Skip to content

Bump the production-dependencies group across 1 directory with 22 updates - #2005

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/main/production-dependencies-fc1ff24f2a
Open

Bump the production-dependencies group across 1 directory with 22 updates#2005
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/main/production-dependencies-fc1ff24f2a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 2, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the production-dependencies group with 22 updates in the / directory:

Package From To
flask 3.1.1 3.1.3
flask-wtf 1.2.2 1.3.0
google-cloud-datastore 2.20.2 2.26.1
gunicorn 23.0.0 26.2.0
pika 1.3.2 1.4.4
pyyaml 6.0.2 6.0.3
requests 2.33.0 2.34.2
sdc-cryptography 1.2.1 1.4.0
structlog 25.2.0 26.1.0
boto3 1.37.23 1.37.38
marshmallow 3.26.2 4.3.1
google-cloud-storage 3.1.0 3.15.0
jsonpointer 3.0.0 3.1.1
redis 7.1.0 8.1.0
flask-compress 1.17 1.25
email-validator 2.2.0 2.3.0
google-cloud-pubsub 2.29.0 2.41.0
google-cloud-tasks 2.19.2 2.25.0
simplejson 3.20.1 4.1.2
markupsafe 3.0.2 3.0.3
cachetools 6.2.2 7.2.0
gevent 25.9.1 26.9.0

Updates flask from 3.1.1 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

  • stream_with_context does not fail inside async views. #5774
  • When using follow_redirects in the test client, the final state of session is correct. #5786
  • Relax type hint for passing bytes IO to send_file. #5776
Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

  • The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

  • stream_with_context does not fail inside async views. :issue:5774
  • When using follow_redirects in the test client, the final state of session is correct. :issue:5786
  • Relax type hint for passing bytes IO to send_file. :issue:5776
Commits
  • 22d9247 release version 3.1.3
  • 089cb86 Merge commit from fork
  • c17f379 request context tracks session access
  • 27be933 start version 3.1.3
  • 4e652d3 Abort if the instance folder cannot be created (#5903)
  • 3d03098 Abort if the instance folder cannot be created
  • 407eb76 document using gevent for async (#5900)
  • ac5664d document using gevent for async
  • 4f79d5b Increase required flit_core version to 3.11 (#5865)
  • fe3b215 Increase required flit_core version to 3.11
  • Additional commits viewable in compare view

Updates flask-wtf from 1.2.2 to 1.3.0

Release notes

Sourced from flask-wtf's releases.

v1.3.0

What's Changed

New Contributors

Full Changelog: pallets-eco/flask-wtf@v1.2.2...v1.3.0

Changelog

Sourced from flask-wtf's changelog.

Version 1.3.0

Released 2026-04-23

  • Don't read the whole uploaded files to know their size. :pr:635
  • Stop support for Python 3.9. Start support for Python 3.14. :pr:648
  • Migrate the project to uv. :pr:649
  • Allow setting a nonce on :class:~flask_wtf.recaptcha.RecaptchaField (string or zero-argument callable) for nonce-based Content Security Policies. :pr:312
  • Add csrf_meta_tag() helper and WTF_CSRF_META_NAME setting to render the CSRF token as an HTML <meta> tag.
  • Forward keyword arguments passed to the reCAPTCHA widget as HTML attributes on the captcha <div>, with the field id used as a default id. :pr:353
  • Add apply_exemptions parameter to :meth:~flask_wtf.csrf.CSRFProtect.protect so @csrf.exempt keeps working when validation is triggered manually. :pr:419
  • Add RECAPTCHA_ENABLED setting. :pr:509
Commits

Updates google-cloud-datastore from 2.20.2 to 2.26.1

Release notes

Sourced from google-cloud-datastore's releases.

google-cloud-tasks: v2.26.0

2.26.0 (2026-10-01)

Features

  • declare Python3.15 support (8775794)

google-cloud-os-login: v2.23.0

2.23.0 (2026-10-01)

Features

  • declare Python3.15 support (8775794)

google-cloud-recommender: v2.23.0

2.23.0 (2026-10-01)

Features

  • declare Python3.15 support (8775794)

google-cloud-redis: v2.23.0

2.23.0 (2026-10-01)

Features

  • declare Python3.15 support (8775794)

google-cloud-talent: v2.22.0

2.22.0 (2026-10-01)

Features

  • declare Python3.15 support (8775794)

google-cloud-scheduler: v2.21.0

2.21.0 (2026-10-01)

Features

  • declare Python3.15 support (8775794)

google-cloud-videointelligence: v2.21.0

2.21.0 (2026-10-01)

... (truncated)

Changelog

Sourced from google-cloud-datastore's changelog.

Changelog

PyPI History

3.16.0 (2026-10-01)

Features

  • declare Python3.15 support (8775794)

3.15.0 (2026-06-02)

Features

3.14.0 (2026-04-02)

Features

3.13.0 (2026-03-26)

Features

Bug Fixes

3.12.0 (2026-03-23)

Features

3.11.0 (2026-03-05)

... (truncated)

Commits
  • 3e29682 chore: release main (#18013)
  • b4d9717 feat: check python and dependency versions in spanner packages (#18177)
  • 66794a0 chore(bigtable): Rerouted legacy client row filters to data client row filter...
  • b42122e Revert "fix(auth): parse hostname for mTLS and PSC endpoint certifica… (#18189)
  • e20796a fix(google-auth-oauthlib): prevent port re-use on windows (#18166)
  • b642373 fix(auth): parse hostname for mTLS and PSC endpoint certificate rotat… (#18153)
  • 5bc3899 feat(spanner): add DataBoost and auto_partition_mode support to DBAPI driver ...
  • 2b056ab docs(django-spanner, common-protos): centralize CONTRIBUTING.rst pointers (#1...
  • 91d5e2a chore(bigtable): added warning to MutationsBatcher (#18176)
  • 23b9499 docs(handwritten): centralize CONTRIBUTING.rst pointers (#17642)
  • Additional commits viewable in compare view

Updates gunicorn from 23.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

  • Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits
  • 36f2a3c gunicorn 26.2.0
  • cbba350 test: cover the h2c edge paths that had none
  • 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
  • 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
  • 5853551 Merge pull request #3712 from Rotzbua/patch-1
  • 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
  • 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
  • 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
  • 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
  • 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
  • Additional commits viewable in compare view

Updates pika from 1.3.2 to 1.4.4

Release notes

Sourced from pika's releases.

1.4.4

https://pypi.org/project/pika/1.4.4/ | GitHub milestone

1.4.2

https://pypi.org/project/pika/1.4.2/ | GitHub milestone

1.4.1

https://pypi.org/project/pika/1.4.1/ | GitHub milestone

1.4.0

https://pypi.org/project/pika/1.4.0/ | GitHub milestone

What's Changed

... (truncated)

Changelog

Sourced from pika's changelog.

1.4.4 (2026-08-06)

Full Changelog

Merged pull requests:

  • Revert "Fix callLater typing by passing keyword arguments" #1678 (jeremycline)

1.4.2 (2026-07-23)

Full Changelog

Closed issues:

  • Importing pika.adapters can break asyncio subprocesses on Windows #1639

Merged pull requests:

  • Stop mutating global asyncio event loop policy on import #1642 (lukebakken)

1.4.1 (2026-05-22)

Merged pull requests:

  • Fix Channel.close() for channels with multiple consumers #1596 (gbenson)

1.4.0 (2026-05-06)

Full Changelog

Implemented enhancements:

Closed issues:

  • Add Hatch scripts to standardize developer commands #1578
  • Fix outdated and broken documentation across the project #1568
  • Update Codecov default branch and badge #1563
  • GitHub actions workflows and test code need updates for RabbitMQ 4.3 #1547
  • datetime.datetime.utcfromtimestamp() is deprecated #1539
  • URLParameters这个类有bug #1533
  • Custom transport #1532
  • x-delay value is being returned in the header as a UINT64 and not a SINT16 #1531
  • Pika should advertise the exchange_exchange_bindings client capability #1530
  • Missing type annotations #1523
  • There is no info about return type of queue_declare() method of pika.channel #1522
  • Getting the user who sent the message #1510

... (truncated)

Commits

Updates pyyaml from 6.0.2 to 6.0.3

Release notes

Sourced from pyyaml's releases.

6.0.3

What's Changed

  • Support for Python 3.14 and free-threading (experimental).

Full Changelog: yaml/pyyaml@6.0.2...6.0.3

Changelog

Sourced from pyyaml's changelog.

6.0.3 (2025-09-25)

  • yaml/pyyaml#864 -- Support for Python 3.14 and free-threading (experimental)
Commits

Updates requests from 2.33.0 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

Updates sdc-cryptography from 1.2.1 to 1.4.0

Release notes

Sourced from sdc-cryptography's releases.

1.4.0

What's Changed

Full Changelog: ONSdigital/sdc-cryptography@1.3.0...1.4.0

1.3.0

What's Changed

New Contributors

Full Changelog: ONSdigital/sdc-cryptography@1.2.3...1.3.0

1.2.3

What's Changed

New Contributors

Full Changelog: ONSdigital/sdc-cryptography@1.2.1...1.2.3

Changelog

Sourced from sdc-cryptography's changelog.

1.4.0

1.3.0

  • Migrate to poetry
  • Add support for Python 3.13 and 3.14
  • Remove support for Python 3.9 (not supported by Poetry)

1.2.3

  • Update cryptography to 48.0.1

1.2.2

  • Update cryptography to 44.0.1
Commits
  • 30e4454 Fix release version 1.4.0 in pyproject.toml (#69)
  • 5f31285 Update cryptography to 50.0.0 due to CVE-2026-69247 (#67)
  • 3441372 Fix publish to pypi GitHub action (python version quoting) (#66)
  • 9d5602c Migrate to Poetry (#65)
  • 9b0666a Bump cryptography to 48.0.1 (#64)
  • 320ec82 Bump cryptography from 43.0.0 to 44.0.1 in the pip group & add CODEOWNERS fil...
  • 557ddd8 Add Permissions to Workflow & Pin Unpinned Tags for Non-Immutable Actions (#61)
  • See full diff in compare view

Updates structlog from 25.2.0 to 26.1.0

Release notes

Sourced from structlog's releases.

26.1.0

Highlights

Given how long this release took, it's pretty thicc with nice things all over the board! Apologies for the long release cycle; it's been a victim of the slopocalypse and me trying to navigate my way thru the new normal. Extra big thanks to my sponsors for not abandoning me in these unironically trying times. ❤️

Full changelog below!

Special Thanks

This release would not be possible without my generous sponsors! Thank you to all of you making sustainable maintenance possible! If you would like to join them, go to https://github.com/sponsors/hynek and check out the sweet perks!

Above and Beyond

Variomedia AG (@variomedia), Tidelift (@tidelift), Kraken Tech (@kraken-tech), Klaviyo (@klaviyo), Privacy Solutions GmbH (@privacy-solutions), FilePreviews (@filepreviews), Ecosystems (@ecosyste-ms), TestMu AI Open Source Office (Formerly LambdaTest) (@LambdaTest-Inc), GitHub (@github), Doist (@Doist), Daniel Fortunov (@asqui), and Kevin P. Fleming (@kpfleming).

Maintenance Sustainers

Buttondown (@buttondown), Christopher Dignam (@chdsbd), Magnus Watn (@magnuswatn), David Cramer (@dcramer), Rivo Laks (@rivol), Polar (@polarsource), Mike Fiedler (@miketheman), Duncan Hill (@cricalix), Colin Marquardt (@cmarqu), Pieter Swinkels (@Description has been truncated

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Oct 2, 2026
@dependabot
dependabot Bot requested a review from a team as a code owner October 2, 2026 07:16
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Oct 2, 2026
@dependabot
Bump the production-dependencies group across 1 directory with 22 upd…
218963b 
…ates

Bumps the production-dependencies group with 22 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [flask](https://github.com/pallets/flask) | `3.1.1` | `3.1.3` |
| [flask-wtf](https://github.com/pallets-eco/flask-wtf) | `1.2.2` | `1.3.0` |
| [google-cloud-datastore](https://github.com/googleapis/google-cloud-python) | `2.20.2` | `2.26.1` |
| [gunicorn](https://github.com/benoitc/gunicorn) | `23.0.0` | `26.2.0` |
| [pika](https://github.com/pika/pika) | `1.3.2` | `1.4.4` |
| [pyyaml](https://github.com/yaml/pyyaml) | `6.0.2` | `6.0.3` |
| [requests](https://github.com/psf/requests) | `2.33.0` | `2.34.2` |
| [sdc-cryptography](https://github.com/ONSdigital/sdc-cryptography) | `1.2.1` | `1.4.0` |
| [structlog](https://github.com/hynek/structlog) | `25.2.0` | `26.1.0` |
| [boto3](https://github.com/boto/boto3) | `1.37.23` | `1.37.38` |
| [marshmallow](https://github.com/marshmallow-code/marshmallow) | `3.26.2` | `4.3.1` |
| [google-cloud-storage](https://github.com/googleapis/google-cloud-python) | `3.1.0` | `3.15.0` |
| [jsonpointer](https://github.com/stefankoegl/python-json-pointer) | `3.0.0` | `3.1.1` |
| [redis](https://github.com/redis/redis-py) | `7.1.0` | `8.1.0` |
| [flask-compress](https://github.com/colour-science/flask-compress) | `1.17` | `1.25` |
| [email-validator](https://github.com/JoshData/python-email-validator) | `2.2.0` | `2.3.0` |
| [google-cloud-pubsub](https://github.com/googleapis/google-cloud-python) | `2.29.0` | `2.41.0` |
| [google-cloud-tasks](https://github.com/googleapis/google-cloud-python) | `2.19.2` | `2.25.0` |
| [simplejson](https://github.com/simplejson/simplejson) | `3.20.1` | `4.1.2` |
| [markupsafe](https://github.com/pallets/markupsafe) | `3.0.2` | `3.0.3` |
| [cachetools](https://github.com/tkem/cachetools) | `6.2.2` | `7.2.0` |
| [gevent](https://github.com/gevent/gevent) | `25.9.1` | `26.9.0` |



Updates `flask` from 3.1.1 to 3.1.3
- [Release notes](https://github.com/pallets/flask/releases)
- [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst)
- [Commits](pallets/flask@3.1.1...3.1.3)

Updates `flask-wtf` from 1.2.2 to 1.3.0
- [Release notes](https://github.com/pallets-eco/flask-wtf/releases)
- [Changelog](https://github.com/pallets-eco/flask-wtf/blob/main/docs/changes.rst)
- [Commits](pallets-eco/flask-wtf@v1.2.2...v1.3.0)

Updates `google-cloud-datastore` from 2.20.2 to 2.26.1
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-documentai-v2.20.2...google-cloud-datastore-v2.26.1)

Updates `gunicorn` from 23.0.0 to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@23.0.0...26.2.0)

Updates `pika` from 1.3.2 to 1.4.4
- [Release notes](https://github.com/pika/pika/releases)
- [Changelog](https://github.com/pika/pika/blob/1.4.4/CHANGELOG.md)
- [Commits](pika/pika@1.3.2...1.4.4)

Updates `pyyaml` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/yaml/pyyaml/releases)
- [Changelog](https://github.com/yaml/pyyaml/blob/6.0.3/CHANGES)
- [Commits](yaml/pyyaml@6.0.2...6.0.3)

Updates `requests` from 2.33.0 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.0...v2.34.2)

Updates `sdc-cryptography` from 1.2.1 to 1.4.0
- [Release notes](https://github.com/ONSdigital/sdc-cryptography/releases)
- [Changelog](https://github.com/ONSdigital/sdc-cryptography/blob/master/CHANGELOG.md)
- [Commits](ONSdigital/sdc-cryptography@1.2.1...1.4.0)

Updates `structlog` from 25.2.0 to 26.1.0
- [Release notes](https://github.com/hynek/structlog/releases)
- [Changelog](https://github.com/hynek/structlog/blob/main/CHANGELOG.md)
- [Commits](hynek/structlog@25.2.0...26.1.0)

Updates `boto3` from 1.37.23 to 1.37.38
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.37.23...1.37.38)

Updates `marshmallow` from 3.26.2 to 4.3.1
- [Changelog](https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst)
- [Commits](marshmallow-code/marshmallow@3.26.2...4.3.1)

Updates `google-cloud-storage` from 3.1.0 to 3.15.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/gcp-sphinx-docfx-yaml/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-kms-v3.1.0...google-cloud-storage-v3.15.0)

Updates `jsonpointer` from 3.0.0 to 3.1.1
- [Commits](stefankoegl/python-json-pointer@v3.0.0...v3.1.1)

Updates `redis` from 7.1.0 to 8.1.0
- [Release notes](https://github.com/redis/redis-py/releases)
- [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES)
- [Commits](redis/redis-py@v7.1.0...v8.1.0)

Updates `flask-compress` from 1.17 to 1.25
- [Changelog](https://github.com/colour-science/flask-compress/blob/master/CHANGELOG.md)
- [Commits](colour-science/flask-compress@v1.17...v1.25)

Updates `email-validator` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/JoshData/python-email-validator/releases)
- [Changelog](https://github.com/JoshData/python-email-validator/blob/main/CHANGELOG.md)
- [Commits](JoshData/python-email-validator@v2.2.0...v2.3.0)

Updates `google-cloud-pubsub` from 2.29.0 to 2.41.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-api-core-v2.29.0...google-cloud-pubsub-v2.41.0)

Updates `google-cloud-tasks` from 2.19.2 to 2.25.0
- [Release notes](https://github.com/googleapis/google-cloud-python/releases)
- [Changelog](https://github.com/googleapis/google-cloud-python/blob/main/packages/google-cloud-documentai/CHANGELOG.md)
- [Commits](googleapis/google-cloud-python@google-cloud-tasks-v2.19.2...google-cloud-tasks-v2.25.0)

Updates `simplejson` from 3.20.1 to 4.1.2
- [Release notes](https://github.com/simplejson/simplejson/releases)
- [Changelog](https://github.com/simplejson/simplejson/blob/main/CHANGES.txt)
- [Commits](simplejson/simplejson@v3.20.1...v4.1.2)

Updates `markupsafe` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/pallets/markupsafe/releases)
- [Changelog](https://github.com/pallets/markupsafe/blob/main/CHANGES.rst)
- [Commits](pallets/markupsafe@3.0.2...3.0.3)

Updates `cachetools` from 6.2.2 to 7.2.0
- [Changelog](https://github.com/tkem/cachetools/blob/master/CHANGELOG.rst)
- [Commits](tkem/cachetools@v6.2.2...v7.2.0)

Updates `gevent` from 25.9.1 to 26.9.0
- [Release notes](https://github.com/gevent/gevent/releases)
- [Changelog](https://github.com/gevent/gevent/blob/master/docs/changelog_pre.rst)
- [Commits](gevent/gevent@25.9.1...26.9.0)

---
updated-dependencies:
- dependency-name: boto3
  dependency-version: 1.37.38
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: cachetools
  dependency-version: 7.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: email-validator
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: flask
  dependency-version: 3.1.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: flask-compress
  dependency-version: '1.25'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: flask-wtf
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: gevent
  dependency-version: 26.9.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: google-cloud-datastore
  dependency-version: 2.26.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: google-cloud-pubsub
  dependency-version: 2.41.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: google-cloud-storage
  dependency-version: 3.15.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: google-cloud-tasks
  dependency-version: 2.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: jsonpointer
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: markupsafe
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: marshmallow
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: pika
  dependency-version: 1.4.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: pyyaml
  dependency-version: 6.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: production-dependencies
- dependency-name: redis
  dependency-version: 8.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: sdc-cryptography
  dependency-version: 1.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: production-dependencies
- dependency-name: simplejson
  dependency-version: 4.1.2
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
- dependency-name: structlog
  dependency-version: 26.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: production-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/pip/main/production-dependencies-fc1ff24f2a branch from 535997c to 218963b Compare October 2, 2026 09:26
@ons-eq-team

ons-eq-team commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

Benchmark Results

Percentile Averages:
50th: 72ms
90th: 263ms
95th: 452ms
99th: 1114ms
99.9th: 2367ms
GETs (99th): 1290ms
POSTs (99th): 911ms

PDF: 11000ms
Session: 7800ms

Total Requests: 65,248
Total Failures: 0
Error Percentage: 0.0%

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ons-eq-team