Fix TCPConnector.close() race condition with in-flight DNS resolution by prshant70 · Pull Request #1 · prshant70/aiohttp

prshant70 · 2026-05-13T17:44:06Z

Problem

TCPConnector.close() had a race condition where the resolver was closed before marking the connector as closed. This allowed in-flight DNS resolutions to resume and attempt to use a None resolver, causing AttributeError instead of the expected ClientConnectionError.

Solution

Reordered the operations to ensure _closed is set to True (via super().close()) before closing the resolver. This way, any resumed DNS resolutions can properly detect the closed state and bail out.

Changes

Reordered close sequence in TCPConnector.close()
Added regression test: test_tcp_connector_close_with_in_flight_dns_resolution()
Test reproduces the exact scenario from issue TCPConnector.close() race: AttributeError on in-flight resolve with aiodns aio-libs/aiohttp#12497

Testing

The new test verifies that in-flight DNS resolutions during close result in proper ClientConnectionError instead of AttributeError.

…challenge fields with empty string values (aio-libs#12107) **This is a backport of PR aio-libs#12097 as merged into master (51d5dba).** Co-authored-by: Kadir Can Ozden <101993364+bysiber@users.noreply.github.com>

(cherry picked from commit dab9e87) Co-authored-by: mingi jung <mingijung.grape@gmail.com>

) --------- Co-authored-by: nightcityblade <nightcityblade@gmail.com> Co-authored-by: Sam Bull <git@sambull.org>

…io-libs#12072) **This is a backport of PR aio-libs#12069 as merged into master (3a39006).** Co-authored-by: Sam Bull <git@sambull.org>

…io-libs#12071) **This is a backport of PR aio-libs#12069 as merged into master (3a39006).** Co-authored-by: Sam Bull <git@sambull.org>

Co-authored-by: gonas <nhjangh@gamil.com>

…bs#12115) (cherry picked from commit 67fa1f5) --------- Co-authored-by: Kevin Park <kevin.park1217@gmail.com>

…#12116) **This is a backport of PR aio-libs#12106 as merged into master (8ab84c5).** --------- Co-authored-by: Sam Bull <git@sambull.org> Co-authored-by: gonas <nhjangh@gamil.com>

(cherry picked from commit 8ab84c5) --------- Co-authored-by: gonas <nhjangh@gamil.com>

…ctx type to accept any object (aio-libs#12118) **This is a backport of PR aio-libs#12113 as merged into master (4d15c33).** --------- Co-authored-by: nightcityblade <jackchen@haloailabs.com> Co-authored-by: Sam Bull <git@sambull.org>

…12119)

…d transfer encoding size mismatch (aio-libs#12122) **This is a backport of PR aio-libs#12119 as merged into master (0e2d3ec).** Co-authored-by: Fridayai700 <aifriday700@gmail.com>

…d transfer encoding size mismatch (aio-libs#12121) **This is a backport of PR aio-libs#12119 as merged into master (0e2d3ec).** Co-authored-by: Fridayai700 <aifriday700@gmail.com>

…12096) (aio-libs#12123) (cherry picked from commit 291d969) Co-authored-by: Kadir Can Ozden <101993364+bysiber@users.noreply.github.com>

…12096) (aio-libs#12124) (cherry picked from commit 291d969) Co-authored-by: Kadir Can Ozden <101993364+bysiber@users.noreply.github.com>

…zation in CookieJar.load() (aio-libs#12105) **This is a backport of PR aio-libs#12091 as merged into master (8a631e7).** --------- Co-authored-by: Yuval Elbar <41901908+YuvalElbar6@users.noreply.github.com> Co-authored-by: Sam Bull <git@sambull.org>

…time (aio-libs#12085) (aio-libs#12127) Co-authored-by: nightcityblade <nightcityblade@gmail.com> Co-authored-by: Sam Bull <git@sambull.org>

…tatic files (aio-libs#12129) **This is a backport of PR aio-libs#12125 as merged into master (f049588).** Co-authored-by: Sam Bull <git@sambull.org>

…time (aio-libs#12085) (aio-libs#12126) Co-authored-by: nightcityblade <nightcityblade@gmail.com>

…tatic files (aio-libs#12128) **This is a backport of PR aio-libs#12125 as merged into master (f049588).** Co-authored-by: Sam Bull <git@sambull.org>

Bumps [rich](https://github.com/Textualize/rich) from 14.3.2 to 14.3.3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/Textualize/rich/releases">rich's releases</a>.</em></p> <blockquote> <h2>The infinite Release</h2> <p>Fixed a infinite loop in split_graphemes</p> <h2>[14.3.3] - 2026-02-19</h2> <h3>Fixed</h3> <ul> <li>Fixed infinite loop with <code>cells.split_graphemes</code> <a href="https://redirect.github.com/Textualize/rich/pull/4006">Textualize/rich#4006</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/Textualize/rich/blob/master/CHANGELOG.md">rich's changelog</a>.</em></p> <blockquote> <h2>[14.3.3] - 2026-02-19</h2> <h3>Fixed</h3> <ul> <li>Fixed infinite loop with <code>cells.split_graphemes</code> <a href="https://redirect.github.com/Textualize/rich/pull/4006">Textualize/rich#4006</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/Textualize/rich/commit/ce0118819d172d134507bcf5982d3faf82bbc43e"><code>ce01188</code></a> Merge pull request <a href="https://redirect.github.com/Textualize/rich/issues/4008">#4008</a> from Textualize/bump1433</li> <li><a href="https://github.com/Textualize/rich/commit/14a47c928241fe5cbf2f1adab0bb61fd1db3472f"><code>14a47c9</code></a> bump</li> <li><a href="https://github.com/Textualize/rich/commit/f54bfe062865187fe3bc733769dcd990a5a0ffe3"><code>f54bfe0</code></a> Merge pull request <a href="https://redirect.github.com/Textualize/rich/issues/4007">#4007</a> from Textualize/copilot/sub-pr-4006</li> <li><a href="https://github.com/Textualize/rich/commit/7338cb9dafd0d0e916585f191ae505b3e602bb51"><code>7338cb9</code></a> Merge pull request <a href="https://redirect.github.com/Textualize/rich/issues/4006">#4006</a> from Textualize/fix-grapheme-stuck</li> <li><a href="https://github.com/Textualize/rich/commit/905b397deb6b5ed59dfd80fa499c90e215f309c8"><code>905b397</code></a> Update tests/test_cells.py</li> <li><a href="https://github.com/Textualize/rich/commit/b031dca1d74f1f82a02d71e771b116ec4f9ad6c8"><code>b031dca</code></a> Update tests/test_cells.py</li> <li><a href="https://github.com/Textualize/rich/commit/f07a3fc5f5f4d5bfc0152cca4b103369934cd8b6"><code>f07a3fc</code></a> Add regression tests for VS16 after zero-width chars in split_graphemes</li> <li><a href="https://github.com/Textualize/rich/commit/b618ccc7e310a92e555d6ec38a7f390b37192ef3"><code>b618ccc</code></a> spelling</li> <li><a href="https://github.com/Textualize/rich/commit/378c34bd43eb4c9779ce1f7ff5dea376b34c91c5"><code>378c34b</code></a> Initial plan</li> <li><a href="https://github.com/Textualize/rich/commit/87e7ca27d0f8047e2d22c6ee9f7cf2c59e4c96af"><code>87e7ca2</code></a> refinements, and tests</li> <li>Additional commits viewable in <a href="https://github.com/Textualize/rich/compare/v14.3.2...v14.3.3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=rich&package-manager=pip&previous-version=14.3.2&new-version=14.3.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…-libs#12130)

…ept BaseException with except Exception (aio-libs#12132) **This is a backport of PR aio-libs#12130 as merged into master (63a411d).** Co-authored-by: Dhruvil Darji <dhruvildarji1409@gmail.com>

…tion link (aio-libs#12135) **This is a backport of PR aio-libs#12133 as merged into master (4ec897b).** Co-authored-by: laurent b <metter2ooo@gmail.com>

Bumps [softprops/action-gh-release](https://github.com/softprops/action-gh-release) from 2 to 3. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/softprops/action-gh-release/releases">softprops/action-gh-release's releases</a>.</em></p> <blockquote> <h2>v3.0.0</h2> <p><code>3.0.0</code> is a major release that moves the action runtime from Node 20 to Node 24. Use <code>v3</code> on GitHub-hosted runners and self-hosted fleets that already support the Node 24 Actions runtime. If you still need the last Node 20-compatible line, stay on <code>v2.6.2</code>.</p> <h2>What's Changed</h2> <h3>Other Changes 🔄</h3> <ul> <li>Move the action runtime and bundle target to Node 24</li> <li>Update <code>@types/node</code> to the Node 24 line and allow future Dependabot updates</li> <li>Keep the floating major tag on <code>v3</code>; <code>v2</code> remains pinned to the latest <code>2.x</code> release</li> </ul> <h2>v2.6.2</h2>  <h2>What's Changed</h2> <h3>Other Changes 🔄</h3> <ul> <li>chore(deps): bump picomatch from 4.0.3 to 4.0.4 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/softprops/action-gh-release/pull/775">softprops/action-gh-release#775</a></li> <li>chore(deps): bump brace-expansion from 5.0.4 to 5.0.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/softprops/action-gh-release/pull/777">softprops/action-gh-release#777</a></li> <li>chore(deps): bump vite from 8.0.0 to 8.0.5 by <a href="https://github.com/dependabot"><code>@dependabot</code></a>[bot] in <a href="https://redirect.github.com/softprops/action-gh-release/pull/781">softprops/action-gh-release#781</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/softprops/action-gh-release/compare/v2...v2.6.2">https://github.com/softprops/action-gh-release/compare/v2...v2.6.2</a></p> <h2>v2.6.1</h2> <p><code>2.6.1</code> is a patch release focused on restoring linked discussion thread creation when <code>discussion_category_name</code> is set. It fixes <code>[aio-libs#764](https://github.com/softprops/action-gh-release/issues/764)</code>, where the draft-first publish flow stopped carrying the discussion category through the final publish step.</p> <p>If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.</p> <h2>What's Changed</h2> <h3>Bug fixes 🐛</h3> <ul> <li>fix: preserve discussion category on publish by <a href="https://github.com/chenrui333"><code>@chenrui333</code></a> in <a href="https://redirect.github.com/softprops/action-gh-release/pull/765">softprops/action-gh-release#765</a></li> </ul> <h2>v2.6.0</h2> <p><code>2.6.0</code> is a minor release centered on <code>previous_tag</code> support for <code>generate_release_notes</code>, which lets workflows pin GitHub's comparison base explicitly instead of relying on the default range. It also includes the recent concurrent asset upload recovery fix, a <code>working_directory</code> docs sync, a checked-bundle freshness guard for maintainers, and clearer immutable-prerelease guidance where GitHub platform behavior imposes constraints on how prerelease asset uploads can be published.</p> <p>If you still hit an issue after upgrading, please open a report with the bug template and include a minimal repro or sanitized workflow snippet where possible.</p> <h2>What's Changed</h2>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md">softprops/action-gh-release's changelog</a>.</em></p> <blockquote> <h2>0.1.13</h2> <ul> <li>fix issue with multiple runs concatenating release bodies <a href="https://redirect.github.com/softprops/action-gh-release/pull/145">#145</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/softprops/action-gh-release/commit/b4309332981a82ec1c5618f44dd2e27cc8bfbfda"><code>b430933</code></a> release: cut v3.0.0 for Node 24 upgrade (<a href="https://redirect.github.com/softprops/action-gh-release/issues/670">#670</a>)</li> <li><a href="https://github.com/softprops/action-gh-release/commit/c2e35e05a74208bafbfcbdae5ebc9da7236e980f"><code>c2e35e0</code></a> chore(deps): bump the npm group across 1 directory with 7 updates (<a href="https://redirect.github.com/softprops/action-gh-release/issues/783">#783</a>)</li> <li>See full diff in <a href="https://github.com/softprops/action-gh-release/compare/v2...v3">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=softprops/action-gh-release&package-manager=github_actions&previous-version=2&new-version=3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sam Bull <git@sambull.org>

Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>v7 What's new</h2> <h3>Direct Uploads</h3> <p>Adds support for uploading single files directly (unzipped). Callers can set the new <code>archive</code> parameter to <code>false</code> to skip zipping the file during upload. Right now, we only support single files. The action will fail if the glob passed resolves to multiple files. The <code>name</code> parameter is also ignored with this setting. Instead, the name of the artifact will be the name of the uploaded file.</p> <h3>ESM</h3> <p>To support new versions of the <code>@actions/*</code> packages, we've upgraded the package to ESM.</p> <h2>What's Changed</h2> <ul> <li>Add proxy integration test by <a href="https://github.com/Link"><code>@Link</code></a>- in <a href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li> <li>Upgrade the module to ESM and bump dependencies by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/762">actions/upload-artifact#762</a></li> <li>Support direct file uploads by <a href="https://github.com/danwkennedy"><code>@danwkennedy</code></a> in <a href="https://redirect.github.com/actions/upload-artifact/pull/764">actions/upload-artifact#764</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Link"><code>@Link</code></a>- made their first contribution in <a href="https://redirect.github.com/actions/upload-artifact/pull/754">actions/upload-artifact#754</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/upload-artifact/compare/v6...v7.0.0">https://github.com/actions/upload-artifact/compare/v6...v7.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/upload-artifact/commit/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f"><code>bbbca2d</code></a> Support direct file uploads (<a href="https://redirect.github.com/actions/upload-artifact/issues/764">#764</a>)</li> <li><a href="https://github.com/actions/upload-artifact/commit/589182c5a4cec8920b8c1bce3e2fab1c97a02296"><code>589182c</code></a> Upgrade the module to ESM and bump dependencies (<a href="https://redirect.github.com/actions/upload-artifact/issues/762">#762</a>)</li> <li><a href="https://github.com/actions/upload-artifact/commit/47309c993abb98030a35d55ef7ff34b7fa1074b5"><code>47309c9</code></a> Merge pull request <a href="https://redirect.github.com/actions/upload-artifact/issues/754">#754</a> from actions/Link-/add-proxy-integration-tests</li> <li><a href="https://github.com/actions/upload-artifact/commit/02a8460834e70dab0ce194c64360c59dc1475ef0"><code>02a8460</code></a> Add proxy integration test</li> <li>See full diff in <a href="https://github.com/actions/upload-artifact/compare/v6...v7">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/upload-artifact&package-manager=github_actions&previous-version=6&new-version=7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) You can trigger a rebase of this PR by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> > **Note** > Automatic rebases have been disabled on this pull request as it has been open for over 30 days. Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sam Bull <git@sambull.org>

Bumps [actions/github-script](https://github.com/actions/github-script) from 8 to 9. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/github-script/releases">actions/github-script's releases</a>.</em></p> <blockquote> <h2>v9.0.0</h2> <p><strong>New features:</strong></p> <ul> <li><strong><code>getOctokit</code> factory function</strong> — Available directly in the script context. Create additional authenticated Octokit clients with different tokens for multi-token workflows, GitHub App tokens, and cross-org access. See <a href="https://github.com/actions/github-script#creating-additional-clients-with-getoctokit">Creating additional clients with <code>getOctokit</code></a> for details and examples.</li> <li><strong>Orchestration ID in user-agent</strong> — The <code>ACTIONS_ORCHESTRATION_ID</code> environment variable is automatically appended to the user-agent string for request tracing.</li> </ul> <p><strong>Breaking changes:</strong></p> <ul> <li><strong><code>require('@actions/github')</code> no longer works in scripts.</strong> The upgrade to <code>@actions/github</code> v9 (ESM-only) means <code>require('@actions/github')</code> will fail at runtime. If you previously used patterns like <code>const { getOctokit } = require('@actions/github')</code> to create secondary clients, use the new injected <code>getOctokit</code> function instead — it's available directly in the script context with no imports needed.</li> <li><code>getOctokit</code> is now an injected function parameter. Scripts that declare <code>const getOctokit = ...</code> or <code>let getOctokit = ...</code> will get a <code>SyntaxError</code> because JavaScript does not allow <code>const</code>/<code>let</code> redeclaration of function parameters. Use the injected <code>getOctokit</code> directly, or use <code>var getOctokit = ...</code> if you need to redeclare it.</li> <li>If your script accesses other <code>@actions/github</code> internals beyond the standard <code>github</code>/<code>octokit</code> client, you may need to update those references for v9 compatibility.</li> </ul> <h2>What's Changed</h2> <ul> <li>Add ACTIONS_ORCHESTRATION_ID to user-agent string by <a href="https://github.com/Copilot"><code>@Copilot</code></a> in <a href="https://redirect.github.com/actions/github-script/pull/695">actions/github-script#695</a></li> <li>ci: use deployment: false for integration test environments by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/github-script/pull/712">actions/github-script#712</a></li> <li>feat!: add getOctokit to script context, upgrade <code>@actions/github</code> v9, <code>@octokit/core</code> v7, and related packages by <a href="https://github.com/salmanmkc"><code>@salmanmkc</code></a> in <a href="https://redirect.github.com/actions/github-script/pull/700">actions/github-script#700</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/Copilot"><code>@Copilot</code></a> made their first contribution in <a href="https://redirect.github.com/actions/github-script/pull/695">actions/github-script#695</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/github-script/compare/v8.0.0...v9.0.0">https://github.com/actions/github-script/compare/v8.0.0...v9.0.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/github-script/commit/3a2844b7e9c422d3c10d287c895573f7108da1b3"><code>3a2844b</code></a> Merge pull request <a href="https://redirect.github.com/actions/github-script/issues/700">#700</a> from actions/salmanmkc/expose-getoctokit + prepare re...</li> <li><a href="https://github.com/actions/github-script/commit/ca10bbdd1a7739de09e99a200c7a59f5d73a4079"><code>ca10bbd</code></a> fix: use <code>@octokit/core/</code>types import for v7 compatibility</li> <li><a href="https://github.com/actions/github-script/commit/86e48e20ac85c970ed1f96e718fd068173948b7b"><code>86e48e2</code></a> merge: incorporate main branch changes</li> <li><a href="https://github.com/actions/github-script/commit/c1084728b5b935ec4ddc1e4cee877b01797b3ff9"><code>c108472</code></a> chore: rebuild dist for v9 upgrade and getOctokit factory</li> <li><a href="https://github.com/actions/github-script/commit/afff112e4f8b57c718168af75b89ce00bc8d091d"><code>afff112</code></a> Merge pull request <a href="https://redirect.github.com/actions/github-script/issues/712">#712</a> from actions/salmanmkc/deployment-false + fix user-ag...</li> <li><a href="https://github.com/actions/github-script/commit/ff8117e5b78c415f814f39ad6998f424fee7b817"><code>ff8117e</code></a> ci: fix user-agent test to handle orchestration ID</li> <li><a href="https://github.com/actions/github-script/commit/81c6b7876079abe10ff715951c9fc7b3e1ab389d"><code>81c6b78</code></a> ci: use deployment: false to suppress deployment noise from integration tests</li> <li><a href="https://github.com/actions/github-script/commit/3953caf8858d318f37b6cc53a9f5708859b5a7b7"><code>3953caf</code></a> docs: update README examples from <a href="https://github.com/v8"><code>@v8</code></a> to <a href="https://github.com/v9"><code>@v9</code></a>, add getOctokit docs and v9 brea...</li> <li><a href="https://github.com/actions/github-script/commit/c17d55b90dcdb3d554d0027a6c180a7adc2daf78"><code>c17d55b</code></a> ci: add getOctokit integration test job</li> <li><a href="https://github.com/actions/github-script/commit/a047196d9a02fe92098771cafbb98c2f1814e408"><code>a047196</code></a> test: add getOctokit integration tests via callAsyncFunction</li> <li>Additional commits viewable in <a href="https://github.com/actions/github-script/compare/v8...v9">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/github-script&package-manager=github_actions&previous-version=8&new-version=9)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sam Bull <git@sambull.org>

Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.3.0 to 21.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/virtualenv/releases">virtualenv's releases</a>.</em></p> <blockquote> <h2>21.3.1</h2>  <h2>What's Changed</h2> <ul> <li>👷 ci: retry transient apt failures on Linux by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3139">pypa/virtualenv#3139</a></li> <li>🐛 fix(seed): bump embedded pip to 26.1.1 by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3138">pypa/virtualenv#3138</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pypa/virtualenv/compare/21.3.0...21.3.1">https://github.com/pypa/virtualenv/compare/21.3.0...21.3.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst">virtualenv's changelog</a>.</em></p> <blockquote> <h1>Bugfixes - 21.3.1</h1> <ul> <li> <p>Upgrade embedded wheels:</p> <ul> <li>pip to <code>26.1.1</code> from <code>26.1</code> (:issue:<code>3138</code>)</li> </ul> </li> </ul> <hr /> <p>v21.3.0 (2026-04-27)</p> <hr /> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/virtualenv/commit/12ab4957289c1963849bf04a5f35982c928c0a35"><code>12ab495</code></a> release 21.3.1</li> <li><a href="https://github.com/pypa/virtualenv/commit/22eadc4d2738af7e96d744369a7f40df34935c94"><code>22eadc4</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pypa/virtualenv/issues/3137">#3137</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/6651dafd919c745adca1e29e31e1d96a1c9e9e52"><code>6651daf</code></a> 🐛 fix(seed): bump embedded pip to 26.1.1 (<a href="https://redirect.github.com/pypa/virtualenv/issues/3138">#3138</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/936a36ae63eb8c68123cf9e23824f68aa9ac51b1"><code>936a36a</code></a> 👷 ci: retry transient apt failures on Linux (<a href="https://redirect.github.com/pypa/virtualenv/issues/3139">#3139</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/cb5a7d1820871cf26e370c6a954e48326ddd6c57"><code>cb5a7d1</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pypa/virtualenv/issues/3133">#3133</a>)</li> <li>See full diff in <a href="https://github.com/pypa/virtualenv/compare/21.3.0...21.3.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=virtualenv&package-manager=pip&previous-version=21.3.0&new-version=21.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [pip](https://github.com/pypa/pip) from 26.1 to 26.1.1. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/pip/blob/main/NEWS.rst">pip's changelog</a>.</em></p> <blockquote> <h1>26.1.1 (2026-05-04)</h1> <h2>Bug Fixes</h2> <ul> <li>Fix issue where uninstallation left behind empty directories. Revert the removal of the adjacent <code>__pycache__</code> directory when a .py file is removed. (<code>[#13973](pypa/pip#13973) <https://github.com/pypa/pip/issues/13973></code>_)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/pip/commit/4432a371c6471e6a93c3eb39b3e9ab2b876b13b9"><code>4432a37</code></a> Bump for release</li> <li><a href="https://github.com/pypa/pip/commit/4943e17e7dd079b3f58e88009d10308f2c55a3ed"><code>4943e17</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13973">#13973</a> from pypa/revert-13725-vfazio-remove-all-optimizati...</li> <li><a href="https://github.com/pypa/pip/commit/e9e7b90f35bfcd3c9e4ff93e0f0cc1b90f59aa68"><code>e9e7b90</code></a> Add news</li> <li><a href="https://github.com/pypa/pip/commit/0ff696479aa07ea5ca78b08d205ae23854b6e0e8"><code>0ff6964</code></a> Revert "Remove <strong>pycache</strong> when package is removed"</li> <li><a href="https://github.com/pypa/pip/commit/cc6b082d6b9350d96c5a24337b12b7a42846c410"><code>cc6b082</code></a> Merge pull request <a href="https://redirect.github.com/pypa/pip/issues/13951">#13951</a> from sbidoul/release/26.1</li> <li><a href="https://github.com/pypa/pip/commit/b2671f1cb340f33db300f0bffc062402bce3eca0"><code>b2671f1</code></a> Bump for development</li> <li>See full diff in <a href="https://github.com/pypa/pip/compare/26.1...26.1.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pip&package-manager=pip&previous-version=26.1&new-version=26.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [python-discovery](https://github.com/tox-dev/python-discovery) from 1.2.2 to 1.3.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/python-discovery/releases">python-discovery's releases</a>.</em></p> <blockquote> <h2>1.3.0</h2>  <h2>What's Changed</h2> <ul> <li>✨ feat(discovery): add iter_interpreters for enumeration by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/71">tox-dev/python-discovery#71</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/python-discovery/compare/1.2.2...1.3.0">https://github.com/tox-dev/python-discovery/compare/1.2.2...1.3.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/python-discovery/commit/00052bd0eee982b68f3dab78a2639fad9a20da47"><code>00052bd</code></a> ✨ feat(discovery): add iter_interpreters for enumeration (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/71">#71</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/791d139a0c877db8f52d29c0587fa93923454b81"><code>791d139</code></a> build(deps): bump astral-sh/setup-uv from 8.0.0 to 8.1.0 (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/68">#68</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/77273ad96029c6fcee81024f77ef873743eafa6f"><code>77273ad</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/70">#70</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/6b5d73b061f21b101eb84206d218fd400454953b"><code>6b5d73b</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/69">#69</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/08688564ee0ee75f44401e08e5f9c2b75d9f1a26"><code>0868856</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/67">#67</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/eb2aa7a4f731b676caaf67633417454ae855fc95"><code>eb2aa7a</code></a> build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/66">#66</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/5b19eea94ec879b173b376a6341d25e930ffe9bd"><code>5b19eea</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/64">#64</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/3aa7d3320d8736dfdbdfef594c39dd64d0cfb5b4"><code>3aa7d33</code></a> build(deps): bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0 (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/63">#63</a>)</li> <li>See full diff in <a href="https://github.com/tox-dev/python-discovery/compare/1.2.2...1.3.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python-discovery&package-manager=pip&previous-version=1.2.2&new-version=1.3.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [pydantic](https://github.com/pydantic/pydantic) from 2.13.3 to 2.13.4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic/releases">pydantic's releases</a>.</em></p> <blockquote> <h2>v2.13.4 2026-05-06</h2> <h2>v2.13.4 (2026-05-06)</h2> <h3>What's Changed</h3> <h4>Packaging</h4> <ul> <li>Bump libc from 0.2.155 to 0.2.185 by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13109">#13109</a></li> <li>Adapt <code>pydantic-core</code> linker flags on macOS by <a href="https://github.com/washingtoneg"><code>@washingtoneg</code></a> and <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13147">#13147</a></li> </ul> <h4>Fixes</h4> <ul> <li>Preserve <code>RootModel</code> core metadata by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13129">#13129</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pydantic/pydantic/compare/v2.13.3...v2.13.4">https://github.com/pydantic/pydantic/compare/v2.13.3...v2.13.4</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pydantic/pydantic/blob/v2.13.4/HISTORY.md">pydantic's changelog</a>.</em></p> <blockquote> <h2>v2.13.4 (2026-05-06)</h2> <p><a href="https://github.com/pydantic/pydantic/releases/tag/v2.13.4">GitHub release</a></p> <h3>What's Changed</h3> <h4>Packaging</h4> <ul> <li>Bump libc from 0.2.155 to 0.2.185 by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13109">#13109</a></li> <li>Adapt <code>pydantic-core</code> linker flags on macOS by <a href="https://github.com/washingtoneg"><code>@washingtoneg</code></a> and <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13147">#13147</a></li> </ul> <h4>Fixes</h4> <ul> <li>Preserve <code>RootModel</code> core metadata by <a href="https://github.com/Viicos"><code>@Viicos</code></a> in <a href="https://redirect.github.com/pydantic/pydantic/pull/13129">#13129</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pydantic/pydantic/commit/cf67d4b3193c3fe43ede18612ed62785eee11382"><code>cf67d4b</code></a> Fix linting</li> <li><a href="https://github.com/pydantic/pydantic/commit/f0d8a214a5803036db46a56b1f62f1e56b81d662"><code>f0d8a21</code></a> Prepare release v2.13.4</li> <li><a href="https://github.com/pydantic/pydantic/commit/5e3fe1d41a00f441204241c66078003ae0391f9a"><code>5e3fe1d</code></a> Check for pydantic tag pattern in CI</li> <li><a href="https://github.com/pydantic/pydantic/commit/7f9edcc2a191d2eaa9751220eb910914e716a686"><code>7f9edcc</code></a> Document tagging conventions</li> <li><a href="https://github.com/pydantic/pydantic/commit/b46a0c9b8a4dd967fda8ec1a92f6437076bf262c"><code>b46a0c9</code></a> Adapt <code>pydantic-core</code> linker flags on macOS</li> <li><a href="https://github.com/pydantic/pydantic/commit/50629c851e61d887d5420452c311ec6203f1f400"><code>50629c8</code></a> Update to PyPy 7.3.22</li> <li><a href="https://github.com/pydantic/pydantic/commit/8522ebb71e5e9a6f7188af5f009f01785b8cf725"><code>8522ebb</code></a> Preserve <code>RootModel</code> core metadata</li> <li><a href="https://github.com/pydantic/pydantic/commit/a37f3aff090ca342dc5f48304889963530b993f8"><code>a37f3af</code></a> Adapt <code>MISSING</code> sentinel test to work with unreleased <code>typing_extensions</code> ver...</li> <li><a href="https://github.com/pydantic/pydantic/commit/909259a9df660518033aa686b689f045a6eaf9d2"><code>909259a</code></a> Remove Logfire example in documentation</li> <li><a href="https://github.com/pydantic/pydantic/commit/2c4174c366606fc2dc46cb806833a080aefa77df"><code>2c4174c</code></a> Bump libc from 0.2.155 to 0.2.185</li> <li>See full diff in <a href="https://github.com/pydantic/pydantic/compare/v2.13.3...v2.13.4">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pydantic&package-manager=pip&previous-version=2.13.3&new-version=2.13.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [librt](https://github.com/mypyc/librt) from 0.9.0 to 0.10.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mypyc/librt/commit/1d5e9b240ac073f10ef389e9e27a2f2647fcd653"><code>1d5e9b2</code></a> Bump version to 0.10.0</li> <li><a href="https://github.com/mypyc/librt/commit/963673e91ad7482aa46df25f7c68d4a5ced8a712"><code>963673e</code></a> Sync mypy and add smoke tests (<a href="https://redirect.github.com/mypyc/librt/issues/38">#38</a>)</li> <li>See full diff in <a href="https://github.com/mypyc/librt/compare/v0.9.0...v0.10.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [urllib3](https://github.com/urllib3/urllib3) from 2.6.3 to 2.7.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/releases">urllib3's releases</a>.</em></p> <blockquote> <h2>2.7.0</h2> <h2>🚀 urllib3 is fundraising for HTTP/2 support</h2> <p><a href="https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support">urllib3 is raising ~$40,000 USD</a> to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects <a href="https://opencollective.com/urllib3">please consider contributing financially</a> to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.</p> <p>Thank you for your support.</p> <h2>Security</h2> <p>Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.</p> <ul> <li> <p>Decompression-bomb safeguards of the streaming API were bypassed:</p> <ol> <li>When <code>HTTPResponse.drain_conn()</code> was called after the response had been read and decompressed partially. (Reported by <a href="https://github.com/Cycloctane"><code>@Cycloctane</code></a>)</li> <li>During the second <code>HTTPResponse.read(amt=N)</code> or <code>HTTPResponse.stream(amt=N)</code> call when the response was decompressed using the official <a href="https://pypi.org/project/brotli/">Brotli</a> library. (Reported by <a href="https://github.com/kimkou2024"><code>@kimkou2024</code></a>)</li> </ol> <p>See GHSA-mf9v-mfxr-j63j for details.</p> </li> <li> <p>HTTP pools created using <code>ProxyManager.connection_from_url</code> did not strip sensitive headers specified in <code>Retry.remove_headers_on_redirect</code> when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by <a href="https://github.com/christos-spearbit"><code>@christos-spearbit</code></a>)</p> </li> </ul> <h2>Deprecations and Removals</h2> <ul> <li>Used <code>FutureWarning</code> instead of <code>DeprecationWarning</code> for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3764">urllib3/urllib3#3764</a>)</li> <li>Removed support for end-of-life Python 3.9. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3720">urllib3/urllib3#3720</a>)</li> <li>Removed support for end-of-life PyPy3.10. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4979">urllib3/urllib3#4979</a>)</li> <li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3777">urllib3/urllib3#3777</a>)</li> </ul> <h2>Bugfixes</h2> <ul> <li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was ignoring decompressed data buffered from previous partial reads. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3636">urllib3/urllib3#3636</a>)</li> <li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only part of the response after a partial read when <code>cache_content=True</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/4967">urllib3/urllib3#4967</a>)</li> <li>Fixed <code>HTTPResponse.stream()</code> and <code>HTTPResponse.read_chunked()</code> to handle <code>amt=0</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3793">urllib3/urllib3#3793</a>)</li> <li>Updated <code>_TYPE_BODY</code> type alias to include missing <code>Iterable[str]</code>, matching the documented and runtime behavior of chunked request bodies. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3798">urllib3/urllib3#3798</a>)</li> <li>Fixed <code>LocationParseError</code> when paths resembling schemeless URIs were passed to <code>HTTPConnectionPool.urlopen()</code>. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3352">urllib3/urllib3#3352</a>)</li> <li>Fixed <code>BaseHTTPResponse.readinto()</code> type annotation to accept <code>memoryview</code> in addition to <code>bytearray</code>, matching the <code>io.RawIOBase.readinto</code> contract and enabling use with <code>io.BufferedReader</code> without type errors. (<a href="https://redirect.github.com/urllib3/urllib3/issues/3764">urllib3/urllib3#3764</a>)</li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/urllib3/urllib3/blob/main/CHANGES.rst">urllib3's changelog</a>.</em></p> <blockquote> <h1>2.7.0 (2026-05-07)</h1> <h2>Security</h2> <p>Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.</p> <ul> <li> <p>Decompression-bomb safeguards of the streaming API were bypassed:</p> <ol> <li>When <code>HTTPResponse.drain_conn()</code> was called after the response had been read and decompressed partially.</li> <li>During the second <code>HTTPResponse.read(amt=N)</code> or <code>HTTPResponse.stream(amt=N)</code> call when the response was decompressed using the official <code>Brotli <https://pypi.org/project/brotli/></code>__ library.</li> </ol> <p>See <code>GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j></code>__ for details.</p> </li> <li> <p>HTTP pools created using <code>ProxyManager.connection_from_url</code> did not strip sensitive headers specified in <code>Retry.remove_headers_on_redirect</code> when redirecting to a different host. (<code>GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc></code>__)</p> </li> </ul> <h2>Deprecations and Removals</h2> <ul> <li>Used <code>FutureWarning</code> instead of <code>DeprecationWarning</code> for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (<code>[aio-libs#3764](urllib3/urllib3#3764) <https://github.com/urllib3/urllib3/issues/3764></code>__)</li> <li>Removed support for end-of-life Python 3.9. (<code>[aio-libs#3720](urllib3/urllib3#3720) <https://github.com/urllib3/urllib3/issues/3720></code>__)</li> <li>Removed support for end-of-life PyPy3.10. (<code>[aio-libs#4979](urllib3/urllib3#4979) <https://github.com/urllib3/urllib3/issues/4979></code>__)</li> <li>Bumped the minimum supported pyOpenSSL version to 19.0.0. (<code>[aio-libs#3777](urllib3/urllib3#3777) <https://github.com/urllib3/urllib3/issues/3777></code>__)</li> </ul> <h2>Bugfixes</h2> <ul> <li>Fixed a bug where <code>HTTPResponse.read(amt=None)</code> was ignoring decompressed data buffered from previous partial reads. (<code>[aio-libs#3636](urllib3/urllib3#3636) <https://github.com/urllib3/urllib3/issues/3636></code>__)</li> <li>Fixed a bug where <code>HTTPResponse.read()</code> could cache only part of the response after a partial read when <code>cache_content=True</code>.</li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2"><code>9a950b9</code></a> Release 2.7.0</li> <li><a href="https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc"><code>5ec0de4</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a"><code>2bdcc44</code></a> Merge commit from fork</li> <li><a href="https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c"><code>f45b0df</code></a> Fix a misleading example for <code>ProxyManager</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/4970">#4970</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b"><code>577193c</code></a> Switch to nightly PyPy3.11 in CI for now (<a href="https://redirect.github.com/urllib3/urllib3/issues/4984">#4984</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc"><code>e90af45</code></a> Avoid infinite loop in <code>HTTPResponse.read_chunked</code> when <code>amt=0</code> (<a href="https://redirect.github.com/urllib3/urllib3/issues/4974">#4974</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210"><code>67ed74f</code></a> Bump dev dependencies (<a href="https://redirect.github.com/urllib3/urllib3/issues/4972">#4972</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d"><code>3abd481</code></a> Upgrade mypy to version 1.20.2 (<a href="https://redirect.github.com/urllib3/urllib3/issues/4978">#4978</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890"><code>2b8725d</code></a> Drop support for EOL PyPy3.10 (<a href="https://redirect.github.com/urllib3/urllib3/issues/4979">#4979</a>)</li> <li><a href="https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33"><code>2944b2a</code></a> Upgrade <code>setup-chrome</code> and <code>setup-firefox</code> to fix warnings (<a href="https://redirect.github.com/urllib3/urllib3/issues/4973">#4973</a>)</li> <li>Additional commits viewable in <a href="https://github.com/urllib3/urllib3/compare/2.6.3...2.7.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=urllib3&package-manager=pip&previous-version=2.6.3&new-version=2.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [mypy](https://github.com/python/mypy) from 1.20.2 to 2.0.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's changelog</a>.</em></p> <blockquote> <h1>Mypy Release Notes</h1> <h2>Next Release</h2> <h2>Mypy 2.0</h2> <p>We’ve just uploaded mypy 2.0.0 to the Python Package Index (<a href="https://pypi.org/project/mypy/">PyPI</a>). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. There are also changes to options and defaults. You can install it as follows:</p> <pre><code>python3 -m pip install -U mypy </code></pre> <p>You can read the full documentation for this release on <a href="http://mypy.readthedocs.io">Read the Docs</a>.</p> <h3>Enable <code>--local-partial-types</code> by Default</h3> <p>This flag affects the inference of types based on assignments in other scopes. For now, explicitly disabling this continues to be supported, but this support will be removed in the future as the legacy behaviour is hard to support with other current and future features in mypy, like the daemon or the new implementation of flexible redefinitions.</p> <p>Contributed by Ivan Levkivskyi, Jukka Lehtosalo, Shantanu in <a href="https://redirect.github.com/python/mypy/pull/21163">PR 21163</a>.</p> <h3>Enable <code>--strict-bytes</code> by Default</h3> <p>Per <a href="https://peps.python.org/pep-0688">PEP 688</a>, mypy no longer treats <code>bytearray</code> and <code>memoryview</code> values as assignable to the <code>bytes</code> type.</p> <p>Contributed by Shantanu in <a href="https://redirect.github.com/python/mypy/pull/18371">PR 18371</a>.</p> <h3>New Behavior for <code>--allow-redefinition</code></h3> <p>The <code>--allow-redefinition</code> flag now behaves like <code>--allow-redefinition-new</code> in mypy 1.20 and earlier. The new behavior is generally more flexible. For example, you can have different types for a variable in different blocks:</p> <pre lang="python"><code># mypy: allow-redefinition <p>def foo(cond: bool) -> None: if cond: for x in ["a", "b"]: # Type of "x" is "str" here ... else: for x in [1, 2]: # Type of "x" is "int" here ... </code></pre></p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python/mypy/commit/7a765008a138ec46c579bfc6ef608860cab36033"><code>7a76500</code></a> Remove +dev from version</li> <li><a href="https://github.com/python/mypy/commit/5a3ab3b29f03d8baafeced3761e1afc8bd58be79"><code>5a3ab3b</code></a> Changelog for mypy 2.0 (<a href="https://redirect.github.com/python/mypy/issues/21422">#21422</a>)</li> <li><a href="https://github.com/python/mypy/commit/f9c86e21e88f96806c65790d604bf1264db39434"><code>f9c86e2</code></a> Some changelog updates for 2.0 (<a href="https://redirect.github.com/python/mypy/issues/21413">#21413</a>)</li> <li><a href="https://github.com/python/mypy/commit/519eaf15e0ceafae30337083577a54c7d3f3b4fe"><code>519eaf1</code></a> Bump librt to 0.10.0 (<a href="https://redirect.github.com/python/mypy/issues/21415">#21415</a>)</li> <li><a href="https://github.com/python/mypy/commit/158a6207d6e221cc403e1d556097b5abf5157cdd"><code>158a620</code></a> Fix negative narrowing for containers (<a href="https://redirect.github.com/python/mypy/issues/21411">#21411</a>)</li> <li><a href="https://github.com/python/mypy/commit/e556eb93a3c551a320a536879ce0a1608d14d490"><code>e556eb9</code></a> Try fixing mypy mypyc wheels (<a href="https://redirect.github.com/python/mypy/issues/21392">#21392</a>)</li> <li><a href="https://github.com/python/mypy/commit/f2c97971f5f4dcd749cf87df1e1308ab5754490a"><code>f2c9797</code></a> Expose --num-workers and --native-parser (<a href="https://redirect.github.com/python/mypy/issues/21387">#21387</a>)</li> <li><a href="https://github.com/python/mypy/commit/db0cb2f7c68b0f9d43d6ee1ab68117c1550dac39"><code>db0cb2f</code></a> Bump ast-serialize cache version (<a href="https://redirect.github.com/python/mypy/issues/21388">#21388</a>)</li> <li><a href="https://github.com/python/mypy/commit/1090ca6d476f629c566250a41204450043a47cf5"><code>1090ca6</code></a> Bump ast-serialize version to 0.3.0 only (<a href="https://redirect.github.com/python/mypy/issues/21391">#21391</a>)</li> <li><a href="https://github.com/python/mypy/commit/714ca9f2ac76e7c6dd56e26fd555f69313ba47ab"><code>714ca9f</code></a> [mypyc] Add note about librt.strings thread safety (<a href="https://redirect.github.com/python/mypy/issues/21383">#21383</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python/mypy/compare/v1.20.2...v2.0.0">compare view</a></li> </ul> </details> <br /> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Sam Bull <git@sambull.org>

Bumps [gunicorn](https://github.com/benoitc/gunicorn) from 25.3.0 to 26.0.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/benoitc/gunicorn/releases">gunicorn's releases</a>.</em></p> <blockquote> <h2>26.0.0</h2> <h2>Breaking Changes</h2> <ul> <li><strong>Eventlet worker removed</strong>: The <code>eventlet</code> worker class has been dropped. Migrate to <code>gevent</code>, <code>gthread</code>, or <code>tornado</code>.</li> </ul> <h2>New Features</h2> <ul> <li><strong>ASGI Framework Compatibility Suite</strong>: New end-to-end compatibility test harness covering Starlette, FastAPI, Litestar, Quart, Sanic, and BlackSheep. Current grid passes 438/444 tests (98%).</li> <li><strong>ASGI Test Suite Expansion</strong>: 134 additional ASGI unit tests covering protocol semantics, lifespan, websockets, and chunked framing.</li> </ul> <h2>Security</h2> <ul> <li><strong>HTTP/1.1 Request-Target Validation</strong> (RFC 9112 sections 3.2.3, 3.2.4): <ul> <li>Reject <code>authority-form</code> request-target outside <code>CONNECT</code></li> <li>Reject <code>asterisk-form</code> request-target outside <code>OPTIONS</code></li> <li>Reject <code>relative-reference</code> request-targets</li> </ul> </li> <li><strong>Header Field Hardening</strong> (RFC 9110): <ul> <li>Reject control characters in header field-value (section 5.5)</li> <li>Reject forbidden trailer field-names (section 6.5.1)</li> <li>Reject <code>Content-Length</code> list form (RFC 9112 section 6.3)</li> </ul> </li> <li><strong>Request Smuggling Hardening</strong>: <ul> <li>Tighten keepalive gate and scope <code>finish_body</code> byte cap</li> <li>Keep <code>_body_receiver</code> alive across the keepalive smuggling gate so pipelined requests cannot re-enter a closed body</li> <li>Address parser/protocol findings from a six-point WSGI/ASGI audit</li> </ul> </li> <li><strong>PROXY Protocol (ASGI)</strong>: Enforce <code>proxy_allow_ips</code> and tighten v1/v2 parsing in the ASGI callback parser.</li> <li><strong>Connection Draining</strong>: Drain the connection on close per RFC 9112 section 9.6 to prevent reset-on-close truncation.</li> </ul> <h2>Bug Fixes</h2> <ul> <li><strong>Body Framing on HEAD/204/304</strong>: <ul> <li>Keep <code>Content-Length</code> on HEAD and 304 responses (<a href="https://redirect.github.com/benoitc/gunicorn/issues/3621">#3621</a>)</li> <li>Drop body framing on HEAD/204/304 even when the framework set it</li> <li>Warn once when an ASGI app emits a body for a no-body response</li> </ul> </li> <li><strong>HTTP/2 ASGI</strong>: <ul> <li>Fix <code>_handle_stream_ended</code> to set <code>_body_complete</code> in the async HTTP/2 handler so request bodies finalize correctly on stream end</li> <li>Add <code>InvalidChunkExtension</code> mapping and fast-parser support in ASGI tests (<a href="https://redirect.github.com/benoitc/gunicorn/issues/3565">#3565</a>)</li> </ul> </li> <li><strong>HTTP/1.1 100-Continue</strong>: Stop adding <code>Transfer-Encoding: chunked</code> to 100-Continue interim responses.</li> <li><strong>WebSocket Close Handshake</strong> (RFC 6455): <ul> <li>Comply with the close handshake state machine</li> <li>Close the transport after the close handshake completes</li> <li>Fix binary send when the <code>text</code> key is <code>None</code></li> </ul> </li> <li><strong>Early Hints</strong>: Validate headers in the <code>early_hints</code> callback to match <code>process_headers</code>; pass only the header name to <code>InvalidHeader</code> (<a href="https://redirect.github.com/benoitc/gunicorn/issues/3588">#3588</a>).</li> <li><strong>ASGI Framework Fixes</strong>: <ul> <li>Fix ASGI disconnect handling for Django-style apps</li> <li>Fix Litestar request handling (use raw ASGI receive for body/headers)</li> <li>Fix Litestar HTTP endpoints for compatibility tests</li> <li>Fix Quart headers endpoint to normalize keys to lowercase</li> <li>Fix Quart WebSocket close test app (missing <code>accept()</code>)</li> <li>Fix duplicate <code>Transfer-Encoding</code> header for BlackSheep streaming</li> </ul> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/benoitc/gunicorn/commit/5d819cf36040f6cc6175fcc804d703fb899509dd"><code>5d819cf</code></a> release: 26.0.0</li> <li><a href="https://github.com/benoitc/gunicorn/commit/b45c70df105f7d5dcbc5abfb732804d6464edc21"><code>b45c70d</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3611">#3611</a> from zc-mattcen/docs-typo</li> <li><a href="https://github.com/benoitc/gunicorn/commit/99c8d48acf453deb5c49fe12e195dbc00d888d1e"><code>99c8d48</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3623">#3623</a> from benoitc/chore/drop-eventlet-add-h2-uvloop-test-...</li> <li><a href="https://github.com/benoitc/gunicorn/commit/5a655af50f20e005dd9e32e6078dc82fa45f3d4b"><code>5a655af</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3622">#3622</a> from benoitc/test/docker-port-and-ipv4-fixes</li> <li><a href="https://github.com/benoitc/gunicorn/commit/201df19a8011c0a1d6a0e75ebe22e89d48eb935e"><code>201df19</code></a> chore: remove eventlet worker; add h2 and uvloop to test deps</li> <li><a href="https://github.com/benoitc/gunicorn/commit/f4ac8e1f1bf1d365e77f41915da55bec31873f84"><code>f4ac8e1</code></a> test: pass action name to dirty client and stabilize after TTOU spam</li> <li><a href="https://github.com/benoitc/gunicorn/commit/54d38afddf1f0db0c15b5f4ff63f3c7bfad96961"><code>54d38af</code></a> test: unblock docker fixtures on macOS hosts</li> <li><a href="https://github.com/benoitc/gunicorn/commit/68843c8893dd938456f0a2da62085ab5776f8871"><code>68843c8</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3621">#3621</a> from benoitc/fix/asgi-preserve-content-length-on-hea...</li> <li><a href="https://github.com/benoitc/gunicorn/commit/31f2618f733cc0c78690df63f4e344aaf3f56b20"><code>31f2618</code></a> Merge pull request <a href="https://redirect.github.com/benoitc/gunicorn/issues/3620">#3620</a> from benoitc/fix/asgi-proxy-protocol-trust-and-parsing</li> <li><a href="https://github.com/benoitc/gunicorn/commit/41ec7527dbd8a9e52728477700707ad40e41d9dc"><code>41ec752</code></a> fix: keep Content-Length on HEAD and 304 responses</li> <li>Additional commits viewable in <a href="https://github.com/benoitc/gunicorn/compare/25.3.0...26.0.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [cryptography](https://github.com/pyca/cryptography) from 47.0.0 to 48.0.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst">cryptography's changelog</a>.</em></p> <blockquote> <p>48.0.0 - 2026-05-04</p> <pre><code> * **BACKWARDS INCOMPATIBLE:** Support for Python 3.8 has been removed. ``cryptography`` now requires Python 3.9 or later. * **BACKWARDS INCOMPATIBLE:** Loading an X.509 CRL whose inner ``TBSCertList.signature`` algorithm does not match the outer ``signatureAlgorithm`` now raises ``ValueError``. Previously, such CRLs were parsed successfully and only rejected during signature validation. * Added support for :doc:`/hazmat/primitives/asymmetric/mlkem` and :doc:`/hazmat/primitives/asymmetric/mldsa` when using OpenSSL 3.5.0 or later, in addition to the existing AWS-LC and BoringSSL support. This means post-quantum algorithms are now available to users of our wheels. <ul> <li><strong>Note:</strong> Going forward, we do not guarantee that all functionality<br /> in <code>cryptography</code> will be available when building against<br /> OpenSSL. See :doc:<code>/statements/state-of-openssl</code> for more information.</li> </ul> <p>.. _v47-0-0:<br /> </code></pre></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pyca/cryptography/commit/8e03e30e3aae01632a697e903e3593c924f0139d"><code>8e03e30</code></a> bump for 48.0.0 release (<a href="https://redirect.github.com/pyca/cryptography/issues/14796">#14796</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/295e0d254ef31ab864730aa41312ec355416ee71"><code>295e0d2</code></a> Add AGENTS.md with CLAUDE.md symlink (<a href="https://redirect.github.com/pyca/cryptography/issues/14794">#14794</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/104a2de19e268a433e6da92be9cb872dcf0003c8"><code>104a2de</code></a> Bump BoringSSL, OpenSSL, AWS-LC in CI (<a href="https://redirect.github.com/pyca/cryptography/issues/14793">#14793</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/67ec1e51988195e17993d2edef5258b27509b926"><code>67ec1e5</code></a> call check_length early on AesSiv::encrypt (<a href="https://redirect.github.com/pyca/cryptography/issues/14792">#14792</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/b2da57a0d9e4bfd2b95364299091a18f74127b26"><code>b2da57a</code></a> changelog for mldsa/mlkem for openssl (<a href="https://redirect.github.com/pyca/cryptography/issues/14791">#14791</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/3cf44adee25c368d4a136e072fa9f80465d91eb0"><code>3cf44ad</code></a> ML-KEM OpenSSL support (<a href="https://redirect.github.com/pyca/cryptography/issues/14781">#14781</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/2e31639666766f846fbab2c605879db0fa64fe83"><code>2e31639</code></a> ML-DSA OpenSSL support (<a href="https://redirect.github.com/pyca/cryptography/issues/14773">#14773</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/5affe5a286a986fdf512c4a5cb280d28a96c10e3"><code>5affe5a</code></a> fix rust nightly clippy (<a href="https://redirect.github.com/pyca/cryptography/issues/14790">#14790</a>)</li> <li><a href="https://github.com/pyca/cryptography/commit/2e73ca448eaf64b6f0d4ffbb794cf96170cef5ec"><code>2e73ca4</code></a> bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (<a href="https://redirect.github.com/pyca/cryptography/issues/1">#1</a>...</li> <li><a href="https://github.com/pyca/cryptography/commit/82ebd3b9f49d49ad5fd8b4b1f1dd02487b6e1466"><code>82ebd3b</code></a> Bump BoringSSL, OpenSSL, AWS-LC in CI (<a href="https://redirect.github.com/pyca/cryptography/issues/14785">#14785</a>)</li> <li>Additional commits viewable in <a href="https://github.com/pyca/cryptography/compare/47.0.0...48.0.0">compare view</a></li> </ul> </details> <br /> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

…io-libs#12493)

…#7679) Co-authored-by: Rodrigo Nogueira <rodrigo.b.nogueira@gmail.com>

Bumps [propcache](https://github.com/aio-libs/propcache) from 0.4.1 to 0.5.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/aio-libs/propcache/releases">propcache's releases</a>.</em></p> <blockquote> <h2>0.5.2</h2> <p>0.5.0 and 0.5.1 were tagged earlier today but never reached PyPI: 0.5.0's deploy failed at cibuildwheel's post-build pytest on free-threaded armv7l musllinux (SIGBUS under QEMU emulation while importing the C extension), and 0.5.1's deploy hit a transient sigstore Rekor 502 during the attestation step. 0.5.2 is the first of the three to actually publish.</p> <h2>Features</h2> <ul> <li> <p>Added support for newer type hints and remove <code>Optional</code> and <code>Union</code> from all annotations -- by :user:<code>Vizonex</code></p> <p><em>Related issues and pull requests on GitHub:</em> <a href="https://redirect.github.com/aio-libs/propcache/issues/193">#193</a>.</p> </li> </ul> <h2>Removals and backward incompatible breaking changes</h2> <ul> <li> <p>Dropped support for Python 3.9 as it has reached end of life.</p> <p><em>Related issues and pull requests on GitHub:</em> <a href="https://redirect.github.com/aio-libs/propcache/issues/216">#216</a>.</p> </li> </ul> <h2>Packaging updates and notes for downstreams</h2> <ul> <li> <p>Changed the Cython build dependency from <code>~= 3.1.0</code> to <code>>= 3.2.0</code>, removing the upper version bound to avoid conflicts for downstream packagers -- by :user:<code>jameshilliard</code> and :user:<code>gundalow</code>.</p> <p>The upstream Cython version is pinned to 3.2.4 in the CI/CD environment.</p> <p><em>Related issues and pull requests on GitHub:</em> <a href="https://redirect.github.com/aio-libs/propcache/issues/184">#184</a>, <a href="https://redirect.github.com/aio-libs/propcache/issues/188">#188</a>, <a href="https://redirect.github.com/aio-libs/propcache/issues/214">#214</a>.</p> </li> <li> <p>Start building and shipping riscv64 wheels -- by :user:<code>justeph</code>.</p> <p><em>Related issues and pull requests on GitHub:</em> <a href="https://redirect.github.com/aio-libs/propcache/issues/194">#194</a>.</p> </li> <li> <p>The :pep:<code>517</code> build backend now supports a new <code>build-inplace</code> config setting (and <code>PROPCACHE_BUILD_INPLACE</code> environment variable) for controlling whether to build the project in-tree or in a temporary directory. It only affects wheels and is set up to build in a temporary directory by default. It does not affect editable wheel builds; they will keep being built in-tree regardless.</p> <p>Here's an example of using this setting:</p> <p>.. code-block:: console</p> </li> </ul>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/aio-libs/propcache/blob/master/CHANGES.rst">propcache's changelog</a>.</em></p> <blockquote> <h1>0.5.2</h1> <p><em>(2026-05-08)</em></p> <p>No significant changes.</p> <hr /> <h1>0.5.1</h1> <p><em>(2026-05-08)</em></p> <p>No significant changes.</p> <hr /> <h1>0.5.0</h1> <p><em>(2026-05-08)</em></p> <h2>Features</h2> <ul> <li> <p>Added support for newer type hints and remove <code>Optional</code> and <code>Union</code> from all annotations -- by :user:<code>Vizonex</code></p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>193</code>.</p> </li> </ul> <h2>Removals and backward incompatible breaking changes</h2> <ul> <li> <p>Dropped support for Python 3.9 as it has reached end of life.</p> <p><em>Related issues and pull requests on GitHub:</em> :issue:<code>216</code>.</p> </li> </ul> <p>Packaging updates and notes for downstreams</p>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/aio-libs/propcache/commit/041f7afe0dff07f3baa77ff444dd735433290940"><code>041f7af</code></a> Release 0.5.2 (<a href="https://redirect.github.com/aio-libs/propcache/issues/222">#222</a>)</li> <li><a href="https://github.com/aio-libs/propcache/commit/9c374aa535fc054676ed84b4e709b8a29cb9a60c"><code>9c374aa</code></a> Release 0.5.1 (<a href="https://redirect.github.com/aio-libs/propcache/issues/221">#221</a>)</li> <li><a href="https://github.com/aio-libs/propcache/commit/c4e2b787766b8fd3c0eb7a1f947c7ab8c05cf6f4"><code>c4e2b78</code></a> Skip cibuildwheel test on free threaded armv7l musllinux (<a href="https://redirect.github.com/aio-libs/propcache/issues/220">#220</a>)</li> <li><a href="https://github.com/aio-libs/propcache/commit/e60bdedb748d995e47358d34b81930f85a979c00"><code>e60bded</code></a> Release 0.5.0 (<a href="https://redirect.github.com/aio-libs/propcache/issues/219">#219</a>)</li> <li><a href="https://github.com/aio-libs/propcache/commit/b88f846f78f8816df48cb8c593d216d235bec87f"><code>b88f846</code></a> Make wheel builds reproducible (<a href="https://redirect.github.com/aio-libs/propcache/issues/218">#218</a>)</li> <li><a href="https://github.com/aio-libs/propcache/commit/fdacd6cd20833a2049793c20997ee0215d1dedda"><code>fdacd6c</code></a> Update Typehint annotations (<a href="https://redirect.github.com/aio-libs/propcache/issues/193">#193</a>)</li> <li><a href="https://github.com/aio-libs/propcache/commit/483e9d36431d6470b6622c6057afa6c404ec8c6c"><code>483e9d3</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/aio-libs/propcache/issues/204">#204</a>)</li> <li><a href="https://github.com/aio-libs/propcache/commit/d0d45e182ab5d580effa7ee4bf562ae14397a67d"><code>d0d45e1</code></a> Drop Python 3.9 support (<a href="https://redirect.github.com/aio-libs/propcache/issues/216">#216</a>)</li> <li><a href="https://github.com/aio-libs/propcache/commit/c0bacf5846a3f168a3868751f6f3ed42564693c4"><code>c0bacf5</code></a> Update pytest-cov requirement from >=2.3.1 to >=7.1.0 (<a href="https://redirect.github.com/aio-libs/propcache/issues/210">#210</a>)</li> <li><a href="https://github.com/aio-libs/propcache/commit/9bfb3e4f32dc4bed06e153b0a2b377ef18524d69"><code>9bfb3e4</code></a> Bump pytest-codspeed from 4.3.0 to 4.5.0 (<a href="https://redirect.github.com/aio-libs/propcache/issues/211">#211</a>)</li> <li>Additional commits viewable in <a href="https://github.com/aio-libs/propcache/compare/v0.4.1...v0.5.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=propcache&package-manager=pip&previous-version=0.4.1&new-version=0.5.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [librt](https://github.com/mypyc/librt) from 0.10.0 to 0.11.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/mypyc/librt/commit/862679a0492f4433a286b2d53965ec2603623be1"><code>862679a</code></a> Sync mypy and bump version to 0.11.0 (<a href="https://redirect.github.com/mypyc/librt/issues/40">#40</a>)</li> <li>See full diff in <a href="https://github.com/mypyc/librt/compare/v0.10.0...v0.11.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=librt&package-manager=pip&previous-version=0.10.0&new-version=0.11.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [virtualenv](https://github.com/pypa/virtualenv) from 21.3.1 to 21.3.2. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/pypa/virtualenv/releases">virtualenv's releases</a>.</em></p> <blockquote> <h2>21.3.2</h2>  <h2>What's Changed</h2> <ul> <li>add 3.16 to embedded wheel versions by <a href="https://github.com/asottile"><code>@asottile</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3140">pypa/virtualenv#3140</a></li> <li>🐛 fix(upgrade): regen embedded init with correct MAX and 3.16 by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/pypa/virtualenv/pull/3143">pypa/virtualenv#3143</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/pypa/virtualenv/compare/21.3.1...21.3.2">https://github.com/pypa/virtualenv/compare/21.3.1...21.3.2</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst">virtualenv's changelog</a>.</em></p> <blockquote> <p>################# Release History #################</p> <p>.. towncrier-draft-entries:: [UNRELEASED DRAFT]</p> <p>.. towncrier release notes start</p> <hr /> <p>v21.3.2 (2026-05-12)</p> <hr /> <p>No significant changes.</p> <hr /> <p>v21.3.1 (2026-05-05)</p> <hr /> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/pypa/virtualenv/commit/8531d47ff3e78492d0c1eb7d1159750e91176b67"><code>8531d47</code></a> release 21.3.2</li> <li><a href="https://github.com/pypa/virtualenv/commit/afefada9505d4fe67805244c31c5761e4c6c2622"><code>afefada</code></a> 🐛 fix(upgrade): regen embedded init with correct MAX and 3.16 (<a href="https://redirect.github.com/pypa/virtualenv/issues/3143">#3143</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/7e270411ebf5739dfc63998a9084dc2bfd2d467b"><code>7e27041</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/pypa/virtualenv/issues/3141">#3141</a>)</li> <li><a href="https://github.com/pypa/virtualenv/commit/214934c9606ef792e42580109cbdff940a62f034"><code>214934c</code></a> add 3.16 to embedded wheel versions (<a href="https://redirect.github.com/pypa/virtualenv/issues/3140">#3140</a>)</li> <li>See full diff in <a href="https://github.com/pypa/virtualenv/compare/21.3.1...21.3.2">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=virtualenv&package-manager=pip&previous-version=21.3.1&new-version=21.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [mypy](https://github.com/python/mypy) from 2.0.0 to 2.1.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/python/mypy/blob/master/CHANGELOG.md">mypy's changelog</a>.</em></p> <blockquote> <h1>Mypy Release Notes</h1> <h2>Next Release</h2> <h2>Mypy 2.1</h2> <p>We’ve just uploaded mypy 2.1.0 to the Python Package Index (<a href="https://pypi.org/project/mypy/">PyPI</a>). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:</p> <pre><code>python3 -m pip install -U mypy </code></pre> <p>You can read the full documentation for this release on <a href="http://mypy.readthedocs.io">Read the Docs</a>.</p> <h3>librt.vecs: Fast Growable Array Type for Mypyc</h3> <p>The new <code>librt.vecs</code> module provides an efficient growable array type <code>vec</code> that is optimized for mypyc use. It provides fast, packed arrays with integer and floating point value types, which can be <strong>several times faster</strong> than <code>list</code>, and tens of times faster than <code>array.array</code> in code compiled using mypyc. It also supports nested <code>vec</code> objects and non-value-type items, such as <code>vec[vec[str]]</code>.</p> <p>Refer to the <a href="https://mypyc.readthedocs.io/en/latest/librt_vecs.html">documentation</a> for the details.</p> <p>Contributed by Jukka Lehtosalo.</p> <h3>librt.random: Fast Pseudo-Random Number Generation</h3> <p>The new <code>librt.random</code> module provides fast pseudo-random number generation that is optimized for code compiled using mypyc. It can be 3x to 10x faster than the stdlib <code>random</code> module in compiled code.</p> <p>Refer to the <a href="https://mypyc.readthedocs.io/en/latest/librt_random.html">documentation</a> for the details.</p> <p>Contributed by Jukka Lehtosalo (PR <a href="https://redirect.github.com/python/mypy/pull/21433">21433</a>).</p> <h3>Mypyc Improvements</h3> <ul> <li>Make compilation order with multiple files consistent (Piotr Sawicki, PR <a href="https://redirect.github.com/python/mypy/pull/21419">21419</a>)</li> <li>Fix crash on accessing <code>StopAsyncIteration</code> (Piotr Sawicki, PR <a href="https://redirect.github.com/python/mypy/pull/21406">21406</a>)</li> <li>Fix incremental compilation with <code>separate</code> flag (Vaggelis Danias, PR <a href="https://redirect.github.com/python/mypy/pull/21299">21299</a>)</li> </ul> <h3>Fixes to Crashes</h3> <ul> <li>Fix crash on partial type with <code>--allow-redefinition</code> and <code>global</code> declaration (Jukka Lehtosalo, PR <a href="https://redirect.github.com/python/mypy/pull/21428">21428</a>)</li> <li>Fix broken awaitable generator patching (Ivan Levkivskyi, PR <a href="https://redirect.github.com/python/mypy/pull/21435">21435</a>)</li> </ul> <h3>Changes to Messages</h3>  </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/python/mypy/commit/c1c336d7e34eb313080c79b156518c58d27c7234"><code>c1c336d</code></a> Remove +dev from version</li> <li><a href="https://github.com/python/mypy/commit/74df14b7cbf08140236aa45bbb7f42219b0b1df7"><code>74df14b</code></a> Add changelog for mypy 2.1 (<a href="https://redirect.github.com/python/mypy/issues/21464">#21464</a>)</li> <li><a href="https://github.com/python/mypy/commit/022d9bc96f86c40f338a5cf150f1806cc8f300ff"><code>022d9bc</code></a> Revert "TypeForm: Enable by default (<a href="https://redirect.github.com/python/mypy/issues/21262">#21262</a>)"</li> <li><a href="https://github.com/python/mypy/commit/8826288214f1cb31496e610667481221e025359c"><code>8826288</code></a> [mypyc] Document librt.random (<a href="https://redirect.github.com/python/mypy/issues/21463">#21463</a>)</li> <li><a href="https://github.com/python/mypy/commit/3f4067b699dbe52d08e42ef3b3ebfdebdc06bd96"><code>3f4067b</code></a> Bump librt version to 0.11.0 (<a href="https://redirect.github.com/python/mypy/issues/21458">#21458</a>)</li> <li><a href="https://github.com/python/mypy/commit/2b1eb58a250c5f1eb4ef5fb1f312ff528c5a1d4e"><code>2b1eb58</code></a> [mypyc] Enable incremental self-compilation (<a href="https://redirect.github.com/python/mypy/issues/21369">#21369</a>)</li> <li><a href="https://github.com/python/mypy/commit/8152f4af3f6c03beaf2660026240f0fdce7feecc"><code>8152f4a</code></a> Respect file config comments for stale modules (<a href="https://redirect.github.com/python/mypy/issues/21444">#21444</a>)</li> <li><a href="https://github.com/python/mypy/commit/116d60bdd3fdfe8d97c6afe99370910db56f1b92"><code>116d60b</code></a> Fix nondeterminism from nonassociativity of overload joins (<a href="https://redirect.github.com/python/mypy/issues/21455">#21455</a>)</li> <li><a href="https://github.com/python/mypy/commit/6c4af8e42110cea3f84bc02add2ca7b89c268210"><code>6c4af8e</code></a> Fix function call message change for small number of args (<a href="https://redirect.github.com/python/mypy/issues/21432">#21432</a>)</li> <li><a href="https://github.com/python/mypy/commit/4b8fdcaf24032592510e8f15421fb32d82a71800"><code>4b8fdca</code></a> [mypyc] Add librt.random module (<a href="https://redirect.github.com/python/mypy/issues/21433">#21433</a>)</li> <li>Additional commits viewable in <a href="https://github.com/python/mypy/compare/v2.0.0...v2.1.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=mypy&package-manager=pip&previous-version=2.0.0&new-version=2.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [requests](https://github.com/psf/requests) from 2.33.1 to 2.34.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/psf/requests/releases">requests's releases</a>.</em></p> <blockquote> <h2>v2.34.0</h2> <h2>2.34.0 (2026-05-11)</h2> <p><strong>Announcements</strong></p> <ul> <li> <p>Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. <strong>We believe types are comprehensive but if you find issues, please report them to the <a href="https://redirect.github.com/psf/requests/issues/7271">pinned tracking issue</a>.</strong></p> <p>Special thanks to <a href="https://github.com/bastimeyer"><code>@bastimeyer</code></a>, <a href="https://github.com/cthoyt"><code>@cthoyt</code></a>, <a href="https://github.com/edgarrmondragon"><code>@edgarrmondragon</code></a>, and <a href="https://github.com/srittau"><code>@srittau</code></a> for helping review and test the types ahead of the release. (<a href="https://redirect.github.com/psf/requests/issues/7272">#7272</a>)</p> </li> </ul> <p><strong>Improvements</strong></p> <ul> <li>Digest Auth hashing algorithms have added <code>usedforsecurity=False</code> to clarify security considerations. (<a href="https://redirect.github.com/psf/requests/issues/7310">#7310</a>)</li> <li>Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (<a href="https://redirect.github.com/psf/requests/issues/7422">#7422</a>)</li> <li>Requests added support for Python 3.14t. (<a href="https://redirect.github.com/psf/requests/issues/7419">#7419</a>)</li> </ul> <p><strong>Bugfixes</strong></p> <ul> <li><code>Response.history</code> no longer contains a reference to itself, preventing accidental looping when traversing the history list. (<a href="https://redirect.github.com/psf/requests/issues/7328">#7328</a>)</li> <li>Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (<a href="https://redirect.github.com/psf/requests/issues/7427">#7427</a>)</li> <li>Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (<a href="https://redirect.github.com/psf/requests/issues/7315">#7315</a>)</li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/cjriches"><code>@cjriches</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7365">psf/requests#7365</a></li> <li><a href="https://github.com/dsanader"><code>@dsanader</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7376">psf/requests#7376</a></li> <li><a href="https://github.com/DimitriPapadopoulos"><code>@DimitriPapadopoulos</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7393">psf/requests#7393</a></li> <li><a href="https://github.com/joshua-51"><code>@joshua-51</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7416">psf/requests#7416</a></li> <li><a href="https://github.com/eggsort"><code>@eggsort</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7421">psf/requests#7421</a></li> <li><a href="https://github.com/typhon8"><code>@typhon8</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7315">psf/requests#7315</a></li> <li><a href="https://github.com/bastimeyer"><code>@bastimeyer</code></a> made their first contribution in <a href="https://redirect.github.com/psf/requests/pull/7425">psf/requests#7425</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/psf/requests/blob/main/HISTORY.md#2340-2026-05-11">https://github.com/psf/requests/blob/main/HISTORY.md#2340-2026-05-11</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/psf/requests/blob/main/HISTORY.md">requests's changelog</a>.</em></p> <blockquote> <h2>2.34.0 (2026-05-11)</h2> <p><strong>Announcements</strong></p> <ul> <li> <p>Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.</p> <p>Special thanks to <a href="https://github.com/bastimeyer"><code>@bastimeyer</code></a>, <a href="https://github.com/cthoyt"><code>@cthoyt</code></a>, <a href="https://github.com/edgarrmondragon"><code>@edgarrmondragon</code></a>, and <a href="https://github.com/srittau"><code>@srittau</code></a> for helping review and test the types ahead of the release. (<a href="https://redirect.github.com/psf/requests/issues/7272">#7272</a>)</p> </li> </ul> <p><strong>Improvements</strong></p> <ul> <li>Digest Auth hashing algorithms have added <code>usedforsecurity=False</code> to clarify security considerations. (<a href="https://redirect.github.com/psf/requests/issues/7310">#7310</a>)</li> <li>Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (<a href="https://redirect.github.com/psf/requests/issues/7422">#7422</a>)</li> <li>Requests added support for Python 3.14t. (<a href="https://redirect.github.com/psf/requests/issues/7419">#7419</a>)</li> </ul> <p><strong>Bugfixes</strong></p> <ul> <li><code>Response.history</code> no longer contains a reference to itself, preventing accidental looping when traversing the history list. (<a href="https://redirect.github.com/psf/requests/issues/7328">#7328</a>)</li> <li>Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (<a href="https://redirect.github.com/psf/requests/issues/7427">#7427</a>)</li> <li>Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (<a href="https://redirect.github.com/psf/requests/issues/7315">#7315</a>)</li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/psf/requests/commit/0b401c76b6e80a4eecf3c690085b2553f6e261ca"><code>0b401c7</code></a> v2.34.0</li> <li><a href="https://github.com/psf/requests/commit/86b378d3f60f828daa13ca50aa82e287ff7b66b4"><code>86b378d</code></a> Align Session.get parameters with requests.get (<a href="https://redirect.github.com/psf/requests/issues/7429">#7429</a>)</li> <li><a href="https://github.com/psf/requests/commit/a4f9a5999bdb9bf2d6e7c8aa973b28cacb17134f"><code>a4f9a59</code></a> Port bpo-39057 to Requests (<a href="https://redirect.github.com/psf/requests/issues/7427">#7427</a>)</li> <li><a href="https://github.com/psf/requests/commit/3816cfa1abd42dca21b9e837f26c59b246016aaf"><code>3816cfa</code></a> Parameterize SupportsItems to handle Mapping key invariance (<a href="https://redirect.github.com/psf/requests/issues/7426">#7426</a>)</li> <li><a href="https://github.com/psf/requests/commit/b684dcb9bbf3aa557d1238e72062c4a29737dd1c"><code>b684dcb</code></a> sessions: fix hooks type (<a href="https://redirect.github.com/psf/requests/issues/7425">#7425</a>)</li> <li><a href="https://github.com/psf/requests/commit/dc9dbdfb3434c6e58d48fd102f93e5342308817e"><code>dc9dbdf</code></a> Formalize 3.15 support (<a href="https://redirect.github.com/psf/requests/issues/7422">#7422</a>)</li> <li><a href="https://github.com/psf/requests/commit/25340ebad09a38e0748aeb26232102022a03ec94"><code>25340eb</code></a> Clear proxy env vars before every test run (<a href="https://redirect.github.com/psf/requests/issues/7423">#7423</a>)</li> <li><a href="https://github.com/psf/requests/commit/fd628095d7b9ddbf3e987d8a4bf0e6062768916f"><code>fd62809</code></a> Preserve leading slashes in request path_url (<a href="https://redirect.github.com/psf/requests/issues/7315">#7315</a>)</li> <li><a href="https://github.com/psf/requests/commit/e8d2c015eecda8273612dd4562425e00cd164ba5"><code>e8d2c01</code></a> docs: Fix missing hook output in docs example (<a href="https://redirect.github.com/psf/requests/issues/7421">#7421</a>)</li> <li><a href="https://github.com/psf/requests/commit/eb173bc819c72580deed2d54190d340cc769e529"><code>eb173bc</code></a> Add 3.14t support to CI (<a href="https://redirect.github.com/psf/requests/issues/7419">#7419</a>)</li> <li>Additional commits viewable in <a href="https://github.com/psf/requests/compare/v2.33.1...v2.34.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=requests&package-manager=pip&previous-version=2.33.1&new-version=2.34.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [coverage](https://github.com/coveragepy/coveragepy) from 7.13.5 to 7.14.0. <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst">coverage's changelog</a>.</em></p> <blockquote> <h2>Version 7.14.0 — 2026-05-10</h2> <ul> <li> <p>Feature: now when running one of the reporting commands, if there are parallel data files that need combining, they will be implicitly combined before creating the report. There is no option to avoid the combination; let us know if you have a use case that requires it. Thanks, <code>Tim Hatch <pull 2162_></code><em>. Closes <code>issue 1781</code></em>.</p> </li> <li> <p>Fix: the output from <code>combine</code> was too verbose, listing each file considered. Now it shows a single line with the counts of files combined, files skipped, and files with errors. The <code>-q</code> flag suppresses this line. The old detailed lines are available with the new <code>--debug=combine</code> option.</p> </li> <li> <p>Fix: running a Python file through a symlink now sets the sys.path correctly, matching regular Python behavior. Fixes <code>issue 2157</code>_.</p> </li> <li> <p>Fix: <code>Collector.flush_data</code> could fail with "RuntimeError: Set changed size during iteration" when a tracer in another thread added a line to the per-file set that <code>add_lines</code> (or <code>add_arcs</code>) was iterating. The values passed to <code>CoverageData</code> are now snapshotted via <code>dict.copy()</code> and <code>set.copy()</code>, which are atomic under the GIL. Thanks, <code>Alex Vandiver <pull 2165_></code>_.</p> </li> <li> <p>Fix: the soft keyword <code>lazy</code> is now bolded in HTML reports.</p> </li> <li> <p>We are no longer testing eventlet support. Eventlet started issuing stern deprecation warnings that break our tests. Our support code is still there.</p> </li> </ul> <p>.. _issue 1781: <a href="https://redirect.github.com/coveragepy/coveragepy/issues/1781">coveragepy/coveragepy#1781</a> .. _issue 2157: <a href="https://redirect.github.com/coveragepy/coveragepy/issues/2157">coveragepy/coveragepy#2157</a> .. _pull 2162: <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2162">coveragepy/coveragepy#2162</a> .. _pull 2165: <a href="https://redirect.github.com/coveragepy/coveragepy/pull/2165">coveragepy/coveragepy#2165</a></p> <p>.. _changes_7-13-5:</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/coveragepy/coveragepy/commit/646351b60429f1b5760af6c1b97b28483244a955"><code>646351b</code></a> docs: sample HTML for 7.14.0</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/39cd015505c8b04369c5b06e34fc22449a697370"><code>39cd015</code></a> docs: prep for 7.14.0</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/649e8aa34af7d80c386ae82e8a3a6c9a3acb0dab"><code>649e8aa</code></a> docs: thanks Alex Vandiver for <a href="https://redirect.github.com/coveragepy/coveragepy/issues/2165">#2165</a></li> <li><a href="https://github.com/coveragepy/coveragepy/commit/8cd392e3b5c4bc15d534aaec0c21714f9f518469"><code>8cd392e</code></a> fix: snapshot data in Collector.flush_data to avoid threading race (<a href="https://redirect.github.com/coveragepy/coveragepy/issues/2165">#2165</a>)</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/c48e0edc2ebe44621b0053176e90f77b0c79bec1"><code>c48e0ed</code></a> fix: less output for combining</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/c2a3a284078556c911e0d9b6c6af1b7082a363ea"><code>c2a3a28</code></a> docs: explain the change from <a href="https://redirect.github.com/coveragepy/coveragepy/issues/2162">#2162</a></li> <li><a href="https://github.com/coveragepy/coveragepy/commit/1cd47aa6ac1da4e150da44055295d4e4f3a014e8"><code>1cd47aa</code></a> fix: implicit combine-during-report now removes the combined data files</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/2d99fd7696e0bccec8037479a4e45c1ecccb8058"><code>2d99fd7</code></a> feat: automatically combine coverage in report, thanks Tim Hatch (<a href="https://redirect.github.com/coveragepy/coveragepy/issues/2162">#2162</a>)</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/9fbdcdfee1c122fac43f1bf9a5e2d1f4d835f21c"><code>9fbdcdf</code></a> fix: lazy soft keywords are bolded</li> <li><a href="https://github.com/coveragepy/coveragepy/commit/5de7d0267b9466d59995aaae1a7e707c8c6f66e7"><code>5de7d02</code></a> build: oops, misplaced quote</li> <li>Additional commits viewable in <a href="https://github.com/coveragepy/coveragepy/compare/7.13.5...7.14.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coverage&package-manager=pip&previous-version=7.13.5&new-version=7.14.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [pytest-codspeed](https://github.com/CodSpeedHQ/pytest-codspeed) from 4.5.0 to 5.0.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/CodSpeedHQ/pytest-codspeed/releases">pytest-codspeed's releases</a>.</em></p> <blockquote> <h2>v5.0.1</h2> <h2>What's Changed</h2> <ul> <li>build: enable free-threaded wheels in cibuildwheel by <a href="https://github.com/art049"><code>@art049</code></a> in <a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/pull/121">CodSpeedHQ/pytest-codspeed#121</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/CodSpeedHQ/pytest-codspeed/compare/v5.0.0...v5.0.1">https://github.com/CodSpeedHQ/pytest-codspeed/compare/v5.0.0...v5.0.1</a></p> <h2>v5.0.0</h2> <h2>Highlights</h2> <p>MacOS walltime profiling is now available with the <a href="https://github.com/CodSpeedHQ/codspeed/releases/tag/v4.16.1">codspeed cli v4.16.1</a> and above.</p> <p><code>pytest-codspeed</code> can now be used in free threaded mode. This has been tested with 3.14t and 3.15t. For this, we have dropped usage of <code>cffi</code> in favor of the native extension support.</p> <h2>What's Changed</h2> <ul> <li>chore: bump instrument-hooks by <a href="https://github.com/not-matthias"><code>@not-matthias</code></a> in <a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/pull/119">CodSpeedHQ/pytest-codspeed#119</a></li> <li>Remove CFFI in favor of native extension to support free-threaded mode by <a href="https://github.com/adriencaccia"><code>@adriencaccia</code></a> in <a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/pull/96">CodSpeedHQ/pytest-codspeed#96</a></li> <li>feat(hooks): declare native extension free-thread safe by <a href="https://github.com/art049"><code>@art049</code></a> in <a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/pull/120">CodSpeedHQ/pytest-codspeed#120</a></li> <li>feat: use instrument-hook markers in walltime by <a href="https://github.com/GuillaumeLagrange"><code>@GuillaumeLagrange</code></a> in <a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/pull/118">CodSpeedHQ/pytest-codspeed#118</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/CodSpeedHQ/pytest-codspeed/compare/v4.5.0...v5.0.0">https://github.com/CodSpeedHQ/pytest-codspeed/compare/v4.5.0...v5.0.0</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/CodSpeedHQ/pytest-codspeed/blob/master/CHANGELOG.md">pytest-codspeed's changelog</a>.</em></p> <blockquote> <h2>[5.0.1] - 2026-05-13</h2> <h3>💼 Other</h3> <ul> <li>Enable free-threaded wheels in cibuildwheel (<a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/issues/121">#121</a>) by <a href="https://github.com/art049"><code>@art049</code></a> in <a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/pull/121">#121</a></li> </ul> <h2>[5.0.0] - 2026-05-13</h2> <h3>🚀 Features</h3> <ul> <li>Use instrument_hooks markers in walltime by <a href="https://github.com/GuillaumeLagrange"><code>@GuillaumeLagrange</code></a></li> <li>Declare native extension free-thread safe (<a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/issues/120">#120</a>) by <a href="https://github.com/art049"><code>@art049</code></a> in <a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/pull/120">#120</a></li> <li>Remove cffi in favor of native extension by <a href="https://github.com/adriencaccia"><code>@adriencaccia</code></a></li> </ul> <h3>⚡ Performance</h3> <ul> <li>Bind callgrind start/stop directly to avoid extra frame by <a href="https://github.com/art049"><code>@art049</code></a> in <a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/pull/96">#96</a></li> </ul> <h3>⚙️ Internals</h3> <ul> <li>Ignore common compilation warnings for instrument-hooks by <a href="https://github.com/GuillaumeLagrange"><code>@GuillaumeLagrange</code></a> in <a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/pull/118">#118</a></li> <li>Use unsigned bash in the macos test by <a href="https://github.com/GuillaumeLagrange"><code>@GuillaumeLagrange</code></a></li> <li>Bump pinned uv version to 0.11.14 by <a href="https://github.com/art049"><code>@art049</code></a></li> <li>Add python 3.15 and 3.15t to test matrix by <a href="https://github.com/art049"><code>@art049</code></a></li> <li>Add 3.14.t in test suite by <a href="https://github.com/adriencaccia"><code>@adriencaccia</code></a></li> <li>Bump instrument-hooks (<a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/issues/119">#119</a>) by <a href="https://github.com/not-matthias"><code>@not-matthias</code></a> in <a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/pull/119">#119</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/CodSpeedHQ/pytest-codspeed/commit/d4d9dc6ca011bbf6d21640e7c370d3d181f944cf"><code>d4d9dc6</code></a> Release v5.0.1 🚀</li> <li><a href="https://github.com/CodSpeedHQ/pytest-codspeed/commit/ad709a5904ea756c577dcfa91caff67c3cf8777a"><code>ad709a5</code></a> build: enable free-threaded wheels in cibuildwheel (<a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/issues/121">#121</a>)</li> <li><a href="https://github.com/CodSpeedHQ/pytest-codspeed/commit/080d620ba846adaf6e1b70b96e525e773438034b"><code>080d620</code></a> Release v5.0.0 🚀</li> <li><a href="https://github.com/CodSpeedHQ/pytest-codspeed/commit/befdebfba2cdebddd84d6377f8d14d72e0ad4086"><code>befdebf</code></a> chore: ignore common compilation warnings for instrument-hooks</li> <li><a href="https://github.com/CodSpeedHQ/pytest-codspeed/commit/ee98055fb69fba4cc62c3822ef3df4c7002352d3"><code>ee98055</code></a> chore: use unsigned bash in the macos test</li> <li><a href="https://github.com/CodSpeedHQ/pytest-codspeed/commit/5a205c8822ca16db400ef25a5d8b51a65c875669"><code>5a205c8</code></a> feat: use instrument_hooks markers in walltime</li> <li><a href="https://github.com/CodSpeedHQ/pytest-codspeed/commit/fda1fbc5f59ea9db783a13a2052c872d22ed9d28"><code>fda1fbc</code></a> feat(hooks): declare native extension free-thread safe (<a href="https://redirect.github.com/CodSpeedHQ/pytest-codspeed/issues/120">#120</a>)</li> <li><a href="https://github.com/CodSpeedHQ/pytest-codspeed/commit/f3ed38804ccffc4e84f14710482c9c3e8ddf5d96"><code>f3ed388</code></a> perf(hooks): bind callgrind start/stop directly to avoid extra frame</li> <li><a href="https://github.com/CodSpeedHQ/pytest-codspeed/commit/e4a419e1410afd9c7eec032683a377d2282177ac"><code>e4a419e</code></a> chore: bump pinned uv version to 0.11.14</li> <li><a href="https://github.com/CodSpeedHQ/pytest-codspeed/commit/ee07afb418bc5324ce306dd0912dce604312b2b7"><code>ee07afb</code></a> ci: add python 3.15 and 3.15t to test matrix</li> <li>Additional commits viewable in <a href="https://github.com/CodSpeedHQ/pytest-codspeed/compare/v4.5.0...v5.0.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=pytest-codspeed&package-manager=pip&previous-version=4.5.0&new-version=5.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [python-discovery](https://github.com/tox-dev/python-discovery) from 1.3.0 to 1.3.1. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/python-discovery/releases">python-discovery's releases</a>.</em></p> <blockquote> <h2>v1.3.1</h2>  <h2>What's Changed</h2> <ul> <li>Canonicalize GraalPy implementation name. by <a href="https://github.com/timfel"><code>@timfel</code></a> in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/73">tox-dev/python-discovery#73</a></li> <li>👷 ci(release): wire up towncrier-driven release pipeline by <a href="https://github.com/gaborbernat"><code>@gaborbernat</code></a> in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/74">tox-dev/python-discovery#74</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/timfel"><code>@timfel</code></a> made their first contribution in <a href="https://redirect.github.com/tox-dev/python-discovery/pull/73">tox-dev/python-discovery#73</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/tox-dev/python-discovery/compare/1.3.0...1.3.1">https://github.com/tox-dev/python-discovery/compare/1.3.0...1.3.1</a></p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/tox-dev/python-discovery/blob/main/docs/changelog.rst">python-discovery's changelog</a>.</em></p> <blockquote> <h1>Bug fixes - 1.3.1</h1> <ul> <li>export normalize_isa and deprecate KNOWN_ARCHITECTURES - by :user:<code>rahuldevikar</code>. (:issue:<code>59</code>)</li> <li>discover uv-managed Pythons on Windows. Previously the glob assumed Unix layout (<code><root>/<key>/bin/python</code>) and silently found nothing on Windows, where uv places <code>python.exe</code> directly under the install root - by :user:<code>gaborbernat</code>. (:issue:<code>65</code>)</li> <li>Canonicalize GraalVM to match GraalPy Python interpreter in PythonSpec and PythonInfo. - by :user:<code>timfel</code>. (:issue:<code>73</code>)</li> </ul> <hr /> <p>v1.3.0 (2026-05-05)</p> <hr /> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/tox-dev/python-discovery/commit/0d344843eae2e74c13eb739f2c043e177aa015b0"><code>0d34484</code></a> release 1.3.1</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/6840c417a47eea7c7ae0347838a63f89c1d24749"><code>6840c41</code></a> 👷 ci(release): wire up towncrier-driven release pipeline (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/74">#74</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/68f7dc15f51a4bdec413080077816b9e895b23cd"><code>68f7dc1</code></a> Canonicalize GraalPy implementation name. (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/73">#73</a>)</li> <li><a href="https://github.com/tox-dev/python-discovery/commit/e7cff49eb8610590395e495f875e5d1e8771e24d"><code>e7cff49</code></a> [pre-commit.ci] pre-commit autoupdate (<a href="https://redirect.github.com/tox-dev/python-discovery/issues/72">#72</a>)</li> <li>See full diff in <a href="https://github.com/tox-dev/python-discovery/compare/1.3.0...1.3.1">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=python-discovery&package-manager=pip&previous-version=1.3.0&new-version=1.3.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Fixes aio-libs#12497 The TCPConnector.close() method had a race condition where the resolver was closed before marking the connector as closed. This allowed in-flight DNS resolutions to resume and attempt to use a None resolver, causing AttributeError instead of the expected ClientConnectionError. The fix reorders the operations to ensure _closed is set to True (via super().close()) before closing the resolver. This way, any resumed DNS resolutions can properly detect the closed state and bail out. - Reorder close sequence: mark connector closed before closing resolver - Add regression test for in-flight DNS resolution during close

patchback Bot and others added 30 commits February 21, 2026 00:08

Fix multipart injection (aio-libs#12104) (aio-libs#12109)

2712a3c

(cherry picked from commit dab9e87) Co-authored-by: mingi jung <mingijung.grape@gmail.com>

Fix multipart injection (aio-libs#12104) (aio-libs#12110)

9a6ada9

(cherry picked from commit dab9e87) Co-authored-by: mingi jung <mingijung.grape@gmail.com>

Fix access log timestamps ignoring daylight savings time (aio-libs#12085

004127a

) --------- Co-authored-by: nightcityblade <nightcityblade@gmail.com> Co-authored-by: Sam Bull <git@sambull.org>

Allow JSONEncoder to return bytes directly (aio-libs#11989)

67fa1f5

[PR aio-libs#12069/3a39006d backport][3.14] Upgrade to llhttp 3.9.1 (a…

9b63f4c

…io-libs#12072) **This is a backport of PR aio-libs#12069 as merged into master (3a39006).** Co-authored-by: Sam Bull <git@sambull.org>

[PR aio-libs#12069/3a39006d backport][3.13] Upgrade to llhttp 3.9.1 (a…

7d590fe

…io-libs#12071) **This is a backport of PR aio-libs#12069 as merged into master (3a39006).** Co-authored-by: Sam Bull <git@sambull.org>

Bound DNS cache (aio-libs#12106)

8ab84c5

Co-authored-by: gonas <nhjangh@gamil.com>

fix: widen trace_request_ctx type to accept any object (aio-libs#12113)

4d15c33

Allow JSONEncoder to return bytes directly (aio-libs#11989) (aio-li…

f82bc8a

…bs#12115) (cherry picked from commit 67fa1f5) --------- Co-authored-by: Kevin Park <kevin.park1217@gmail.com>

[PR aio-libs#12106/8ab84c52 backport][3.14] Bound DNS cache (aio-libs…

58e7f8f

…#12116) **This is a backport of PR aio-libs#12106 as merged into master (8ab84c5).** --------- Co-authored-by: Sam Bull <git@sambull.org> Co-authored-by: gonas <nhjangh@gamil.com>

Bound DNS cache (aio-libs#12106) (aio-libs#12117)

c4d77c3

(cherry picked from commit 8ab84c5) --------- Co-authored-by: gonas <nhjangh@gamil.com>

Make clear that regex is not affected by ReDoS (aio-libs#12120)

dc85b4c

Fix server hang on chunked transfer encoding size mismatch (aio-libs#…

0e2d3ec

…12119)

[PR aio-libs#12119/0e2d3ec4 backport][3.14] Fix server hang on chunke…

4bcb942

…d transfer encoding size mismatch (aio-libs#12122) **This is a backport of PR aio-libs#12119 as merged into master (0e2d3ec).** Co-authored-by: Fridayai700 <aifriday700@gmail.com>

[PR aio-libs#12119/0e2d3ec4 backport][3.13] Fix server hang on chunke…

36573aa

…d transfer encoding size mismatch (aio-libs#12121) **This is a backport of PR aio-libs#12119 as merged into master (0e2d3ec).** Co-authored-by: Fridayai700 <aifriday700@gmail.com>

Fix _sendfile_fallback over-reading beyond requested count (aio-libs#…

4f12a66

…12096) (aio-libs#12123) (cherry picked from commit 291d969) Co-authored-by: Kadir Can Ozden <101993364+bysiber@users.noreply.github.com>

Fix _sendfile_fallback over-reading beyond requested count (aio-libs#…

ceb098b

…12096) (aio-libs#12124) (cherry picked from commit 291d969) Co-authored-by: Kadir Can Ozden <101993364+bysiber@users.noreply.github.com>

[3.14] Backport: Fix access log timestamps ignoring daylight savings …

fe6974c

…time (aio-libs#12085) (aio-libs#12127) Co-authored-by: nightcityblade <nightcityblade@gmail.com> Co-authored-by: Sam Bull <git@sambull.org>

Block absolute paths in static files (aio-libs#12125)

f049588

[PR aio-libs#12125/f049588a backport][3.14] Block absolute paths in s…

97e11d2

…tatic files (aio-libs#12129) **This is a backport of PR aio-libs#12125 as merged into master (f049588).** Co-authored-by: Sam Bull <git@sambull.org>

[3.13] Backport: Fix access log timestamps ignoring daylight savings …

7438e8d

…time (aio-libs#12085) (aio-libs#12126) Co-authored-by: nightcityblade <nightcityblade@gmail.com>

[PR aio-libs#12125/f049588a backport][3.13] Block absolute paths in s…

0ae2aa0

…tatic files (aio-libs#12128) **This is a backport of PR aio-libs#12125 as merged into master (f049588).** Co-authored-by: Sam Bull <git@sambull.org>

Replace unintentional except BaseException with except Exception (aio…

63a411d

…-libs#12130)

[PR aio-libs#12130/63a411d0 backport][3.14] Replace unintentional exc…

8896cfc

…ept BaseException with except Exception (aio-libs#12132) **This is a backport of PR aio-libs#12130 as merged into master (63a411d).** Co-authored-by: Dhruvil Darji <dhruvildarji1409@gmail.com>

Update Gunicorn documentation link (aio-libs#12133)

4ec897b

[PR aio-libs#12133/4ec897bd backport][3.14] Update Gunicorn documenta…

26917a2

…tion link (aio-libs#12135) **This is a backport of PR aio-libs#12133 as merged into master (4ec897b).** Co-authored-by: laurent b <metter2ooo@gmail.com>

dependabot Bot and others added 30 commits May 4, 2026 00:57

💅 Drop unnecessary comments from FUNDING conf

b568128

💄 Add @aio-libs to the funding config

5ba569e

Merge branch 'maintenance/funding-sync'

7d534ab

Remove pytest_plugin (aio-libs#10762)

5a8ebdf

Don't re-await main_task in run_app finally when it's already done (a…

76d3a7f

…io-libs#12493)

Change headers to a dict that parses comma-separated values (aio-libs…

e8f4371

…#7679) Co-authored-by: Rodrigo Nogueira <rodrigo.b.nogueira@gmail.com>

Navigation Menu

Fix TCPConnector.close() race condition with in-flight DNS resolution - #1

Fix TCPConnector.close() race condition with in-flight DNS resolution#1
prshant70 wants to merge 3959 commits into
masterfrom
fix/issue-12497-tcpconnector-race-condition

prshant70 commented May 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants

Conversation

prshant70 commented May 13, 2026

Problem

Solution

Changes

Testing

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

20 participants