build(deps): bump the pip group across 1 directory with 13 updates by dependabot[bot] · Pull Request #1 · alberto4003/electrum

dependabot · 2026-08-25T19:14:21Z

Bumps the pip group with 13 updates in the /contrib/deterministic-build directory:

Package	From	To
cryptography	`45.0.3`	`50.0.0`
pip	`25.1.1`	`26.1.2`
setuptools	`80.9.0`	`83.0.0`
wheel	`0.45.1`	`0.46.2`
cbor2	`5.6.5`	`5.9.0`
ecdsa	`0.19.1`	`0.19.2`
idna	`3.10`	`3.15`
protobuf	`3.20.3`	`5.29.6`
requests	`2.32.3`	`2.33.0`
urllib3	`1.26.20`	`2.7.0`
aiohttp	`3.12.9`	`3.14.3`
dnspython	`2.4.2`	`2.6.1`
sh	`2.2.2`	`2.2.4`

Updates cryptography from 45.0.3 to 50.0.0

Changelog

Sourced from cryptography's changelog.

50.0.0 - 2026-07-31


* **SECURITY ISSUE**:
  :func:`~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der`
  and its PEM and S/MIME variants no longer expose distinguishable errors or
  timing when unwrapping a ``RecipientInfo``'s ``encryptedKey``, which could
  act as a Bleichenbacher oracle for callers that decrypt untrusted messages.
  A random key is now substituted on failure, as described in :rfc:`3218`.
  Credit to **@X1AOxiang** for reporting the issue. **CVE-2026-69247**
* Deprecated Diffie-Hellman key exchange over finite fields (FFDH).
  Everything FFDH is deprecated, including the types in
  ``cryptography.hazmat.primitives.asymmetric.dh`` and loading FFDH keys or
  parameters with the key loading APIs. Users should migrate to a more
  modern key exchange algorithm.
* Added ``xof()`` class methods to
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE128` and
  :class:`~cryptography.hazmat.primitives.hashes.SHAKE256` for constructing
  algorithm instances configured for use with
  :class:`~cryptography.hazmat.primitives.hashes.XOFHash`.
* The :mod:`X.509 verification <cryptography.x509.verification>` APIs are now
  considered stable and are subject to our API stability policy.
* Added the :doc:`/cobblestone` recipe, an implementation of the
  Cobblestone-128 and Cobblestone-256 instantiations of the `C2SP
  chunked-encryption specification
  <https://c2sp.org/chunked-encryption>`_ for streaming authenticated
  encryption of large messages.
* Parsing a Signed Certificate Timestamp list now rejects encodings that
  carry trailing bytes after the list or after an individual SCT, instead of
  silently ignoring them.
* Added support for using :class:`~cryptography.x509.Name` as a field type in
  the :doc:`/hazmat/asn1/index` module.
* Loading a public key or an EC private key now rejects DER where the
  ``subjectPublicKey`` (or EC ``publicKey``) ``BIT STRING`` declares a non-zero
  number of unused bits, instead of silently ignoring it.
* Parsing a CRL entry's ``InvalidityDate`` extension now rejects a
  ``GeneralizedTime`` that carries fractional seconds or another non-DER form,
  matching the strict encoding already required for every other X.509 time
  field.
* :func:`~cryptography.x509.ocsp.load_der_ocsp_request` and
  :func:`~cryptography.x509.ocsp.load_der_ocsp_response` now reject a request
  or response whose ``version`` field is not ``v1``, the only version defined
  by RFC 6960, matching the version validation already performed when loading
  certificates, CSRs and CRLs.
* :class:`~cryptography.hazmat.primitives.hashes.XOFHash` is now supported
  when building against AWS-LC.
* HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when
  building against AWS-LC.
* Diffie-Hellman (:doc:`/hazmat/primitives/asymmetric/dh`) is now supported
  when building against AWS-LC.
</tr></table>

... (truncated)

Commits

dcb7050 Prepare for 50.0.0 release (#15372)
53fccd9 Don't leak how PKCS#7 encryptedKey decryption failed (#15369)
d472f97 Add from __future__ import annotations to all src/ Python files (#15371)
908773d Bump downstream dependencies in CI (#15368)
2cc07cc Bump BoringSSL, OpenSSL, AWS-LC in CI (#15367)
c94ede9 chore(deps): bump ruff from 0.16.0 to 0.16.1 (#15366)
67a8308 chore(deps): bump virtualenv from 21.7.0 to 21.7.1 (#15365)
95018ff Release the GIL in one-shot AEAD encrypt/decrypt (#15361)
6954733 Release the GIL during DH and DSA parameter generation (#15364)
6893b94 Import _serialization instead of serialization in x509/extensions (#15363)
Additional commits viewable in compare view

Updates pip from 25.1.1 to 26.1.2

Changelog

Sourced from pip's changelog.

26.1.2 (2026-05-31)

Bug Fixes

Reject console_scripts and gui_scripts entry points whose name would install a script outside the scripts directory. ([#14000](https://github.com/pypa/pip/issues/14000) <https://github.com/pypa/pip/issues/14000>_)

Fix installation incorrectly failing when the target path contains a doubled slash, such as with pip install --root //.... ([#14001](https://github.com/pypa/pip/issues/14001) <https://github.com/pypa/pip/issues/14001>_)

Send a consistent Accept-Encoding header to avoid a spurious Cache entry deserialization failed warning. ([#14012](https://github.com/pypa/pip/issues/14012) <https://github.com/pypa/pip/issues/14012>_)

26.1.1 (2026-05-04)

Bug Fixes

Fix issue where uninstallation left behind empty directories. Revert the removal of the adjacent __pycache__ directory when a .py file is removed. ([#13973](https://github.com/pypa/pip/issues/13973) <https://github.com/pypa/pip/issues/13973>_)

26.1 (2026-04-26)

Deprecations and Removals

Drop support for Python 3.9. ([#13795](https://github.com/pypa/pip/issues/13795) <https://github.com/pypa/pip/issues/13795>_)

Features

Add experimental support to read requirements from standardized pylock.toml files (-r pylock.toml). ([#13876](https://github.com/pypa/pip/issues/13876) <https://github.com/pypa/pip/issues/13876>_)

Allow --uploaded-prior-to to accept a duration in days (e.g., P3D for 3 days ago). ([#13674](https://github.com/pypa/pip/issues/13674) <https://github.com/pypa/pip/issues/13674>_)

Enhancements

Speed up dependency resolution when there are complex conflicts. ([#13859](https://github.com/pypa/pip/issues/13859) <https://github.com/pypa/pip/issues/13859>_)

Reduce memory usage when resolving large dependency trees. ([#13843](https://github.com/pypa/pip/issues/13843) <https://github.com/pypa/pip/issues/13843>_)

Emit a deprecation warning when pip imports an unexpected module after installation of a distribution has started. ([#13912](https://github.com/pypa/pip/issues/13912) <https://github.com/pypa/pip/issues/13912>_)

Allow URL constraints to apply to requirements with extras. ([#12018](https://github.com/pypa/pip/issues/12018) <https://github.com/pypa/pip/issues/12018>_)

Allow unpinned requirements to use hashes from constraints. Constraints like {name}=={version} --hash=... feeds into hash verification for a corresponding requirement. ([#9243](https://github.com/pypa/pip/issues/9243) <https://github.com/pypa/pip/issues/9243>_)

Improve conflict reports that involve direct URLs. ([#13932](https://github.com/pypa/pip/issues/13932) <https://github.com/pypa/pip/issues/13932>_)

Show all errors instead of first error for faulty dependency_groups definitions. ([#13917](https://github.com/pypa/pip/issues/13917) <https://github.com/pypa/pip/issues/13917>_)

... (truncated)

Commits

31d7d16 Bump for release
79f348c Update AUTHORS.txt
237a925 Merge pull request #14001 from notatallshaw/fix-is-within-directory
34d0285 Merge pull request #14006 from laymonage/fix-requirements_from_scripts-space-...
09d3e07 Merge pull request #14012 from notatallshaw/stable-accept-encoding
fa7854f Use is_within_directory for entry point check
d01b46c NEWS ENTRY
7ff8bdd Fix is_within_directory for doubled-slash roots
7ea3466 NEWS ENTRY
85673ea Fix Accept-Encoding to gzip, deflate
Additional commits viewable in compare view

Updates setuptools from 80.9.0 to 83.0.0

Changelog

Sourced from setuptools's changelog.

v83.0.0

Features

Require Python 3.10 or later.

Bugfixes

MANIFEST.in matching (via FileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude, global-exclude, recursive-exclude, or prune rule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

pypa/distutils#334

v82.0.1

Bugfixes

Fix the loading of launcher manifest.xml file. (#5047)

Replaced deprecated json.__version__ with fixture in tests. (#5186)

Improved Documentation

Add advice about how to improve predictability when installing sdists. (#5168)

Misc

#4941, #5157, #5169, #5175

v82.0.0

... (truncated)

Commits

6519f72 Bump version: 82.0.1 → 83.0.0
d1151b1 Merge pull request #5250 from pypa/feature/distutils-d7633fbed
a2df31e Capture removal of dry_run parameter in changelog.
00144dc Moved newsfragment to the release where it occurred.
a4a5a2b Add news fragment.
77470c2 Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed
3c43897 Merge pull request #5247 from pypa/copilot/fix-pypy-version-issue
bb6ea66 Bump PyPy from 3.10 to 3.11 in CI workflow
a2bc3ac Fix broken intersphinx reference to build's installation docs
2d6a739 Use stacked parametrize decorators instead of itertools.product
Additional commits viewable in compare view

Updates wheel from 0.45.1 to 0.46.2

Release notes

Sourced from wheel's releases.

0.46.2

Restored the bdist_wheel command for compatibility with setuptools older than v70.1

Importing wheel.bdist_wheel now emits a FutureWarning instead of a DeprecationWarning

Fixed wheel unpack potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)

0.46.1

Temporarily restored the wheel.macosx_libfile module (#659)

0.46.0

Dropped support for Python 3.8

Removed the bdist_wheel setuptools command implementation and entry point. The wheel.bdist_wheel module is now just an alias to setuptools.command.bdist_wheel, emitting a deprecation warning on import.

Removed vendored packaging in favor of a run-time dependency on it

Made the wheel.metadata module private (with a deprecation warning if it's imported

Made the wheel.cli package private (no deprecation warning)

Fixed an exception when calling the convert command with an empty description field

Changelog

Sourced from wheel's changelog.

Release Notes

UNRELEASED

Fixed the macOS platform-tag warning always using the plural "these files" wording, even when only a single library required a higher deployment target ([#697](https://github.com/pypa/wheel/issues/697) <https://github.com/pypa/wheel/pull/697>_)

0.48.0 (2026-08-12)

Added a --local-version option to wheel pack to add, replace, or remove a PEP 440 local version identifier from a wheel ([#570](https://github.com/pypa/wheel/issues/570) <https://github.com/pypa/wheel/issues/570>_)

Fixed wheel convert unnecessarily upgrading compatible core metadata versions ([#643](https://github.com/pypa/wheel/issues/643) <https://github.com/pypa/wheel/issues/643>_)

Fixed wheel tags producing invalid archives when retagging wheels whose entries use ZIP64, by dropping the central-directory ZIP64 extra field that is not valid in a local file header ([#692](https://github.com/pypa/wheel/issues/692) <https://github.com/pypa/wheel/issues/692>_)

Fixed wheel convert writing the converted wheel outside the destination directory when the input archive contained a maliciously crafted project name or version with path separators (arbitrary file write / path traversal) (GHSA-vgq5-9859-3mmw <https://github.com/pypa/wheel/security/advisories/GHSA-vgq5-9859-3mmw>_)

0.47.0 (2026-04-22)

Added the wheel info subcommand to display metadata about wheel files without unpacking them ([#639](https://github.com/pypa/wheel/issues/639) <https://github.com/pypa/wheel/issues/639>_)

Fixed WheelFile raising Missing RECORD file when the wheel filename contains uppercase characters (e.g. Django-3.2.5.whl) but the .dist-info directory inside uses normalized lowercase naming ([#411](https://github.com/pypa/wheel/issues/411) <https://github.com/pypa/wheel/issues/411>_)

0.46.3 (2026-01-22)

Fixed ImportError: cannot import name '_setuptools_logging' from 'wheel' when installed alongside an old version of setuptools and running the bdist_wheel command ([#676](https://github.com/pypa/wheel/issues/676) <https://github.com/pypa/wheel/issues/676>_)

0.46.2 (2026-01-22)

Restored the bdist_wheel command for compatibility with setuptools older than v70.1

Importing wheel.bdist_wheel now emits a FutureWarning instead of a DeprecationWarning

Fixed wheel unpack potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)

0.46.1 (2025-04-08)

... (truncated)

Commits

eba4036 Updated the version number for v0.46.2
557fb54 Created a new release
7a7d2de Fixed security issue around wheel unpack (#675)
41418fa Fixed test failures due to metadata normalization changes
c1d442b [pre-commit.ci] pre-commit autoupdate (#674)
0bac882 Update github actions environments (#673)
be9f45b [pre-commit.ci] pre-commit autoupdate (#667)
6244f08 Update pre-commit ruff legacy alias (#668)
15b7577 PEP 639 compliance (#670)
fc8cb41 Revert "Removed redundant Python version from the publish workflow (#666)"
Additional commits viewable in compare view

Updates cbor2 from 5.6.5 to 5.9.0

Release notes

Sourced from cbor2's releases.

5.9.0

Added the max_depth decoder parameter to limit the maximum allowed nesting level of containers, with a default value of 400 levels (CVE-2026-26209)

Changed the default read_size from 4096 to 1 for backwards compatibility. The buffered reads introduced in 5.8.0 could cause issues when code needs to access the stream position after decoding. Users can opt-in to faster decoding by passing read_size=4096 when they don't need to access the stream directly after decoding. Added a direct read path for read_size=1 to avoid buffer management overhead. (#275; PR by @andreer)

Fixed C encoder not respecting string referencing when encoding string-type datetimes (tag 0) (#254)

Fixed a missed check for an exception in the C implementation of CBOREncoder.encode_shared() (#287)

Fixed two reference/memory leaks in the C extension's long string decoder (#290 PR by @killiancowan82)

Fixed C decoder ignoring the str_errors setting when decoding strings, and improved string decoding performance by using stack allocation for small strings and eliminating unnecessary conditionals. Benchmarks show 9-17% faster deserialization. (#255; PR by @andreer)

5.8.0

Added readahead buffering to C decoder for improved performance. The decoder now uses a 4 KB buffer by default to reduce the number of read calls. Benchmarks show 20-140% performance improvements for decoding operations. (#268; PR by @andreer)

Fixed Python decoder not preserving share index when decoding array items containing nested shareable tags, causing shared references to resolve to wrong objects (#267; PR by @andreer)

Reset shared reference state at the start of each top-level encode/decode operation (#266; PR by @andreer)

5.7.1

Improved performance on decoding large definite bytestrings (#240 <agronholm/cbor2#240>_; PR by @dwpaley)

Fixed a read(-1) vulnerability caused by boundary handling error (#264 <agronholm/cbor2#264>_; PR by @tylzh97)

5.7.0

Added support for Python 3.14 (no free-threading support yet, sorry)

Dropped support for Python 3.8 (#247 <agronholm/cbor2#247>_; PR by @hugovk)

Added support for encoding indefinite containers (#256 <agronholm/cbor2#256>_; PR by @CZDanol)

Added complex number support (tag 43000) (#249 <agronholm/cbor2#249>_; PR by @chillenb)

Commits

93c5988 Bumped up the version
d903d62 Updated the max_depth default value in the C function signature
2b53b28 Stack allocate small strings (#270)
a7ac10d Upped the max_depth value to 400
54c8ed5 Fixed reference/memory leaks in decode_definite_long_string (#290)
a8d92dc [pre-commit.ci] pre-commit autoupdate (#289)
c91aa00 [pre-commit.ci] pre-commit autoupdate (#288)
53521e7 Fixed ssize_t to Py_ssize_t
94e0d21 Added missing Python counterpart for max_depth
bcb6cea Added the max_depth decoder parameter
Additional commits viewable in compare view

Updates ecdsa from 0.19.1 to 0.19.2

Release notes

Sourced from ecdsa's releases.

0.19.2

Bug fixes:

Fix CVE-2026-33936, a DER parsing issue in remove_octet_string(), remove_constructed(), and remove_implitic() where a truncated buffer wasn't detected. This can lead to high level functions, like SigningKey.from_der() to raise unexpected exceptions. (Mohamed Abdelaal (0xmrma))

Maintenance:

Update CI to use newer version of Ubuntu.

Changelog

Sourced from ecdsa's changelog.

Release 0.19.2 (26 Mar 2026)

Bug fixes:

Fix CVE-2026-33936, a DER parsing issue in remove_octet_string(), remove_constructed(), and remove_implitic() where a truncated buffer wasn't detected. This can lead to high level functions, like SigningKey.from_der() to raise unexpected exceptions. (Mohamed Abdelaal (0xmrma))

Maintenance:

Update CI to use newer version of Ubuntu.

Release 0.19.1 (13 Mar 2025)

New API:

der.remove_implitic and der.encode_implicit for decoding and encoding DER IMPLICIT values with custom tag values and arbitrary classes

Bug fixes:

Minor fixes around arithmetic with curves that have non-prime order (useful for experimentation, not practical deployments)

Fix arithmetic to work with curves that have (0, 0) on the curve

Fix canonicalization of signatures when s is just slightly above half of curve order

Maintenance:

Dropped official support for Python 3.5 (again, issues with CI, support for Python 2.6 and Python 2.7 is unchanged)

Officialy support Python 3.12 and 3.13 (add them to CI)

Removal of few more unnecessary six.b literals (Alexandre Detiste)

Fix typos in warning messages

Release 0.19.0 (08 Apr 2024)

New API:

to_ssh in VerifyingKey and SigningKey, supports Ed25519 keys only (Pablo Mazzini)

New features:

Support for twisted Brainpool curves

Doc fix:

Fix curve equation in glossary

Documentation for signature encoding and signature decoding functions

Maintenance:

Dropped official support for 3.3 and 3.4 (because of problems running them in CI, not because it's actually incompatible; support for 2.6 and 2.7 is

... (truncated)

Commits

bd66899 Merge commit from fork
9c046ee tests: reject truncated DER lengths
acc40fd der: reject truncated lengths in octet/implicit/constructed
55aca78 Merge pull request #363 from gstarovo/ubuntu20-deprecation
c4f0df1 chore: change to ubuntu-22 since u-20 is deprecated
See full diff in compare view

Updates idna from 3.10 to 3.15

Changelog

Sourced from idna's changelog.

3.15 (2026-05-12)

Enforce DNS-length cap on individual labels early in check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.

Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.

Use raise ... from err for proper exception chaining and switch internal string formatting to f-strings.

Allow flit_core 4.x in the build backend.

Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.

Add Dependabot configuration for GitHub Actions.

Convert README and HISTORY from reStructuredText to Markdown.

Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.

3.14 (2026-05-10)

Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]

Thanks to Stan Ulbrych for reporting the issue.

3.13 (2026-04-22)

Correct classification error for codepoint U+A7F1

3.12 (2026-04-21)

Update to Unicode 17.0.0.

Issue a deprecation warning for the transitional argument.

Added lazy-loading to provide some performance improvements.

Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.

Thanks to Rodrigo Nogueira for contributions to this release.

3.11 (2025-10-12)

Update to Unicode 16.0.0, including significant changes to UTS46 processing. As a result of Unicode ending support for it, transitional processing no longer has an effect and returns the same result.

... (truncated)

Commits

af30a09 Release 3.15
30314d4 Pre-release 3.15rc0
05d4b21 Merge pull request #237 from kjd/convert-docs-to-markdown
2987fdb Convert README and HISTORY from reStructuredText to Markdown
59fa800 Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333ea
def6983 Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea
bbd8004 Merge pull request #234 from StanFromIreland/patch-1
edd07c0 Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group
5557db0 Merge branch 'master' into patch-1
f11746c Merge pull request #235 from StanFromIreland/patch-2
Additional commits viewable in compare view

Updates protobuf from 3.20.3 to 5.29.6

Commits

See full diff in compare view

Updates requests from 2.32.3 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.

Dropped support for Python 3.8 following its end of support.

v2.32.4

2.32.4 (2025-06-10)

... (truncated)

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.

Dropped support for Python 3.8 following its end of support.

2.32.4 (2025-06-10)

Security

CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file.

... (truncated)

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates urllib3 from 1.26.20 to 2.7.0

Release notes

Sourced from urllib3's releases.

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially. (Reported by @Cycloctane)

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli library. (Reported by @kimkou2024)

See GHSA-mf9v-mfxr-j63j for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @christos-spearbit)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (urllib3/urllib3#3763)

Removed support for end-of-life Python 3.9. (urllib3/urllib3#3720)

Removed support for end-of-life PyPy3.10. (urllib3/urllib3#4979)

Bumped the minimum supported pyOpenSSL version to 19.0.0. (urllib3/urllib3#3777)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. (urllib3/urllib3#3636)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True. (urllib3/urllib3#4967)

Fixed HTTPResponse.stream() and HTTPResponse.read_chunked() to handle amt=0. (urllib3/urllib3#3793)

Updated _TYPE_BODY type alias to include missing Iterable[str], matching the documented and runtime behavior of chunked request bodies. (urllib3/urllib3#3798)

Fixed LocationParseError when paths resembling schemeless URIs were passed to HTTPConnectionPool.urlopen(). (urllib3/urllib3#3352)

Fixed BaseHTTPResponse.readinto() type annotation to accept memoryview in addition to bytearray, matching the io.RawIOBase.readinto contract and enabling use with io.BufferedReader without type errors. (urllib3/urllib3#3764)

2.6.3

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

Fixed a security issue where decompression-bomb safeguards of the streaming API were bypassed when HTTP redirects were followed. (CVE-2026-21441 reported by @D47A, 8.9 High, GHSA-38jv-5279-wg99)

Started treating Retry-After times greater than 6 hours as 6 hours by default. (urllib3/urllib3#3743)

Fixed urllib3.connection.VerifiedHTTPSConnection on Emscripten. (urllib3/urllib3#3752)

2.6.2

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.7.0 (2026-05-07)

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially.

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli <https://pypi.org/project/brotli/>__ library.

See GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>__ for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc>__)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. ([#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763>__)

Removed support for end-of-life Python 3.9. ([#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720>__)

Removed support for end-of-life PyPy3.10. ([#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979>__)

Bumped the minimum supported pyOpenSSL version to 19.0.0. ([#3777](https://github.com/urllib3/urllib3/issues/3777) <https://github.com/urllib3/urllib3/issues/3777>__)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. ([#3636](https://github.com/urllib3/urllib3/issues/3636) <https://github.com/urllib3/urllib3/issues/3636>__)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True.

... (truncated)

Commits

9a950b9 Release 2.7.0
5ec0de4 Merge commit from fork
2bdcc44 Merge commit from fork
f45b0df Fix a misleading example for ProxyManager (#4970)
577193c Switch to nightly PyPy3.11 in CI for now (#4984)
e90af45 Avoid infinite loop in HTTPResponse.read_chunked when amt=0 (#4974)
67ed74f Bump dev dependencies (#4972)
3abd481 Upgrade mypy to version 1.20.2 (#4978)
2b8725d Drop support for EOL PyPy3.10 (#4979)
2944b2a Upgrade setup-chrome and setup-firefox to fix warnings (#4973)
Additional commits viewable in compare view

Updates aiohttp from 3.12.9 to 3.14.3

Changelog

Sourced from aiohttp's changelog.

3.14.3 (2026-07-22)

Bug fixes

Fixed the client dropping only the first Authorization, Cookie and Proxy-Authorization header when a redirect crossed an origin -- by :user:arshsmith1.

Related issues and pull requests on GitHub: :issue:13180.

Fixed error message construction in the C HTTP parser -- by :user:bdraco.

Related issues and pull requests on GitHub: :issue:13222.

3.14.2 (2026-07-20)

Bug fixes

Fixed :py:attr:~aiohttp.web.StreamResponse.last_modified rounding a :class:datetime.datetime with a fractional second down.

Related issues and pull requests on GitHub: :issue:5303.

Fixed resolving localhost on Windows to fall back without AI_ADDRCONFIG when the first lookup fails, so localhost still works without an active network.

Related issues and pull requests on GitHub: :issue:5357.

... (truncated)

Commits

5e392ce Release v3.14.3 (#13225)
49f65d5 [PR #13222/f4866933 backport][3.14] Build C parser error message from bounded...
240099e [PR #13180/ee53d655 backport][3.14] drop every copy of credential headers on ...
d93f30a Bump version (#13202)
c1b9212 Release v3.14.2 (#13201)
380d4b5 [PR #13054/ed8b040c backport][3.14] escape backslashes in digest auth quoted-...
e1e1bee Make llhttp method array size dynamic (#13174) (#13196)
aa4cf29 [PR #13170/2b906869 backport][3.14] Fix StreamResponse.last_modified rounding...
71b57b4 [PR #13172/a57747ed backport][3.14] Fix C parser folding fragment into query_...
64a03fb [PR #13169/1adc0cd7 backport][3.14] Upgrade http:// to https:// in README.rst...
Additional commits viewable in compare view

Updates dnspython from 2.4.2 to 2.6.1

Release notes

Sourced from dnspython's releases.

dnspython 2.6.1

See What's New for details.

This is a bug fix release for 2.6.0 where the "TuDoor" fix erroneously suppressed legitimate Truncated exceptions. This caused the stub resolver to timeout instead of failing over to TCP when a legitimate truncated response was received over UDP.

This release addresses the potential DoS issue discussed in the "TuDoor" paper (CVE-2023-29483). The dnspython stub resolver is vulnerable to a potential DoS if a bad-in-some-way response from the right address and port forged by an attacker arrives before a legitimate one on the UDP port dnspython is using for that query. In this situation, dnspython might switch to querying another resolver or give up entirely, possibly denying service for that resolution. This release addresses the issue by adopting the recommended mitigation, which is ignoring the bad packets and continuing to listen for a legitimate response until the timeout for the query has expired.

Thank you to all the contributors to this release, and, as usual, thanks to my co-maintainers: Tomáš Křížek, Petr Špaček, and Brian Wellington.

dnspython 2.6.0

See What's New for details.

This release addresses the potential DoS issue discussed in the "TuDoor" paper (CVE-2023-29483). The dnspython stub resolver is vulnerable to a potential DoS if a bad-in-some-way response from the right address and port forged by an attacker arrives before a legitimate one on the UDP port dnspython is using for that query. In this situation, dnspython mig...
Description has been truncated

Bumps the pip group with 13 updates in the /contrib/deterministic-build directory: | Package | From | To | | --- | --- | --- | | [cryptography](https://github.com/pyca/cryptography) | `45.0.3` | `50.0.0` | | [pip](https://github.com/pypa/pip) | `25.1.1` | `26.1.2` | | [setuptools](https://github.com/pypa/setuptools) | `80.9.0` | `83.0.0` | | [wheel](https://github.com/pypa/wheel) | `0.45.1` | `0.46.2` | | [cbor2](https://github.com/agronholm/cbor2) | `5.6.5` | `5.9.0` | | [ecdsa](https://github.com/tlsfuzzer/python-ecdsa) | `0.19.1` | `0.19.2` | | [idna](https://github.com/kjd/idna) | `3.10` | `3.15` | | [protobuf](https://github.com/protocolbuffers/protobuf) | `3.20.3` | `5.29.6` | | [requests](https://github.com/psf/requests) | `2.32.3` | `2.33.0` | | [urllib3](https://github.com/urllib3/urllib3) | `1.26.20` | `2.7.0` | | [aiohttp](https://github.com/aio-libs/aiohttp) | `3.12.9` | `3.14.3` | | [dnspython](https://github.com/rthalley/dnspython) | `2.4.2` | `2.6.1` | | [sh](https://github.com/amoffat/sh) | `2.2.2` | `2.2.4` | Updates `cryptography` from 45.0.3 to 50.0.0 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@45.0.3...50.0.0) Updates `pip` from 25.1.1 to 26.1.2 - [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst) - [Commits](pypa/pip@25.1.1...26.1.2) Updates `setuptools` from 80.9.0 to 83.0.0 - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](pypa/setuptools@v80.9.0...v83.0.0) Updates `wheel` from 0.45.1 to 0.46.2 - [Release notes](https://github.com/pypa/wheel/releases) - [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst) - [Commits](pypa/wheel@0.45.1...0.46.2) Updates `cbor2` from 5.6.5 to 5.9.0 - [Release notes](https://github.com/agronholm/cbor2/releases) - [Commits](agronholm/cbor2@5.6.5...5.9.0) Updates `ecdsa` from 0.19.1 to 0.19.2 - [Release notes](https://github.com/tlsfuzzer/python-ecdsa/releases) - [Changelog](https://github.com/tlsfuzzer/python-ecdsa/blob/master/NEWS) - [Commits](tlsfuzzer/python-ecdsa@python-ecdsa-0.19.1...python-ecdsa-0.19.2) Updates `idna` from 3.10 to 3.15 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.10...v3.15) Updates `protobuf` from 3.20.3 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `requests` from 2.32.3 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.3...v2.33.0) Updates `urllib3` from 1.26.20 to 2.7.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@1.26.20...2.7.0) Updates `aiohttp` from 3.12.9 to 3.14.3 - [Changelog](https://github.com/aio-libs/aiohttp/blob/master/CHANGES.rst) - [Commits](aio-libs/aiohttp@v3.12.9...v3.14.3) Updates `dnspython` from 2.4.2 to 2.6.1 - [Release notes](https://github.com/rthalley/dnspython/releases) - [Changelog](https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst) - [Commits](rthalley/dnspython@v2.4.2...v2.6.1) Updates `sh` from 2.2.2 to 2.2.4 - [Release notes](https://github.com/amoffat/sh/releases) - [Changelog](https://github.com/amoffat/sh/blob/develop/CHANGELOG.md) - [Commits](amoffat/sh@2.2.2...2.2.4) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: direct:production dependency-group: pip - dependency-name: pip dependency-version: 26.1.2 dependency-type: direct:production dependency-group: pip - dependency-name: setuptools dependency-version: 83.0.0 dependency-type: direct:production dependency-group: pip - dependency-name: wheel dependency-version: 0.46.2 dependency-type: direct:production dependency-group: pip - dependency-name: cbor2 dependency-version: 5.9.0 dependency-type: direct:production dependency-group: pip - dependency-name: ecdsa dependency-version: 0.19.2 dependency-type: direct:production dependency-group: pip - dependency-name: idna dependency-version: '3.15' dependency-type: direct:production dependency-group: pip - dependency-name: protobuf dependency-version: 5.29.6 dependency-type: direct:production dependency-group: pip - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: pip - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: direct:production dependency-group: pip - dependency-name: aiohttp dependency-version: 3.14.3 dependency-type: direct:production dependency-group: pip - dependency-name: dnspython dependency-version: 2.6.1 dependency-type: direct:production dependency-group: pip - dependency-name: sh dependency-version: 2.2.4 dependency-type: direct:production dependency-group: pip ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Aug 25, 2026

Navigation Menu

build(deps): bump the pip group across 1 directory with 13 updates - #1

build(deps): bump the pip group across 1 directory with 13 updates#1
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/contrib/deterministic-build/pip-a048c8e284

dependabot Bot commented on behalf of github Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 25, 2026

26.1.2 (2026-05-31)

Bug Fixes

26.1.1 (2026-05-04)

Bug Fixes

26.1 (2026-04-26)

Deprecations and Removals

Features

Enhancements

v83.0.0

Features

Bugfixes

Deprecations and Removals

v82.0.1

Bugfixes

Improved Documentation

Misc

0.46.2

0.46.1

0.46.0

Release Notes

5.9.0

5.8.0

5.7.1

5.7.0

0.19.2

3.15 (2026-05-12)

3.14 (2026-05-10)

3.13 (2026-04-22)

3.12 (2026-04-21)

3.11 (2025-10-12)

v2.33.0

2.33.0 (2026-03-25)

New Contributors

v2.32.5

2.32.5 (2025-08-18)

v2.32.4

2.32.4 (2025-06-10)

2.33.0 (2026-03-25)

2.32.5 (2025-08-18)

2.32.4 (2025-06-10)

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

Security

Deprecations and Removals

Bugfixes

2.6.3

🚀 urllib3 is fundraising for HTTP/2 support

Changes

2.6.2

2.7.0 (2026-05-07)

Security

Deprecations and Removals

Bugfixes

3.14.3 (2026-07-22)

Bug fixes

3.14.2 (2026-07-20)

Bug fixes

dnspython 2.6.1

dnspython 2.6.0

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants