), run

... (truncated)

Commits
  • 48132d3 chore: 3.4.0 release (#1764)
  • 2c34e2a docs: replace m2r2 with myst-parser to drop the mistune dependency (#1761)
  • 76cc44b chore(deps): bump cryptography in the uv group across 1 directory (#1760)
  • a5e5032 docs: migrate m2r to m2r2 and build docs in CI (#1758)
  • ea8f2f0 chore(deps): bump the npm_and_yarn group across 1 directory with 7 updates (#...
  • de8e735 Fix 500 error when client_id or username contains a NUL byte (#1754)
  • 0c9240b Fix ReadWriteScopedResourceMixin.new() rejecting any constructor argument...
  • c5f2b9d Add section in docs about migrations testing (#1717)
  • 11b36e4 Extract HttpRequest creation to own method (#1660)
  • 82fc862 Fix wildcard redirect URI validation for Netlify double-dash deploy previews ...
  • Additional commits viewable in compare view

Updates flower from 2.0.1 to 2.1.0

Release notes

Sourced from flower's releases.

v2.1.0

Features

  • Added read-only mode for the UI and API by @​MrEarle #1468
  • Updated the UI with a responsive design
  • Added persistent dark mode with light and system theme options
  • Added a browser favicon by @​rolfws #1502
  • Improved task search with boolean operators and field filters
  • Preserved task-table preferences across visits by @​fretman92 #1333
  • Added TLS support for Redis Sentinel by @​cyberjunk #1327
  • Added AMQPS support for RabbitMQ connections by @​borland667
  • Updated and auto-provisioned the Grafana dashboard

Performance and reliability

  • Moved blocking broker and control operations off the I/O loop
  • Made Redis queue inspection asynchronous and pipelined
  • Prevented duplicate worker inspections
  • Fixed broker connection leaks #1490
  • Purged stale offline-worker Prometheus metrics #1128
  • Persisted dashboard counters across restarts #787
  • Improved handling of missing custom configuration files

Bug fixes

  • Fixed Redis SSL configurations #1177
  • Fixed percent-encoded IPv6 broker addresses #1220
  • Stopped exposing broker alternate URLs in worker statistics #1512
  • Fixed broker page rendering when queue inspection fails by @​alexei #1501
  • Fixed autoscaling response interpolation by @​funkyrailroad #1427
  • Improved GitHub OAuth errors when email access is unavailable by @​bysiber #1486
  • Prevented authentication failures while rendering error pages #1268, #1499
  • Fixed task search for non-string values #1401
  • Fixed task state filters to require the state prefix by @​AleksaMCode #1516
  • Fixed worker names in timeout and rate-limit error responses by @​phanky1 #1506
  • Fixed startup banner output when using a dynamic port #1449
  • Fixed worker active-task totals when counts are null by @​M4RC0Sx #1511
  • Fixed undefined worker pool grow and shrink values by @​daydaychen #1324

Documentation

... (truncated)

Changelog

Sourced from flower's changelog.

Flower 2.1.0

Features

  • Added read-only mode for the UI and API #1468 by @​MrEarle.
  • Updated the UI with a responsive design.
  • Added persistent dark mode with light and system theme options.
  • Added a browser favicon #1502 by @​rolfws.
  • Improved task search with boolean operators and field filters.
  • Preserved task-table preferences across visits #1333 by @​fretman92.
  • Added TLS support for Redis Sentinel #1327 by @​cyberjunk.
  • Added AMQPS support for RabbitMQ connections by @​borland667.
  • Updated and auto-provisioned the Grafana dashboard.
  • Enabled API access in the Docker Compose demo.

Performance and reliability

  • Moved blocking broker and control operations off the I/O loop.
  • Made Redis queue inspection asynchronous and pipelined.
  • Prevented duplicate worker inspections.
  • Fixed broker connection leaks #1490.
  • Purged stale offline-worker Prometheus metrics #1128.
  • Persisted dashboard counters across restarts #787.
  • Improved handling of missing custom configuration files.
  • Fixed startup banner output when using a dynamic port #1449.
  • Fixed worker active-task totals when counts are null #1511 by @​M4RC0Sx.
  • Fixed undefined worker pool grow and shrink values #1324 by @​daydaychen.

Bug fixes

  • Fixed Redis SSL configurations #1177.
  • Fixed percent-encoded IPv6 broker addresses #1220.
  • Stopped exposing broker alternate URLs in worker statistics #1512.
  • Fixed broker page rendering when queue inspection fails #1501 by @​alexei.
  • Fixed autoscaling response interpolation #1427 by @​funkyrailroad.
  • Improved GitHub OAuth errors when email access is unavailable #1486 by @​bysiber.
  • Prevented authentication failures while rendering error pages #1268, #1499.
  • Fixed task search for non-string values #1401.
  • Fixed task state filters to require the state prefix #1516 by @​AleksaMCode.
  • Fixed worker names in timeout and rate-limit error responses #1506 by @​phanky1.

Documentation

... (truncated)

Commits
  • 3597bd1 Set release version
  • d083f73 Update documentation for 2.1.0
  • b58869b Merge remote-tracking branch 'origin/master' into 2.0
  • e6cf8ef Add Python 3.13 and 3.14 support
  • 8ecede9 Document custom authentication providers
  • 00d310b Persist dashboard counters across restarts
  • 0a51160 Purge offline workers from metrics
  • 72a09c8 Prevent duplicate worker inspections
  • 17ead90 Make Redis queue inspection non-blocking
  • b11ddcb Update blocking operation handling
  • Additional commits viewable in compare view

Updates faker from 40.31.0 to 40.36.0

Release notes

Sourced from faker's releases.

Release v40.36.0

See CHANGELOG.md.

Release v40.35.0

See CHANGELOG.md.

Release v40.34.0

See CHANGELOG.md.

Release v40.33.2

See CHANGELOG.md.

Release v40.33.1

See CHANGELOG.md.

Release v40.33.0

See CHANGELOG.md.

Release v40.32.0

See CHANGELOG.md.

Changelog

Sourced from faker's changelog.

v40.36.0 - 2026-07-24

  • Fix: correct uk_UA bban_format to 6 digits + 19 letters so iban() generates valid Ukrainian IBANs (#2417). Thanks @​CedricConday.

v40.35.0 - 2026-07-22

  • Fix: add correct bban_format so ru_RU iban() generates valid Russian IBANs (#2416). Thanks @​CedricConday.

v40.34.0 - 2026-07-22

  • Fix: correct BBAN length so da_DK iban() generates valid Danish IBANs (#2409). Thanks @​CedricConday.

v40.33.2 - 2026-07-22

  • Validate positive=True against a non-positive max_value in pydecimal (#2428). Thanks @​Sreekant13.

v40.33.1 - 2026-07-22

  • Make uuid1() and uuid7() reproducible under a fixed seed (#2427). Thanks @​vidigoat.

v40.33.0 - 2026-07-22

  • Add alphanumeric CNPJ support for pt_BR via flag (#2402). Thanks @​moohbr.

v40.32.0 - 2026-07-20

Commits
  • 62d5a6a Bump version: 40.35.0 → 40.36.0
  • 09c254a 📝 Update CHANGELOG.md
  • ce45ebd fix(uk_UA): correct bban_format to 6 digits + 19 letters so iban() is valid (...
  • 8ad78a6 Merge pull request #2434 from joke2k/joke2k-security-md
  • ce3d3b1 Add SECURITY.md to the manifest file
  • ac535cf Revise security policy for clarity and updates
  • 4b7d4d7 💄 Lint code
  • 2e83f45 Bump version: 40.34.0 → 40.35.0
  • b1caba1 📝 Update CHANGELOG.md
  • 706aaca 💄 Lint code
  • Additional commits viewable in compare view

Updates pytest-django from 4.12.0 to 4.14.0

Release notes

Sourced from pytest-django's releases.

v4.14.0

https://pytest-django.readthedocs.io/en/stable/changelog.html#v4-14-0-2026-08-10

v4.13.0

https://pytest-django.readthedocs.io/en/latest/changelog.html#v4-13-0-2026-08-06

Changelog

Sourced from pytest-django's changelog.

v4.14.0 (2026-08-10)

Compatibility ^^^^^^^^^^^^^

  • Restored (unofficial) support for Django 5.0 and Django 5.1.

Improvements ^^^^^^^^^^^^

  • Added a django extra to the package. By depending on this extra (e.g. pip install pytest-django[django]), the dependency resolver will ensure you get a version of pytest-django that is compatible with your version of Django (lower bound only). At least from now on...

v4.13.0 (2026-08-06)

Compatibility ^^^^^^^^^^^^^

  • Dropped support for Django 4.2 and 5.1.

Improvements ^^^^^^^^^^^^

  • Export pytest_django.Settings from the top-level pytest_django module so the :fixture:settings fixture can be type-annotated ([#1257](https://github.com/pytest-dev/pytest-django/issues/1257) <https://github.com/pytest-dev/pytest-django/issues/1257>__).

Bugfixes ^^^^^^^^

  • Fixed type hints of assert methods to match actual signature (PR [#1271](https://github.com/pytest-dev/pytest-django/issues/1271) <https://github.com/pytest-dev/pytest-django/pull/1271>__)
  • Handled Django 6.2's ImproperlyConfigured (in addition to ImportError) when the configured DJANGO_SETTINGS_MODULE cannot be imported, so pytest-django still shows its guidance message.
  • Fixed django_db(transaction=True) tests being set up twice, which repeated the serialized_rollback restore and the fixtures load, and sent setting_changed and post_migrate twice when available_apps is set.
  • Fixed --help/--version failing with AppRegistryNotReady (surfaced as a could not load initial conftests warning) when a conftest.py imports Django models at the top level. Django is now set up even when --help/--version are passed, before the initial conftests are loaded for these options ([#1152](https://github.com/pytest-dev/pytest-django/issues/1152) <https://github.com/pytest-dev/pytest-django/issues/1152>__).
Commits
  • 1a6b612 Release 4.14.0
  • fffb11d docs: remove $ for consistency
  • e8c0606 docs: move the django extra explanation
  • b66deb6 tests: strict import to make pyright happy
  • 823db39 tests: fix wrong type (typing only)
  • a1eaf5d Drop django<5 message asserts compat
  • 2ea1423 Fix _pre_setup_ran_eagerly on Django 5.0 and 5.1
  • 903429c Add django extra to ensure Django dependency compatible lower bound
  • 9661589 docs: prefer newer pytest config TOML format
  • 7646196 docs: remove needless comment
  • Additional commits viewable in compare view

Updates django-stubs from 6.0.7 to 6.1.0

Commits

Updates djlint from 1.40.7 to 1.44.2

Release notes

Sourced from djlint's releases.

v1.44.2

Fix

  • H037 no longer reports two attributes whose names differ only before a . as duplicates (data-a.checked and data-b.checked, or alpine's x-on:click.prevent and x-on:keyup.prevent).
  • An attribute whose name merely ends in the name a rule looks for is no longer mistaken for it. data-alt and data-x.alt left H013 silent on an image with no alt, data-lang and xml:lang silenced H005, data-height and data-width silenced H006, data-name="description" silenced H030 and data-name="keywords" silenced H031, and data-x.id satisfied a <label for> for H042.
  • A name written inside an attribute value is no longer read as an attribute. title="alt=x" left H013 silent, class="language-en" silenced H005, and title="the ID=5" was reported by H010 as an uppercase attribute name.
  • H005 no longer reports a tag whose name only starts with html, such as <htmlx>, and points at the <html> tag itself rather than at everything up to the last > in the file.

v1.44.1

Fix

  • Formatting no longer changes what the page renders. A space that shows was dropped (<span>a</span><span> b </span> rendered as ab, a{% if x %} b {% endif %}c as abc), a space that shows nothing was added (<span> </span> became <span> </span>), and moving a tag onto its own line could add one (x<img>y, or across a comment as in a{# c #}<img>). Whitespace is now kept where it renders and dropped where it does not.
  • A line break inside an attribute value is kept, so a title tooltip no longer loses a line and a data- value read by script no longer comes back different. Line breaks in class, style, srcset and sizes mean nothing and are still joined.
  • Indentation inside <pre> and <textarea> is left alone when the closing tag has something after it on its line (<pre> a\n b</pre> tail).
  • Whitespace css does not collapse, such as U+2005, is text, and is no longer stripped from the edges of an element or of the file.
  • Two indenting fixes: a line that closes one tag and opens another (</b><i>) indents its contents again, and a line that closes more tags than it opens unindents even when a whole tag ends it (</b><small></small>). Both left the lines after them at the wrong level.
  • --line-break-after-multiline-tag now applies only to tags actually written over several lines, as its help says. It was holding back the content of every element, splitting tags that fit on one line.
  • A class value is tidied wherever it was written: class=" a b " becomes class="a b". A tag whose attribute value holds a line break is spread over lines, since it cannot fit on one.

v1.44.0

Feature

  • New --allow-empty-input option, and the matching allow_empty_input config key, exits 0 instead of 2 when the given paths match no files.

Fix

  • An html close tag inside an inline {% if %}...{% endif %} no longer dedents everything that follows it by one level, collapsing nested structures toward column 0 - a regression in 1.43.0. A close tag already at the content level of the template block it sits in is held there, but the level it was denied was then taken off the end of the line instead, so {% if r %}</strong>{% endif %} moved the rest of the block left. The matching open tag never took a level to give back, since {% endif %} had already returned it.
  • A run where every file found was skipped by exclude, extend_exclude, use_gitignore or require_pragma now exits 0 instead of 1. Skipping them is the configuration doing its job, and it is what lets exclude work under pre-commit, which passes the names of every staged file. Paths that match no files at all now exit 2 rather than 1, so exit 1 means only that djLint found something to report.
  • An unhandled error exits 2 instead of 1, so a crash is no longer indistinguishable from a lint error. The traceback is still printed.
  • An unrecognized --profile, or profile in a config file, is now a usage error. A typo used to lint with a silently different rule set and exit 0, and raised KeyError with --require-pragma.
  • A directory whose name matches the file extension (build.html/) is no longer picked up as a template and opened as a file, crashing the run.
  • No files to check! is written to stderr instead of stdout, where formatted code is written.
  • Input piped to djlint - --reformat that --require-pragma skips is handed back byte for byte instead of being replaced by No files to check!.

v1.43.2

Fix

  • blank_line_before_tag no longer inserts a blank line when the previous line opens a block and increases the indentation, e.g. between <div> and {% block %}. Since 1.41.0 blank_line_after_tag has left the closing edge of a block alone ({% endblock %} before </div>), while the opening edge kept its padding, so a template using both options came out lopsided.

v1.43.1

Fix

  • H025 no longer reports the closing tag of a multi-line <script> or <style> as an orphan - a regression in 1.43.0. A genuinely unmatched </script> is still reported.

v1.43.0

Feature

  • New --stdin-filename option gives content piped in on stdin (djlint -) its real path, so per-file-ignores matches against that name and linter messages report it. Per-file ignores were previously dead for piped input, since nothing matches the name -. Path separators are normalized as they are for files on disk.

Fix

... (truncated)

Changelog

Sourced from djlint's changelog.

[1.44.2] - 2026-08-08

Fix

  • H037 no longer reports two attributes whose names differ only before a . as duplicates (data-a.checked and data-b.checked, or alpine's x-on:click.prevent and x-on:keyup.prevent).
  • An attribute whose name merely ends in the name a rule looks for is no longer mistaken for it. data-alt and data-x.alt left H013 silent on an image with no alt, data-lang and xml:lang silenced H005, data-height and data-width silenced H006, data-name="description" silenced H030 and data-name="keywords" silenced H031, and data-x.id satisfied a <label for> for H042.
  • A name written inside an attribute value is no longer read as an attribute. title="alt=x" left H013 silent, class="language-en" silenced H005, and title="the ID=5" was reported by H010 as an uppercase attribute name.
  • H005 no longer reports a tag whose name only starts with html, such as <htmlx>, and points at the <html> tag itself rather than at everything up to the last > in the file.

[1.44.1] - 2026-08-07

Fix

  • Formatting no longer changes what the page renders. A space that shows was dropped (<span>a</span><span> b </span> rendered as ab, a{% if x %} b {% endif %}c as abc), a space that shows nothing was added (<span> </span> became <span> </span>), and moving a tag onto its own line could add one (x<img>y, or across a comment as in a{# c #}<img>). Whitespace is now kept where it renders and dropped where it does not.
  • A line break inside an attribute value is kept, so a title tooltip no longer loses a line and a data- value read by script no longer comes back different. Line breaks in class, style, srcset and sizes mean nothing and are still joined.
  • Indentation inside <pre> and <textarea> is left alone when the closing tag has something after it on its line (<pre> a\n b</pre> tail).
  • Whitespace css does not collapse, such as U+2005, is text, and is no longer stripped from the edges of an element or of the file.
  • Two indenting fixes: a line that closes one tag and opens another (</b><i>) indents its contents again, and a line that closes more tags than it opens unindents even when a whole tag ends it (</b><small></small>). Both left the lines after them at the wrong level.
  • --line-break-after-multiline-tag now applies only to tags actually written over several lines, as its help says. It was holding back the content of every element, splitting tags that fit on one line.
  • A class value is tidied wherever it was written: class=" a b " becomes class="a b". A tag whose attribute value holds a line break is spread over lines, since it cannot fit on one.

[1.44.0] - 2026-08-04

Feature

  • New --allow-empty-input option, and the matching allow_empty_input config key, exits 0 instead of 2 when the given paths match no files.

Fix

  • An html close tag inside an inline {% if %}...{% endif %} no longer dedents everything that follows it by one level, collapsing nested structures toward column 0 - a regression in 1.43.0. A close tag already at the content level of the template block it sits in is held there, but the level it was denied was then taken off the end of the line instead, so {% if r %}</strong>{% endif %} moved the rest of the block left. The matching open tag never took a level to give back, since {% endif %} had already returned it.
  • A run where every file found was skipped by exclude, extend_exclude, use_gitignore or require_pragma now exits 0 instead of 1. Skipping them is the configuration doing its job, and it is what lets exclude work under pre-commit, which passes the names of every staged file. Paths that match no files at all now exit 2 rather than 1, so exit 1 means only that djLint found something to report.
  • An unhandled error exits 2 instead of 1, so a crash is no longer indistinguishable from a lint error. The traceback is still printed.
  • An unrecognized --profile, or profile in a config file, is now a usage error. A typo used to lint with a silently different rule set and exit 0, and raised KeyError with --require-pragma.
  • A directory whose name matches the file extension (build.html/) is no longer picked up as a template and opened as a file, crashing the run.
  • No files to check! is written to stderr instead of stdout, where formatted code is written.
  • Input piped to djlint - --reformat that --require-pragma skips is handed back byte for byte instead of being replaced by No files to check!.

[1.43.2] - 2026-08-01

Fix

  • blank_line_before_tag no longer inserts a blank line when the previous line opens a block and increases the indentation, e.g. between <div> and {% block %}. Since 1.41.0 blank_line_after_tag has left the closing edge of a block alone ({% endblock %} before </div>), while the opening edge kept its padding, so a template using both options came out lopsided.

[1.43.1] - 2026-07-28

Fix

  • H025 no longer reports the closing tag of a multi-line <script> or <style> as an orphan - a regression in 1.43.0. A genuinely unmatched </script> is still reported.

[1.43.0] - 2026-07-27

... (truncated)

Commits
  • 76675b6 v1.44.2
  • c6016b2 fix(linter): don't read an attribute name from the middle in H037
  • 9de6448 chore(deps): lock file maintenance (#2351)
  • e7d5056 chore(deps): update dependency cssnano to v8.0.3 (#2350)
  • 8c7a95b chore(deps): lock file maintenance (#2349)
  • 03a5f48 chore(deps): update dependency @​codemirror/lang-html to v6.4.12 (#2348)
  • fb312f9 improve docs & code comments
  • 919439f chore(deps): lock file maintenance (#2347)
  • Description has been truncated

@dependabot
build(deps): bump the minor-and-patch group across 1 directory with 1…
4f16134 
…2 updates

Bumps the minor-and-patch group with 12 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [boto3](https://github.com/boto/boto3) | `1.43.49` | `1.43.74` |
| [django-htmx](https://github.com/adamchainz/django-htmx) | `1.28.0` | `1.29.0` |
| [django-oauth-toolkit](https://github.com/django-oauth/django-oauth-toolkit) | `3.3.0` | `3.4.0` |
| [flower](https://github.com/mher/flower) | `2.0.1` | `2.1.0` |
| [faker](https://github.com/joke2k/faker) | `40.31.0` | `40.36.0` |
| [pytest-django](https://github.com/pytest-dev/pytest-django) | `4.12.0` | `4.14.0` |
| [django-stubs](https://github.com/typeddjango/django-stubs) | `6.0.7` | `6.1.0` |
| [djlint](https://github.com/djlint/djLint) | `1.40.7` | `1.44.2` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.7.6` | `9.7.7` |
| [django-test-plus](https://github.com/revsys/django-test-plus) | `2.4.1` | `2.6.2` |
| [pytest-lazy-fixtures](https://github.com/dev-petrov/pytest-lazy-fixtures) | `1.4.0` | `1.4.1` |
| [ruff](https://github.com/astral-sh/ruff) | `0.15.21` | `0.16.3` |



Updates `boto3` from 1.43.49 to 1.43.74
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.43.49...1.43.74)

Updates `django-htmx` from 1.28.0 to 1.29.0
- [Changelog](https://github.com/adamchainz/django-htmx/blob/main/docs/changelog.rst)
- [Commits](adamchainz/django-htmx@1.28.0...1.29.0)

Updates `django-oauth-toolkit` from 3.3.0 to 3.4.0
- [Release notes](https://github.com/django-oauth/django-oauth-toolkit/releases)
- [Changelog](https://github.com/django-oauth/django-oauth-toolkit/blob/master/CHANGELOG.md)
- [Commits](django-oauth/django-oauth-toolkit@3.3.0...3.4.0)

Updates `flower` from 2.0.1 to 2.1.0
- [Release notes](https://github.com/mher/flower/releases)
- [Changelog](https://github.com/mher/flower/blob/v2.1.0/CHANGELOG.md)
- [Commits](mher/flower@v2.0.1...v2.1.0)

Updates `faker` from 40.31.0 to 40.36.0
- [Release notes](https://github.com/joke2k/faker/releases)
- [Changelog](https://github.com/joke2k/faker/blob/master/CHANGELOG.md)
- [Commits](joke2k/faker@v40.31.0...v40.36.0)

Updates `pytest-django` from 4.12.0 to 4.14.0
- [Release notes](https://github.com/pytest-dev/pytest-django/releases)
- [Changelog](https://github.com/pytest-dev/pytest-django/blob/main/docs/changelog.rst)
- [Commits](pytest-dev/pytest-django@v4.12.0...v4.14.0)

Updates `django-stubs` from 6.0.7 to 6.1.0
- [Release notes](https://github.com/typeddjango/django-stubs/releases)
- [Commits](typeddjango/django-stubs@6.0.7...6.1.0)

Updates `djlint` from 1.40.7 to 1.44.2
- [Release notes](https://github.com/djlint/djLint/releases)
- [Changelog](https://github.com/djlint/djLint/blob/master/CHANGELOG.md)
- [Commits](djlint/djLint@v1.40.7...v1.44.2)

Updates `mkdocs-material` from 9.7.6 to 9.7.7
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.7.6...9.7.7)

Updates `django-test-plus` from 2.4.1 to 2.6.2
- [Changelog](https://github.com/revsys/django-test-plus/blob/main/CHANGELOG.md)
- [Commits](revsys/django-test-plus@2.4.1...2.6.2)

Updates `pytest-lazy-fixtures` from 1.4.0 to 1.4.1
- [Release notes](https://github.com/dev-petrov/pytest-lazy-fixtures/releases)
- [Commits](dev-petrov/pytest-lazy-fixtures@1.4.0...1.4.1)

Updates `ruff` from 0.15.21 to 0.16.3
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.15.21...0.16.3)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.43.74
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: django-htmx
  dependency-version: 1.29.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: django-oauth-toolkit
  dependency-version: 3.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: flower
  dependency-version: 2.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: faker
  dependency-version: 40.36.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pytest-django
  dependency-version: 4.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: django-stubs
  dependency-version: 6.1.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: djlint
  dependency-version: 1.44.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: mkdocs-material
  dependency-version: 9.7.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: django-test-plus
  dependency-version: 2.6.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: pytest-lazy-fixtures
  dependency-version: 1.4.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: ruff
  dependency-version: 0.16.3
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file minor PRs that should result in a minor version bump (new small features) python:uv Pull requests that update python:uv code labels Aug 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file minor PRs that should result in a minor version bump (new small features) python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants