{"id":406,"name":"lxml","ecosystem":"pip","repository_url":"https://github.com/lxml/lxml","issues_count":2161,"created_at":"2025-06-06T15:01:34.351Z","updated_at":"2025-06-06T15:01:34.351Z","purl":"pkg:pypi/lxml","metadata":{"id":2792383,"name":"lxml","ecosystem":"pypi","description":"Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTree API.","homepage":"https://lxml.de/","licenses":"BSD-3-Clause","normalized_licenses":["BSD-3-Clause"],"repository_url":"https://github.com/lxml/lxml","keywords_array":[],"namespace":null,"versions_count":169,"first_release_published_at":"2006-03-21T10:40:07.000Z","latest_release_published_at":"2025-04-23T01:44:29.000Z","latest_release_number":"5.4.0","last_synced_at":"2025-06-06T06:02:21.392Z","created_at":"2022-04-10T11:31:26.838Z","updated_at":"2025-06-06T06:02:21.393Z","registry_url":"https://pypi.org/project/lxml/","install_command":"pip install lxml --index-url https://pypi.org/simple","documentation_url":"https://lxml.readthedocs.io/","metadata":{"funding":null,"documentation":null,"classifiers":["Development Status :: 5 - Production/Stable","Intended Audience :: Developers","Intended Audience :: Information Technology","License :: OSI Approved :: BSD License","Operating System :: OS Independent","Programming Language :: C","Programming Language :: Cython","Programming Language :: Python :: 3","Programming Language :: Python :: 3.10","Programming Language :: Python :: 3.11","Programming Language :: Python :: 3.12","Programming Language :: Python :: 3.6","Programming Language :: Python :: 3.7","Programming Language :: Python :: 3.8","Programming Language :: Python :: 3.9","Topic :: Software Development :: Libraries :: Python Modules","Topic :: Text Processing :: Markup :: HTML","Topic :: Text Processing :: Markup :: XML"],"normalized_name":"lxml"},"repo_metadata":{"id":1386644,"uuid":"1353927","full_name":"lxml/lxml","owner":"lxml","description":"The lxml XML toolkit for Python","archived":false,"fork":false,"pushed_at":"2025-05-13T04:19:22.000Z","size":20962,"stargazers_count":2835,"open_issues_count":15,"forks_count":582,"subscribers_count":83,"default_branch":"master","last_synced_at":"2025-05-27T00:02:14.722Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://lxml.de/","language":"Python","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lxml.png","metadata":{"files":{"readme":"README.rst","changelog":"CHANGES.txt","contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null},"funding":{"github":"scoder","patreon":null,"open_collective":null,"ko_fi":null,"tidelift":"pypi/lxml","community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"custom":null}},"created_at":"2011-02-11T05:43:11.000Z","updated_at":"2025-05-26T19:28:31.000Z","dependencies_parsed_at":"2023-10-16T02:59:50.607Z","dependency_job_id":"26883f6d-9578-4b90-9c90-53c6be5a0d2e","html_url":"https://github.com/lxml/lxml","commit_stats":{"total_commits":6090,"total_committers":166,"mean_commits":36.68674698795181,"dds":0.4824302134646963,"last_synced_commit":"7be20eb3931010b42dfa81427c45fa716f52954c"},"previous_names":[],"tags_count":148,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lxml","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":257352266,"owners_count":22533023,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"lxml","name":"lxml","uuid":"612230","kind":"organization","description":null,"email":null,"website":null,"location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/612230?v=4","repositories_count":5,"last_synced_at":"2025-05-29T00:20:20.537Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/lxml","funding_links":[],"total_stars":2893,"followers":44,"following":0,"created_at":"2022-11-02T16:31:24.483Z","updated_at":"2025-05-29T00:20:20.537Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lxml","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lxml/repositories"},"tags":[{"name":"lxml-5.4.0","sha":"6e76d57af83d59d7a0456fd5889e392a7b366b43","kind":"tag","published_at":"2025-04-22T12:15:30.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.4.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.4.0/manifests"},{"name":"lxml-5.3.2","sha":"820db896be83f72f1cb653981362c682c8fc0d1f","kind":"tag","published_at":"2025-04-05T08:13:09.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.3.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.3.2/manifests"},{"name":"lxml-5.3.1","sha":"1dd500100ff79217553bec0d1218bdde3e0ce0fc","kind":"tag","published_at":"2025-02-09T13:39:36.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.3.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.3.1/manifests"},{"name":"lxml-5.3.0","sha":"475f4ab305d3b6eccb0520e9298a6cf829ffcf75","kind":"tag","published_at":"2024-08-10T04:22:29.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.3.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.3.0/manifests"},{"name":"lxml-5.2.2","sha":"8e4b14cbee88e1b04d7c49d29b2e593a37cdf80e","kind":"tag","published_at":"2024-05-12T10:08:08.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.2.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.2.2/manifests"},{"name":"lxml-5.2.1","sha":"47f94ff45551670e167dda2d7b9b205bbdbe0466","kind":"tag","published_at":"2024-04-02T08:02:36.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.2.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.2.1/manifests"},{"name":"lxml-5.2.0","sha":"a8ab41dc88f7adec8532a039d80ef292499d57bf","kind":"tag","published_at":"2024-03-30T21:14:08.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.2.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.2.0/manifests"},{"name":"lxml-5.1.1","sha":"3299a7e8154a2c010754a969348cd0a3858282a0","kind":"tag","published_at":"2024-03-28T17:49:19.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.1.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.1.1/manifests"},{"name":"lxml-5.0.2","sha":"d2fca62352fc526989beb0f46e59b3f1dd75c0e0","kind":"tag","published_at":"2024-03-28T17:47:39.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.0.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.0.2/manifests"},{"name":"lxml-5.1.0-2","sha":"f466da4ebdbb69d5436ee91a0eaf45b7105e9530","kind":"tag","published_at":"2024-01-10T11:07:10.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.1.0-2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.1.0-2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.1.0-2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.1.0-2/manifests"},{"name":"lxml-5.0.1-1","sha":"12e4da6dfb86910d2bb8d35321dacf949f8320df","kind":"tag","published_at":"2024-01-08T20:27:12.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.0.1-1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.0.1-1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.0.1-1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.0.1-1/manifests"},{"name":"lxml-5.1.0-1","sha":"3ef7def9822ebae8e70d381aace0b398a9765908","kind":"tag","published_at":"2024-01-05T22:00:22.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.1.0-1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.1.0-1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.1.0-1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.1.0-1/manifests"},{"name":"lxml-5.1.0","sha":"82a42601e3a7f1a44aadc5a948c2b6fde3e0e407","kind":"tag","published_at":"2024-01-05T13:49:00.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.1.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.1.0/manifests"},{"name":"lxml-5.0.1","sha":"eb5cd981685850d1f99d99c36ade323d3008574f","kind":"tag","published_at":"2024-01-05T13:41:12.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.0.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.0.1/manifests"},{"name":"lxml-5.0.0-1","sha":"7ebda90211052233b9c8bb3723f1d84f57f45e56","kind":"tag","published_at":"2023-12-29T20:27:41.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.0.0-1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.0.0-1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.0.0-1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.0.0-1/manifests"},{"name":"lxml-5.0.0","sha":"73fa11564a8cb814a9da7400449e65790a25105e","kind":"tag","published_at":"2023-12-29T13:31:12.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-5.0.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-5.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-5.0.0/manifests"},{"name":"lxml-4.9.4","sha":"d7f33d6d5bd92cfd3a390d25e306e66487222402","kind":"tag","published_at":"2023-12-19T10:13:56.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.9.4","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.9.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.4/manifests"},{"name":"lxml-4.9.3-3","sha":"09070ceab1607bbf59436052ad6327ea5deb9eb3","kind":"tag","published_at":"2023-07-10T15:56:47.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.9.3-3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.9.3-3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.3-3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.3-3/manifests"},{"name":"lxml-4.9.3-2","sha":"afcdbc9a7f68abde4204601638a8c18d86f746c3","kind":"tag","published_at":"2023-07-10T08:55:59.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.9.3-2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.9.3-2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.3-2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.3-2/manifests"},{"name":"lxml-4.9.3-1","sha":"0cd3d8aeec0c93d1617e7209c80026b693290f62","kind":"tag","published_at":"2023-07-06T13:05:26.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.9.3-1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.9.3-1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.3-1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.3-1/manifests"},{"name":"lxml-4.9.3","sha":"15936e95e52cf1abcaee6a506291219a9638e781","kind":"tag","published_at":"2023-07-05T08:14:11.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.9.3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.9.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.3/manifests"},{"name":"lxml-4.9.2","sha":"c17c1ca0496fbde3827c01cecd6a37d848142772","kind":"tag","published_at":"2022-12-13T19:27:23.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.9.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.9.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.2/manifests"},{"name":"lxml-4.9.1","sha":"d01872ccdf7e1e5e825b6c6292b43e7d27ae5fc4","kind":"tag","published_at":"2022-07-01T19:20:01.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.9.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.9.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.1/manifests"},{"name":"lxml-4.9.0","sha":"b224e0f69dde58425d1077e07d193d19d3f803a9","kind":"tag","published_at":"2022-05-31T19:25:23.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.9.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.9.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.9.0/manifests"},{"name":"lxml-4.8.0","sha":"e82c9153c4a7d505480b94c60b9a84d79d948efb","kind":"tag","published_at":"2022-02-17T11:08:06.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.8.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.8.0/manifests"},{"name":"lxml-4.7.1","sha":"745ac2685ca05c67afbf2a1dde24e4d48bd86dcd","kind":"tag","published_at":"2021-12-13T13:28:05.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.7.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.7.1/manifests"},{"name":"lxml-4.7.0","sha":"5c4f6a23d5758ec66cfe22b082a40c2e08df4658","kind":"tag","published_at":"2021-12-12T21:38:56.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.7.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.7.0/manifests"},{"name":"lxml-4.6.5","sha":"a9611ba80bc5196c1dd07a0b1964fcb603695d63","kind":"tag","published_at":"2021-12-12T14:24:01.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.6.5","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.6.5","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.5/manifests"},{"name":"lxml-4.7.0-pre","sha":"982f8d5612925010a12a70748a077af846def6be","kind":"tag","published_at":"2021-11-05T09:35:20.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.7.0-pre","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.7.0-pre","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.7.0-pre","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.7.0-pre/manifests"},{"name":"lxml-4.6.4-5","sha":"24a459910130afc8a16bdecdde35ca9d5aa47f1d","kind":"tag","published_at":"2021-11-02T19:29:44.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.6.4-5","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.6.4-5","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.4-5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.4-5/manifests"},{"name":"lxml-4.6.4-4","sha":"b232e1987408e76fb6450f1a476dbab0377c92e8","kind":"tag","published_at":"2021-11-02T19:01:08.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.6.4-4","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.6.4-4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.4-4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.4-4/manifests"},{"name":"lxml-4.6.4-3","sha":"667f4b47995e0d4cc9b8c20ead1709810c9965d0","kind":"tag","published_at":"2021-11-02T15:50:21.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.6.4-3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.6.4-3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.4-3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.4-3/manifests"},{"name":"lxml-4.6.4-2","sha":"03c3f10f517c72a233241dcfafb8d3429d3e44c8","kind":"tag","published_at":"2021-11-02T15:12:07.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.6.4-2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.6.4-2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.4-2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.4-2/manifests"},{"name":"lxml-4.6.4-1","sha":"ae377082fea8520fb1a3a76746c44424d2c1fa0c","kind":"tag","published_at":"2021-11-02T14:20:05.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.6.4-1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.6.4-1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.4-1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.4-1/manifests"},{"name":"lxml-4.6.4","sha":"bbee1e900d46bb7044dedf67455f29433aa385ac","kind":"tag","published_at":"2021-11-02T12:54:44.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.6.4","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.6.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.4/manifests"},{"name":"lxml-4.6.3","sha":"a5f9cb52079dc57477c460dbe6ba0f775e14a999","kind":"tag","published_at":"2021-03-21T14:11:52.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.6.3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.6.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.3/manifests"},{"name":"lxml-4.6.2","sha":"4cb57362deb23bca0f70f41ab1efa13390fcdbb1","kind":"tag","published_at":"2020-11-26T20:58:39.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.6.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.6.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.2/manifests"},{"name":"lxml-4.6.1","sha":"61432a8489657744ed32367ed9fb17fafe405d8e","kind":"tag","published_at":"2020-10-18T08:08:33.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.6.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.1/manifests"},{"name":"lxml-4.6.0","sha":"2d88783eb95a5f58ba51c946bacfab07fa572ca0","kind":"tag","published_at":"2020-10-17T09:46:04.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.6.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.6.0/manifests"},{"name":"lxml-4.5.2","sha":"076c6740da7236ae6558436835b828da419f6476","kind":"tag","published_at":"2020-07-09T18:20:11.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.5.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.5.2/manifests"},{"name":"lxml-4.5.1","sha":"0ce08858a824a0a4fae4102af849a8fbf7bcad6f","kind":"tag","published_at":"2020-05-19T08:53:55.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.5.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.5.1/manifests"},{"name":"lxml-4.5.0","sha":"8d23c0caa4aee4f36ba553ad58bb506a14d2b33a","kind":"tag","published_at":"2020-01-29T09:31:51.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.5.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.5.0/manifests"},{"name":"lxml-4.4.3","sha":"78c346448b7b738dfe180ea3150cc4b789358f10","kind":"tag","published_at":"2020-01-28T13:37:42.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.4.3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.4.3/manifests"},{"name":"lxml-4.4.2","sha":"589c3c2f35e89fec66aa7f4bec2eb2755033b2b2","kind":"tag","published_at":"2019-11-25T08:54:05.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.4.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.4.2/manifests"},{"name":"lxml-4.4.1","sha":"1781e48f8e51bb3eba8e31c3d7fbc47b4acfae26","kind":"tag","published_at":"2019-08-11T08:26:32.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.4.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.4.1/manifests"},{"name":"lxml-4.4.0","sha":"ca90c24282fd0aadeda15fd853468229b46c1b9e","kind":"tag","published_at":"2019-07-27T07:05:06.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.4.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.4.0/manifests"},{"name":"lxml-4.3.5","sha":"1848047e2724a01a16d54029e013316617285491","kind":"tag","published_at":"2019-07-27T05:36:08.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.3.5","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.3.5","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.3.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.3.5/manifests"},{"name":"lxml-4.3.4","sha":"6156d61ca53cadfd6b3d1b2908af518174997039","kind":"tag","published_at":"2019-06-10T04:47:07.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.3.4","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.3.4/manifests"},{"name":"lxml-4.3.3","sha":"e2d97468f3cea7b7fb11399732705d9f688c3c6d","kind":"tag","published_at":"2019-03-26T13:10:56.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.3.3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.3.3/manifests"},{"name":"lxml-4.3.2","sha":"f2981e643b5b5a56089146bd5a093ecf7526dc12","kind":"tag","published_at":"2019-02-28T19:58:12.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.3.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.3.2/manifests"},{"name":"lxml-4.3.1","sha":"642a41bdc3aae05f52ccf32981c429c7d3789f63","kind":"commit","published_at":"2019-02-08T19:28:15.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.3.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.3.1/manifests"},{"name":"lxml-4.3.0","sha":"7303cadd01b81fceb40f74148a5b9b6178936768","kind":"commit","published_at":"2019-01-04T15:29:32.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.3.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.3.0/manifests"},{"name":"lxml-4.2.6","sha":"1dd26eb772abd58ae3aea596800ed0cd612cf145","kind":"tag","published_at":"2019-01-02T17:17:40.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.2.6","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.2.6","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.6/manifests"},{"name":"lxml-4.2.6-win1","sha":"1dd26eb772abd58ae3aea596800ed0cd612cf145","kind":"commit","published_at":"2019-01-02T17:15:09.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.2.6-win1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.2.6-win1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.6-win1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.6-win1/manifests"},{"name":"lxml-4.2.5","sha":"1dee355e83b1f524de7a772a8da941a186036bc2","kind":"commit","published_at":"2018-09-09T15:16:33.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.2.5","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.2.5","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.5/manifests"},{"name":"lxml-4.2.4","sha":"5578c4d5d90a49d581112adac13e4cca54978c69","kind":"commit","published_at":"2018-08-03T16:44:06.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.2.4","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.2.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.4/manifests"},{"name":"lxml-4.2.3-win","sha":"eb445d0f7e155d5919b990ca81992a328be38813","kind":"commit","published_at":"2018-06-27T16:36:02.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.2.3-win","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.2.3-win","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.3-win","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.3-win/manifests"},{"name":"lxml-4.2.3","sha":"995a804444dddbad339e1ae11fd12fa7d0a653bb","kind":"commit","published_at":"2018-06-27T16:01:55.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.2.3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.2.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.3/manifests"},{"name":"lxml-4.2.2","sha":"065cd904e2e4211a3356b531b0dbcfebbd408903","kind":"commit","published_at":"2018-06-22T18:43:35.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.2.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.2/manifests"},{"name":"lxml-4.2.1","sha":"5653058f940e3be686a97489d7ff004640fdfe27","kind":"commit","published_at":"2018-03-21T20:29:01.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.2.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.1/manifests"},{"name":"lxml-4.2.0","sha":"4fd86ebeb11d859827cc7eae419488020a29bbc0","kind":"commit","published_at":"2018-03-13T20:12:59.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.2.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.2.0/manifests"},{"name":"lxml-4.1.1","sha":"14705c659d35ec1a86fcad9dfca0137a55112b7d","kind":"commit","published_at":"2017-11-04T06:53:39.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.1.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.1.1/manifests"},{"name":"lxml-4.1.0","sha":"ba11df65439f62728367bffcd14ed351f064b563","kind":"commit","published_at":"2017-10-13T15:22:59.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.1.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.1.0/manifests"},{"name":"lxml-4.0.0","sha":"f83f1404011a2db268b0d9fe838c77f128642520","kind":"commit","published_at":"2017-09-17T07:52:54.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-4.0.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-4.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-4.0.0/manifests"},{"name":"lxml-3.8.0-py27fix","sha":"7cdfc401e54194f45ac8fe258d922d8407fdc519","kind":"commit","published_at":"2017-06-12T14:39:21.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.8.0-py27fix","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.8.0-py27fix","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.8.0-py27fix","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.8.0-py27fix/manifests"},{"name":"lxml-3.8.0","sha":"3fcd59c91f9bdc13e1054398a95a0e5819210628","kind":"commit","published_at":"2017-06-03T17:36:39.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.8.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.8.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.8.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.8.0/manifests"},{"name":"lxml-3.7.2","sha":"1cd159ef1fa6c13f9f21ddf9d69385b686b384a1","kind":"commit","published_at":"2017-01-08T14:47:57.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.7.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.7.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.7.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.7.2/manifests"},{"name":"lxml-3.7.1","sha":"c667651a02ff8b206fa3af7e5e0cf17dac2f1176","kind":"commit","published_at":"2016-12-23T18:58:22.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.7.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.7.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.7.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.7.1/manifests"},{"name":"lxml-3.7.0","sha":"826ca604eccdf6f325c1c161e73132e765bb3855","kind":"commit","published_at":"2016-12-10T15:45:56.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.7.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.7.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.7.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.7.0/manifests"},{"name":"lxml-3.6.4","sha":"0151ad50249ed059d6ba2856882f379fd37a4795","kind":"commit","published_at":"2016-08-20T04:40:58.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.6.4","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.6.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.6.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.6.4/manifests"},{"name":"lxml-3.6.3","sha":"70c1aa3b667afc39da69e1258ad4e36fa45cf3d0","kind":"commit","published_at":"2016-08-18T18:33:05.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.6.3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.6.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.6.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.6.3/manifests"},{"name":"lxml-3.6.2","sha":"3b87120a90ae12aa69b8ffa394fababe595d0e34","kind":"commit","published_at":"2016-08-18T14:24:04.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.6.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.6.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.6.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.6.2/manifests"},{"name":"lxml-3.6.1","sha":"2fae19478d87dfdcaed23ed63b7f64b2ab8c0dc7","kind":"commit","published_at":"2016-07-24T08:26:05.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.6.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.6.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.6.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.6.1/manifests"},{"name":"lxml-3.6.0","sha":"79637c7c245f6439cc4b85817b12826483e3e8d5","kind":"commit","published_at":"2016-03-17T12:57:36.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.6.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.6.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.6.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.6.0/manifests"},{"name":"lxml-3.5.0","sha":"b00892ed4ac551c39ff7ba42ff55524ad2516028","kind":"commit","published_at":"2015-11-13T07:46:34.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.5.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.5.0/manifests"},{"name":"lxml-3.5.0b1","sha":"717942131fe47584c45800970758d9b46ee077ff","kind":"commit","published_at":"2015-09-18T07:17:02.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.5.0b1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.5.0b1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.5.0b1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.5.0b1/manifests"},{"name":"lxml-3.4.4","sha":"525541fc94ab8e4ea3b938d40e2d7b9b1e0d4eb2","kind":"commit","published_at":"2015-04-25T14:09:22.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.4.4","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.4.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.4.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.4.4/manifests"},{"name":"lxml-3.4.3","sha":"fe7dfaa133ec963a5173169993d464c324640f87","kind":"commit","published_at":"2015-04-15T17:27:09.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.4.3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.4.3/manifests"},{"name":"lxml-3.4.2","sha":"c1dfce0462b3bf3930938f5d08b8f0188803efcf","kind":"commit","published_at":"2015-02-07T19:45:54.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.4.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.4.2/manifests"},{"name":"lxml-3.4.1","sha":"55b7af55eeb50abab9ca6d251d6137607849d6a1","kind":"commit","published_at":"2014-11-20T18:42:52.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.4.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.4.1/manifests"},{"name":"lxml-3.4.0","sha":"14505bc62f5f1fc9fb0ff007955f3e67ab4562bb","kind":"commit","published_at":"2014-09-10T16:57:25.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.4.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.4.0/manifests"},{"name":"lxml-3.4.0beta1","sha":"638b9ce006ba32e46a09101e15c93ee94649a2ae","kind":"commit","published_at":"2014-09-05T13:16:46.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.4.0beta1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.4.0beta1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.4.0beta1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.4.0beta1/manifests"},{"name":"lxml-3.3.6","sha":"4c8e222b6704b78381bdcaa5f6d3abf1d041d0b4","kind":"commit","published_at":"2014-08-28T14:11:16.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.3.6","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.3.6","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.6/manifests"},{"name":"lxml-3.3.5","sha":"32337d2a820d77768de8f8b082119bf79c86ef93","kind":"commit","published_at":"2014-04-18T06:52:37.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.3.5","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.3.5","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.5/manifests"},{"name":"lxml-3.3.4","sha":"076efc798ee7eae048d9ee764f30e2980a7c870f","kind":"commit","published_at":"2014-04-03T19:45:31.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.3.4","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.4/manifests"},{"name":"lxml-3.3.3","sha":"5ad64a7b6882fdf1d034e319e956ff53d1f85ac1","kind":"commit","published_at":"2014-03-04T16:26:09.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.3.3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.3/manifests"},{"name":"lxml-3.3.2","sha":"e65717efb3ebca0ee62297c79e38f79ba5353da5","kind":"commit","published_at":"2014-02-26T19:35:55.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.3.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.2/manifests"},{"name":"lxml-3.3.1","sha":"3f8cba77030383ad52e45263d416e903ad2bea4d","kind":"commit","published_at":"2014-02-12T08:49:06.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.3.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.1/manifests"},{"name":"lxml-3.3.0","sha":"dcfaf4311fdab59706dc7084c47af44c40cbb4bd","kind":"commit","published_at":"2014-01-26T06:59:48.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.3.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.0/manifests"},{"name":"lxml-3.3.0beta5","sha":"9a8ccef6860ba2c80392d4e2ebdf14c487913ef4","kind":"commit","published_at":"2014-01-18T06:56:23.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.3.0beta5","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.3.0beta5","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.0beta5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.0beta5/manifests"},{"name":"lxml-3.3.0beta4","sha":"dd0bbe36408fe1a49f278f368e8e76aff8e075bf","kind":"commit","published_at":"2014-01-12T14:00:03.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.3.0beta4","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.3.0beta4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.0beta4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.0beta4/manifests"},{"name":"lxml-3.3.0beta3","sha":"a7a7b6b471345ed981489da15448625f03671f2c","kind":"commit","published_at":"2014-01-02T15:17:51.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.3.0beta3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.3.0beta3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.0beta3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.0beta3/manifests"},{"name":"lxml-3.2.5","sha":"4bbc11f847dfc30c783c0d54103efe37ebaa090d","kind":"commit","published_at":"2014-01-02T14:44:31.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.2.5","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.2.5","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.2.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.2.5/manifests"},{"name":"lxml-3.3.0beta2","sha":"81d0036486d4ce81bdd86774ea95d002fdd6d0e1","kind":"commit","published_at":"2013-12-20T11:07:36.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.3.0beta2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.3.0beta2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.0beta2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.0beta2/manifests"},{"name":"lxml-3.3.0beta1","sha":"91f5e8b3c7bbc3051cb78d242a63164c1f2e38ba","kind":"commit","published_at":"2013-12-12T19:10:11.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.3.0beta1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.3.0beta1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.0beta1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.3.0beta1/manifests"},{"name":"lxml-3.2.4","sha":"f07ca33d53618d96c5752b2e35e3464c5bdc2a58","kind":"commit","published_at":"2013-11-07T16:40:40.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.2.4","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.2.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.2.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.2.4/manifests"},{"name":"lxml-3.2.3","sha":"96b62dd29fb402e55b12255fe9ac7120c9f87742","kind":"commit","published_at":"2013-07-28T11:58:46.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.2.3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.2.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.2.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.2.3/manifests"},{"name":"lxml-3.2.2","sha":"f8192a702e6bdd4388ab0bcf1242f01d580f7810","kind":"commit","published_at":"2013-07-28T11:12:27.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.2.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.2.2/manifests"},{"name":"lxml-3.2.1","sha":"90afe19b11c4fd1df8998b254d8a60b550aa56d0","kind":"commit","published_at":"2013-05-11T21:29:02.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.2.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.2.1/manifests"},{"name":"lxml-3.2.0","sha":"8fc99f8ef3e2f12e74fb407ae62c5db50cfe7b92","kind":"commit","published_at":"2013-04-28T18:42:33.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.2.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.2.0/manifests"},{"name":"lxml-3.1.2","sha":"76c9042511bfee787efad2d2f5cbdb850c01fbd6","kind":"commit","published_at":"2013-04-12T05:14:28.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.1.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.1.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.1.2/manifests"},{"name":"lxml-3.1.1","sha":"98c8562f7d659b49997c136947afdf6bf835d5ab","kind":"commit","published_at":"2013-03-29T20:54:23.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.1.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.1.1/manifests"},{"name":"lxml-3.1.0","sha":"633436c0f352c33daa94cd62d1ddd0d13ea9c247","kind":"commit","published_at":"2013-02-10T15:48:59.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.1.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.1.0/manifests"},{"name":"lxml-3.1beta1","sha":"ca93d61264654b724e6ca57ecefbb294cef86007","kind":"commit","published_at":"2012-12-21T21:56:14.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.1beta1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.1beta1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.1beta1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.1beta1/manifests"},{"name":"lxml-3.0.2","sha":"a5525afb27e1227ccb0245c14d982b95abed0422","kind":"commit","published_at":"2012-12-14T10:23:08.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.0.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.0.2/manifests"},{"name":"lxml-3.0.1","sha":"4b2e26fefac767069d32348d2443dae064b6022e","kind":"commit","published_at":"2012-10-14T15:52:19.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.0.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.0.1/manifests"},{"name":"lxml-3.0","sha":"bcfbb8226c4cf04d50f2209788ee68cd672fa995","kind":"commit","published_at":"2012-10-08T17:43:51.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.0/manifests"},{"name":"lxml-2.3.6","sha":"1f44374e9c4725d05d77d213822c4a50f4ddcfb6","kind":"commit","published_at":"2012-09-28T19:00:18.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.3.6","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.3.6","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3.6/manifests"},{"name":"lxml-3.0beta1","sha":"26358d2218a84ad8ee89cce64828f907489c43af","kind":"commit","published_at":"2012-09-26T17:48:03.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.0beta1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.0beta1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.0beta1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.0beta1/manifests"},{"name":"lxml-3.0alpha2","sha":"ff1ba90049003f8badfb0a833125d09d8692af1d","kind":"commit","published_at":"2012-08-23T18:50:56.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.0alpha2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.0alpha2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.0alpha2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.0alpha2/manifests"},{"name":"lxml-3.0alpha1","sha":"bf47a9747fd5fef3322c7b39445d27d6bd0db7d1","kind":"commit","published_at":"2012-07-31T08:42:27.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-3.0alpha1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-3.0alpha1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.0alpha1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-3.0alpha1/manifests"},{"name":"lxml-2.3.5","sha":"46a2dddfcd15b74c4577d8081b52227ebd89eff2","kind":"commit","published_at":"2012-07-31T08:09:29.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.3.5","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.3.5","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3.5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3.5/manifests"},{"name":"lxml-2.3.4","sha":"c8cde5d8c85f7405e6bd41cc335cdeffe8563e30","kind":"commit","published_at":"2012-03-26T10:27:32.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.3.4","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.3.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3.4/manifests"},{"name":"lxml-2.3.3","sha":"58322e88b9568daa53b73a229c0a2a14fa2b7579","kind":"commit","published_at":"2012-01-04T17:50:56.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.3.3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3.3/manifests"},{"name":"lxml-2.3.2","sha":"4c325e12ae20a600fa59dc9820cf62abc5ca62c9","kind":"commit","published_at":"2011-11-11T15:27:35.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.3.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3.2/manifests"},{"name":"lxml-2.3.1","sha":"047c32a4eff2479965e429ccabf9ff113cd1257a","kind":"commit","published_at":"2011-09-25T19:05:18.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.3.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3.1/manifests"},{"name":"lxml-2.3","sha":"6ef1ba8e441647f78b7a4ab860561e68cbe0c44d","kind":"commit","published_at":"2011-02-06T19:24:04.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3/manifests"},{"name":"lxml-2.3beta1","sha":"a48f8d91f2f724a50d7eb0af908d572362d6c043","kind":"commit","published_at":"2010-09-06T08:42:39.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.3beta1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.3beta1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3beta1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3beta1/manifests"},{"name":"lxml-2.3alpha2","sha":"de09bbb825739c0df6efddc6e002b37a408c9b02","kind":"commit","published_at":"2010-07-24T20:05:12.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.3alpha2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.3alpha2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3alpha2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3alpha2/manifests"},{"name":"lxml-2.3alpha1","sha":"9fad5ea8bdd8303c01f6d5fc2d9ba5fa5ec1905c","kind":"commit","published_at":"2010-06-19T10:04:57.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.3alpha1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.3alpha1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3alpha1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.3alpha1/manifests"},{"name":"lxml-2.2.2","sha":"1de6a9b2b8b1375a58d08caa896db8ac4039b058","kind":"commit","published_at":"2009-06-21T07:37:42.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.2.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.2.2/manifests"},{"name":"lxml-2.2.1","sha":"66f59d14ebf9a8bacda4706fcde3f0c9ffd0943b","kind":"commit","published_at":"2009-06-02T19:14:38.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.2.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.2.1/manifests"},{"name":"lxml-2.2","sha":"0a5b686b7ebd93025732dbd0fe4b4dee55ea4932","kind":"commit","published_at":"2009-03-21T15:01:06.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.2/manifests"},{"name":"lxml-2.1","sha":"322d9b068ec4a3a89dbdeaa311f2941f01d05a89","kind":"commit","published_at":"2008-07-09T12:00:51.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.1/manifests"},{"name":"lxml-2.1beta3","sha":"3bc3fbd318dc2f25389df94b5a84326af1c1497e","kind":"commit","published_at":"2008-06-19T16:37:04.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.1beta3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.1beta3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.1beta3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.1beta3/manifests"},{"name":"lxml-2.1beta2","sha":"ba7f3e588556327616f05e2080fead2d63d2fd7a","kind":"commit","published_at":"2008-05-02T18:18:01.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.1beta2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.1beta2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.1beta2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.1beta2/manifests"},{"name":"lxml-2.1beta1","sha":"3bb2ea015b98c917e3f362a5e61d4798f50397b7","kind":"commit","published_at":"2008-04-15T18:35:40.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.1beta1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.1beta1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.1beta1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.1beta1/manifests"},{"name":"lxml-2.1alpha1","sha":"7aea95cb3ef2b41eb4b1f828c523cec4f36fa19e","kind":"commit","published_at":"2008-03-27T16:43:21.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.1alpha1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.1alpha1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.1alpha1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.1alpha1/manifests"},{"name":"lxml-2.0.1","sha":"9826b4dac26ff02494212404385b62d52f2b7a7d","kind":"commit","published_at":"2008-02-13T21:35:34.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.0.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0.1/manifests"},{"name":"lxml-2.0","sha":"8700fbb5b46a2cbe111fc9df2156a61aac8cebcb","kind":"commit","published_at":"2008-02-01T18:01:29.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0/manifests"},{"name":"lxml-2.0beta2","sha":"536ede0ec18084efccc298ace91afe4b1d58e478","kind":"commit","published_at":"2008-01-26T20:10:09.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.0beta2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.0beta2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0beta2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0beta2/manifests"},{"name":"lxml-2.0beta1","sha":"f5fd919e957cf8ffc884137b4aef0a47cbc66741","kind":"commit","published_at":"2008-01-11T14:20:44.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.0beta1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.0beta1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0beta1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0beta1/manifests"},{"name":"lxml-2.0alpha6","sha":"d8a4e4d505ceeeb1192d9b2a5ea3d75f5b61a36f","kind":"commit","published_at":"2007-12-19T11:34:33.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.0alpha6","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.0alpha6","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0alpha6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0alpha6/manifests"},{"name":"lxml-2.0alpha5","sha":"4ae3c1f3ec7adfe9b65e24416b153415368ff0f8","kind":"commit","published_at":"2007-11-25T11:19:13.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.0alpha5","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.0alpha5","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0alpha5","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0alpha5/manifests"},{"name":"lxml-2.0alpha4","sha":"c1b351b9c7fba4981bc8324b3d20863cb2fa0696","kind":"commit","published_at":"2007-10-07T20:12:23.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.0alpha4","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.0alpha4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0alpha4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0alpha4/manifests"},{"name":"lxml-2.0alpha3","sha":"816a730eb5d44e840c6d0c99c8570b78c95e54e3","kind":"commit","published_at":"2007-09-26T13:19:12.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.0alpha3","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.0alpha3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0alpha3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0alpha3/manifests"},{"name":"lxml-2.0alpha2","sha":"ed4299b1b40e24ef83a0968505d4463ddb996b83","kind":"commit","published_at":"2007-09-15T21:44:54.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.0alpha2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.0alpha2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0alpha2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0alpha2/manifests"},{"name":"lxml-2.0alpha1","sha":"96d31fd6c4607fc446c7545383a7c9fe7ce9ee3b","kind":"commit","published_at":"2007-09-02T16:34:07.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-2.0alpha1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-2.0alpha1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0alpha1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-2.0alpha1/manifests"},{"name":"lxml-1.2","sha":"2940d9b6723599da95cf294fe5125e29c9751f7b","kind":"commit","published_at":"2007-02-20T13:02:53.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-1.2","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-1.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-1.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-1.2/manifests"},{"name":"lxml-1.1","sha":"efe21228d415486e38fd5849225138eb58208282","kind":"commit","published_at":"2006-09-13T07:32:05.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-1.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-1.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-1.1/manifests"},{"name":"lxml-1.1beta","sha":"d2a31b950eca3ca422e1586775c58ae3fd2a63bf","kind":"commit","published_at":"2006-08-08T19:00:17.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-1.1beta","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-1.1beta","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-1.1beta","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-1.1beta/manifests"},{"name":"lxml-1.1alpha","sha":"ba7ea71cc7a5f89053053352a594340fa3cfc6e6","kind":"commit","published_at":"2006-06-27T07:59:53.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-1.1alpha","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-1.1alpha","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-1.1alpha","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-1.1alpha/manifests"},{"name":"lxml-1.0","sha":"38dc947e8d29f3694113c38fd2a11906113fb898","kind":"commit","published_at":"2006-06-01T17:51:39.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-1.0","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-1.0/manifests"},{"name":"lxml-1.0.beta","sha":"7f8fbe87787d456db9deff86986b0d65247cc697","kind":"commit","published_at":"2006-05-18T11:27:38.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-1.0.beta","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-1.0.beta","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-1.0.beta","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-1.0.beta/manifests"},{"name":"lxml-0.9","sha":"ac8f3f551da68e72cd4ec901271a4ea40b753d99","kind":"commit","published_at":"2006-03-20T18:51:12.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-0.9","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-0.9","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-0.9","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-0.9/manifests"},{"name":"lxml-0.7","sha":"7eab217298901501db2dc2522261fb3aef644581","kind":"commit","published_at":"2005-06-15T16:37:32.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-0.7","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-0.7","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-0.7","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-0.7/manifests"},{"name":"lxml-0.6","sha":"bd8d2806dd74093d91126776b9d4d7c4d6c8377c","kind":"commit","published_at":"2005-05-14T17:14:18.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-0.6","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-0.6","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-0.6","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-0.6/manifests"},{"name":"lxml-0.5.1","sha":"05970717a529f38fe4e9802e09eb768f43e2a0a5","kind":"commit","published_at":"2005-04-09T19:39:18.000Z","download_url":"https://codeload.github.com/lxml/lxml/tar.gz/lxml-0.5.1","html_url":"https://github.com/lxml/lxml/releases/tag/lxml-0.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-0.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lxml%2Flxml/tags/lxml-0.5.1/manifests"}]},"repo_metadata_updated_at":"2025-06-03T00:29:20.541Z","dependent_packages_count":4127,"downloads":131415252,"downloads_period":"last-month","dependent_repos_count":115734,"rankings":{"downloads":0.013756243041633729,"dependent_repos_count":0.009170828694422485,"dependent_packages_count":0.00641958008609574,"stargazers_count":2.005843652044086,"forks_count":2.7809620932966745,"docker_downloads_count":0.006786413233872639,"average":0.8038231350661308},"purl":"pkg:pypi/lxml","advisories":[{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWpxNHYtZjVxNi1tanFx","url":"https://github.com/advisories/GHSA-jq4v-f5q6-mjqq","title":"lxml vulnerable to Cross-Site Scripting ","description":"An XSS vulnerability was discovered in the python `lxml` clean module versions before 4.6.3. When disabling `the safe_attrs_only` and `forms` arguments, the `Cleaner` class does not remove the `formaction` attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in `lxml` 4.6.3.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-03-22T16:53:53.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2021-28957","https://github.com/lxml/lxml/pull/316","https://github.com/lxml/lxml/pull/316/commits/10ec1b4e9f93713513a3264ed6158af22492f270","https://github.com/lxml/lxml/commit/2d01a1ba8984e0483ce6619b972832377f208a0d","https://bugs.launchpad.net/lxml/+bug/1888153","https://pypi.org/project/lxml","https://lists.debian.org/debian-lts-announce/2021/03/msg00031.html","https://github.com/lxml/lxml/commit/a5f9cb52079dc57477c460dbe6ba0f775e14a999","https://www.debian.org/security/2021/dsa-4880","https://www.oracle.com/security-alerts/cpuoct2021.html","https://security.gentoo.org/glsa/202208-06","https://github.com/advisories/GHSA-jq4v-f5q6-mjqq","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2021-19.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3C2R44VDUY7FJVMAVRZ2WY7XYL4SVN45","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XXN3QPWCTQVOGW4BMWV3AUUZZ4NRZNSQ","https://security.netapp.com/advisory/ntap-20210521-0004"],"source_kind":"github","identifiers":["GHSA-jq4v-f5q6-mjqq","CVE-2021-28957"],"repository_url":"https://github.com/lxml/lxml","blast_radius":26.836343106411725,"packages":[{"versions":[{"first_patched_version":"4.6.3","vulnerable_version_range":"\u003c 4.6.3"}],"ecosystem":"pypi","package_name":"lxml"}],"created_at":"2022-12-21T16:12:45.854Z","updated_at":"2024-09-30T16:54:23.000Z","epss_percentage":0.00533,"epss_percentile":0.66111},{"uuid":"GSA_kwCzR0hTQS13cnh2LTJqNXEtbTM4d84AAtHM","url":"https://github.com/advisories/GHSA-wrxv-2j5q-m38w","title":"lxml NULL Pointer Dereference allows attackers to cause a denial of service","description":"NULL Pointer Dereference allows attackers to cause a denial of service (or application crash). This only applies when lxml is used together with libxml2 2.9.10 through 2.9.14. libxml2 2.9.9 and earlier are not affected. It allows triggering crashes through forged input data, given a vulnerable code sequence in the application. The vulnerability is caused by the iterwalk function (also used by the canonicalize function). Such code shouldn't be in wide-spread use, given that parsing + iterwalk would usually be replaced with the more efficient iterparse function. However, an XML converter that serialises to C14N would also be vulnerable, for example, and there are legitimate use cases for this code sequence. If untrusted input is received (also remotely) and processed via iterwalk function, a crash can be triggered.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-07-06T00:00:30.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.9,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2022-2309","https://github.com/lxml/lxml/commit/86368e9cf70a0ad23cccd5ee32de847149af0c6f","https://huntr.dev/bounties/8264e74f-edda-4c40-9956-49de635105ba","https://github.com/lxml/lxml/blob/master/CHANGES.txt","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2022-230.yaml","https://security.gentoo.org/glsa/202208-06","https://github.com/advisories/GHSA-wrxv-2j5q-m38w","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HGYC6L7ENH5VEGN3YWFBYMGKX6WNS7HZ","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/URHHSIBTPTALXMECRLAC2EVDNAFSR5NO","https://security.netapp.com/advisory/ntap-20220915-0006"],"source_kind":"github","identifiers":["GHSA-wrxv-2j5q-m38w","CVE-2022-2309"],"repository_url":"https://github.com/lxml/lxml","blast_radius":34.93788064796998,"packages":[{"versions":[{"first_patched_version":"4.9.1","vulnerable_version_range":"\u003c 4.9.1"}],"ecosystem":"pypi","package_name":"lxml"}],"created_at":"2022-12-21T16:12:13.769Z","updated_at":"2024-09-30T20:19:36.000Z","epss_percentage":0.00513,"epss_percentile":0.65419},{"uuid":"GSA_kwCzR0hTQS14cDI2LXA1M2gtNmgycM309Q","url":"https://github.com/advisories/GHSA-xp26-p53h-6h2p","title":"Improper Neutralization of Input During Web Page Generation in LXML","description":"An issue was discovered in lxml before 4.2.5. lxml/html/clean.py in the lxml.html.clean module does not remove javascript: URLs that use escaping, allowing a remote attacker to conduct XSS attacks, as demonstrated by \"j a v a s c r i p t:\" in Internet Explorer. This is a similar issue to CVE-2014-3146.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-05-13T01:13:21.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2018-19787","https://github.com/lxml/lxml/commit/6be1d081b49c97cfd7b3fbd934a193b668629109","https://lists.debian.org/debian-lts-announce/2018/12/msg00001.html","https://lists.debian.org/debian-lts-announce/2020/11/msg00044.html","https://github.com/advisories/GHSA-xp26-p53h-6h2p","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2018-12.yaml","https://usn.ubuntu.com/3841-1","https://usn.ubuntu.com/3841-2"],"source_kind":"github","identifiers":["GHSA-xp26-p53h-6h2p","CVE-2018-19787"],"repository_url":"https://github.com/lxml/lxml","blast_radius":26.836343106411725,"packages":[{"versions":[{"first_patched_version":"4.2.5","vulnerable_version_range":"\u003c 4.2.5"}],"ecosystem":"pypi","package_name":"lxml"}],"created_at":"2022-12-21T16:12:16.473Z","updated_at":"2024-09-30T20:17:22.000Z","epss_percentage":0.00807,"epss_percentile":0.72987},{"uuid":"GSA_kwCzR0hTQS01N3F3LWNjMmctcHY1cM4AAX1M","url":"https://github.com/advisories/GHSA-57qw-cc2g-pv5p","title":"lxml Cross-site Scripting Via Control Characters","description":"Incomplete blacklist vulnerability in the `lxml.html.clean` module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the `clean_html` function.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2022-05-14T04:01:59.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2014-3146","http://advisories.mageia.org/MGASA-2014-0218.html","http://lists.opensuse.org/opensuse-updates/2014-05/msg00083.html","http://lxml.de/3.3/changes-3.3.5.html","http://seclists.org/fulldisclosure/2014/Apr/210","http://seclists.org/fulldisclosure/2014/Apr/319","http://www.debian.org/security/2014/dsa-2941","http://www.openwall.com/lists/oss-security/2014/05/09/7","http://www.ubuntu.com/usn/USN-2217-1","https://github.com/lxml/lxml/pull/273","https://github.com/lxml/lxml/commit/3f3082e0a67851cde26a48da3d1f4b75d8aa07ec","https://github.com/lxml/lxml/commit/86e81ab393ba14c1be71284675851a3bdce57d69","https://github.com/lxml/lxml/commit/e86b294f1f81b899a59925123560ff924a72f1cc","https://web.archive.org/web/20140724172044/http://secunia.com/advisories/58013","https://web.archive.org/web/20140805110535/http://secunia.com/advisories/59008","https://web.archive.org/web/20140806061046/http://secunia.com/advisories/58744","https://web.archive.org/web/20141017122607/https://mailman-mail5.webfaction.com/pipermail/lxml/2014-April/007128.html","https://web.archive.org/web/20150523055039/http://www.mandriva.com/en/support/security/advisories/advisory/MDVSA-2015:112/?name=MDVSA-2015:112","https://web.archive.org/web/20200228180542/http://www.securityfocus.com/bid/67159","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2014-9.yaml","https://mailman-mail5.webfaction.com/pipermail/lxml/2014-April/007128.html","https://github.com/advisories/GHSA-57qw-cc2g-pv5p"],"source_kind":"github","identifiers":["GHSA-57qw-cc2g-pv5p","CVE-2014-3146"],"repository_url":"https://github.com/lxml/lxml","blast_radius":26.836343106411725,"packages":[{"versions":[{"first_patched_version":"3.3.5","vulnerable_version_range":"\u003c 3.3.5"}],"ecosystem":"pypi","package_name":"lxml"}],"created_at":"2023-08-04T21:05:07.764Z","updated_at":"2024-09-30T17:03:33.000Z","epss_percentage":0.09494,"epss_percentile":0.92388},{"uuid":"MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXBnd3cteGY0Ni1oOTJy","url":"https://github.com/advisories/GHSA-pgww-xf46-h92r","title":"lxml vulnerable to Cross-site Scripting","description":"A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-01-07T21:54:01.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2020-27783","https://github.com/lxml/lxml/commit/a105ab8dc262ec6735977c25c13f0bdfcdec72a7","https://bugzilla.redhat.com/show_bug.cgi?id=1901633","https://lists.debian.org/debian-lts-announce/2020/12/msg00028.html","https://snyk.io/vuln/SNYK-PYTHON-LXML-1047473","https://www.debian.org/security/2020/dsa-4810","https://advisory.checkmarx.net/advisory/CX-2020-4286","https://www.oracle.com//security-alerts/cpujul2021.html","https://github.com/advisories/GHSA-pgww-xf46-h92r","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2020-62.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JKG67GPGTV23KADT4D4GK4RMHSO4CIQL","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TMHVKRUT22LVWNL3TB7HPSDHJT74Q3JK","https://pypi.org/project/lxml","https://security.netapp.com/advisory/ntap-20210521-0003"],"source_kind":"github","identifiers":["GHSA-pgww-xf46-h92r","CVE-2020-27783"],"repository_url":"https://github.com/lxml/lxml","blast_radius":26.836343106411725,"packages":[{"versions":[{"first_patched_version":"4.6.2","vulnerable_version_range":"\u003c 4.6.2"}],"ecosystem":"pypi","package_name":"lxml"}],"created_at":"2022-12-21T16:13:12.234Z","updated_at":"2025-05-29T01:10:44.794Z","epss_percentage":0.01054,"epss_percentile":0.765},{"uuid":"GSA_kwCzR0hTQS01NXg1LWZqNmMtaDZtOM0a1g","url":"https://github.com/advisories/GHSA-55x5-fj6c-h6m8","title":"lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through","description":"### Impact\nThe HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs.\n\nUsers that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5.\n\n### Patches\nThe issue has been resolved in lxml 4.6.5.\n\n### Workarounds\nNone.\n\n### References\nThe issues are tracked under the report IDs GHSL-2021-1037 and GHSL-2021-1038.\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2021-12-13T18:14:36.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:H/SA:N","references":["https://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8","https://github.com/lxml/lxml/commit/12fa9669007180a7bb87d990c375cf91ca5b664a","https://github.com/lxml/lxml/commit/a3eacbc0dcf1de1c822ec29fb7d090a4b1712a9c#diff-59130575b4fb2932c957db2922977d7d89afb0b2085357db1a14615a2fcad776","https://github.com/lxml/lxml/commit/f2330237440df7e8f39c3ad1b1aa8852be3b27c0","https://nvd.nist.gov/vuln/detail/CVE-2021-43818","https://lists.debian.org/debian-lts-announce/2021/12/msg00037.html","https://www.debian.org/security/2022/dsa-5043","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://security.gentoo.org/glsa/202208-06","https://github.com/pypa/advisory-database/tree/main/vulns/lxml/PYSEC-2021-852.yaml","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TUIS2KE3HZ2AAQKXFLTJFZPP2IFHJTC7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/V2XMOM5PFT6U5AAXY6EFNT5JZCKKHK2V","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WZGNET2A4WGLSUXLBFYKNC5PXHQMI3I7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZQ4SPKJX3RRJK4UWA6FXCRHD2TVRQI44","https://security.netapp.com/advisory/ntap-20220107-0005","https://github.com/advisories/GHSA-55x5-fj6c-h6m8"],"source_kind":"github","identifiers":["GHSA-55x5-fj6c-h6m8","CVE-2021-43818"],"repository_url":"https://github.com/lxml/lxml","blast_radius":31.899804069885636,"packages":[{"versions":[{"first_patched_version":"4.6.5","vulnerable_version_range":"\u003c 4.6.5"}],"ecosystem":"pypi","package_name":"lxml"}],"created_at":"2022-12-21T16:12:40.793Z","updated_at":"2024-09-30T16:50:30.000Z","epss_percentage":0.02863,"epss_percentile":0.85512}],"docker_usage_url":"https://docker.ecosyste.ms/usage/pypi/lxml","docker_dependents_count":6398,"docker_downloads_count":5072336033,"usage_url":"https://repos.ecosyste.ms/usage/pypi/lxml","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/pypi/lxml/dependencies","status":null,"funding_links":["https://github.com/sponsors/scoder","https://tidelift.com/funding/github/pypi/lxml"],"critical":true,"versions_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/lxml/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/lxml/version_numbers","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/lxml/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/lxml/related_packages","maintainers":[{"uuid":"faassen","login":"faassen","name":null,"email":null,"url":null,"packages_count":403,"html_url":"https://pypi.org/user/faassen/","role":null,"created_at":"2022-12-13T22:07:40.446Z","updated_at":"2022-12-13T22:07:40.446Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/maintainers/faassen/packages"},{"uuid":"scoder","login":"scoder","name":null,"email":null,"url":null,"packages_count":11,"html_url":"https://pypi.org/user/scoder/","role":null,"created_at":"2022-12-13T22:07:40.454Z","updated_at":"2022-12-13T22:07:40.454Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/maintainers/scoder/packages"},{"uuid":"zope.wineggbuilder","login":"zope.wineggbuilder","name":null,"email":null,"url":null,"packages_count":3,"html_url":"https://pypi.org/user/zope.wineggbuilder/","role":null,"created_at":"2022-12-13T22:07:40.462Z","updated_at":"2022-12-13T22:07:40.462Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/maintainers/zope.wineggbuilder/packages"}],"registry":{"name":"pypi.org","url":"https://pypi.org","ecosystem":"pypi","default":true,"packages_count":690322,"maintainers_count":292759,"namespaces_count":0,"keywords_count":228590,"github":"pypi","metadata":{"funded_packages_count":48950},"icon_url":"https://github.com/pypi.png","created_at":"2022-04-04T15:19:23.364Z","updated_at":"2025-06-06T05:32:09.692Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/namespaces"}},"unique_repositories_count":1116,"unique_repositories_count_past_30_days":5,"recent_issues":[{"uuid":"4964417245","node_id":"PR_kwDOSuNyS871pZua","number":26,"state":"open","title":"build(deps): Bump the dependencies group across 3 directories with 73 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-07-24T01:50:20.000Z","updated_at":"2026-07-24T01:50:21.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps): Bump","group_name":"dependencies","update_count":73,"packages":[{"name":"asgiref","old_version":"3.11.1","new_version":"3.12.1","repository_url":"https://github.com/django/asgiref"},{"name":"bleach","old_version":"4.1.0","new_version":"6.4.0","repository_url":"https://github.com/mozilla/bleach"},{"name":"blessed","old_version":"1.39.0","new_version":"1.47.0","repository_url":"https://github.com/jquast/blessed"},{"name":"boto3","old_version":"1.43.8","new_version":"1.43.50","repository_url":"https://github.com/boto/boto3"},{"name":"botocore","old_version":"1.43.8","new_version":"1.43.50","repository_url":"https://github.com/boto/botocore"},{"name":"certifi","old_version":"2026.4.22","new_version":"2026.6.17","repository_url":"https://github.com/certifi/python-certifi"},{"name":"cffi","old_version":"2.0.0","new_version":"2.1.0","repository_url":"https://github.com/python-cffi/cffi"},{"name":"charset-normalizer","old_version":"3.4.7","new_version":"3.4.9","repository_url":"https://github.com/jawah/charset_normalizer"},{"name":"django","old_version":"5.2.14","new_version":"6.0.7","repository_url":"https://github.com/django/django"},{"name":"django-allauth","old_version":"65.14.3","new_version":"65.18.0","repository_url":"https://github.com/sponsors/pennersr"},{"name":"django-filter","old_version":"25.2","new_version":"26.1","repository_url":"https://github.com/carltongibson/django-filter"},{"name":"django-js-asset","old_version":"3.1.2","new_version":"4.0.1","repository_url":"https://github.com/feincms/django-js-asset"},{"name":"django-maintenance-mode","old_version":"0.22.0","new_version":"0.23.0","repository_url":"https://github.com/fabiocaccamo/django-maintenance-mode"},{"name":"django-markdownify","old_version":"0.9.1","new_version":"0.9.7","repository_url":"https://github.com/erwinmatijsen/django-markdownify"},{"name":"django-money","old_version":"3.6.0","new_version":"3.6.1","repository_url":"https://github.com/django-money/django-money"},{"name":"django-oauth-toolkit","old_version":"3.2.0","new_version":"3.3.0","repository_url":"https://github.com/django-oauth/django-oauth-toolkit"},{"name":"django-otp","old_version":"1.3.0","new_version":"1.7.0","repository_url":"https://github.com/django-otp/django-otp"},{"name":"django-redis","old_version":"6.0.0","new_version":"7.0.0","repository_url":"https://github.com/jazzband/django-redis"},{"name":"django-structlog","old_version":"10.0.0","new_version":"10.1.0","repository_url":"https://github.com/jrobichaud/django-structlog"},{"name":"docutils","old_version":"0.22.4","new_version":"0.23","repository_url":"https://github.com/rtfd/recommonmark"},{"name":"drf-spectacular","old_version":"0.29.0","new_version":"0.30.0","repository_url":"https://github.com/tfranzel/drf-spectacular"},{"name":"dulwich","old_version":"1.2.1","new_version":"1.2.11","repository_url":"https://github.com/dulwich/dulwich"},{"name":"fido2","old_version":"2.2.0","new_version":"2.2.1","repository_url":"https://github.com/Yubico/python-fido2"},{"name":"grpcio","old_version":"1.80.0","new_version":"1.82.1","repository_url":"https://github.com/grpc/grpc"},{"name":"icalendar","old_version":"7.1.0","new_version":"7.2.0","repository_url":"https://github.com/collective/icalendar"},{"name":"idna","old_version":"3.15","new_version":"3.18","repository_url":"https://github.com/kjd/idna"},{"name":"importlib-metadata","old_version":"8.7.1","new_version":"9.0.0","repository_url":"https://github.com/python/importlib_metadata"},{"name":"jwcrypto","old_version":"1.5.7","new_version":"1.5.8","repository_url":"https://github.com/latchset/jwcrypto"},{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"},{"name":"nh3","old_version":"0.3.5","new_version":"0.3.6","repository_url":"https://github.com/messense/nh3"},{"name":"opentelemetry-exporter-otlp-proto-common","old_version":"1.41.1","new_version":"1.44.0","repository_url":"https://github.com/open-telemetry/opentelemetry-python"},{"name":"opentelemetry-exporter-otlp-proto-grpc","old_version":"1.41.1","new_version":"1.44.0","repository_url":"https://github.com/open-telemetry/opentelemetry-python"},{"name":"opentelemetry-exporter-otlp-proto-http","old_version":"1.41.1","new_version":"1.44.0","repository_url":"https://github.com/open-telemetry/opentelemetry-python"},{"name":"opentelemetry-instrumentation","old_version":"0.62b1","new_version":"0.65b0","repository_url":"https://github.com/open-telemetry/opentelemetry-python-contrib"},{"name":"opentelemetry-instrumentation-dbapi","old_version":"0.62b1","new_version":"0.65b0","repository_url":"https://github.com/open-telemetry/opentelemetry-python-contrib"},{"name":"opentelemetry-proto","old_version":"1.41.1","new_version":"1.44.0","repository_url":"https://github.com/open-telemetry/opentelemetry-python"},{"name":"opentelemetry-semantic-conventions","old_version":"0.62b1","new_version":"0.65b0","repository_url":"https://github.com/open-telemetry/opentelemetry-python"},{"name":"opentelemetry-util-http","old_version":"0.62b1","new_version":"0.65b0","repository_url":"https://github.com/open-telemetry/opentelemetry-python-contrib"},{"name":"pillow","old_version":"12.2.0","new_version":"12.3.0","repository_url":"https://github.com/python-pillow/Pillow"},{"name":"platformdirs","old_version":"4.9.6","new_version":"4.10.0","repository_url":"https://github.com/tox-dev/platformdirs"},{"name":"prettytable","old_version":"3.17.0","new_version":"3.18.0","repository_url":"https://github.com/prettytable/prettytable"},{"name":"protobuf","old_version":"6.33.6","new_version":"7.35.1","repository_url":"https://github.com/protocolbuffers/protobuf"},{"name":"pyjwt","old_version":"2.12.1","new_version":"2.13.0","repository_url":"https://github.com/jpadilla/pyjwt"},{"name":"pypdf","old_version":"6.11.0","new_version":"6.14.2","repository_url":"https://github.com/py-pdf/pypdf"},{"name":"python-fsutil","old_version":"0.16.1","new_version":"0.17.0","repository_url":"https://github.com/fabiocaccamo/python-fsutil"},{"name":"redis","old_version":"7.4.0","new_version":"8.0.1","repository_url":"https://github.com/redis/redis-py"},{"name":"rpds-py","old_version":"0.30.0","new_version":"2026.6.3","repository_url":"https://github.com/crate-py/rpds"},{"name":"s3transfer","old_version":"0.17.0","new_version":"0.19.1","repository_url":"https://github.com/boto/s3transfer"},{"name":"sentry-sdk","old_version":"2.60.0","new_version":"2.66.0","repository_url":"https://github.com/getsentry/sentry-python"},{"name":"setuptools","old_version":"82.0.1","new_version":"83.0.0","repository_url":"https://github.com/pypa/setuptools"},{"name":"structlog","old_version":"25.5.0","new_version":"26.1.0","repository_url":"https://github.com/hynek/structlog"},{"name":"tqdm","old_version":"4.67.3","new_version":"4.68.4","repository_url":"https://github.com/tqdm/tqdm"},{"name":"typing-extensions","old_version":"4.15.0","new_version":"4.16.0","repository_url":"https://github.com/python/typing_extensions"},{"name":"tzdata","old_version":"2026.2","new_version":"2026.3","repository_url":"https://github.com/python/tzdata"},{"name":"wcwidth","old_version":"0.7.0","new_version":"0.8.2","repository_url":"https://github.com/jquast/wcwidth"},{"name":"weasyprint","old_version":"68.1","new_version":"69.0","repository_url":"https://github.com/Kozea/WeasyPrint"},{"name":"wrapt","old_version":"1.17.3","new_version":"2.2.2","repository_url":"https://github.com/GrahamDumpleton/wrapt"},{"name":"zipp","old_version":"3.23.1","new_version":"4.1.0","repository_url":"https://github.com/jaraco/zipp"},{"name":"zopfli","old_version":"0.4.1","new_version":"0.4.3","repository_url":"https://github.com/fonttools/py-zopfli"},{"name":"click","old_version":"8.3.3","new_version":"8.4.2","repository_url":"https://github.com/pallets/click"},{"name":"coverage","old_version":"7.14.0","new_version":"7.15.2","repository_url":"https://github.com/coveragepy/coveragepy"},{"name":"django-stubs","old_version":"6.0.4","new_version":"6.0.7","repository_url":"https://github.com/typeddjango/django-stubs"},{"name":"django-stubs-ext","old_version":"6.0.4","new_version":"6.0.7","repository_url":"https://github.com/typeddjango/django-stubs"},{"name":"pip","old_version":"26.1.1","new_version":"26.1.2","repository_url":"https://github.com/pypa/pip"},{"name":"prek","old_version":"0.4.0","new_version":"0.4.10","repository_url":"https://github.com/j178/prek"},{"name":"pytest","old_version":"9.0.3","new_version":"9.1.1","repository_url":"https://github.com/pytest-dev/pytest"},{"name":"pytest-codspeed","old_version":"5.0.2","new_version":"5.0.3","repository_url":"https://github.com/CodSpeedHQ/pytest-codspeed"},{"name":"ty","old_version":"0.0.1a21","new_version":"0.0.60","repository_url":"https://github.com/astral-sh/ty"},{"name":"types-psycopg2","old_version":"2.9.21.20260509","new_version":"2.9.21.20260712","repository_url":"https://github.com/python/typeshed"},{"name":"types-pyyaml","old_version":"6.0.12.20260510","new_version":"6.0.12.20260518","repository_url":"https://github.com/python/typeshed"}],"path":null,"ecosystem":"pip"},"body":"Bumps the dependencies group with 1 update in the /contrib/dev_reqs directory: [jc](https://github.com/kellyjonbrazil/jc).\nBumps the dependencies group with 2 updates in the /docs directory: [mkdocs-git-revision-date-localized-plugin](https://github.com/timvink/mkdocs-git-revision-date-localized-plugin) and [mkdocstrings](https://github.com/mkdocstrings/mkdocstrings).\nBumps the dependencies group with 70 updates in the /src/backend directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [asgiref](https://github.com/django/asgiref) | `3.11.1` | `3.12.1` |\n| [bleach](https://github.com/mozilla/bleach) | `4.1.0` | `6.4.0` |\n| [blessed](https://github.com/jquast/blessed) | `1.39.0` | `1.47.0` |\n| [boto3](https://github.com/boto/boto3) | `1.43.8` | `1.43.50` |\n| [botocore](https://github.com/boto/botocore) | `1.43.8` | `1.43.50` |\n| [certifi](https://github.com/certifi/python-certifi) | `2026.4.22` | `2026.6.17` |\n| [cffi](https://github.com/python-cffi/cffi) | `2.0.0` | `2.1.0` |\n| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.7` | `3.4.9` |\n| [django](https://github.com/django/django) | `5.2.14` | `6.0.7` |\n| [django-allauth](https://github.com/sponsors/pennersr) | `65.14.3` | `65.18.0` |\n| [django-filter](https://github.com/carltongibson/django-filter) | `25.2` | `26.1` |\n| [django-js-asset](https://github.com/feincms/django-js-asset) | `3.1.2` | `4.0.1` |\n| [django-maintenance-mode](https://github.com/fabiocaccamo/django-maintenance-mode) | `0.22.0` | `0.23.0` |\n| [django-markdownify](https://github.com/erwinmatijsen/django-markdownify) | `0.9.1` | `0.9.7` |\n| [django-money](https://github.com/django-money/django-money) | `3.6.0` | `3.6.1` |\n| [django-oauth-toolkit](https://github.com/django-oauth/django-oauth-toolkit) | `3.2.0` | `3.3.0` |\n| [django-otp](https://github.com/django-otp/django-otp) | `1.3.0` | `1.7.0` |\n| [django-redis](https://github.com/jazzband/django-redis) | `6.0.0` | `7.0.0` |\n| [django-structlog](https://github.com/jrobichaud/django-structlog) | `10.0.0` | `10.1.0` |\n| [docutils](https://github.com/rtfd/recommonmark) | `0.22.4` | `0.23` |\n| [drf-spectacular](https://github.com/tfranzel/drf-spectacular) | `0.29.0` | `0.30.0` |\n| [dulwich](https://github.com/dulwich/dulwich) | `1.2.1` | `1.2.11` |\n| [fido2](https://github.com/Yubico/python-fido2) | `2.2.0` | `2.2.1` |\n| [grpcio](https://github.com/grpc/grpc) | `1.80.0` | `1.82.1` |\n| [icalendar](https://github.com/collective/icalendar) | `7.1.0` | `7.2.0` |\n| [idna](https://github.com/kjd/idna) | `3.15` | `3.18` |\n| [importlib-metadata](https://github.com/python/importlib_metadata) | `8.7.1` | `9.0.0` |\n| [jwcrypto](https://github.com/latchset/jwcrypto) | `1.5.7` | `1.5.8` |\n| [lxml](https://github.com/lxml/lxml) | `6.1.0` | `6.1.1` |\n| [nh3](https://github.com/messense/nh3) | `0.3.5` | `0.3.6` |\n| [opentelemetry-exporter-otlp-proto-common](https://github.com/open-telemetry/opentelemetry-python) | `1.41.1` | `1.44.0` |\n| [opentelemetry-exporter-otlp-proto-grpc](https://github.com/open-telemetry/opentelemetry-python) | `1.41.1` | `1.44.0` |\n| [opentelemetry-exporter-otlp-proto-http](https://github.com/open-telemetry/opentelemetry-python) | `1.41.1` | `1.44.0` |\n| [opentelemetry-instrumentation](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.62b1` | `0.65b0` |\n| [opentelemetry-instrumentation-dbapi](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.62b1` | `0.65b0` |\n| [opentelemetry-proto](https://github.com/open-telemetry/opentelemetry-python) | `1.41.1` | `1.44.0` |\n| [opentelemetry-semantic-conventions](https://github.com/open-telemetry/opentelemetry-python) | `0.62b1` | `0.65b0` |\n| [opentelemetry-util-http](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.62b1` | `0.65b0` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` |\n| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.9.6` | `4.10.0` |\n| [prettytable](https://github.com/prettytable/prettytable) | `3.17.0` | `3.18.0` |\n| [protobuf](https://github.com/protocolbuffers/protobuf) | `6.33.6` | `7.35.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.12.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.11.0` | `6.14.2` |\n| [python-fsutil](https://github.com/fabiocaccamo/python-fsutil) | `0.16.1` | `0.17.0` |\n| [redis](https://github.com/redis/redis-py) | `7.4.0` | `8.0.1` |\n| [rpds-py](https://github.com/crate-py/rpds) | `0.30.0` | `2026.6.3` |\n| [s3transfer](https://github.com/boto/s3transfer) | `0.17.0` | `0.19.1` |\n| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.60.0` | `2.66.0` |\n| [setuptools](https://github.com/pypa/setuptools) | `82.0.1` | `83.0.0` |\n| [structlog](https://github.com/hynek/structlog) | `25.5.0` | `26.1.0` |\n| [tqdm](https://github.com/tqdm/tqdm) | `4.67.3` | `4.68.4` |\n| [typing-extensions](https://github.com/python/typing_extensions) | `4.15.0` | `4.16.0` |\n| [tzdata](https://github.com/python/tzdata) | `2026.2` | `2026.3` |\n| [wcwidth](https://github.com/jquast/wcwidth) | `0.7.0` | `0.8.2` |\n| [weasyprint](https://github.com/Kozea/WeasyPrint) | `68.1` | `69.0` |\n| [wrapt](https://github.com/GrahamDumpleton/wrapt) | `1.17.3` | `2.2.2` |\n| [zipp](https://github.com/jaraco/zipp) | `3.23.1` | `4.1.0` |\n| [zopfli](https://github.com/fonttools/py-zopfli) | `0.4.1` | `0.4.3` |\n| [click](https://github.com/pallets/click) | `8.3.3` | `8.4.2` |\n| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.0` | `7.15.2` |\n| [django-stubs](https://github.com/typeddjango/django-stubs) | `6.0.4` | `6.0.7` |\n| [django-stubs-ext](https://github.com/typeddjango/django-stubs) | `6.0.4` | `6.0.7` |\n| [pip](https://github.com/pypa/pip) | `26.1.1` | `26.1.2` |\n| [prek](https://github.com/j178/prek) | `0.4.0` | `0.4.10` |\n| [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` |\n| [pytest-codspeed](https://github.com/CodSpeedHQ/pytest-codspeed) | `5.0.2` | `5.0.3` |\n| [ty](https://github.com/astral-sh/ty) | `0.0.1a21` | `0.0.60` |\n| [types-psycopg2](https://github.com/python/typeshed) | `2.9.21.20260509` | `2.9.21.20260712` |\n| [types-pyyaml](https://github.com/python/typeshed) | `6.0.12.20260510` | `6.0.12.20260518` |\n\n\nUpdates `jc` from 1.25.6 to 1.25.7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kellyjonbrazil/jc/releases\"\u003ejc's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eJC version 1.25.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003ecsv-ih\u003c/code\u003e, \u003ccode\u003etsv\u003c/code\u003e, and \u003ccode\u003etsv-ih\u003c/code\u003e file parsers for CSV files without headers,\nTSV files, and TSV files without headers. Note that these are standard and\nnot streaming parsers so the entire CSV/TSV will be loaded into memory. For\nlazy loading equivalents, see below.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ecsv-ih-s\u003c/code\u003e, \u003ccode\u003etsv-s\u003c/code\u003e, and \u003ccode\u003etsv-ih-s\u003c/code\u003e streaming file parsers for CSV files\nwithout headers, TSV files, and TSV files without headers. These streaming\nparsers will lazily load the data into memory and may be more suitable for\nextremely large files.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003etypeset\u003c/code\u003e and \u003ccode\u003edeclare\u003c/code\u003e Bash internal command parser to convert variables\nsimple arrays, and associative arrays along with object metadata\u003c/li\u003e\n\u003cli\u003eEnhance \u003ccode\u003epip-show\u003c/code\u003e command parser to add \u003ccode\u003e-f\u003c/code\u003e show files support\u003c/li\u003e\n\u003cli\u003eEnhance \u003ccode\u003ersync\u003c/code\u003e and \u003ccode\u003ersync-s\u003c/code\u003e parsers to add \u003ccode\u003e--stats\u003c/code\u003e or \u003ccode\u003e--info=stats[1-3]\u003c/code\u003e fields\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ecertbot\u003c/code\u003e command parser to allow parsing of named certs\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003edir\u003c/code\u003e command parser for incorrect stripping of the \u003ccode\u003eD:\u003c/code\u003e drive letter\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ehashsum\u003c/code\u003e command parser to correctly parse the \u003ccode\u003emode\u003c/code\u003e indicator\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eifconfig\u003c/code\u003e command parser for incorrect stripping of leading zeros in some hex numbers\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eiptables\u003c/code\u003e command parser when Target is blank and verbose output is used\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003elsattr\u003c/code\u003e command parser for filenames with spaces (newlines in filenames are\nstill not supported)\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eproc-pid-smaps\u003c/code\u003e proc parser when unknown VmFlags are output\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ejc.utils.timestamp\u003c/code\u003e function and tests for behavior change in python 3.15\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eufw\u003c/code\u003e command parser to support rule logging. A new boolean \u003ccode\u003elog\u003c/code\u003e field is introduced\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kellyjonbrazil/jc/blob/master/CHANGELOG\"\u003ejc's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003ejc changelog\u003c/p\u003e\n\u003cp\u003e20260617 v1.25.7\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003ecsv-ih\u003c/code\u003e, \u003ccode\u003etsv\u003c/code\u003e, and \u003ccode\u003etsv-ih\u003c/code\u003e file parsers for CSV files without headers,\nTSV files, and TSV files without headers. Note that these are standard and\nnot streaming parsers so the entire CSV/TSV will be loaded into memory. For\nlazy loading equivalents, see below.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ecsv-ih-s\u003c/code\u003e, \u003ccode\u003etsv-s\u003c/code\u003e, and \u003ccode\u003etsv-ih-s\u003c/code\u003e streaming file parsers for CSV files\nwithout headers, TSV files, and TSV files without headers. These streaming\nparsers will lazily load the data into memory and may be more suitable for\nextremely large files.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003etypeset\u003c/code\u003e and \u003ccode\u003edeclare\u003c/code\u003e Bash internal command parser to convert variables\nsimple arrays, and associative arrays along with object metadata\u003c/li\u003e\n\u003cli\u003eEnhance \u003ccode\u003epip-show\u003c/code\u003e command parser to add \u003ccode\u003e-f\u003c/code\u003e show files support\u003c/li\u003e\n\u003cli\u003eEnhance \u003ccode\u003ersync\u003c/code\u003e and \u003ccode\u003ersync-s\u003c/code\u003e parsers to add \u003ccode\u003e--stats\u003c/code\u003e or \u003ccode\u003e--info=stats[1-3]\u003c/code\u003e fields\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ecertbot\u003c/code\u003e command parser to allow parsing of named certs\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003edir\u003c/code\u003e command parser for incorrect stripping of the \u003ccode\u003eD:\u003c/code\u003e drive letter\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ehashsum\u003c/code\u003e command parser to correctly parse the \u003ccode\u003emode\u003c/code\u003e indicator\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eifconfig\u003c/code\u003e command parser for incorrect stripping of leading zeros in some hex numbers\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eiptables\u003c/code\u003e command parser when Target is blank and verbose output is used\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003elsattr\u003c/code\u003e command parser for filenames with spaces (newlines in filenames are\nstill not supported)\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eproc-pid-smaps\u003c/code\u003e proc parser when unknown VmFlags are output\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ejc.utils.timestamp\u003c/code\u003e function and tests for behavior change in python 3.15\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eufw\u003c/code\u003e command parser to support rule logging. A new boolean \u003ccode\u003elog\u003c/code\u003e field is introduced\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e20251012 v1.25.6\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003enet-localgroup\u003c/code\u003e Windows command parser\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003enet-user\u003c/code\u003e Windows command parser\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eroute-print\u003c/code\u003e Windows command parser\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003etraceroute-s\u003c/code\u003e streaming command parser\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003emax_hops\u003c/code\u003e and \u003ccode\u003edata_bytes\u003c/code\u003e fields to \u003ccode\u003etraceroute\u003c/code\u003e command parser\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ex509-crl\u003c/code\u003e file parser to support Certificate Revocation List PEM and DER files\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eyay\u003c/code\u003e as a magic command for the \u003ccode\u003epacman\u003c/code\u003e command parser\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ebluetoothctl\u003c/code\u003e command parser to support output with the \u003ccode\u003ecable_pairing\u003c/code\u003e attribute\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003enmcli\u003c/code\u003e command parser to support blank \u003ccode\u003eteam.config\u003c/code\u003e JSON value and \u003ccode\u003eteam-port.config\u003c/code\u003e JSON value\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003etop\u003c/code\u003e command parsers to correct memory size field parsing. Several new unit\nand byte conversion fields have been added\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ewho\u003c/code\u003e command parser to support the \u003ccode\u003eprocess\u003c/code\u003e field on Debian13\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e20250503 v1.25.5\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eamixer\u003c/code\u003e command parser\u003c/li\u003e\n\u003cli\u003eEnhance \u003ccode\u003eiptables\u003c/code\u003e command parser to add default policy statistics fields\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ebluetoothctl\u003c/code\u003e parser failing to parse controllers with power state prop\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003elsblk\u003c/code\u003e command parser to support multiple mountpoints. Also, added\nbyte conversions for size fields.\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003enmcli\u003c/code\u003e command parser to support \u003ccode\u003eteam.config\u003c/code\u003e JSON field\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003etime\u003c/code\u003e command parser for output that does not contain centiseconds\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ex509-cert\u003c/code\u003e parser to handle IDNA2008 encoded email addresses with a warning\u003c/li\u003e\n\u003cli\u003eFix typing for upcoming python v3.14\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/8290734a87a30e5f0af7e1fba5ecbda2e1c145a8\"\u003e\u003ccode\u003e8290734\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kellyjonbrazil/jc/issues/712\"\u003e#712\u003c/a\u003e from kellyjonbrazil/dev\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/9d11e1fe5bbdfb9f68b001940a7ae235b68db637\"\u003e\u003ccode\u003e9d11e1f\u003c/code\u003e\u003c/a\u003e doc update\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/3a2946b6584f2128917ffe908f749498b8c5ea5c\"\u003e\u003ccode\u003e3a2946b\u003c/code\u003e\u003c/a\u003e add streaming csv-ih, tsv, and tsv-ih parsers with doc fixes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/22ff0e33c3957c929d45864cc9790b8f7b6fe9c8\"\u003e\u003ccode\u003e22ff0e3\u003c/code\u003e\u003c/a\u003e fix for python 3.15 behavior changes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/fab550e3b8fef49abe297c5ac4f0b2f9b330d3a9\"\u003e\u003ccode\u003efab550e\u003c/code\u003e\u003c/a\u003e docs: fix typos (\u003ca href=\"https://redirect.github.com/kellyjonbrazil/jc/issues/711\"\u003e#711\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/6e79f08c9083836467711e6965f5ca18b1505674\"\u003e\u003ccode\u003e6e79f08\u003c/code\u003e\u003c/a\u003e Add TSV alias and CSV/TSV \u0026quot;No Header\u0026quot; alias (\u003ca href=\"https://redirect.github.com/kellyjonbrazil/jc/issues/709\"\u003e#709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/900aed5d880f2c1150739976bfbfb1f87e64cbc9\"\u003e\u003ccode\u003e900aed5\u003c/code\u003e\u003c/a\u003e fix tests and update docs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/676695eacf75aa01920b89bb1809ee96e47d20bb\"\u003e\u003ccode\u003e676695e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kellyjonbrazil/jc/issues/701\"\u003e#701\u003c/a\u003e from jeffdyke/feature/certs-with-cert-name\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/30c75073044dd364174b080709e9fb6c870ce82e\"\u003e\u003ccode\u003e30c7507\u003c/code\u003e\u003c/a\u003e doc update\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/7d801f30bb9b35b60938c193d76227f5a3473b50\"\u003e\u003ccode\u003e7d801f3\u003c/code\u003e\u003c/a\u003e doc update\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kellyjonbrazil/jc/compare/v1.25.6...v1.25.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `mkdocs-git-revision-date-localized-plugin` from 1.5.2 to 1.5.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/releases\"\u003emkdocs-git-revision-date-localized-plugin's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.5.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix paths in MANIFEST.in by \u003ca href=\"https://github.com/mitya57\"\u003e\u003ccode\u003e@​mitya57\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/timvink/mkdocs-git-revision-date-localized-plugin/pull/211\"\u003etimvink/mkdocs-git-revision-date-localized-plugin#211\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mitya57\"\u003e\u003ccode\u003e@​mitya57\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/timvink/mkdocs-git-revision-date-localized-plugin/pull/211\"\u003etimvink/mkdocs-git-revision-date-localized-plugin#211\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/compare/v1.5.2...v1.5.3\"\u003ehttps://github.com/timvink/mkdocs-git-revision-date-localized-plugin/compare/v1.5.2...v1.5.3\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/commit/30e58767a16cd9ec1dd2669f0bdc1af8630af18c\"\u003e\u003ccode\u003e30e5876\u003c/code\u003e\u003c/a\u003e Bump version to 1.5.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/commit/d58c5becb14bcd4a6143768fb3b7478954c09133\"\u003e\u003ccode\u003ed58c5be\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/timvink/mkdocs-git-revision-date-localized-plugin/issues/211\"\u003e#211\u003c/a\u003e from mitya57/fix-manifest\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/commit/6da0b4ea1b8c379164a4f1db8e005e98a0b4557d\"\u003e\u003ccode\u003e6da0b4e\u003c/code\u003e\u003c/a\u003e Fix paths in MANIFEST.in\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/commit/aa0d4a3b93f6c4cc36afbf2d8def4af5566d0834\"\u003e\u003ccode\u003eaa0d4a3\u003c/code\u003e\u003c/a\u003e Constrain mkdocs to \u0026lt;2\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/compare/v1.5.2...v1.5.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `mkdocstrings` from 1.0.4 to 1.0.6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/releases\"\u003emkdocstrings's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.0.6\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/releases/tag/1.0.6\"\u003e1.0.6\u003c/a\u003e - 2026-07-11\u003c/h2\u003e\n\u003cp\u003e\u003c!-- raw HTML omitted --\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/compare/1.0.5...1.0.6\"\u003eCompare with 1.0.5\u003c/a\u003e\u003c!-- raw HTML omitted --\u003e\u003c/p\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eStop propagating Zensical's \u003ccode\u003ezrelpath\u003c/code\u003e treeprocessor and its \u003ccode\u003epreview\u003c/code\u003e extension (\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/473279816aff4cc8ee3215fdf8b2d186517fc63d\"\u003e4732798\u003c/a\u003e by Timothée Mazzucotelli). \u003ca href=\"https://redirect.github.com/zensical/zensical/issues/818\"\u003eIssue-zensical-818\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.0.5\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/releases/tag/1.0.5\"\u003e1.0.5\u003c/a\u003e - 2026-07-10\u003c/h2\u003e\n\u003cp\u003e\u003c!-- raw HTML omitted --\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/compare/1.0.4...1.0.5\"\u003eCompare with 1.0.4\u003c/a\u003e\u003c!-- raw HTML omitted --\u003e\u003c/p\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eParse inventory project and version (\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/acc0da32d11428ea9c60f8e50f90df329f2e6460\"\u003eacc0da3\u003c/a\u003e by Timothée Mazzucotelli).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/blob/main/CHANGELOG.md\"\u003emkdocstrings's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/releases/tag/1.0.6\"\u003e1.0.6\u003c/a\u003e - 2026-07-11\u003c/h2\u003e\n\u003cp\u003e\u003c!-- raw HTML omitted --\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/compare/1.0.5...1.0.6\"\u003eCompare with 1.0.5\u003c/a\u003e\u003c!-- raw HTML omitted --\u003e\u003c/p\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eStop propagating Zensical's \u003ccode\u003ezrelpath\u003c/code\u003e treeprocessor and its \u003ccode\u003epreview\u003c/code\u003e extension (\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/473279816aff4cc8ee3215fdf8b2d186517fc63d\"\u003e4732798\u003c/a\u003e by Timothée Mazzucotelli). \u003ca href=\"https://redirect.github.com/zensical/zensical/issues/818\"\u003eIssue-zensical-818\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/releases/tag/1.0.5\"\u003e1.0.5\u003c/a\u003e - 2026-07-10\u003c/h2\u003e\n\u003cp\u003e\u003c!-- raw HTML omitted --\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/compare/1.0.4...1.0.5\"\u003eCompare with 1.0.4\u003c/a\u003e\u003c!-- raw HTML omitted --\u003e\u003c/p\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eParse inventory project and version (\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/acc0da32d11428ea9c60f8e50f90df329f2e6460\"\u003eacc0da3\u003c/a\u003e by Timothée Mazzucotelli).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/9a11dcb8e9b39ff6e1a22abdd362350de4e68e9f\"\u003e\u003ccode\u003e9a11dcb\u003c/code\u003e\u003c/a\u003e chore: Prepare release 1.0.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/473279816aff4cc8ee3215fdf8b2d186517fc63d\"\u003e\u003ccode\u003e4732798\u003c/code\u003e\u003c/a\u003e fix: Stop propagating Zensical's \u003ccode\u003ezrelpath\u003c/code\u003e treeprocessor and its \u003ccode\u003epreview\u003c/code\u003e e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/ecbaa9a05dde5bdc83accf8814fa1c9a1ffe1473\"\u003e\u003ccode\u003eecbaa9a\u003c/code\u003e\u003c/a\u003e Merge branch 'main' of github.com:mkdocstrings/mkdocstrings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/64260f748f3db8b301a9d6fa05b2609ab6f6876c\"\u003e\u003ccode\u003e64260f7\u003c/code\u003e\u003c/a\u003e chore: Prepare release 1.0.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/acc0da32d11428ea9c60f8e50f90df329f2e6460\"\u003e\u003ccode\u003eacc0da3\u003c/code\u003e\u003c/a\u003e fix: Parse inventory project and version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/ec45a9b7a1301a4c70e02e6c92e1b9caff6df61f\"\u003e\u003ccode\u003eec45a9b\u003c/code\u003e\u003c/a\u003e ci: Fix warnings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/ce2199c5195535f8c3b4907dd3ac7de2181925cc\"\u003e\u003ccode\u003ece2199c\u003c/code\u003e\u003c/a\u003e chore: Update sponsors section in README (\u003ca href=\"https://redirect.github.com/mkdocstrings/mkdocstrings/issues/823\"\u003e#823\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/compare/1.0.4...1.0.6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `asgiref` from 3.11.1 to 3.12.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/django/asgiref/blob/main/CHANGELOG.txt\"\u003easgiref's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.12.1 (2026-07-14)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eRestored the previous SyncToAsync.\u003cstrong\u003ecall\u003c/strong\u003e internal code shape, which was\nrelied on by some APM services. (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/572\"\u003e#572\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003eNote, this change was available whilst maintaining the underlying fix (from\n\u003ca href=\"https://redirect.github.com/django/asgiref/issues/564\"\u003e#564\u003c/a\u003e). It does not constitute an API stability promise. Ideally APMs are\n\u003cem\u003enot\u003c/em\u003e monkey patching internal APIs, and future changes will be made here if\nneeded.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12.0 (2026-07-14)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003eAsyncToSync\u003c/code\u003e no longer captures the running event loop on\ninstantiation. (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/562\"\u003e#562\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003eThis resolves a series of deadlocks that users experienced after asgiref 3.9.0,\nparticularly with pytest-asyncio. pytest-asyncio stops the event loop between\ntests, and long-running unawaited futures could find themselves trying to\nschedule work onto a stopped loop, and so would never complete. Ideally, code\nshould be structured to await long-running futures before returning, but this\nchange should help users experiencing issues here.\u003c/p\u003e\n\u003cp\u003eThe loop is now resolved when the callable is invoked rather than when it is\ncreated. If \u003ccode\u003easync_to_sync\u003c/code\u003e is called from within \u003ccode\u003esync_to_async\u003c/code\u003e, the\nparent event loop is still used, as before.\u003c/p\u003e\n\u003cp\u003eThe possibility of deadlock therefore remains in some nested patterns. For\nexample, an async function may call a long-running \u003ccode\u003esync_to_async\u003c/code\u003e function\nthat itself uses \u003ccode\u003easync_to_sync\u003c/code\u003e; if the outer function returns before the\nsync future completes, the parent event loop may already be stopped, and the\nnested calls cannot be driven to completion.\u003c/p\u003e\n\u003cp\u003eThis is not a bug in asgiref — the same patterns deadlock in plain asyncio. As\nabove, restructure your code to await the \u003ccode\u003esync_to_async\u003c/code\u003e future before\nexiting the driving coroutine.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed an event loop deadlock when exiting \u003ccode\u003eThreadSensitiveContext\u003c/code\u003e\nwhile its executor thread was still blocked waiting on the event loop.\n(\u003ca href=\"https://redirect.github.com/django/asgiref/issues/535\"\u003e#535\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDropped support for EOL Python 3.9.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eStatelessServer.run()\u003c/code\u003e failing on Python 3.14, where\n\u003ccode\u003easyncio.get_event_loop()\u003c/code\u003e no longer creates an event loop if none\nexists. It now uses \u003ccode\u003easyncio.run()\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/559\"\u003e#559\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eLocal\u003c/code\u003e leaking data between unrelated sync threads when\n\u003ccode\u003esys.flags.thread_inherit_context\u003c/code\u003e is enabled (Python 3.14+), so a newly\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/ef9d4b8b371cf8a7bb63dea3d0fdc60923e9e081\"\u003e\u003ccode\u003eef9d4b8\u003c/code\u003e\u003c/a\u003e Releasing 3.12.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/34fba6328f67a753d814c280811fd34094bd1f6c\"\u003e\u003ccode\u003e34fba63\u003c/code\u003e\u003c/a\u003e Restore previous SyncToAsync.\u003cstrong\u003ecall\u003c/strong\u003e internal code shape.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/a43900c131874be571c6afdca642d4054eed0acf\"\u003e\u003ccode\u003ea43900c\u003c/code\u003e\u003c/a\u003e Separate mypy from tests extra.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/1b7c338591054c04ff6c140d899ced28b803b4e0\"\u003e\u003ccode\u003e1b7c338\u003c/code\u003e\u003c/a\u003e Releasing 3.12.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/157d9d4168434d73b1bb5a619f947b74ccbf1fc8\"\u003e\u003ccode\u003e157d9d4\u003c/code\u003e\u003c/a\u003e Renovate precommit (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/552\"\u003e#552\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/deda0d4fd8d3997dddd9646dd9ef7e0b6d3e59a5\"\u003e\u003ccode\u003ededa0d4\u003c/code\u003e\u003c/a\u003e Test free-threading builds and fix Local data leak for thread_inherit_context...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/a54250a24ad770616d3afcc37af3186558562041\"\u003e\u003ccode\u003ea54250a\u003c/code\u003e\u003c/a\u003e Don’t capture the event loop in \u003ccode\u003eAsyncToSync.__init__\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/562\"\u003e#562\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/836356a2802247a0963177197b50cbd7476d7950\"\u003e\u003ccode\u003e836356a\u003c/code\u003e\u003c/a\u003e Use asyncio.run in StatelessServer.run (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/561\"\u003e#561\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/e04afd54ba29bb277ba6177dc898c73c129446f3\"\u003e\u003ccode\u003ee04afd5\u003c/code\u003e\u003c/a\u003e Dropped support for Python 3.9. (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/543\"\u003e#543\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/95d2430a346be7f40652d2eabff84fe54fbc725d\"\u003e\u003ccode\u003e95d2430\u003c/code\u003e\u003c/a\u003e Fixed \u003ca href=\"https://redirect.github.com/django/asgiref/issues/535\"\u003e#535\u003c/a\u003e: ThreadSensitiveContext.\u003cstrong\u003eaexit\u003c/strong\u003e blocking the event loop. (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/563\"\u003e#563\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/django/asgiref/compare/3.11.1...3.12.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `bleach` from 4.1.0 to 6.4.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/mozilla/bleach/blob/main/CHANGES\"\u003ebleach's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.4.0 (June 5th, 2026)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eNOTE: 2026-06-05: Bleach is no longer maintained. There will be no future\nreleases including for security issues.\u003c/strong\u003e\nSee issue: \u003ccode\u003e\u0026lt;https://github.com/mozilla/bleach/issues/698\u0026gt;\u003c/code\u003e__\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eBackwards incompatible changes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for pypy 3.10. (\u003ca href=\"https://redirect.github.com/mozilla/bleach/issues/764\"\u003e#764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity fixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eFix bug 2023812 / GHSA-8rfp-98v4-mmr6.\u003c/p\u003e\n\u003cp\u003eFix XSS issue with sanitize_uri_value where disallowed schemes with\nUnicode invisible characters wouldn't be rejected.\u003c/p\u003e\n\u003cp\u003eFor example::\u003c/p\u003e\n\u003cp\u003eimport bleach\npayload1 = '\u003c!-- raw HTML omitted --\u003eClick\u003c!-- raw HTML omitted --\u003e'\nresult1 = bleach.clean(payload1)\nprint(repr(result1))\u003c/p\u003e\n\u003cp\u003eoutputs::\u003c/p\u003e\n\u003cp\u003e'\u003c!-- raw HTML omitted --\u003eClick\u003c!-- raw HTML omitted --\u003e'\u003c/p\u003e\n\u003cp\u003eSee the advisory for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFix GHSA-gj48-438w-jh9v.\u003c/p\u003e\n\u003cp\u003eFix issue where URI sanitization wasn't happening in formaction attributes.\u003c/p\u003e\n\u003cp\u003eSee the advisory for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBug fixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eAdd support for pypy 3.11. (\u003ca href=\"https://redirect.github.com/mozilla/bleach/issues/764\"\u003e#764\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDrop version max in tinycss2 pin. (\u003ca href=\"https://redirect.github.com/mozilla/bleach/issues/772\"\u003e#772\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003eThis removes one of the things we had to keep checking and updating. Users\nnow own the responsibility for correctness with the version of tinycss2\nthey're using.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 6.3.0 (October 27th, 2025)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/f0355a7af00500482c5292c6c83290c6a178068d\"\u003e\u003ccode\u003ef0355a7\u003c/code\u003e\u003c/a\u003e fix: fix last release date in CHANGES\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/ae4e8a26706516ad01b92e66321b480208a440da\"\u003e\u003ccode\u003eae4e8a2\u003c/code\u003e\u003c/a\u003e chore: bleach 6.4.0 and final release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/970df58e9f0c55cc52244f3f0106e473a40d886d\"\u003e\u003ccode\u003e970df58\u003c/code\u003e\u003c/a\u003e fix: uri-sanitization in formaction attributes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/7c4867c32344d1c961107fae62240a6f0dc680dc\"\u003e\u003ccode\u003e7c4867c\u003c/code\u003e\u003c/a\u003e fix: xss bypass in allowed protocol test using unicode invisible characters\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/913ab75992b845e2c9c060c41f24d46921db4693\"\u003e\u003ccode\u003e913ab75\u003c/code\u003e\u003c/a\u003e fix: reduce redundancy in workflow jobs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/218c15af455c8dec14f98fcb2e235f8680e93930\"\u003e\u003ccode\u003e218c15a\u003c/code\u003e\u003c/a\u003e fix: rework pip caching\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/4f0b097bf80548a022050e2f71f024d755a9f154\"\u003e\u003ccode\u003e4f0b097\u003c/code\u003e\u003c/a\u003e fix: fix tox platform restrictions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/e95a79d07bb5d792425c2bc0ef5dd03f6614f3bb\"\u003e\u003ccode\u003ee95a79d\u003c/code\u003e\u003c/a\u003e chore: update pytest\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/91539d4e80d4685b8f2bedc79076ff0ff6c1b911\"\u003e\u003ccode\u003e91539d4\u003c/code\u003e\u003c/a\u003e Bump actions/cache from 5.0.3 to 5.0.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/cd47b4ce495859065da23c2116f651e591e1e90d\"\u003e\u003ccode\u003ecd47b4c\u003c/code\u003e\u003c/a\u003e fix: handle left-angle-bracket that's not a tag (\u003ca href=\"https://redirect.github.com/mozilla/bleach/issues/733\"\u003e#733\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/mozilla/bleach/compare/v4.1.0...v6.4.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `blessed` from 1.39.0 to 1.47.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jquast/blessed/releases\"\u003eblessed's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.46\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix DA1 response for some terminals (kitty) by \u003ca href=\"https://github.com/jquast\"\u003e\u003ccode\u003e@​jquast\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jquast/blessed/pull/392\"\u003ejquast/blessed#392\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved remote truecolor detection by unique TERM by \u003ca href=\"https://github.com/jquast\"\u003e\u003ccode\u003e@​jquast\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jquast/blessed/pull/394\"\u003ejquast/blessed#394\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd sugar for some extended capabilities by \u003ca href=\"https://github.com/jquast\"\u003e\u003ccode\u003e@​jquast\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jquast/blessed/pull/393\"\u003ejquast/blessed#393\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jquast/blessed/compare/1.45...1.46\"\u003ehttps://github.com/jquast/blessed/compare/1.45...1.46\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e1.43: bugfix leaked XTGETTCAP responses into inkey()\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix leaked XTGETTCAP responses into inkey() by \u003ca href=\"https://github.com/jquast\"\u003e\u003ccode\u003e@​jquast\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jquast/blessed/pull/383\"\u003ejquast/blessed#383\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jquast/blessed/compare/1.42...1.43\"\u003ehttps://github.com/jquast/blessed/compare/1.42...1.43\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e1.42: bugfix regression: cbreak and raw() were not thread-safe\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: regression in \u003ccode\u003eTerminal.cbreak()\u003c/code\u003e and \u003ccode\u003eraw\u003c/code\u003e were not thread-safe broken in versions 1.40 and 1.41, remove signal ignore of SIGTTOU \u003ca href=\"https://redirect.github.com/jquast/blessed/issues/380\"\u003e#380\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jquast/blessed/compare/1.41...1.42\"\u003ehttps://github.com/jquast/blessed/compare/1.41...1.42\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e1.41: bugfix get_location() regression\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix get_location() return type in 1.40 release by \u003ca href=\"https://github.com/jquast\"\u003e\u003ccode\u003e@​jquast\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jquast/blessed/pull/379\"\u003ejquast/blessed#379\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jquast/blessed/compare/1.40...1.41\"\u003ehttps://github.com/jquast/blessed/compare/1.40...1.41\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e1.40: XTGETTCAP support\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ecurses-free jinxed 2.0 integration by \u003ca href=\"https://github.com/jquast\"\u003e\u003ccode\u003e@​jquast\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jquast/blessed/pull/374\"\u003ejquast/blessed#374\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eQuery XTGETTCAP on Terminal init by \u003ca href=\"https://github.com/jquast\"\u003e\u003ccode\u003e@​jquast\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jquast/blessed/pull/375\"\u003ejquast/blessed#375\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jquast/blessed/compare/1.39...1.40\"\u003ehttps://github.com/jquast/blessed/compare/1.39...1.40\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e1.17.9: Initial support for Python 3.10\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: Now imports on 3.10+\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.15.0: Disable various integration tests, support python 3.7\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003e1.14.0: bugfix term.wrap for text containing newlines\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: term.wrap misbehaved for text containing newlines, \u003ca href=\"https://redirect.github.com/jquast/blessed/issues/74\"\u003e#74\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.13.0: new Terminal.split_seqs() function, speed enhancement\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eenhancement: method \u003ccode\u003eTerminal.split_seqs\u003c/code\u003e introduced, and 4x cost reduction in related sequence-aware functions, \u003ca href=\"https://redirect.github.com/jquast/blessed/issues/29\"\u003e#29\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003edeprecated: function \u003ccode\u003eblessed.sequences.measure_length\u003c/code\u003e superseded by \u003ccode\u003eblessed.sequences.iter_parse\u003c/code\u003e if necessary.\u003c/li\u003e\n\u003cli\u003edeprecated: warnings about \u0026quot;binary-packed capabilities\u0026quot; are no longer emitted on strange terminal types, making best effort.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.12.0: add Terminal.get_location() method\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eenhancement: method Terminal.get_location\u003ccode\u003ereturns the\u003c/code\u003e(row, col)`` position of the cursor at the time of call for attached terminal.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jquast/blessed/blob/master/docs/history.rst\"\u003eblessed's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e.. py:currentmodule:: blessed.terminal\u003c/p\u003e\n\u003ch1\u003eVersion History\u003c/h1\u003e\n\u003cp\u003e1.47\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: :meth:\u003ccode\u003e~Terminal.does_sixel\u003c/code\u003e now returns \u003ccode\u003eTrue\u003c/code\u003e for SyncTERM using special-case\nmatching of its illegal DA1 response.\u003c/li\u003e\n\u003cli\u003ebugfix: legacy SGR mouse decoder reported no-button motion event (mode 1003) as \u003ccode\u003eLEFT_MOTION\u003c/code\u003e\ninstead of \u003ccode\u003eMOTION\u003c/code\u003e, :ghpull:\u003ccode\u003e398\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003ebugfix: match keyboard input \u003ccode\u003e\\x1b\\n\u003c/code\u003e as \u003ccode\u003eKEY_ALT_ENTER\u003c/code\u003e instead of \u003ccode\u003eKEY_CTRL_ALT_J\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e1.46\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: :meth:\u003ccode\u003e~Terminal.does_sixel\u003c/code\u003e failed to detect DA1 and caused the response to \u0026quot;leak\u0026quot; into\nnext call to :meth:\u003ccode\u003e~Terminal.inkey\u003c/code\u003e for some terminals of unmatched patterns (e.g., kitty).\u003c/li\u003e\n\u003cli\u003eimprove: add new sugar for extended cap-defined styles, like 'clear_scrollback' (common),\n'strikethrough', and 'overline' (not common).\u003c/li\u003e\n\u003cli\u003eimprove: Truecolor support by unique TERM, improves remote sessions like SSH that do not forward\n\u003ccode\u003eCOLORTERM\u003c/code\u003e, and, for the few terminals that do not respond to XTGETTCAP request for \u003ccode\u003eRGB\u003c/code\u003e:\n(kitty).\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e1.45\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: name consistency of kitty keyboard modifiers :ghpull:\u003ccode\u003e390\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e1.44\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eimprove: reduce errant XTGETTCAP output for Terminal.app and ConEmu.exe :ghpull:\u003ccode\u003e385\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e1.43\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: regression of XTGETTCAP responses leaking into first call for empty/non-response\nterminals (libvte/Gnome Terminal), in versions 1.40 to 1.42 :ghpull:\u003ccode\u003e383\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e1.42\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: regression in :meth:\u003ccode\u003e~.Terminal.cbreak\u003c/code\u003e and :meth:\u003ccode\u003e~.Terminal.raw\u003c/code\u003e were not thread-safe\nbroken in versions 1.40 and 1.41, remove signal ignore of SIGTTOU :ghissue:\u003ccode\u003e380\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e1.41\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: :meth:\u003ccode\u003e~.Terminal.get_location\u003c/code\u003e broken in 1.40, returned a generator instead of a tuple.\n:ghissue:\u003ccode\u003e378\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e1.40\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eimproved: jinxed_ is \u003cstrong\u003enow required on all platforms\u003c/strong\u003e, providing a curses-free and\n\u003ccode\u003esingleton-free \u0026lt;https://jinxed.readthedocs.io/en/stable/capabilities.html#singleton-free\u0026gt;\u003c/code\u003e_\nimplementation of the subset of curses_ used by blessed.  The jinxed_ 1.5.0 release provides a\nterminal \u003ccode\u003ecapability database \u0026lt;https://jinxed.readthedocs.io/en/stable/capabilities.html#database\u0026gt;\u003c/code\u003e of 45 terminals and their\ncommon aliases.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eimproved: Class initialization of :class:\u003ccode\u003e~.Terminal()\u003c/code\u003e now uses \u003ccode\u003eXTGETTCAP\u003c/code\u003e_ to determine\npreferred terminal name \u003ccode\u003eTN\u003c/code\u003e, 24-bit color support \u003ccode\u003eRGB\u003c/code\u003e, number of colors \u003ccode\u003eCo\u003c/code\u003e, \u003ccode\u003eitalic\u003c/code\u003e,\nand \u003ccode\u003eblink\u003c/code\u003e capabilities.\u003c/p\u003e\n\u003cp\u003eThis improves detection of Terminal \u003ccode\u003ekind\u003c/code\u003e and \u003ccode\u003enumber_of_colors\u003c/code\u003e over protocols like serial\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/jquast/blessed/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `boto3` from 1.43.8 to 1.43.50\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/a8ae7f0619b16600dfb006b07c55c3e276cbf21a\"\u003e\u003ccode\u003ea8ae7f0\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.50'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/b8c36a990c84df2cdec68b0af03194c619e3e8f1\"\u003e\u003ccode\u003eb8c36a9\u003c/code\u003e\u003c/a\u003e Bumping version to 1.43.50\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/fa19980a5c4eee55479fb56b444dc785a6e6b988\"\u003e\u003ccode\u003efa19980\u003c/code\u003e\u003c/a\u003e Add changelog entries from botocore\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/2ce2fd5ac8a6e5069465b4eface2938a940bc8b2\"\u003e\u003ccode\u003e2ce2fd5\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.49'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/d2937da5351e7da82f983c2c572ba35615746b62\"\u003e\u003ccode\u003ed2937da\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.49' into develop\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/159cb6abdba69c6a433ad2b83920e850643a85cc\"\u003e\u003ccode\u003e159cb6a\u003c/code\u003e\u003c/a\u003e Bumping version to 1.43.49\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/2b8f4d84ae0fb264813e0997f3e510d517b4a1ab\"\u003e\u003ccode\u003e2b8f4d8\u003c/code\u003e\u003c/a\u003e Add changelog entries from botocore\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/aa40f37ebe773ef7e8aadbeffee37aeaec8a29c2\"\u003e\u003ccode\u003eaa40f37\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.48'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/652b573c3d4853497e60f983ff2938d2c4efbb4e\"\u003e\u003ccode\u003e652b573\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.48' into develop\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/13cce5d163edd8e436f51d61c9fde9619c48993b\"\u003e\u003ccode\u003e13cce5d\u003c/code\u003e\u003c/a\u003e Bumping version to 1.43.48\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/boto/boto3/compare/1.43.8...1.43.50\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `botocore` from 1.43.8 to 1.43.50\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/42b0340e335b1f633be78fa7e59832bb37951a68\"\u003e\u003ccode\u003e42b0340\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.50'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/febd30f4a24b77afe9ef211aad0675453d621618\"\u003e\u003ccode\u003efebd30f\u003c/code\u003e\u003c/a\u003e Bumping version to 1.43.50\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/31af253ee49bea34214380b92e7d0152d5f69fa4\"\u003e\u003ccode\u003e31af253\u003c/code\u003e\u003c/a\u003e Update endpoints model\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/e179889d6e2bc604b77b9785735d336612e7108a\"\u003e\u003ccode\u003ee179889\u003c/code\u003e\u003c/a\u003e Update to latest models\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/eceb63d43b437b7e5cc67251c07bdb583ee845bd\"\u003e\u003ccode\u003eeceb63d\u003c/code\u003e\u003c/a\u003e Bump the github-actions group with 3 updates (\u003ca href=\"https://redirect.github.com/boto/botocore/issues/3749\"\u003e#3749\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/eecee80c7891c35f2f60ec00d7c4fa81b5fce388\"\u003e\u003ccode\u003eeecee80\u003c/code\u003e\u003c/a\u003e Bump \u003ca href=\"https://github.com/astral-sh/ruff-pre-commit\"\u003ehttps://github.com/astral-sh/ruff-pre-commit\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/boto/botocore/issues/3745\"\u003e#3745\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/7d6402f9d49dfa0a873f07b57b888b8d5158738c\"\u003e\u003ccode\u003e7d6402f\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.49'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/10f305e588ce4ebe24dd0c8d8ff0e825782bbd85\"\u003e\u003ccode\u003e10f305e\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.49' into develop\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/2b632ee6822a4f254a02aae6e37b479ae77b688f\"\u003e\u003ccode\u003e2b632ee\u003c/code\u003e\u003c/a\u003e Bumping version to 1.43.49\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/7ef2356e4892dfb360bddfb0fba8632ac8a59797\"\u003e\u003ccode\u003e7ef2356\u003c/code\u003e\u003c/a\u003e Update to latest models\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/boto/botocore/compare/1.43.8...1.43.50\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `certifi` from 2026.4.22 to 2026.6.17\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/d0ac52f3d93a514224197c7efb66c41b1beae5d1\"\u003e\u003ccode\u003ed0ac52f\u003c/code\u003e\u003c/a\u003e 2026.06.17 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/418\"\u003e#418\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/d46de621787c609158579929f44b91ce731d01b8\"\u003e\u003ccode\u003ed46de62\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6.0.2 to 6.0.3 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/417\"\u003e#417\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/6c183ec39d81135350dd44abd0e5daefc8e35b9d\"\u003e\u003ccode\u003e6c183ec\u003c/code\u003e\u003c/a\u003e fix: update Requests docs link to canonical URL (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/415\"\u003e#415\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/36e35680e0dc42c70cd60bfe440e92e7137f5a1c\"\u003e\u003ccode\u003e36e3568\u003c/code\u003e\u003c/a\u003e Bump dessant/lock-threads from 6.0.0 to 6.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/d7ea151afc2ce6bef0555b9349902bd867e928dd\"\u003e\u003ccode\u003ed7ea151\u003c/code\u003e\u003c/a\u003e 2026.05.20 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/413\"\u003e#413\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/certifi/python-certifi/compare/2026.04.22...2026.06.17\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `cffi` from 2.0.0 to 2.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/python-cffi/cffi/releases\"\u003ecffi's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.1.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.15 and support for C extensions generated by CFFI\nto target the new \u003ccode\u003eabi3t\u003c/code\u003e free-threaded ABI.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.9.\u003c/li\u003e\n\u003cli\u003eAdded \u003ccode\u003ecffi-gen-src\u003c/code\u003e CLI to generate CFFI C extension source for alternate build backend support.\u003c/li\u003e\n\u003cli\u003eFixed crashes inside \u003ccode\u003e__delitem__\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eFixed \u0026quot;string too big\u0026quot; error under MSVC.\u003c/li\u003e\n\u003cli\u003eFixed mingw builds.\u003c/li\u003e\n\u003cli\u003eAdded support for arm64 iOS wheels.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/d9f6f70adac5ca9f260abf5405cf4d0373767b65\"\u003e\u003ccode\u003ed9f6f70\u003c/code\u003e\u003c/a\u003e New release 2.1.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/02a7b0e32db93964b9756537110119d74aa23425\"\u003e\u003ccode\u003e02a7b0e\u003c/code\u003e\u003c/a\u003e Misc pre-2.1 release/packaging cleanup (\u003ca href=\"https://redirect.github.com/python-cffi/cffi/issues/253\"\u003e#253\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/1362e5ddc5417f1350200d4d6183c3eb3da9cc8d\"\u003e\u003ccode\u003e1362e5d\u003c/code\u003e\u003c/a\u003e Move cffi-gen-src release note to 2.1.0 notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/a797055125e049fd79483d0dcdf8cff59c64c6e4\"\u003e\u003ccode\u003ea797055\u003c/code\u003e\u003c/a\u003e Make error message when embedding version test fails more friendly\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/f1f40a8e1667b9ef6cf8fe3c451829408feab018\"\u003e\u003ccode\u003ef1f40a8\u003c/code\u003e\u003c/a\u003e Update changelog\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/dc62c93af7be7c535dc17f621de2bfc99490d3bd\"\u003e\u003ccode\u003edc62c93\u003c/code\u003e\u003c/a\u003e Delete missed cp39 Windows builds\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/a34118009e64a7fed8ea49bdbad4d6a07494bb4f\"\u003e\u003ccode\u003ea341180\u003c/code\u003e\u003c/a\u003e Update version numbers to prepare for v2.1 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/9f04d8506a6c7186dc3be7316f21aab042e075cb\"\u003e\u003ccode\u003e9f04d85\u003c/code\u003e\u003c/a\u003e Mark test using inet_ntoa as thread-unsafe\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/5f127028caeb7750c4763f7381dd1b12c4747d95\"\u003e\u003ccode\u003e5f12702\u003c/code\u003e\u003c/a\u003e Fix flaky pytest-run-parallel CI crash\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/26b3d3ae756138d4f9e8f42f063f73c26aa40c24\"\u003e\u003ccode\u003e26b3d3a\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into integrate-buildtool\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/python-cffi/cffi/compare/v2.0.0...v2.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `charset-normalizer` from 3.4.7 to 3.4.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jawah/charset_normalizer/releases\"\u003echarset-normalizer's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 3.4.9\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.8...3.4.9\"\u003e3.4.9\u003c/a\u003e (2026-07-07)\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRegression in our fallback path leading to a decode error. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/771\"\u003e#771\u003c/a\u003e)\nWe've yanked 3.4.8 as a result of that bug.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 3.4.8\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.7...3.4.8\"\u003e3.4.8\u003c/a\u003e (2026-07-06)\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/742\"\u003e#742\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUnnecessary json import at runtime (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/753\"\u003e#753\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eInverse capitalization not seen by noise detector (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/731\"\u003e#731\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eNo longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.\u003c/li\u003e\n\u003cli\u003eMicro-optimizations in our noise / coherence measurements.\u003c/li\u003e\n\u003cli\u003eNo longer using regex search by default for our preemptive charset mark algorithm.\u003c/li\u003e\n\u003cli\u003eRaised upperbound of setuptools to v83.\u003c/li\u003e\n\u003cli\u003eRaised upperbound of mypy(c) to v2.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRemoved\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRedundant UTF7 BOM marker (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/730\"\u003e#730\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md\"\u003echarset-normalizer's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.8...3.4.9\"\u003e3.4.9\u003c/a\u003e (2026-07-07)\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRegression in our fallback path leading to a decode error. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/771\"\u003e#771\u003c/a\u003e)\nWe've yanked 3.4.8 as a result of that bug.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.7...3.4.8\"\u003e3.4.8\u003c/a\u003e (2026-07-06)\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/742\"\u003e#742\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUnnecessary json import at runtime (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/753\"\u003e#753\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eInverse capitalization not seen by noise detector (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/731\"\u003e#731\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eNo longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.\u003c/li\u003e\n\u003cli\u003eMicro-optimizations in our noise / coherence measurements.\u003c/li\u003e\n\u003cli\u003eNo longer using regex search by default for our preemptive charset mark algorithm.\u003c/li\u003e\n\u003cli\u003eRaised upperbound of setuptools to v83.\u003c/li\u003e\n\u003cli\u003eRaised upperbound of mypy(c) to v2.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRemoved\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRedundant UTF7 BOM marker (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/730\"\u003e#730\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/cc6840753f17f00dea4e339ce37507747217e916\"\u003e\u003ccode\u003ecc68407\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/772\"\u003e#772\u003c/a\u003e from jawah/fix-regression-fallback-path\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/152b923c87e212e11c9591ff0a29ff35df719c91\"\u003e\u003ccode\u003e152b923\u003c/code\u003e\u003c/a\u003e chore: release 3.4.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/2bc26076a86704fc19bc2ae811615b169373dea6\"\u003e\u003ccode\u003e2bc2607\u003c/code\u003e\u003c/a\u003e fix: unicodedecodeerror in fallback path\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/be252d70c9f45846f0e851cc4d1829328540c825\"\u003e\u003ccode\u003ebe252d7\u003c/code\u003e\u003c/a\u003e chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/767\"\u003e#767\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/71c7bdd25514e5631c17be397abb6a2974b26e5b\"\u003e\u003ccode\u003e71c7bdd\u003c/code\u003e\u003c/a\u003e chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/768\"\u003e#768\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/aeea391cc95761f1353b3914afcdee7a6e7589da\"\u003e\u003ccode\u003eaeea391\u003c/code\u003e\u003c/a\u003e chore(deps): bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/758\"\u003e#758\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/a6f8febd210c129ea741e6562fc06ee1ac437487\"\u003e\u003ccode\u003ea6f8feb\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/770\"\u003e#770\u003c/a\u003e from jawah/unblock-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/528e16ce9105d10ea6cc66d41f237ba3c64c4392\"\u003e\u003ccode\u003e528e16c\u003c/code\u003e\u003c/a\u003e chore: add osv-scanner.toml\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/5993498b06d0bcb0cc1aaab1255742fef39a5aca\"\u003e\u003ccode\u003e5993498\u003c/code\u003e\u003c/a\u003e chore: ast_serialize musl missing prebuilt riscv,s390x,ppc64le\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/aa2ddd8fb788b98a815f25c37609e919105d1dbb\"\u003e\u003ccode\u003eaa2ddd8\u003c/code\u003e\u003c/a\u003e Release 3.4.8 (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/766\"\u003e#766\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jawah/charset_normalizer/compare/3.4.7...3.4.9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `django` from 5.2.14 to 6.0.7\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/e2a424605ac2e7e6e799496542fb2997207e2f23\"\u003e\u003ccode\u003ee2a4246\u003c/code\u003e\u003c/a\u003e [6.0.x] Bumped version for 6.0.7 release.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/a5de13f1491f1dbf2bb0ad9b91570524ebbc8acd\"\u003e\u003ccode\u003ea5de13f\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed CVE-2026-53878 -- Prevented newlines from being accepted in Dom...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/38dfbd27d7d4f4e6eaa087d7a90f2613fbf55b3a\"\u003e\u003ccode\u003e38dfbd2\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed CVE-2026-53877 -- Prevented heap buffer over-read when creating...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/64f9a2b2283fde3ec69fb0dfe441cf0f6f411ba3\"\u003e\u003ccode\u003e64f9a2b\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed CVE-2026-48588 -- Prevented caching of responses that set cooki...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/c26957a58241037f5849171f35177b95c7ec6660\"\u003e\u003ccode\u003ec26957a\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed flatpages synopsis in docs.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/0b60f44b77510c00ca79403560987cfbaf5a0037\"\u003e\u003ccode\u003e0b60f44\u003c/code\u003e\u003c/a\u003e [6.0.x] Added FILE_UPLOAD_DIRECTORY_PERMISSIONS to docs settings index.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/d928e3060b258fcd002c80d80bb40390efc988db\"\u003e\u003ccode\u003ed928e30\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed \u003ca href=\"https://redirect.github.com/django/django/issues/37172\"\u003e#37172\u003c/a\u003e -- Linked to upload handlers section in FILE_UPLOAD_* se...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/e18935cc265aa30079b9c2d280e53cfb91679bba\"\u003e\u003ccode\u003ee18935c\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed \u003ca href=\"https://redirect.github.com/django/django/issues/37158\"\u003e#37158\u003c/a\u003e -- Reordered the contribution checklist sections.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/490eb9cfb68848b88c91f2b6c75d57e2620c7304\"\u003e\u003ccode\u003e490eb9c\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed document referenced in multiple toctrees warning in docs/intern...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/748a9b53c5864f87f4501378d2748199ff0063bb\"\u003e\u003ccode\u003e748a9b5\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed duplicate target name in docs/internals/howto-release-django.txt.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/django/django/compare/5.2.14...6.0.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `django-allauth` from 65.14.3 to 65.18.0\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/sponsors/pennersr/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `django-filter` from 25.2 to 26.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/carltongibson/django-filter/blob/main/CHANGES.rst\"\u003edjango-filter's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 26.1 (2026-07-11)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eAdded testing for Django 6.1.\u003c/p\u003e\n\u003cp\u003eDRF integration will require the upcoming DRF v3.18.\nSee \u003ca href=\"https://redirect.github.com/encode/django-rest-framework/pull/9978\"\u003eencode/django-rest-framework#9978\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded testing against Python 3.14.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/carltongibson/django-filter/commit/52c3c0f21ef8fe281982ec0e95a3675cd8402214\"\u003e\u003ccode\u003e52c3c0f\u003c/code\u003e\u003c/a\u003e Set date and bump version for 26.1 release.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/carltongibson/django-filter/commit/6a3222aaf83170df0f967423444d5312b99a3d69\"\u003e\u003ccode\u003e6a3222a\u003c/code\u003e\u003c/a\u003e Add testing for Python 3.14.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/carltongibson/django-filter/commit/aa3bd8e87136d4730f4eb44b3386e52c218bcf66\"\u003e\u003ccode\u003eaa3bd8e\u003c/code\u003e\u003c/a\u003e Added testing against Django 6.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/carltongibson/django-filter/commit/ec717ea11378a4dc003cbe2f77b5211d8815a0b6\"\u003e\u003ccode\u003eec717ea\u003c/code\u003e\u003c/a\u003e Correct Language header in Greek locale file (el) (\u003ca href=\"https://redirect.github.com/carltongibson/django-filter/issues/1751\"\u003e#1751\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/carltongibson/django-filter/commit/31b297ca2414218052476ba458c4d1eedc0a0f99\"\u003e\u003ccode\u003e31b297c\u003c/code\u003e\u003c/a\u003e Bump the github-actions group with 2 updates (\u003ca href=\"https://redirect.github.com/carltongibson/django-filter/issues/1733\"\u003e#1733\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/carltongibson/django-filter/commit/590c0a3e7d73fafa4fb25df45b53fcc79258d09f\"\u003e\u003ccode\u003e590c0a3\u003c/code\u003e\u003c/a\u003e Fix version range for Django 6.0 (\u003ca href=\"https://redirect.github.com/carltongibson/django-filter/issues/1731\"\u003e#1731\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/carltongibson/django-filter/commit/6204bc4eb75edf7ba766fc256d72a68fa80c3029\"\u003e\u003ccode\u003e6204bc4\u003c/code\u003e\u003c/a\u003e Added release date for v25.2.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/carltongibson/django-filter/compare/25.2...26.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `django-js-asset` from 3.1.2 to 4.0.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/feincms/django-js-asset/blob/main/CHANGELOG.rst\"\u003edjango-js-asset's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e.. _changelog:\u003c/p\u003e\n\u003ch1\u003eChange log\u003c/h1\u003e\n\u003cp\u003eNext version\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Fixed ``js_asset.Media`` crashing with an ``AttributeError`` when rendering an\n  asset that only implements Django's plain ``__html__`` contract (neither a\n  ``MediaAsset`` nor one of our ``ImportMap``/``JSON`` types). Such assets now\n  fall back to ``__html__()`` exactly like ``django.forms.Media`` does; the\n  nonce cannot be threaded into an opaque ``__html__`` asset, same as with stock\n  Django.\n- Corrected the docs around Django 6.1 support. Thanks James Bligh!\n- Finally set up a documentation site at Read the Docs for django-js-asset.\n\u003cp\u003e4.0 (2026-06-11)\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cp\u003eThis is a major release. Most code keeps working unchanged and the rendered\nHTML is the same, but \u003cstrong\u003eif you use import maps the upgrade is not automatic\u003c/strong\u003e --\nsee the import-map note at the end.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003ejs_asset.Media\u003c/code\u003e, a \u003ccode\u003edjango.forms.Media\u003c/code\u003e subclass with two extra\nabilities. First, it merges every embedded \u003ccode\u003eImportMap\u003c/code\u003e into a single\n\u003ccode\u003e\u0026lt;script type=\u0026quot;importmap\u0026quot;\u0026gt;\u003c/code\u003e rendered before any other script -- this\nreplaces the old global \u003ccode\u003eimportmap\u003c/code\u003e object and works no matter how many\nmedia objects Django combines. Second, it applies a request-scoped CSP nonce\nto the tags it renders. It implements \u003ccode\u003e__add__\u003c/code\u003e \u003cstrong\u003eand\u003c/strong\u003e \u003ccode\u003e__radd__\u003c/code\u003e, so it\nkeeps its type -- and its nonce -- when combined with a plain \u003ccode\u003eforms.Media\u003c/code\u003e\nfrom either side (e.g. while Django collects form and widget media). The nonce\ncan be passed to the constructor (\u003ccode\u003enonce=\u003c/code\u003e), copied onto a clone with\n\u003ccode\u003ewith_nonce()\u003c/code\u003e, or passed to \u003ccode\u003erender(nonce=...)\u003c/code\u003e; \u003ccode\u003erender()\u003c/code\u003e also accepts\n\u003ccode\u003eattrs={\u0026quot;nonce\u0026quot;: ...}\u003c/code\u003e so it plugs straight into Django 6.2's\n\u003ccode\u003e{% csp_nonce_attr %}\u003c/code\u003e tag. \u003ccode\u003eMedia.from_media()\u003c/code\u003e wraps an existing\n\u003ccode\u003eforms.Media\u003c/code\u003e instance (e.g. \u003ccode\u003eform.media\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eJS\u003c/code\u003e and \u003ccode\u003eCSS\u003c/code\u003e now \u003cem\u003eproduce\u003c/em\u003e Django's own \u003ccode\u003eScript\u003c/code\u003e and \u003ccode\u003eStylesheet\u003c/code\u003e\nobjects (backported via \u003ccode\u003ejs_asset._compat\u003c/code\u003e on Django versions that lack\nthem) instead of being standalone dataclasses. They therefore share merge\nbuckets with native Django assets and with bare path strings, so the same\nfile is no longer rendered more than once when \u003ccode\u003ejs_asset\u003c/code\u003e assets, plain\nstrings and Django's auto-wrapped assets meet in \u003ccode\u003eforms.Media.merge()\u003c/code\u003e.\n\u003ccode\u003eisinstance(x, JS)\u003c/code\u003e / \u003ccode\u003eisinstance(x, CSS)\u003c/code\u003e keep working (via a metaclass).\nInline CSS (\u003ccode\u003eCSS(src, inline=True)\u003c/code\u003e) is rendered by a small dedicated\n\u003ccode\u003eInlineStyle\u003c/code\u003e asset. Rendered output is unchanged.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eScript\u003c/code\u003e, \u003ccode\u003eStylesheet\u003c/code\u003e, \u003ccode\u003eMediaAsset\u003c/code\u003e and \u003ccode\u003eInlineStyle\u003c/code\u003e can now be\nimported from \u003ccode\u003ejs_asset\u003c/code\u003e -- prefer these in \u003ccode\u003eisinstance\u003c/code\u003e checks over\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/7c024a3ef83a1c2951f2ab3925e85b81ebbc8bc0\"\u003e\u003ccode\u003e7c024a3\u003c/code\u003e\u003c/a\u003e django-js-asset 4.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/59aa7e529ef7052c3c1710e8a673c14c852334f6\"\u003e\u003ccode\u003e59aa7e5\u003c/code\u003e\u003c/a\u003e Fix \u003cstrong\u003ehtml\u003c/strong\u003e objects in Media\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/b3c515c793185d96d43124a8239267a535bdd18f\"\u003e\u003ccode\u003eb3c515c\u003c/code\u003e\u003c/a\u003e django-js-asset 4.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/8a343389d9500999bd3397a1d1c44cb5ee709a00\"\u003e\u003ccode\u003e8a34338\u003c/code\u003e\u003c/a\u003e Address review comments\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/b7d05eb0f4d7548219b06eb4057fe908c2e85a23\"\u003e\u003ccode\u003eb7d05eb\u003c/code\u003e\u003c/a\u003e Remove the global importmap and update the guidance accordingly\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/3213b9bd209527e989c0fb8f552e7941407460cc\"\u003e\u003ccode\u003e3213b9b\u003c/code\u003e\u003c/a\u003e Increase interoperability with Django's own object-based media assets\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/cfe3b529f22bd8dcd1abf193aa4af0f1e96681be\"\u003e\u003ccode\u003ecfe3b52\u003c/code\u003e\u003c/a\u003e Add a Media subclass with import-map merging and CSP nonce support\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/6708307bd5e1d5cc18cb58da63e2c6ace07e653c\"\u003e\u003ccode\u003e6708307\u003c/code\u003e\u003c/a\u003e dj62 does not exist yet as a release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/9961d4871605432a9923d2a844d51d9efca47c73\"\u003e\u003ccode\u003e9961d48\u003c/code\u003e\u003c/a\u003e Run tests with newer Django and Python versions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/f77abf57e6754612793c9976305f704f61dfceff\"\u003e\u003ccode\u003ef77abf5\u003c/code\u003e\u003c/a\u003e Bump the github-actions group with 2 updates (\u003ca href=\"https://redirect.github.com/feincms/django-js-asset/issues/20\"\u003e#20\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/feincms/django-js-asset/compare/3.1.2...4.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `django-maintenance-mode` from 0.22.0 to 0.23.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/fabiocaccamo/django-maintenance-mode/releases\"\u003edjango-maintenance-mode's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.23.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003ePython 3.14\u003c/code\u003e and \u003ccode\u003eDjango 6.0\u003c/code\u003e support.\u003c/li\u003e\n\u003cli\u003eAdd scheduled maintenance mode support: \u003ccode\u003eset_maintenance_mode(True, start=..., end=...)\u003c/code\u003e and \u003ccode\u003emanage.py maintenance_mode on --start ... --end ...\u003c/code\u003e (maintenance mode automatically activates/deactivates itself based on the scheduled datetimes). \u003ca href=\"https://redirect.github.com/fabiocaccamo/django-maintenance-mode/issues/64\"\u003e#64\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003eNote for custom state backends consumers: \u003ccode\u003eget_value()\u003c/code\u003e now returns \u003ccode\u003ebool\u003c/code\u003e or \u003ccode\u003edict\u003c/code\u003e (scheduled state), and the state file format is extended accordingly (running \u003ccode\u003emaintenance_mode off\u003c/code\u003e restores the plain bool format).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eMAINTENANCE_MODE_LOGOUT_STAFF_USER\u003c/code\u003e and \u003ccode\u003eMAINTENANCE_MODE_LOGOUT_SUPERUSER\u003c/code\u003e settings to override the \u003ccode\u003eMAINTENANCE_MODE_LOGOUT_AUTHENTICATED_USER\u003c/code\u003e behavior for staff users and superusers (if \u003ccode\u003eNone\u003c/code\u003e, default, they inherit the \u003ccode\u003eMAINTENANCE_MODE_LOGOUT_AUTHENTICATED_USER\u003c/code\u003e behavior). \u003ca href=\"https://redirect.github.com/fabiocaccamo/django-maintenance-mode/issues/191\"\u003e#191\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eMAINTENANCE_MODE_RESPONSE_TYPE\u003c/code\u003e to be the path of a function that receives the request and returns the response type (\u003ccode\u003e\u0026quot;html\u0026quot;\u003c/code\u003e or \u003ccode\u003e\u0026quot;json\u0026quot;\u003c/code\u003e). \u003ca href=\"https://redirect.github.com/fabiocaccamo/django-maintenance-mode/issues/204\"\u003e#204\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eMAINTENANCE_MODE_GET_AUTHENTICATED_USER\u003c/code\u003e setting to support non-session authentication (eg. \u003ccode\u003eJWT\u003c/code\u003e / token authentication with \u003ccode\u003edjango-rest-framework\u003c/code\u003e). \u003ca href=\"https://redirect.github.com/fabiocaccamo/django-maintenance-mode/issues/233\"\u003e#233\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove middleware position docs. \u003ca href=\"https://redirect.github.com/fabiocaccamo/django-maintenance-mode/issues/251\"\u003e#251\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/fabiocaccamo/django-maintenance-mode/blob/main/CHANGELOG.md\"\u003edjango-maintenance-mode's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/fabiocaccamo/django-maintenance-mode/releases/tag/0.23.0\"\u003e0.23.0\u003c/a\u003e - 2026-07-13\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003ePython 3.14\u003c/code\u003e and \u003ccode\u003eDjango 6.0\u003c/code\u003e support.\u003c/li\u003e\n\u003cli\u003eAdd scheduled maintenance mode support: \u003ccode\u003eset_maintenance_mode(True, start=..., end=...)\u003c/code\u003e and \u003ccode\u003emanage.py maintenance_mode on --start ... --end ...\u003c/code\u003e (maintenance mode automatically activates/deactivates itself based on the scheduled datetimes). \u003ca href=\"https://redirect.github.com/fabiocaccamo/django-maintenance-mode/issues/64\"\u003e#64\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003eNote for custom state backends consumers: \u003ccode\u003eget_value()\u003c/code\u003e now returns \u003ccode\u003ebool\u003c/code\u003e or \u003ccode\u003edict\u003c/code\u003e (scheduled state), and the state file format is extended accordingly (running \u003ccode\u003emaintenance_mode off\u003c/code\u003e restores the plain bool format).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eMAINTE...\n\n_Description has been truncated_","html_url":"https://github.com/artursampaio-gc/goproduct/pull/26","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/artursampaio-gc%2Fgoproduct/issues/26","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/26/packages"},{"uuid":"4788376467","node_id":"PR_kwDOPJsOlc7s0ZDN","number":3,"state":"open","title":"chore(deps): bump the uv group across 2 directories with 20 updates","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-07-01T18:51:27.000Z","updated_at":"2026-07-01T18:55:01.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"uv","update_count":20,"packages":[{"name":"nltk","old_version":"3.9.1","new_version":"3.9.4","repository_url":"https://github.com/nltk/nltk"},{"name":"authlib","old_version":"1.6.0","new_version":"1.6.12","repository_url":"https://github.com/authlib/authlib"},{"name":"cryptography","old_version":"45.0.5","new_version":"48.0.1","repository_url":"https://github.com/pyca/cryptography"},{"name":"fastmcp","old_version":"2.10.5","new_version":"3.2.0","repository_url":"https://github.com/PrefectHQ/fastmcp"},{"name":"idna","old_version":"3.10","new_version":"3.15","repository_url":"https://github.com/kjd/idna"},{"name":"joserfc","old_version":"1.6.4","new_version":"1.6.7","repository_url":"https://github.com/authlib/joserfc"},{"name":"langchain-core","old_version":"1.1.0","new_version":"1.3.3","repository_url":"https://github.com/langchain-ai/langchain"},{"name":"langchain-text-splitters","old_version":"1.0.0","new_version":"1.1.2","repository_url":"https://github.com/langchain-ai/langchain"},{"name":"langsmith","old_version":"0.4.7","new_version":"0.8.18","repository_url":"https://github.com/langchain-ai/langsmith-sdk"},{"name":"lxml","old_version":"6.0.0","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"},{"name":"pillow","old_version":"11.3.0","new_version":"12.2.0","repository_url":"https://github.com/python-pillow/Pillow"},{"name":"pyjwt","old_version":"2.10.1","new_version":"2.13.0","repository_url":"https://github.com/jpadilla/pyjwt"},{"name":"python-multipart","old_version":"0.0.20","new_version":"0.0.31","repository_url":"https://github.com/Kludex/python-multipart"},{"name":"requests","old_version":"2.32.4","new_version":"2.33.0","repository_url":"https://github.com/psf/requests"},{"name":"starlette","old_version":"0.46.2","new_version":"1.3.1","repository_url":"https://github.com/Kludex/starlette"},{"name":"transformers","old_version":"4.53.2","new_version":"5.3.0","repository_url":"https://github.com/huggingface/transformers"},{"name":"ujson","old_version":"5.10.0","new_version":"5.13.0","repository_url":"https://github.com/ultrajson/ultrajson"},{"name":"urllib3","old_version":"2.5.0","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"}],"path":null,"ecosystem":"pip"},"body":"Bumps the uv group with 18 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [nltk](https://github.com/nltk/nltk) | `3.9.1` | `3.9.4` |\n| [authlib](https://github.com/authlib/authlib) | `1.6.0` | `1.6.12` |\n| [cryptography](https://github.com/pyca/cryptography) | `45.0.5` | `48.0.1` |\n| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `2.10.5` | `3.2.0` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [joserfc](https://github.com/authlib/joserfc) | `1.6.4` | `1.6.7` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `1.1.0` | `1.3.3` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `1.0.0` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.4.7` | `0.8.18` |\n| [lxml](https://github.com/lxml/lxml) | `6.0.0` | `6.1.0` |\n| [pillow](https://github.com/python-pillow/Pillow) | `11.3.0` | `12.2.0` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.31` |\n| [requests](https://github.com/psf/requests) | `2.32.4` | `2.33.0` |\n| [starlette](https://github.com/Kludex/starlette) | `0.46.2` | `1.3.1` |\n| [transformers](https://github.com/huggingface/transformers) | `4.53.2` | `5.3.0` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.13.0` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.5.0` | `2.7.0` |\n\nBumps the uv group with 19 updates in the /docker directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pytest](https://github.com/pytest-dev/pytest) | `9.0.2` | `9.0.3` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.1` | `3.9.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [authlib](https://github.com/authlib/authlib) | `1.6.0` | `1.6.12` |\n| [cryptography](https://github.com/pyca/cryptography) | `45.0.5` | `48.0.1` |\n| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `2.10.5` | `3.2.0` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `1.1.0` | `1.3.3` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `1.0.0` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.4.7` | `0.8.18` |\n| [lxml](https://github.com/lxml/lxml) | `6.0.0` | `6.1.0` |\n| [pillow](https://github.com/python-pillow/Pillow) | `11.3.0` | `12.2.0` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.31` |\n| [requests](https://github.com/psf/requests) | `2.32.4` | `2.33.0` |\n| [starlette](https://github.com/Kludex/starlette) | `0.46.2` | `1.3.1` |\n| [transformers](https://github.com/huggingface/transformers) | `4.53.2` | `5.3.0` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.13.0` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.5.0` | `2.7.0` |\n\n\nUpdates `nltk` from 3.9.1 to 3.9.4\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/nltk/nltk/blob/develop/ChangeLog\"\u003enltk's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eVersion 3.10.0 2026-06-11\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce the stricter \u003ccode\u003enltk.pathsec\u003c/code\u003e security policy by default\u003c/li\u003e\n\u003cli\u003eDocument the new security model and migration guidance\u003c/li\u003e\n\u003cli\u003eHarden resource loading against path traversal and SSRF/DNS-rebinding\u003c/li\u003e\n\u003cli\u003eHarden downloader path handling and block XML entity expansion\u003c/li\u003e\n\u003cli\u003eClose remaining corpus-reader security edge cases\u003c/li\u003e\n\u003cli\u003eReplace unsafe \u003ccode\u003eexec()\u003c/code\u003e usage in the utility CLI\u003c/li\u003e\n\u003cli\u003eWarn on unpickling user-provided pickles\u003c/li\u003e\n\u003cli\u003eAdd HuggingFace datasets integration (\u003ccode\u003enltk.huggingface\u003c/code\u003e)\u003c/li\u003e\n\u003cli\u003eAlign TnT with Brants (2000) specifications\u003c/li\u003e\n\u003cli\u003eFix PorterStemmer irregular-form lowercasing in NLTK mode\u003c/li\u003e\n\u003cli\u003eFix TransitionParser sparse index dtype for scikit-learn 1.9\u003c/li\u003e\n\u003cli\u003eFix TextCat tie handling\u003c/li\u003e\n\u003cli\u003eFix WordNet object comparisons for incompatible types\u003c/li\u003e\n\u003cli\u003eCache WordNet max depth lazily for \u003ccode\u003elch_similarity()\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFix CCG variable direction, substitution, and type-raising bugs\u003c/li\u003e\n\u003cli\u003eFix Jaro similarity for single-character and empty-string cases\u003c/li\u003e\n\u003cli\u003eImprove CI and release-maintenance workflows\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to the following contributors to 3.10.0:\n13rac1, alvations, bowiechen, devesh-2002, ekaf, elias-ba,\nhaosenwang1018, HyperPS, ihitamandal, jancallewaert, jhnwnstd,\nJuanIMartinezB, Lemm1, LinZiyuu, Mr-Neutr0n, PastelStorm,\nscruge1, Syzygy2048, ylwango613, yzhaoinuw\u003c/p\u003e\n\u003cp\u003eVersion 3.9.4 2026-03-24\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eSupport Python 3.14\u003c/li\u003e\n\u003cli\u003eFix bug in Levenshtein distance when substitution_cost \u0026gt; 2\u003c/li\u003e\n\u003cli\u003eFix bug in Treebank detokeniser re quote ordering\u003c/li\u003e\n\u003cli\u003eFix bug in Jaro similarity for empty strings\u003c/li\u003e\n\u003cli\u003eSeveral security enhancements\u003c/li\u003e\n\u003cli\u003eFix GHSA-rf74-v2fm-23pw: unbounded recursion in JSONTaggedDecoder\u003c/li\u003e\n\u003cli\u003eImplement TextTiling vocabulary introduction method (Hearst 1997)\u003c/li\u003e\n\u003cli\u003eFix ALINE feature matrix errors and add comprehensive tests\u003c/li\u003e\n\u003cli\u003eSupport multiple VerbNet versions, fix longid/shortid regex for VerbNet ids\u003c/li\u003e\n\u003cli\u003eLet downloader fallback to md5 when sha256 is unavailable\u003c/li\u003e\n\u003cli\u003eSeveral other minor bugfixes and code cleanups\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to the following contributors to 3.9.4:\nMin-Yen Kan, Eric Kafe, Emily Voss, bowiechen, Hrudhai01,\njancallewaert, Mr-Neutr0n, pollak.peter89, ylwango613,\u003c/p\u003e\n\u003cp\u003eVersion 3.9.3 2026-02-21\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix CVE-2025-14009: secure ZIP extraction in nltk.downloader (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3468\"\u003e#3468\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBlock path traversal/arbitrary reads in nltk.data for protocol-less refs (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3467\"\u003e#3467\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBlock path traversal/abs paths in corpus readers and FS pointers (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3479\"\u003e#3479\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3480\"\u003e#3480\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eValidate external StanfordSegmenter JARs using SHA256 (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3477\"\u003e#3477\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/ad9c96ba00a16923ffe917eacf63f1707bfa2d08\"\u003e\u003ccode\u003ead9c96b\u003c/code\u003e\u003c/a\u003e Update copyright year\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/7edcddfda566627b897397397cc4d10ae91cb86d\"\u003e\u003ccode\u003e7edcddf\u003c/code\u003e\u003c/a\u003e Updates for 3.9.4 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/67a2736f89b286b028db08bd247134f17a11fc6b\"\u003e\u003ccode\u003e67a2736\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3180\"\u003e#3180\u003c/a\u003e from yzhaoinuw/bug-on-edit_distance_align\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/2b17ac5358a1c8d4b97455766efde0b786e6cdb2\"\u003e\u003ccode\u003e2b17ac5\u003c/code\u003e\u003c/a\u003e Fix edit_distance_align backtrace for high substitution costs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/4b72976a6ff3d180ed4012f11843e611a8f89516\"\u003e\u003ccode\u003e4b72976\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3018\"\u003e#3018\u003c/a\u003e from JuanIMartinezB/bug/shortid-longid\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/8a5619f53a281149e5342b1a00fe05fe2fc6517f\"\u003e\u003ccode\u003e8a5619f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3222\"\u003e#3222\u003c/a\u003e from Syzygy2048/feature/texttiling-vocabulary-introd...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/c6574d755e02b6163d9cd1d0b407076940e08864\"\u003e\u003ccode\u003ec6574d7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3289\"\u003e#3289\u003c/a\u003e from ihitamandal/codeflash/optimize-windowdiff-2024-...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/98ff5d9eaa1a81511873b9aef857944519c28dc4\"\u003e\u003ccode\u003e98ff5d9\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3435\"\u003e#3435\u003c/a\u003e from Hrudhai01/fix-3260-detokenize-quotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/aec4fce1b84ad725b8975f7365b23a4f626572a9\"\u003e\u003ccode\u003eaec4fce\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3522\"\u003e#3522\u003c/a\u003e from ekaf/pathsec\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/eec4ee3591cb9cb8b8c2989f08012608c841d532\"\u003e\u003ccode\u003eeec4ee3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3526\"\u003e#3526\u003c/a\u003e from nltk/update-contributing\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/nltk/nltk/compare/3.9.1...3.9.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `authlib` from 1.6.0 to 1.6.12\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/authlib/authlib/releases\"\u003eauthlib's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.6.12\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eInvalidScopeError\u003c/code\u003e  in \u003ccode\u003eOpenIDImplicitGrant\u003c/code\u003e and \u003ccode\u003eOpenIDHybridGrant\u003c/code\u003e.\n\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.11...v1.6.12\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.11...v1.6.12\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.11\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.10...v1.6.11\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.10...v1.6.11\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix CSRF issue with starlette client\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.10\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.9...v1.6.10\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.9...v1.6.10\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eUnsupportedResponseTypeError\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.9\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.8...v1.6.9\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.8...v1.6.9\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eChanges in \u003ccode\u003ejose\u003c/code\u003e module\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eNot using header's \u003ccode\u003ejwk\u003c/code\u003e automatically\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eES256K\u003c/code\u003e into default jwt algorithms\u003c/li\u003e\n\u003cli\u003eRemove deprecated algorithm from default registry\u003c/li\u003e\n\u003cli\u003eGenerate random \u003ccode\u003ecek\u003c/code\u003e when \u003ccode\u003ecek\u003c/code\u003e length doesn't match\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.8\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.7...v1.6.8\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.7...v1.6.8\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eEdDSA\u003c/code\u003e to default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.7\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.6...v1.6.7\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.6...v1.6.7\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eSet supported algorithms for the default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/p\u003e\n\u003ch2\u003ev1.6.6\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix(ClientAuth): fix incorrect signature when Content-Type is x-www-form-urlencoded by \u003ca href=\"https://github.com/shc261392\"\u003e\u003ccode\u003e@​shc261392\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/778\"\u003eauthlib/authlib#778\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix: Use \u003ccode\u003eexpires_in\u003c/code\u003e when \u003ccode\u003eexpires_at\u003c/code\u003e is unparsable by \u003ca href=\"https://github.com/bendavis78\"\u003e\u003ccode\u003e@​bendavis78\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/842\"\u003eauthlib/authlib#842\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eget_jwt_config\u003c/code\u003e takes a \u003ccode\u003eclient\u003c/code\u003e parameter. by \u003ca href=\"https://github.com/azmeuk\"\u003e\u003ccode\u003e@​azmeuk\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/844\"\u003eauthlib/authlib#844\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/shc261392\"\u003e\u003ccode\u003e@​shc261392\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/778\"\u003eauthlib/authlib#778\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/bendavis78\"\u003e\u003ccode\u003e@​bendavis78\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/842\"\u003eauthlib/authlib#842\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.5...v1.6.6\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.5...v1.6.6\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.6.5\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a \u003ccode\u003erequest\u003c/code\u003e param to RFC7591 \u003ccode\u003egenerate_client_info\u003c/code\u003e and \u003ccode\u003egenerate_client_secret\u003c/code\u003e methods by \u003ca href=\"https://github.com/azmeuk\"\u003e\u003ccode\u003e@​azmeuk\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/825\"\u003eauthlib/authlib#825\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: support list params in prepare_grant_uri by \u003ca href=\"https://github.com/lisongmin\"\u003e\u003ccode\u003e@​lisongmin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/827\"\u003eauthlib/authlib#827\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump SonarSource/sonarqube-scan-action from 5 to 6 in /.github/workflows by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/828\"\u003eauthlib/authlib#828\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/authlib/authlib/blob/1.6.12/docs/changelog.rst\"\u003eauthlib's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 1.6.12\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on may 4, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eInvalidScopeError\u003c/code\u003e\nin \u003ccode\u003eOpenIDImplicitGrant\u003c/code\u003e and \u003ccode\u003eOpenIDHybridGrant\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.11\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Apr 16, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix CSRF vulnerability in the Starlette OAuth client when a \u003ccode\u003ecache\u003c/code\u003e is\nconfigured.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.10\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Apr 13, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eUnsupportedResponseTypeError\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.9\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Mar 2, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eNot using header's \u003ccode\u003ejwk\u003c/code\u003e automatically.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eES256K\u003c/code\u003e into default jwt algorithms.\u003c/li\u003e\n\u003cli\u003eRemove deprecated algorithm from default registry.\u003c/li\u003e\n\u003cli\u003eGenerate random \u003ccode\u003ecek\u003c/code\u003e when \u003ccode\u003ecek\u003c/code\u003e length doesn't match.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.8\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Feb 17, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eEdDSA\u003c/code\u003e to default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.7\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Feb 6, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eSet supported algorithms for the default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.6\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/e46e515b3a87ea63ab0606b248d75f69d83a2391\"\u003e\u003ccode\u003ee46e515\u003c/code\u003e\u003c/a\u003e chore: bump to 1.6.12\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/9babc131e13b018a267ae78747cba7caa6dfb7d5\"\u003e\u003ccode\u003e9babc13\u003c/code\u003e\u003c/a\u003e fix: redirecting to unvalidated redirect_uri on InvalidScopeError in OIDC grants\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/0dc0e5b4dc84f155319518a3732113af6fa47525\"\u003e\u003ccode\u003e0dc0e5b\u003c/code\u003e\u003c/a\u003e chore: bump to 1.6.11\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/aa7b8e46e00d0622658666476782042ac00153a5\"\u003e\u003ccode\u003eaa7b8e4\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/401a7709c3fe43bce1b2105d16a475b688faa788\"\u003e\u003ccode\u003e401a770\u003c/code\u003e\u003c/a\u003e fix: CSRF issue with starlette client\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/ef09aebbba4439dedb22bd15777d1b3458b6f0ab\"\u003e\u003ccode\u003eef09aeb\u003c/code\u003e\u003c/a\u003e chore: release 1.6.10\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/3be08468201a7766a93012ce149ea12822cab096\"\u003e\u003ccode\u003e3be0846\u003c/code\u003e\u003c/a\u003e fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/9266eaa2227ad7e21dc731b2a4a01909aabd934b\"\u003e\u003ccode\u003e9266eaa\u003c/code\u003e\u003c/a\u003e chore: release 1.6.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b\"\u003e\u003ccode\u003eb9bb2b2\u003c/code\u003e\u003c/a\u003e fix(oidc): fail close at validating c_hash and at_hash\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/1b0a1d988842bff7347c4ec0a70e45c3ba55504e\"\u003e\u003ccode\u003e1b0a1d9\u003c/code\u003e\u003c/a\u003e fix(jose): generate random cek when cek length doesn't match\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.0...1.6.12\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `cryptography` from 45.0.5 to 48.0.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst\"\u003ecryptography's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e48.0.1 - 2026-06-09\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.\n\u003cp\u003e.. _v48-0-0:\u003c/p\u003e\n\u003cp\u003e48.0.0 - 2026-05-04\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Support for Python 3.8 has been removed.\n\u003ccode\u003ecryptography\u003c/code\u003e now requires Python 3.9 or later.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Loading an X.509 CRL whose inner\n\u003ccode\u003eTBSCertList.signature\u003c/code\u003e algorithm does not match the outer\n\u003ccode\u003esignatureAlgorithm\u003c/code\u003e now raises \u003ccode\u003eValueError\u003c/code\u003e. Previously, such CRLs\nwere parsed successfully and only rejected during signature validation.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded support for :doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mlkem\u003c/code\u003e and\n:doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mldsa\u003c/code\u003e when using OpenSSL 3.5.0 or\nlater, in addition to the existing AWS-LC and BoringSSL support. This means\npost-quantum algorithms are now available to users of our wheels.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eNote:\u003c/strong\u003e Going forward, we do not guarantee that all functionality\nin \u003ccode\u003ecryptography\u003c/code\u003e will be available when building against\nOpenSSL. See :doc:\u003ccode\u003e/statements/state-of-openssl\u003c/code\u003e for more information.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. _v47-0-0:\u003c/p\u003e\n\u003cp\u003e47.0.0 - 2026-04-24\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Support for Python 3.8 is deprecated and will be removed in the next\n  ``cryptography`` release.\n* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves\n  (``SECT*`` classes) has been removed. These curves are rarely used and\n  have additional security considerations that make them undesirable.\n* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.\n  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC\n  continue to be supported.\n* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL \u0026lt; 4.1.\n* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or\n  keys with unsupported explicit curve encodings now raises\n  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of\n  ``ValueError``. This change affects\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,\n  and :meth:`~cryptography.x509.Certificate.public_key` when called on\n  certificates with unsupported public key algorithms.\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt; \n\u003c/code\u003e\u003c/pre\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/de987ce48ccfeb1abca41efa23b2bf73ec704f74\"\u003e\u003ccode\u003ede987ce\u003c/code\u003e\u003c/a\u003e 48.0.1 version bump and changelog (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14996\"\u003e#14996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/8e03e30e3aae01632a697e903e3593c924f0139d\"\u003e\u003ccode\u003e8e03e30\u003c/code\u003e\u003c/a\u003e bump for 48.0.0 release (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14796\"\u003e#14796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/295e0d254ef31ab864730aa41312ec355416ee71\"\u003e\u003ccode\u003e295e0d2\u003c/code\u003e\u003c/a\u003e Add AGENTS.md with CLAUDE.md symlink (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14794\"\u003e#14794\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/104a2de19e268a433e6da92be9cb872dcf0003c8\"\u003e\u003ccode\u003e104a2de\u003c/code\u003e\u003c/a\u003e Bump BoringSSL, OpenSSL, AWS-LC in CI (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14793\"\u003e#14793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/67ec1e51988195e17993d2edef5258b27509b926\"\u003e\u003ccode\u003e67ec1e5\u003c/code\u003e\u003c/a\u003e call check_length early on AesSiv::encrypt (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14792\"\u003e#14792\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/b2da57a0d9e4bfd2b95364299091a18f74127b26\"\u003e\u003ccode\u003eb2da57a\u003c/code\u003e\u003c/a\u003e changelog for mldsa/mlkem for openssl (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14791\"\u003e#14791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/3cf44adee25c368d4a136e072fa9f80465d91eb0\"\u003e\u003ccode\u003e3cf44ad\u003c/code\u003e\u003c/a\u003e ML-KEM OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14781\"\u003e#14781\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e31639666766f846fbab2c605879db0fa64fe83\"\u003e\u003ccode\u003e2e31639\u003c/code\u003e\u003c/a\u003e ML-DSA OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14773\"\u003e#14773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/5affe5a286a986fdf512c4a5cb280d28a96c10e3\"\u003e\u003ccode\u003e5affe5a\u003c/code\u003e\u003c/a\u003e fix rust nightly clippy (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14790\"\u003e#14790\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e73ca448eaf64b6f0d4ffbb794cf96170cef5ec\"\u003e\u003ccode\u003e2e73ca4\u003c/code\u003e\u003c/a\u003e bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pyca/cryptography/compare/45.0.5...48.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `fastmcp` from 2.10.5 to 3.2.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/PrefectHQ/fastmcp/releases\"\u003efastmcp's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.2.0: Show Don't Tool\u003c/h2\u003e\n\u003cp\u003eFastMCP 3.2 is the Apps release. The 3.0 architecture gave you providers and transforms; 3.1 shipped Code Mode for tool discovery. 3.2 puts a face on it: your tools can now return interactive UIs — charts, dashboards, forms, maps — rendered right inside the conversation.\u003c/p\u003e\n\u003ch2\u003eFastMCPApp\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003eFastMCPApp\u003c/code\u003e is a new provider class for building interactive applications inside MCP. It separates the tools the LLM sees (\u003ccode\u003e@app.ui()\u003c/code\u003e) from the backend tools the UI calls (\u003ccode\u003e@app.tool()\u003c/code\u003e), manages visibility automatically, and gives tool references stable identifiers that survive namespace transforms and server composition — without requiring host cooperation.\u003c/p\u003e\n\u003cpre lang=\"python\"\u003e\u003ccode\u003efrom fastmcp import FastMCP, FastMCPApp\nfrom prefab_ui.actions.mcp import CallTool\nfrom prefab_ui.components import Column, Form, Input, Button, ForEach, Text\n\u003cp\u003eapp = FastMCPApp(\u0026quot;Contacts\u0026quot;)\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/app\"\u003e\u003ccode\u003e@​app\u003c/code\u003e\u003c/a\u003e.tool()\ndef save_contact(name: str, email: str) -\u0026gt; list[dict]:\ndb.append({\u0026quot;name\u0026quot;: name, \u0026quot;email\u0026quot;: email})\nreturn list(db)\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/app\"\u003e\u003ccode\u003e@​app\u003c/code\u003e\u003c/a\u003e.ui()\ndef contact_manager() -\u0026gt; PrefabApp:\nwith PrefabApp(state={\u0026quot;contacts\u0026quot;: list(db)}) as view:\nwith Column(gap=4):\nForEach(\u0026quot;contacts\u0026quot;, lambda c: Text(c.name))\nwith Form(on_submit=CallTool(\u0026quot;save_contact\u0026quot;)):\nInput(name=\u0026quot;name\u0026quot;, required=True)\nInput(name=\u0026quot;email\u0026quot;, required=True)\nButton(\u0026quot;Save\u0026quot;)\nreturn view\u003c/p\u003e\n\u003cp\u003emcp = FastMCP(\u0026quot;Server\u0026quot;, providers=[app])\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cp\u003eThe UI is built with \u003ca href=\"https://prefab.prefect.io\"\u003ePrefab\u003c/a\u003e, a Python component library that compiles to interactive UIs. You write Python; the user sees charts, tables, forms, and dashboards. FastMCP handles the MCP Apps protocol machinery — renderer resources, CSP configuration, structured content serialization — so you don't have to.\u003c/p\u003e\n\u003cp\u003eFor simpler cases where you just want to visualize data without server interaction, set \u003ccode\u003eapp=True\u003c/code\u003e on any tool and return Prefab components directly:\u003c/p\u003e\n\u003cpre lang=\"python\"\u003e\u003ccode\u003e@mcp.tool(app=True)\ndef revenue_chart(year: int) -\u0026gt; PrefabApp:\n    with PrefabApp() as app:\n        BarChart(data=revenue_data, series=[ChartSeries(data_key=\u0026quot;revenue\u0026quot;)])\n    return app\n\u003c/code\u003e\u003c/pre\u003e\n\u003ch2\u003eBuilt-in Providers\u003c/h2\u003e\n\u003cp\u003eFive ready-made providers you add with a single \u003ccode\u003eadd_provider()\u003c/code\u003e call:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eFileUpload\u003c/strong\u003e — drag-and-drop file upload with session-scoped storage\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx\"\u003efastmcp's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003chr /\u003e\n\u003ch2\u003etitle: \u0026quot;Changelog\u0026quot;\nicon: \u0026quot;list-check\u0026quot;\nrss: true\ntag: NEW\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.1\"\u003ev3.4.1: Floor It\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eFastMCP 3.4.1 floors Starlette at \u003ccode\u003e\u0026gt;=1.0.1\u003c/code\u003e so installs can no longer resolve to a version affected by CVE-2026-48710, which was previously only constrained transitively through \u003ccode\u003emcp\u003c/code\u003e. It also makes OAuthProxy log refresh-token cache misses instead of failing silently.\u003c/p\u003e\n\u003ch3\u003eEnhancements ✨\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eLog refresh-token misses in OAuthProxy instead of failing silently by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4276\"\u003e#4276\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eSecurity 🔒\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd explicit starlette\u0026gt;=1.0.1 floor (CVE-2026-48710) by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4286\"\u003e#4286\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocs 📚\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDocument --notes-start-tag in release instructions by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4275\"\u003e#4275\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/PrefectHQ/fastmcp/compare/v3.4.0...v3.4.1\"\u003ev3.4.0...v3.4.1\u003c/a\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.0\"\u003ev3.4.0: Remote Control\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eFastMCP 3.4 is about reaching servers that live somewhere else. The headline is \u003ccode\u003efastmcp-remote\u003c/code\u003e, a standalone bridge that connects stdio-only MCP hosts to servers hosted over HTTP. Around it, the proxy layer those connections depend on is hardened: a proxy now forwards \u003ccode\u003einitialize\u003c/code\u003e upstream and fails loudly when the backend is missing or misconfigured, instead of reporting a connected-but-empty proxy. And FastMCP-issued access tokens can now outlive short-lived upstream tokens, so authenticated sessions survive the long idle periods remote clients are prone to.\u003c/p\u003e\n\u003ch3\u003eNew Features 🎉\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd fastmcp-remote bridge package by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4208\"\u003e#4208\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes ⚠️\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eForward proxy initialize as bridge behavior by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4228\"\u003e#4228\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eEnhancements ✨\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eci: require external PRs to link a tracked issue by \u003ca href=\"https://github.com/strawgate\"\u003e\u003ccode\u003e@​strawgate\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4173\"\u003e#4173\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: new options --host and --no-log-panel | --log-panel  to cli dev apps by \u003ca href=\"https://github.com/itaru2622\"\u003e\u003ccode\u003e@​itaru2622\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4123\"\u003e#4123\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd valid_scopes and extra_authorize_params to WorkOSProvider by \u003ca href=\"https://github.com/tiagoskaneta\"\u003e\u003ccode\u003e@​tiagoskaneta\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4135\"\u003e#4135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd token_expiry_threshold_seconds for proactive token refresh by \u003ca href=\"https://github.com/mohankumarelec\"\u003e\u003ccode\u003e@​mohankumarelec\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4142\"\u003e#4142\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd review-issue skill for triaging gated external contributions by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4212\"\u003e#4212\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd contract gate to review-issue skill by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4214\"\u003e#4214\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eLet ToolResult return an error result via is_error by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4217\"\u003e#4217\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate published docs after PyPI release by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4211\"\u003e#4211\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAllow pre-bound HTTP sockets by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4222\"\u003e#4222\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd targeted coverage tests by \u003ca href=\"https://github.com/strawgate\"\u003e\u003ccode\u003e@​strawgate\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4230\"\u003e#4230\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade ty to 0.0.39 by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4225\"\u003e#4225\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDecouple FastMCP access token lifetime from upstream expires_in by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4254\"\u003e#4254\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eSecurity 🔒\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat(code-mode): default sandbox limits and per-execution tool-call cap by \u003ca href=\"https://github.com/strawgate\"\u003e\u003ccode\u003e@​strawgate\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4170\"\u003e#4170\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSecurity: Fix 3 findings in GitHub Actions workflows by \u003ca href=\"https://github.com/jpr5\"\u003e\u003ccode\u003e@​jpr5\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4183\"\u003e#4183\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/665514e19a78543709be85b4261153bbe98e882f\"\u003e\u003ccode\u003e665514e\u003c/code\u003e\u003c/a\u003e Add forward_resource flag to OAuthProxy (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3711\"\u003e#3711\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/f189d1f7fbfd55c9f68c750a3a293e31c7586e8b\"\u003e\u003ccode\u003ef189d1f\u003c/code\u003e\u003c/a\u003e Bump pydantic-monty to 0.0.9 (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3707\"\u003e#3707\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/6faa2d61f82eab670694965606fd7b14bedddc7f\"\u003e\u003ccode\u003e6faa2d6\u003c/code\u003e\u003c/a\u003e Remove hardcoded prefab-ui version from pinning warnings (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3708\"\u003e#3708\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/dd8816c6ccc733048fe6208bfc8f80ded505f993\"\u003e\u003ccode\u003edd8816c\u003c/code\u003e\u003c/a\u003e chore: Update SDK documentation (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3701\"\u003e#3701\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/d27495960af23969f11d6e1e44e2018529c1c37e\"\u003e\u003ccode\u003ed274959\u003c/code\u003e\u003c/a\u003e docs: note that custom routes are unauthenticated (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3706\"\u003e#3706\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/4a54be2d5f1ac8925a461e67cf993e0278729d4d\"\u003e\u003ccode\u003e4a54be2\u003c/code\u003e\u003c/a\u003e Add examples gallery page (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3705\"\u003e#3705\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/961dd5045611e9c1bd6b7c4f5ac3aa14f0a30ce7\"\u003e\u003ccode\u003e961dd50\u003c/code\u003e\u003c/a\u003e Add interactive map example with geocoding (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3702\"\u003e#3702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/f01d0c581c7a821a9701d6dde4d9beb95e32d479\"\u003e\u003ccode\u003ef01d0c5\u003c/code\u003e\u003c/a\u003e Add quiz example app, fix dev server empty string args (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3700\"\u003e#3700\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/85b7efd74601a72c74ac68e23599de6c032bb9c4\"\u003e\u003ccode\u003e85b7efd\u003c/code\u003e\u003c/a\u003e chore: Update SDK documentation (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3694\"\u003e#3694\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/27abe3c3f0cc2ce1925cc3cbc7968d5637ebc82b\"\u003e\u003ccode\u003e27abe3c\u003c/code\u003e\u003c/a\u003e Add sales dashboard and live system monitor examples, bump prefab-ui to 0.17 ...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/PrefectHQ/fastmcp/compare/v2.10.5...v3.2.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 3.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in \u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining and\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e Release 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e Pre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from kjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e Convert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from kjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from StanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from StanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kjd/idna/compare/v3.10...v3.15\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `joserfc` from 1.6.4 to 1.6.7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/authlib/joserfc/releases\"\u003ejoserfc's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.6.7\u003c/h2\u003e\n\u003ch3\u003e   🐞 Bug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ejws\u003c/strong\u003e: Validate payload size for b64=false  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/authlib/joserfc/commit/4d4ea2e\"\u003e\u003c!-- raw HTML omitted --\u003e(4d4ea)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003etyping\u003c/strong\u003e: Accept any Collection for algorithms, not just list  -  by \u003ca href=\"https://github.com/jonathangreen\"\u003e\u003ccode\u003e@​jonathangreen\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/authlib/joserfc/commit/102a7a7\"\u003e\u003c!-- raw HTML omitted --\u003e(102a7)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003etyping\u003c/strong\u003e: Use cast for type hints  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/authlib/joserfc/commit/75d9f95\"\u003e\u003c!-- raw HTML omitted --\u003e(75d9f)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch5\u003e    \u003ca href=\"https://github.com/authlib/joserfc/compare/1.6.5...1.6.7\"\u003eView changes on GitHub\u003c/a\u003e\u003c/h5\u003e\n\u003ch2\u003e1.6.5\u003c/h2\u003e\n\u003cp\u003e\u003cem\u003eNo significant changes\u003c/em\u003e\u003c/p\u003e\n\u003ch5\u003e    \u003ca href=\"https://github.com/authlib/joserfc/compare/1.6.4...1.6.5\"\u003eView changes on GitHub\u003c/a\u003e\u003c/h5\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/authlib/joserfc/blob/main/docs/changelog.rst\"\u003ejoserfc's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.6.7\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on May 23, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate for type hints.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.6.6\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on May 18, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eJWS\u003c/strong\u003e: validate payload size when \u003ccode\u003eb64=false\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.6.5\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on May 3, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eJWS\u003c/strong\u003e: increase registry's payload max size.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/1e5b94da589c695f54abd9f1a0ad822dcffe0305\"\u003e\u003ccode\u003e1e5b94d\u003c/code\u003e\u003c/a\u003e chore: release 1.6.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/75d9f95815f522ccb50515fb36efbcc6601b2e34\"\u003e\u003ccode\u003e75d9f95\u003c/code\u003e\u003c/a\u003e fix(typing): use cast for type hints\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/6d240377ce8ddfb15793822d9d82cf66e66a9980\"\u003e\u003ccode\u003e6d24037\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/authlib/joserfc/issues/98\"\u003e#98\u003c/a\u003e from jonathangreen/algorithms-accept-collection\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/102a7a7610eb50cd53cd46d917146b7af295613f\"\u003e\u003ccode\u003e102a7a7\u003c/code\u003e\u003c/a\u003e fix(typing): accept any Collection for algorithms, not just list\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/8b869e8754b5022c3a2a9e1071fe15f65d3749c6\"\u003e\u003ccode\u003e8b869e8\u003c/code\u003e\u003c/a\u003e chore: release 1.6.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/00d599bfc1282cf887bb6a8bc82598dc10532fa5\"\u003e\u003ccode\u003e00d599b\u003c/code\u003e\u003c/a\u003e chore: update actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/9186561fc40de112e3b3f01934b11d7ca54da142\"\u003e\u003ccode\u003e9186561\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/authlib/joserfc/issues/97\"\u003e#97\u003c/a\u003e from authlib/fix-b64\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/4d4ea2e787ed36a2190158d86d8470e3acbb349b\"\u003e\u003ccode\u003e4d4ea2e\u003c/code\u003e\u003c/a\u003e fix(jws): validate payload size for b64=false\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/b6554cca2f0ae4f246411aa569b2980381eb35a3\"\u003e\u003ccode\u003eb6554cc\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/authlib/joserfc/issues/96\"\u003e#96\u003c/a\u003e from sebasxsala/fix-p512-fixture\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/b89eadff61ef9d8cf4302d18987f27dc1b281647\"\u003e\u003ccode\u003eb89eadf\u003c/code\u003e\u003c/a\u003e test: normalize P-521 private key fixture\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/authlib/joserfc/compare/1.6.4...1.6.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langchain-core` from 1.1.0 to 1.3.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langchain/releases\"\u003elangchain-core's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elangchain-core==1.3.3\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.2\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37198\"\u003e#37198\u003c/a\u003e)\nfix(core): set deprecation \u003ccode\u003esince\u003c/code\u003e to 1.3.3 to match release (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37200\"\u003e#37200\u003c/a\u003e)\nfix(core, langchain): harden \u003ccode\u003eload()\u003c/code\u003e against untrusted manifests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37197\"\u003e#37197\u003c/a\u003e)\nchore: bump notebook from 7.5.0 to 7.5.6 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37109\"\u003e#37109\u003c/a\u003e)\nchore: bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260408 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37129\"\u003e#37129\u003c/a\u003e)\nfix(core): preserve structured \u003ccode\u003einputs\u003c/code\u003e on tool runs in tracers (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37108\"\u003e#37108\u003c/a\u003e)\nrelease(perplexity): 1.2.0 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37091\"\u003e#37091\u003c/a\u003e)\nchore(docs): update x handle references (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37081\"\u003e#37081\u003c/a\u003e)\nfix(core): make \u003ccode\u003eremoval\u003c/code\u003e optional in \u003ccode\u003ewarn_deprecated\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37056\"\u003e#37056\u003c/a\u003e)\nfix(core): validate batch_size in _batch and _abatch to prevent infinite loop (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36663\"\u003e#36663\u003c/a\u003e)\nchore(core): mark stream_v2/astream_v2 as beta (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36992\"\u003e#36992\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.2\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.1\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36990\"\u003e#36990\u003c/a\u003e)\nfeat(core): add content-block-centric streaming (v2) (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36834\"\u003e#36834\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.1\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.0\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36972\"\u003e#36972\u003c/a\u003e)\nfeat(core): allow _format_output to pass through list of ToolOutputMixin instances (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36963\"\u003e#36963\u003c/a\u003e)\nchore: bump nbconvert from 7.17.0 to 7.17.1 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36923\"\u003e#36923\u003c/a\u003e)\nfeat(core): Update inheritance behavior for tracer metadata for special keys (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36900\"\u003e#36900\u003c/a\u003e)\nchore: bump langsmith from 0.7.13 to 0.7.31 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36813\"\u003e#36813\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.0\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.2.31\u003c/p\u003e\n\u003cp\u003erelease(core): release 1.3.0 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36851\"\u003e#36851\u003c/a\u003e)\nrelease(core): 1.3.0a3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36829\"\u003e#36829\u003c/a\u003e)\nchore(core): keep checkpoint_ns behavior in streaming metadata for backwards compat (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36828\"\u003e#36828\u003c/a\u003e)\nfeat(core): Add chat model and LLM invocation params to traceable metadata (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36771\"\u003e#36771\u003c/a\u003e)\nfix(core): restore cloud metadata IPs and link-local range in SSRF policy (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36816\"\u003e#36816\u003c/a\u003e)\nchore(deps): bump pytest to \u003ccode\u003e9.0.3\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36801\"\u003e#36801\u003c/a\u003e)\nchore(core): harden private SSRF utilities (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36768\"\u003e#36768\u003c/a\u003e)\nfix(openai): handle content blocks without type key in responses api conversion (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36725\"\u003e#36725\u003c/a\u003e)\nchore: bump pytest from 9.0.2 to 9.0.3 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36719\"\u003e#36719\u003c/a\u003e)\nrelease(core): 1.3.0.a2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36698\"\u003e#36698\u003c/a\u003e)\nfix(core): Use reference counting for storing inherited run trees to support garbage collection (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36660\"\u003e#36660\u003c/a\u003e)\ndocs(core): nit (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36685\"\u003e#36685\u003c/a\u003e)\nrelease(core): 1.3.0a1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36656\"\u003e#36656\u003c/a\u003e)\nchore(core): reduce streaming metadata / perf (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36588\"\u003e#36588\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.0a3\u003c/h2\u003e\n\u003cp\u003eInitial release\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/5039dfec1f8e78459540a7f1b52fb0d6d82e3f07\"\u003e\u003ccode\u003e5039dfe\u003c/code\u003e\u003c/a\u003e release(core): 1.3.3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37198\"\u003e#37198\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/55a7707837742c2f7a9b7e4a5dd428bf615f3b82\"\u003e\u003ccode\u003e55a7707\u003c/code\u003e\u003c/a\u003e fix(core): set deprecation \u003ccode\u003esince\u003c/code\u003e to 1.3.3 to match release (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37200\"\u003e#37200\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/c979c6187b6d82f4bef35b10b84b39fa44806b22\"\u003e\u003ccode\u003ec979c61\u003c/code\u003e\u003c/a\u003e fix(core, langchain): harden \u003ccode\u003eload()\u003c/code\u003e against untrusted manifests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37197\"\u003e#37197\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/d7031101da78e3f6b6c5956b48a5170c1a33292b\"\u003e\u003ccode\u003ed703110\u003c/code\u003e\u003c/a\u003e docs: update README.md (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37190\"\u003e#37190\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/4d50a2a68b38e9acc53027ea7e7cc89e2d80b4c7\"\u003e\u003ccode\u003e4d50a2a\u003c/code\u003e\u003c/a\u003e ci(infra): run pre-release checks before TestPyPI publish (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37194\"\u003e#37194\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/9bd730e1991baac4ea80aa07d93110dc1b52ee25\"\u003e\u003ccode\u003e9bd730e\u003c/code\u003e\u003c/a\u003e fix(fireworks): require \u003ccode\u003eapi_key\u003c/code\u003e in \u003ccode\u003eFireworksEmbeddings\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37193\"\u003e#37193\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/f475f4191fc3a8d3cf14063b44d524594c080c04\"\u003e\u003ccode\u003ef475f41\u003c/code\u003e\u003c/a\u003e release(mistralai): 1.1.4 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37191\"\u003e#37191\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/7dbff48aff508b01dc231ea0cbd4e4e09da92c97\"\u003e\u003ccode\u003e7dbff48\u003c/code\u003e\u003c/a\u003e fix(mistralai): strip non-wire keys from \u003ccode\u003eToolMessage\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37188\"\u003e#37188\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/913816c440ea79295370e1af6484e17b86e5d03c\"\u003e\u003ccode\u003e913816c\u003c/code\u003e\u003c/a\u003e release(fireworks): 1.3.1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37189\"\u003e#37189\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/4498d3dc84a85688fa4d15476403a900bc7f9114\"\u003e\u003ccode\u003e4498d3d\u003c/code\u003e\u003c/a\u003e fix(fireworks): strip non-wire keys from \u003ccode\u003eToolMessage\u003c/code\u003e text content blocks (#...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/langchain-ai/langchain/compare/langchain-core==1.1.0...langchain-core==1.3.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langchain-text-splitters` from 1.0.0 to 1.1.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langchain/releases\"\u003elangchain-text-splitters's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elangchain-text-splitters==1.1.2\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-text-splitters==1.1.1\u003c/p\u003e\n\u003cp\u003erelease(text-splitters): 1.1.2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36822\"\u003e#36822\u003c/a\u003e)\nfix(text-splitters): deprecate and use SSRF-safe transport in split_text_from_url (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36821\"\u003e#36821\u003c/a\u003e)\nchore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36797\"\u003e#36797\u003c/a\u003e)\nchore(deps): bump pytest to \u003ccode\u003e9.0.3\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36801\"\u003e#36801\u003c/a\u003e)\nchore: bump pytest from 9.0.2 to 9.0.3 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36714\"\u003e#36714\u003c/a\u003e)\nchore: add comment explaining \u003ccode\u003epygments\u0026gt;=2.20.0\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36570\"\u003e#36570\u003c/a\u003e)\nrelease(core): 1.2.26 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36511\"\u003e#36511\u003c/a\u003e)\nchore: pygments\u0026gt;=2.20.0 across all packages (CVE-2026-4539) (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36385\"\u003e#36385\u003c/a\u003e)\nfix(text-splitters): prevent silent data loss for empty dict values in RecursiveJsonSplitter (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35079\"\u003e#35079\u003c/a\u003e)\nfeat(text-splitters): support spacy tests with Python 3.14 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36198\"\u003e#36198\u003c/a\u003e)\nfix(infra): correct lint_diff relative paths in package makefiles (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36333\"\u003e#36333\u003c/a\u003e)\nchore: bump requests from 2.32.5 to 2.33.0 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36238\"\u003e#36238\u003c/a\u003e)\nchore: bump nltk from 3.9.3 to 3.9.4 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36237\"\u003e#36237\u003c/a\u003e)\nchore(partners): bump \u003ccode\u003elangchain-core\u003c/code\u003e min to \u003ccode\u003e1.2.21\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36183\"\u003e#36183\u003c/a\u003e)\nchore(text-splitters): bump nltk in lock file (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36112\"\u003e#36112\u003c/a\u003e)\nci: suppress pytest streaming output in CI (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36092\"\u003e#36092\u003c/a\u003e)\nchore(text-splitters): speed up ci (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36050\"\u003e#36050\u003c/a\u003e)\nci: avoid unnecessary dep installs in lint targets (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36046\"\u003e#36046\u003c/a\u003e)\nchore: bump orjson from 3.11.5 to 3.11.6 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35856\"\u003e#35856\u003c/a\u003e)\nchore: bump locks, lint (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35985\"\u003e#35985\u003c/a\u003e)\nperf(.github): set a timeout on get min versions HTTP calls (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35851\"\u003e#35851\u003c/a\u003e)\nchore: bump tornado from 6.5.2 to 6.5.5 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35774\"\u003e#35774\u003c/a\u003e)\nchore: bump the minor-and-patch group across 3 directories with 3 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35589\"\u003e#35589\u003c/a\u003e)\nchore: bump the other-deps group across 3 directories with 2 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35512\"\u003e#35512\u003c/a\u003e)\nchore: bump nltk from 3.9.2 to 3.9.3 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35449\"\u003e#35449\u003c/a\u003e)\nchore: bump the other-deps group across 3 directories with 2 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35407\"\u003e#35407\u003c/a\u003e)\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/58c4e5bbdd9d18d7fe7ec83b5a05477d06fe2a8e\"\u003e\u003ccode\u003e58c4e5b\u003c/code\u003e\u003c/a\u003e release(text-splitters): 1.1.2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36822\"\u003e#36822\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/c289bf10e940e960a132d7403482283114063063\"\u003e\u003ccode\u003ec289bf1\u003c/code\u003e\u003c/a\u003e fix(text-splitters): deprecate and use SSRF-safe transport in split_text_from...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/b7447c6969fc928ec3f29c200e2e56c0a46c4c77\"\u003e\u003ccode\u003eb7447c6\u003c/code\u003e\u003c/a\u003e fix(infra): skip serdes tests in min-version release step (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36818\"\u003e#36818\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/41c0cc58b0dac82000d24715f7a4b44dc8b01fd3\"\u003e\u003ccode\u003e41c0cc5\u003c/code\u003e\u003c/a\u003e release(openai): 1.1.14 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36820\"\u003e#36820\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/0516156ef98f5001129f6d47bc8682d6536d58fb\"\u003e\u003ccode\u003e0516156\u003c/code\u003e\u003c/a\u003e fix(openai): use SSRF-safe transport for image token counting (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36819\"\u003e#36819\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/338aa8131a8124e7aa1e042616ccd2366ff9f699\"\u003e\u003ccode\u003e338aa81\u003c/code\u003e\u003c/a\u003e fix(core): restore cloud metadata IPs and link-local range in SSRF policy (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/3\"\u003e#3\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/51e954877efd2d2c3c5bf09364dcfec8794eadb0\"\u003e\u003ccode\u003e51e9548\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36797\"\u003e#36797\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/e85c418cfa559d4a794ddc6db92c6febab44651c\"\u003e\u003ccode\u003ee85c418\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/model-profiles (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36798\"\u003e#36798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/789126e6c78ad74664bea26228dda6e72e135dce\"\u003e\u003ccode\u003e789126e\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/standard-tests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36799\"\u003e#36799\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/937b3eb3827551d17ee4736f9acc4aa57e88c716\"\u003e\u003ccode\u003e937b3eb\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/langchain_v1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36800\"\u003e#36800\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/langchain-ai/langchain/compare/langchain-text-splitters==1.0.0...langchain-text-splitters==1.1.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langsmith` from 0.4.7 to 0.8.18\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langsmith-sdk/releases\"\u003elangsmith's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.8.18\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps-dev): bump vitest from 3.2.4 to 3.2.6 in /js by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3002\"\u003elangchain-ai/langsmith-sdk#3002\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump pyjwt from 2.12.1 to 2.13.0 in /python by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3030\"\u003elangchain-ai/langsmith-sdk#3030\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump python-multipart from 0.0.27 to 0.0.31 in /python by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3036\"\u003elangchain-ai/langsmith-sdk#3036\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump aiohttp from 3.14.0 to 3.14.1 in /python by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3037\"\u003elangchain-ai/langsmith-sdk#3037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump cryptography from 46.0.7 to 48.0.1 in /python by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3038\"\u003elangchain-ai/langsmith-sdk#3038\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump starlette from 1.0.1 to 1.3.1 in /python by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3039\"\u003elangchain-ai/langsmith-sdk#3039\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump langchain-anthropic from 1.4.4 to 1.4.6 in /python by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3044\"\u003elangchain-ai/langsmith-sdk#3044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm_and_yarn group across 4 directories with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3046\"\u003elangchain-ai/langsmith-sdk#3046\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm_and_yarn group across 2 directories with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3060\"\u003elangchain-ai/langsmith-sdk#3060\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etest(python): fix integration assertions for updated attachment error message by \u003ca href=\"https://github.com/QuentinBrosse\"\u003e\u003ccode\u003e@​QuentinBrosse\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3061\"\u003elangchain-ai/langsmith-sdk#3061\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: reconcile bumpversion config and mandate release process for agents by \u003ca href=\"https://github.com/QuentinBrosse\"\u003e\u003ccode\u003e@​QuentinBrosse\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3062\"\u003elangchain-ai/langsmith-sdk#3062\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease(py): 0.8.18 by \u003ca href=\"https://github.com/QuentinBrosse\"\u003e\u003ccode\u003e@​QuentinBrosse\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3063\"\u003elangchain-ai/langsmith-sdk#3063\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.17...v0.8.18\"\u003ehttps://github.com/langchain-ai/langsmith-sdk/compare/v0.8.17...v0.8.18\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev0.8.17\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: expose the resources from the generated openapi client in the langsmith client by \u003ca href=\"https://github.com/sineha-mani\"\u003e\u003ccode\u003e@​sineha-mani\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3018\"\u003elangchain-ai/langsmith-sdk#3018\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat(js): port \u003ccode\u003eisTracingEnabled\u003c/code\u003e utility from Python by \u003ca href=\"https://github.com/dqbd\"\u003e\u003ccode\u003e@​dqbd\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3032\"\u003elangchain-ai/langsmith-sdk#3032\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd sandbox mount support to JS SDK by \u003ca href=\"https://github.com/DanielKneipp\"\u003e\u003ccode\u003e@​DanielKneipp\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3010\"\u003elangchain-ai/langsmith-sdk#3010\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease(js): bump to 0.7.9 by \u003ca href=\"https://github.com/dqbd\"\u003e\u003ccode\u003e@​dqbd\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3035\"\u003elangchain-ai/langsmith-sdk#3035\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd sandbox mount support to Python SDK by \u003ca href=\"https://github.com/DanielKneipp\"\u003e\u003ccode\u003e@​DanielKneipp\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3009\"\u003elangchain-ai/langsmith-sdk#3009\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: note that _openapi_client directories are auto-generated by \u003ca href=\"https://github.com/KiewanVillatel\"\u003e\u003ccode\u003e@​KiewanVillatel\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3034\"\u003elangchain-ai/langsmith-sdk#3034\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update JS SDK type declarations with skipLibCheck disabled by \u003ca href=\"https://github.com/sineha-mani\"\u003e\u003ccode\u003e@​sineha-mani\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3043\"\u003elangchain-ai/langsmith-sdk#3043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease(js): 0.7.10 by \u003ca href=\"https://github.com/dqbd\"\u003e\u003ccode\u003e@​dqbd\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3045\"\u003elangchain-ai/langsmith-sdk#3045\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: adding python async for online evals by \u003ca href=\"https://github.com/sineha-mani\"\u003e\u003ccode\u003e@​sineha-mani\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3048\"\u003elangchain-ai/langsmith-sdk#3048\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd sandbox Git mount SDK helpers by \u003ca href=\"https://github.com/DanielKneipp\"\u003e\u003ccode\u003e@​DanielKneipp\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3040\"\u003elangchain-ai/langsmith-sdk#3040\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: use insights tab in sdk report links [closes LSO-2936] by \u003ca href=\"https://github.com/eric-langchain\"\u003e\u003ccode\u003e@​eric-langchain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3050\"\u003elangchain-ai/langsmith-sdk#3050\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat(client): warn when backend version is below minimum required by \u003ca href=\"https://github.com/KiewanVillatel\"\u003e\u003ccode\u003e@​KiewanVillatel\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3041\"\u003elangchain-ai/langsmith-sdk#3041\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: bump _MIN_BACKEND_VERSION to 0.16.5rc1 by \u003ca href=\"https://github.com/langtions-bot\"\u003e\u003ccode\u003e@​langtions-bot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3053\"\u003elangchain-ai/langsmith-sdk#3053\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(sandbox): use built-in gcp auth host matching by \u003ca href=\"https://github.com/DanielKneipp\"\u003e\u003ccode\u003e@​DanielKneipp\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3055\"\u003elangchain-ai/langsmith-sdk#3055\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(python): py to 0.8.17 by \u003ca href=\"https://github.com/sineha-mani\"\u003e\u003ccode\u003e@​sineha-mani\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3056\"\u003elangchain-ai/langsmith-sdk#3056\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sineha-mani\"\u003e\u003ccode\u003e@​sineha-mani\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3018\"\u003elangchain-ai/langsmith-sdk#3018\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/eric-langchain\"\u003e\u003ccode\u003e@​eric-langchain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3050\"\u003elangchain-ai/langsmith-sdk#3050\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.16...v0.8.17\"\u003ehttps://github.com/langchain-ai/langsmith-sdk/compare/v0.8.16...v0.8.17\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev0.8.16\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/...\n\n_Description has been truncated_","html_url":"https://github.com/CaffeeLake/MemOS/pull/3","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/CaffeeLake%2FMemOS/issues/3","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/3/packages"},{"uuid":"4782104700","node_id":"PR_kwDOEq4Je87sfsdB","number":1165,"state":"open","title":"Bump the pip group across 1 directory with 10 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-07-01T03:16:54.000Z","updated_at":"2026-07-01T03:18:53.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","group_name":"pip","update_count":10,"packages":[{"name":"pyarrow","old_version":"17.0.0","new_version":"23.0.1","repository_url":"https://github.com/apache/arrow"},{"name":"pytest","old_version":"9.0.2","new_version":"9.0.3","repository_url":"https://github.com/pytest-dev/pytest"},{"name":"flask","old_version":"2.2.5","new_version":"3.1.3","repository_url":"https://github.com/pallets/flask"},{"name":"lxml","old_version":"4.9.2","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"},{"name":"pillow","old_version":"12.1.1","new_version":"12.2.0","repository_url":"https://github.com/python-pillow/Pillow"},{"name":"pyjwt","old_version":"2.6.0","new_version":"2.13.0","repository_url":"https://github.com/jpadilla/pyjwt"},{"name":"pypdf","old_version":"6.7.1","new_version":"6.13.3","repository_url":"https://github.com/py-pdf/pypdf"},{"name":"python-dotenv","old_version":"1.2.1","new_version":"1.2.2","repository_url":"https://github.com/theskumar/python-dotenv"},{"name":"requests","old_version":"2.32.4","new_version":"2.33.0","repository_url":"https://github.com/psf/requests"},{"name":"werkzeug","old_version":"3.0.6","new_version":"3.1.6","repository_url":"https://github.com/pallets/werkzeug"}],"path":null,"ecosystem":"pip"},"body":"Bumps the pip group with 10 updates in the /etl-pipeline directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `17.0.0` | `23.0.1` |\n| [pytest](https://github.com/pytest-dev/pytest) | `9.0.2` | `9.0.3` |\n| [flask](https://github.com/pallets/flask) | `2.2.5` | `3.1.3` |\n| [lxml](https://github.com/lxml/lxml) | `4.9.2` | `6.1.0` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.1.1` | `12.2.0` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.6.0` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.7.1` | `6.13.3` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.1` | `1.2.2` |\n| [requests](https://github.com/psf/requests) | `2.32.4` | `2.33.0` |\n| [werkzeug](https://github.com/pallets/werkzeug) | `3.0.6` | `3.1.6` |\n\n\nUpdates `pyarrow` from 17.0.0 to 23.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/apache/arrow/releases\"\u003epyarrow's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Arrow 23.0.1\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/23.0.1.html\"\u003ehttps://arrow.apache.org/release/23.0.1.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.1 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 23.0.1 RC0\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/23.0.0.html\"\u003ehttps://arrow.apache.org/release/23.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 23.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/22.0.0.html\"\u003ehttps://arrow.apache.org/release/22.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0 RC1\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 22.0.0 RC1\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 22.0.0 RC0\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/21.0.0.html\"\u003ehttps://arrow.apache.org/release/21.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC6\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC6\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC5\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC5\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC4\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC4\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC3\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC3\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/20.0.0.html\"\u003ehttps://arrow.apache.org/release/20.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC1\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC1\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC0\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/82a374e5f3de5b744f26591e6cd96de6349c76d9\"\u003e\u003ccode\u003e82a374e\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update versions for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/c1ae37c4a597f466b1806e65a9e011be1060dfc5\"\u003e\u003ccode\u003ec1ae37c\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update .deb/.rpm changelogs for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/8f6e55736f60f1f95aee1e8765c6b75ad9589111\"\u003e\u003ccode\u003e8f6e557\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update CHANGELOG.md for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/4e16a1aeed83a65e6b49556c2fed8e9061cdf980\"\u003e\u003ccode\u003e4e16a1a\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49159\"\u003eGH-49159\u003c/a\u003e: [C++][Gandiva] Detect overflow in repeat() (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49160\"\u003e#49160\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/985621dbfcf3fd2061889e43c50b59825df84f3f\"\u003e\u003ccode\u003e985621d\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/48817\"\u003eGH-48817\u003c/a\u003e [R][C++] Bump C++20 in R build infrastructure (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/48819\"\u003e#48819\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/1bea06ad4e14d75dd97a78a0148cd9cf6f4df0bc\"\u003e\u003ccode\u003e1bea06a\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49024\"\u003eGH-49024\u003c/a\u003e: [CI] Update Debian version in \u003ccode\u003e.env\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49032\"\u003e#49032\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/147bcd6d8f3fef05dd06968d3b60c17721c60334\"\u003e\u003ccode\u003e147bcd6\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49156\"\u003eGH-49156\u003c/a\u003e: [Python] Require GIL for string comparison (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49161\"\u003e#49161\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/e4f922b1621b6c833f583cf26500f115ab5bc483\"\u003e\u003ccode\u003ee4f922b\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49138\"\u003eGH-49138\u003c/a\u003e: [Packaging][Python] Remove nightly cython install from manylinux wh...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/f9376e4721b81bad9fe3fe840926a3283f95ee30\"\u003e\u003ccode\u003ef9376e4\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49003\"\u003eGH-49003\u003c/a\u003e: [C++] Don't consider \u003ccode\u003eout_of_range\u003c/code\u003e an error in float parsing (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49095\"\u003e#49095\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/ab2c0ad6b23d05d5f77fc8a34d5a1c4baaacb0a4\"\u003e\u003ccode\u003eab2c0ad\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49044\"\u003eGH-49044\u003c/a\u003e: [CI][Python] Fix test_download_tzdata_on_windows by adding required...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/apache/arrow/compare/go/v17.0.0...apache-arrow-23.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pytest` from 9.0.2 to 9.0.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytest-dev/pytest/releases\"\u003epytest's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e9.0.3\u003c/h2\u003e\n\u003ch1\u003epytest 9.0.3 (2026-04-07)\u003c/h1\u003e\n\u003ch2\u003eBug fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/12444\"\u003e#12444\u003c/a\u003e: Fixed \u003ccode\u003epytest.approx\u003c/code\u003e which now correctly takes into account \u003ccode\u003e~collections.abc.Mapping\u003c/code\u003e keys order to compare them.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/13634\"\u003e#13634\u003c/a\u003e: Blocking a \u003ccode\u003econftest.py\u003c/code\u003e file using the \u003ccode\u003e-p no:\u003c/code\u003e option is now explicitly disallowed.\u003c/p\u003e\n\u003cp\u003ePreviously this resulted in an internal assertion failure during plugin loading.\u003c/p\u003e\n\u003cp\u003ePytest now raises a clear \u003ccode\u003eUsageError\u003c/code\u003e explaining that conftest files are not plugins and cannot be disabled via \u003ccode\u003e-p\u003c/code\u003e.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/13734\"\u003e#13734\u003c/a\u003e: Fixed crash when a test raises an exceptiongroup with \u003ccode\u003e__tracebackhide__ = True\u003c/code\u003e.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14195\"\u003e#14195\u003c/a\u003e: Fixed an issue where non-string messages passed to \u003c!-- raw HTML omitted --\u003eunittest.TestCase.subTest()\u003c!-- raw HTML omitted --\u003e were not printed.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14343\"\u003e#14343\u003c/a\u003e: Fixed use of insecure temporary directory (CVE-2025-71176).\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eImproved documentation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/13388\"\u003e#13388\u003c/a\u003e: Clarified documentation for \u003ccode\u003e-p\u003c/code\u003e vs \u003ccode\u003ePYTEST_PLUGINS\u003c/code\u003e plugin loading and fixed an incorrect \u003ccode\u003e-p\u003c/code\u003e example.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/13731\"\u003e#13731\u003c/a\u003e: Clarified that capture fixtures (e.g. \u003ccode\u003ecapsys\u003c/code\u003e and \u003ccode\u003ecapfd\u003c/code\u003e) take precedence over the \u003ccode\u003e-s\u003c/code\u003e / \u003ccode\u003e--capture=no\u003c/code\u003e command-line options in \u003ccode\u003eAccessing captured output from a test function \u0026lt;accessing-captured-output\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14088\"\u003e#14088\u003c/a\u003e: Clarified that the default \u003ccode\u003epytest_collection\u003c/code\u003e hook sets \u003ccode\u003esession.items\u003c/code\u003e before it calls \u003ccode\u003epytest_collection_finish\u003c/code\u003e, not after.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14255\"\u003e#14255\u003c/a\u003e: TOML integer log levels must be quoted: Updating reference documentation.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eContributor-facing changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/12689\"\u003e#12689\u003c/a\u003e: The test reports are now published to Codecov from GitHub Actions.\nThe test statistics is visible \u003ca href=\"https://app.codecov.io/gh/pytest-dev/pytest/tests\"\u003eon the web interface\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e-- by \u003ccode\u003ealeguy02\u003c/code\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/a7d58d7a21b78581e636bbbdea13c66ad1657c1e\"\u003e\u003ccode\u003ea7d58d7\u003c/code\u003e\u003c/a\u003e Prepare release version 9.0.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/089d98199c253d8f89a040243bc4f2aa6cd5ab22\"\u003e\u003ccode\u003e089d981\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14366\"\u003e#14366\u003c/a\u003e from bluetech/revert-14193-backport\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/8127eaf4ab7f6b2fdd0dc1b38343ec97aeef05ac\"\u003e\u003ccode\u003e8127eaf\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;Fix: assertrepr_compare respects dict insertion order (\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14050\"\u003e#14050\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14193\"\u003e#14193\u003c/a\u003e)\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/99a7e6029e7a6e8d53e5df114b1346e035370241\"\u003e\u003ccode\u003e99a7e60\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14363\"\u003e#14363\u003c/a\u003e from pytest-dev/patchback/backports/9.0.x/95d8423bd...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/ddee02a578da30dd43aedc39c1c1f1aaadfcee95\"\u003e\u003ccode\u003eddee02a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14343\"\u003e#14343\u003c/a\u003e from bluetech/cve-2025-71176-simple\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/74eac6916fee34726cb194f16c516e96fbd29619\"\u003e\u003ccode\u003e74eac69\u003c/code\u003e\u003c/a\u003e doc: Update training info (\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14298\"\u003e#14298\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14301\"\u003e#14301\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/f92dee777cfdb77d1c43633d02766ddf1f07c869\"\u003e\u003ccode\u003ef92dee7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14267\"\u003e#14267\u003c/a\u003e from pytest-dev/patchback/backports/9.0.x/d6fa26c62...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/7ee58acc8777c31ac6cf388d01addf5a414a7439\"\u003e\u003ccode\u003e7ee58ac\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/12378\"\u003e#12378\u003c/a\u003e from Pierre-Sassoulas/fix-implicit-str-concat-and-d...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/37da870d37e3a2f5177cae075c7b9ae279432bf8\"\u003e\u003ccode\u003e37da870\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14259\"\u003e#14259\u003c/a\u003e from mitre88/patch-4 (\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14268\"\u003e#14268\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/c34bfa3b7acb65b594707c714f1d8461b0304eed\"\u003e\u003ccode\u003ec34bfa3\u003c/code\u003e\u003c/a\u003e Add explanation for string context diffs (\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14257\"\u003e#14257\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14266\"\u003e#14266\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pytest-dev/pytest/compare/9.0.2...9.0.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `flask` from 2.2.5 to 3.1.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pallets/flask/releases\"\u003eflask's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.1.3\u003c/h2\u003e\n\u003cp\u003eThis is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.\u003c/p\u003e\n\u003cp\u003ePyPI: \u003ca href=\"https://pypi.org/project/Flask/3.1.3/\"\u003ehttps://pypi.org/project/Flask/3.1.3/\u003c/a\u003e\nChanges: \u003ca href=\"https://flask.palletsprojects.com/page/changes/#version-3-1-3\"\u003ehttps://flask.palletsprojects.com/page/changes/#version-3-1-3\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe session is marked as accessed for operations that only access the keys but not the values, such as \u003ccode\u003ein\u003c/code\u003e and \u003ccode\u003elen\u003c/code\u003e. \u003ca href=\"https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726\"\u003eGHSA-68rp-wp8r-4726\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.1.2\u003c/h2\u003e\n\u003cp\u003eThis is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.\u003c/p\u003e\n\u003cp\u003ePyPI: \u003ca href=\"https://pypi.org/project/Flask/3.1.2/\"\u003ehttps://pypi.org/project/Flask/3.1.2/\u003c/a\u003e\nChanges: \u003ca href=\"https://flask.palletsprojects.com/page/changes/#version-3-1-2\"\u003ehttps://flask.palletsprojects.com/page/changes/#version-3-1-2\u003c/a\u003e\nMilestone: \u003ca href=\"https://github.com/pallets/flask/milestone/38?closed=1\"\u003ehttps://github.com/pallets/flask/milestone/38?closed=1\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003estream_with_context\u003c/code\u003e does not fail inside async views. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5774\"\u003e#5774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eWhen using \u003ccode\u003efollow_redirects\u003c/code\u003e in the test client, the final state of \u003ccode\u003esession\u003c/code\u003e is correct. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5786\"\u003e#5786\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRelax type hint for passing bytes IO to \u003ccode\u003esend_file\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5776\"\u003e#5776\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.1.1\u003c/h2\u003e\n\u003cp\u003eThis is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.\u003c/p\u003e\n\u003cp\u003ePyPI: \u003ca href=\"https://pypi.org/project/Flask/3.1.1/\"\u003ehttps://pypi.org/project/Flask/3.1.1/\u003c/a\u003e\nChanges: \u003ca href=\"https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1\"\u003ehttps://flask.palletsprojects.com/en/stable/changes/#version-3-1-1\u003c/a\u003e\nMilestone \u003ca href=\"https://github.com/pallets/flask/milestone/36?closed=1\"\u003ehttps://github.com/pallets/flask/milestone/36?closed=1\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix signing key selection order when key rotation is enabled via \u003ccode\u003eSECRET_KEY_FALLBACKS\u003c/code\u003e. GHSA-4grg-w6v8-c28g\u003c/li\u003e\n\u003cli\u003eFix type hint for \u003ccode\u003ecli_runner.invoke\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5645\"\u003e#5645\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eflask --help\u003c/code\u003e loads the app and plugins first to make sure all commands are shown. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5673\"\u003e#5673\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMark sans-io base class as being able to handle views that return \u003ccode\u003eAsyncIterable\u003c/code\u003e. This is not accurate for Flask, but makes typing easier for Quart. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5659\"\u003e#5659\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.1.0\u003c/h2\u003e\n\u003cp\u003eThis is the Flask 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such as \u003ca href=\"https://pypi.org/project/pip-tools/\"\u003epip-tools\u003c/a\u003e to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.\u003c/p\u003e\n\u003cp\u003ePyPI: \u003ca href=\"https://pypi.org/project/Flask/3.1.0/\"\u003ehttps://pypi.org/project/Flask/3.1.0/\u003c/a\u003e\nChanges: \u003ca href=\"https://flask.palletsprojects.com/en/stable/changes/#version-3-1-0\"\u003ehttps://flask.palletsprojects.com/en/stable/changes/#version-3-1-0\u003c/a\u003e\nMilestone: \u003ca href=\"https://github.com/pallets/flask/milestone/33?closed=1\"\u003ehttps://github.com/pallets/flask/milestone/33?closed=1\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDrop support for Python 3.8. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5623\"\u003e#5623\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate minimum dependency versions to latest feature releases. Werkzeug \u0026gt;= 3.1, ItsDangerous \u0026gt;= 2.2, Blinker \u0026gt;= 1.9. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5624\"\u003e#5624\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5633\"\u003e#5633\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eProvide a configuration option to control automatic option responses. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5496\"\u003e#5496\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eFlask.open_resource\u003c/code\u003e/\u003ccode\u003eopen_instance_resource\u003c/code\u003e and \u003ccode\u003eBlueprint.open_resource\u003c/code\u003e take an \u003ccode\u003eencoding\u003c/code\u003e parameter to use when opening in text mode. It defaults to \u003ccode\u003eutf-8\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5504\"\u003e#5504\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eRequest.max_content_length\u003c/code\u003e can be customized per-request instead of only through the \u003ccode\u003eMAX_CONTENT_LENGTH\u003c/code\u003e config. Added \u003ccode\u003eMAX_FORM_MEMORY_SIZE\u003c/code\u003e and \u003ccode\u003eMAX_FORM_PARTS\u003c/code\u003e config. Added documentation about resource limits to the security page. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5625\"\u003e#5625\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for the \u003ccode\u003ePartitioned\u003c/code\u003e cookie attribute (CHIPS), with the \u003ccode\u003eSESSION_COOKIE_PARTITIONED\u003c/code\u003e config. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5472\"\u003e#5472\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e-e path\u003c/code\u003e takes precedence over default \u003ccode\u003e.env\u003c/code\u003e and \u003ccode\u003e.flaskenv\u003c/code\u003e files. \u003ccode\u003eload_dotenv\u003c/code\u003e loads default files in addition to a path unless \u003ccode\u003eload_defaults=False\u003c/code\u003e is passed. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5628\"\u003e#5628\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport key rotation with the \u003ccode\u003eSECRET_KEY_FALLBACKS\u003c/code\u003e config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5621\"\u003e#5621\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix how setting \u003ccode\u003ehost_matching=True\u003c/code\u003e or \u003ccode\u003esubdomain_matching=False\u003c/code\u003e interacts with \u003ccode\u003eSERVER_NAME\u003c/code\u003e. Setting \u003ccode\u003eSERVER_NAME\u003c/code\u003e no longer restricts requests to only that domain. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5553\"\u003e#5553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eRequest.trusted_hosts\u003c/code\u003e is checked during routing, and can be set through the \u003ccode\u003eTRUSTED_HOSTS\u003c/code\u003e config. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5636\"\u003e#5636\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.0.3\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pallets/flask/blob/main/CHANGES.rst\"\u003eflask's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 3.1.3\u003c/h2\u003e\n\u003cp\u003eReleased 2026-02-18\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe session is marked as accessed for operations that only access the keys\nbut not the values, such as \u003ccode\u003ein\u003c/code\u003e and \u003ccode\u003elen\u003c/code\u003e. :ghsa:\u003ccode\u003e68rp-wp8r-4726\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 3.1.2\u003c/h2\u003e\n\u003cp\u003eReleased 2025-08-19\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003estream_with_context\u003c/code\u003e does not fail inside async views. :issue:\u003ccode\u003e5774\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eWhen using \u003ccode\u003efollow_redirects\u003c/code\u003e in the test client, the final state\nof \u003ccode\u003esession\u003c/code\u003e is correct. :issue:\u003ccode\u003e5786\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eRelax type hint for passing bytes IO to \u003ccode\u003esend_file\u003c/code\u003e. :issue:\u003ccode\u003e5776\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 3.1.1\u003c/h2\u003e\n\u003cp\u003eReleased 2025-05-13\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix signing key selection order when key rotation is enabled via\n\u003ccode\u003eSECRET_KEY_FALLBACKS\u003c/code\u003e. :ghsa:\u003ccode\u003e4grg-w6v8-c28g\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFix type hint for \u003ccode\u003ecli_runner.invoke\u003c/code\u003e. :issue:\u003ccode\u003e5645\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eflask --help\u003c/code\u003e loads the app and plugins first to make sure all commands\nare shown. :issue:\u003ccode\u003e5673\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eMark sans-io base class as being able to handle views that return\n\u003ccode\u003eAsyncIterable\u003c/code\u003e. This is not accurate for Flask, but makes typing easier\nfor Quart. :pr:\u003ccode\u003e5659\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 3.1.0\u003c/h2\u003e\n\u003cp\u003eReleased 2024-11-13\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDrop support for Python 3.8. :pr:\u003ccode\u003e5623\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eUpdate minimum dependency versions to latest feature releases.\nWerkzeug \u0026gt;= 3.1, ItsDangerous \u0026gt;= 2.2, Blinker \u0026gt;= 1.9. :pr:\u003ccode\u003e5624,5633\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eProvide a configuration option to control automatic option\nresponses. :pr:\u003ccode\u003e5496\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eFlask.open_resource\u003c/code\u003e/\u003ccode\u003eopen_instance_resource\u003c/code\u003e and\n\u003ccode\u003eBlueprint.open_resource\u003c/code\u003e take an \u003ccode\u003eencoding\u003c/code\u003e parameter to use when\nopening in text mode. It defaults to \u003ccode\u003eutf-8\u003c/code\u003e. :issue:\u003ccode\u003e5504\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eRequest.max_content_length\u003c/code\u003e can be customized per-request instead of only\nthrough the \u003ccode\u003eMAX_CONTENT_LENGTH\u003c/code\u003e config. Added\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/22d924701a6ae2e4cd01e9a15bbaf3946094af65\"\u003e\u003ccode\u003e22d9247\u003c/code\u003e\u003c/a\u003e release version 3.1.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4\"\u003e\u003ccode\u003e089cb86\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/c17f379390731543eea33a570a47bd4ef76a54fa\"\u003e\u003ccode\u003ec17f379\u003c/code\u003e\u003c/a\u003e request context tracks session access\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/27be9338405382445a7cb01151e084559b98d602\"\u003e\u003ccode\u003e27be933\u003c/code\u003e\u003c/a\u003e start version 3.1.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/4e652d3f68b90d50aa2301d3b7e68c3fafd9251d\"\u003e\u003ccode\u003e4e652d3\u003c/code\u003e\u003c/a\u003e Abort if the instance folder cannot be created (\u003ca href=\"https://redirect.github.com/pallets/flask/issues/5903\"\u003e#5903\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/3d03098a97ddc6a908aa4a50c2ef7381f8297d0a\"\u003e\u003ccode\u003e3d03098\u003c/code\u003e\u003c/a\u003e Abort if the instance folder cannot be created\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/407eb76b27884848383a37c7274654f0271e4bc4\"\u003e\u003ccode\u003e407eb76\u003c/code\u003e\u003c/a\u003e document using gevent for async (\u003ca href=\"https://redirect.github.com/pallets/flask/issues/5900\"\u003e#5900\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/ac5664d2281533eacafd64f5cc7d5edcdaccab60\"\u003e\u003ccode\u003eac5664d\u003c/code\u003e\u003c/a\u003e document using gevent for async\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/4f79d5b59a56bc4356a97f2e81a35f98cb18d7b3\"\u003e\u003ccode\u003e4f79d5b\u003c/code\u003e\u003c/a\u003e Increase required flit_core version to 3.11 (\u003ca href=\"https://redirect.github.com/pallets/flask/issues/5865\"\u003e#5865\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/fe3b215d3ade4db68262dae1a3cdc464a1fc524f\"\u003e\u003ccode\u003efe3b215\u003c/code\u003e\u003c/a\u003e Increase required flit_core version to 3.11\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pallets/flask/compare/2.2.5...3.1.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lxml` from 4.9.2 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/releases\"\u003elxml's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elxml-6.1.0\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.4\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.3\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.2\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.1\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.0\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-5.4.0\u003c/h2\u003e\n\u003ch1\u003e5.4.0 (2025-04-22)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2107279: Binary wheels use libxml2 2.13.8 and libxslt 1.1.43 to resolve several CVEs.\n(Binary wheels for Windows continue to use a patched libxml2 2.11.9 and libxslt 1.1.39.)\nIssue found by Anatoly Katyushin, see \u003ca href=\"https://bugs.launchpad.net/lxml/+bug/2107279\"\u003ehttps://bugs.launchpad.net/lxml/+bug/2107279\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003elxml-5.3.2\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-5.3.1\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-5.3.0\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-5.2.2\u003c/h2\u003e\n\u003ch1\u003e5.2.2 (2024-05-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#417: The \u003ccode\u003etest_feed_parser\u003c/code\u003e test could fail if \u003ccode\u003elxml_html_clean\u003c/code\u003e was not installed.\nIt is now skipped in that case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2059910: The minimum CPU architecture for the Linux x86 binary wheels was set back to\n\u0026quot;core2\u0026quot;, without SSE 4.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.3 (2026-04-09)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSeveral out of memory error cases now raise \u003ccode\u003eMemoryError\u003c/code\u003e that were not handled before.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSlicing with large step values (outside of \u003ccode\u003e+/- sys.maxsize\u003c/code\u003e) could trigger undefined C behaviour.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2125399: Some failing tests were fixed or disabled in PyPy.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2138421: Memory leak in error cases when setting the \u003ccode\u003epublic_id\u003c/code\u003e or \u003ccode\u003esystem_url\u003c/code\u003e of a document.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c7d76d6cb817c8e1f316e43b16cab5e6ad669ad0\"\u003e\u003ccode\u003ec7d76d6\u003c/code\u003e\u003c/a\u003e Change security policy to point to Github security advisories.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/378ccf82db8160928807c55ed580c0443aa94f42\"\u003e\u003ccode\u003e378ccf8\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/315270b810a9e3276c60daba549299d204ac962b\"\u003e\u003ccode\u003e315270b\u003c/code\u003e\u003c/a\u003e Docs: Reduce TOC depth of package pages and move module contents first.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6dbba7f3c72f655b05b26ef453fdee31af13ccf5\"\u003e\u003ccode\u003e6dbba7f\u003c/code\u003e\u003c/a\u003e Docs: Show current year in copyright line.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/e4385bfa5d79527350d5ef17372fb70ba80b4cce\"\u003e\u003ccode\u003ee4385bf\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5bed1e1a227cd9ba5a879aaeacdf504093a3f6e8\"\u003e\u003ccode\u003e5bed1e1\u003c/code\u003e\u003c/a\u003e Validate file hashes in release download script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c13ee10a429f1144779bb1cbf6ae3bec808ae9c1\"\u003e\u003ccode\u003ec13ee10\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.0.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-4.9.2...lxml-6.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pillow` from 12.1.1 to 12.2.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/python-pillow/Pillow/releases\"\u003epillow's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e12.2.0\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html\"\u003ehttps://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eDocumentation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate 12.2.0 release notes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9522\"\u003e#9522\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd loader plugins: AMOS abk, Atari Degas, 40+ more obscure formats via Netpbm \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9482\"\u003e#9482\u003c/a\u003e [\u003ca href=\"https://github.com/bitplane\"\u003e\u003ccode\u003e@​bitplane\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate Python versions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9515\"\u003e#9515\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eJeffrey A. Clark -\u0026gt; Jeffrey 'Alex' Clark \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9513\"\u003e#9513\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd release notes for \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9394\"\u003e#9394\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9419\"\u003e#9419\u003c/a\u003e and \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9456\"\u003e#9456\u003c/a\u003e \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9467\"\u003e#9467\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd Amiga Workbench .info loader to 3rd party plugins list \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9459\"\u003e#9459\u003c/a\u003e [\u003ca href=\"https://github.com/bitplane\"\u003e\u003ccode\u003e@​bitplane\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eMerge PFM documentation into PPM \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9434\"\u003e#9434\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate macOS tested Pillow versions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9431\"\u003e#9431\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eFix CVE number \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9430\"\u003e#9430\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependencies\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate xz to 5.8.3 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9523\"\u003e#9523\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate libjpeg-turbo to 3.1.4.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9507\"\u003e#9507\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate libpng to 1.6.56 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9499\"\u003e#9499\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate freetype to 2.14.3 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9485\"\u003e#9485\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdated libavif to 1.4.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9479\"\u003e#9479\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdated harfbuzz to 13.2.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9461\"\u003e#9461\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate Ghostscript to 10.7.0 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9469\"\u003e#9469\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate harfbuzz to 13.0.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9453\"\u003e#9453\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate libavif to 1.4.0 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9460\"\u003e#9460\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate freetype to 2.14.2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9449\"\u003e#9449\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate actions/download-artifact action to v8 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9451\"\u003e#9451\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdated libpng to 1.6.55 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9425\"\u003e#9425\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eTesting\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCleanup .spider extension in the same test where it is added \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9517\"\u003e#9517\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eRun tests in parallel via tox for 3.5x speedup \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9516\"\u003e#9516\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eEnable colour in CI logs \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9486\"\u003e#9486\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate Ghostscript to 10.7.0 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9469\"\u003e#9469\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eSimplify TGA test code \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9477\"\u003e#9477\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate tests to check for ValueError when encoding an empty image \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9464\"\u003e#9464\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpgrade CI from \u003ccode\u003emacos-15-intel\u003c/code\u003e to \u003ccode\u003emacos-26-intel\u003c/code\u003e \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9454\"\u003e#9454\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd check-case-conflict hook \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9446\"\u003e#9446\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eSpecify platform when pulling docker image \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9440\"\u003e#9440\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eGHA: Cache libavif and webp builds for Ubuntu \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9437\"\u003e#9437\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate macOS tested Pillow versions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9431\"\u003e#9431\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eOther changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck calloc return value \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9527\"\u003e#9527\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eCheck all allocs in the Arrow tree \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9488\"\u003e#9488\u003c/a\u003e [\u003ca href=\"https://github.com/wiredfool\"\u003e\u003ccode\u003e@​wiredfool\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eReject non-numeric elements inside list coords \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9526\"\u003e#9526\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eMove variable declaration inside define \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9525\"\u003e#9525\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/3c41c095064200a02672d89cc5ff629eaf4b0d4f\"\u003e\u003ccode\u003e3c41c09\u003c/code\u003e\u003c/a\u003e 12.2.0 version bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/cdaa29eb520291c4f1fb50fb71ae46502d41e460\"\u003e\u003ccode\u003ecdaa29e\u003c/code\u003e\u003c/a\u003e Check calloc return value (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9527\"\u003e#9527\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/585b2f5a780722c8a5bfffb3a40f7f42e8a205be\"\u003e\u003ccode\u003e585b2f5\u003c/code\u003e\u003c/a\u003e Check calloc return value\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/ecf011ea15991d4cebacd946e58270cc30b0f2c1\"\u003e\u003ccode\u003eecf011e\u003c/code\u003e\u003c/a\u003e Check all allocs in the Arrow tree (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9488\"\u003e#9488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/cf6de8ca9b23e714aa5310e1c791eda66fc0b670\"\u003e\u003ccode\u003ecf6de8c\u003c/code\u003e\u003c/a\u003e Reject non-numeric elements inside list coords (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9526\"\u003e#9526\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/ffdcede6516b28d9667c92929854023d17048b64\"\u003e\u003ccode\u003effdcede\u003c/code\u003e\u003c/a\u003e Update 12.2.0 release notes (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9522\"\u003e#9522\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/7929d7760fe5a307ba5ae6eabdf70ae4486b147c\"\u003e\u003ccode\u003e7929d77\u003c/code\u003e\u003c/a\u003e Added security release notes (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/149\"\u003e#149\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/c4f7aa5dfb4dbd1242978ac235e01b9934ec6d3c\"\u003e\u003ccode\u003ec4f7aa5\u003c/code\u003e\u003c/a\u003e Added security release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/22cdb5f2e4b15250c06563b1124ac1667342712f\"\u003e\u003ccode\u003e22cdb5f\u003c/code\u003e\u003c/a\u003e Move variable declaration inside define (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9525\"\u003e#9525\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/fc15b3b01899408ec989d7804c5283e13802d057\"\u003e\u003ccode\u003efc15b3b\u003c/code\u003e\u003c/a\u003e Resize tall images vertically first (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9524\"\u003e#9524\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/python-pillow/Pillow/compare/12.1.1...12.2.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pyjwt` from 2.6.0 to 2.13.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/releases\"\u003epyjwt's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.13.0\u003c/h2\u003e\n\u003ch1\u003ePyJWT 2.13.0 — Security Release\u003c/h1\u003e\n\u003cp\u003eThis release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\"\u003e\u003ccode\u003eGHSA-xgmm-8j9v-c9wx\u003c/code\u003e\u003c/a\u003e — JWK JSON accepted as HMAC secret (algorithm confusion).\u003c/strong\u003e \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in \u003ccode\u003ealgorithms=[…]\u003c/code\u003e and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. \u003cem\u003eReported by \u003ca href=\"https://github.com/aradona91\"\u003e\u003ccode\u003e@​aradona91\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\"\u003e\u003ccode\u003eGHSA-jq35-7prp-9v3f\u003c/code\u003e\u003c/a\u003e — Algorithm allow-list bypass with \u003ccode\u003ePyJWK\u003c/code\u003e / \u003ccode\u003ePyJWKClient\u003c/code\u003e.\u003c/strong\u003e When verifying with a \u003ccode\u003ePyJWK\u003c/code\u003e, the caller's \u003ccode\u003ealgorithms=[…]\u003c/code\u003e allow-list was checked against the token header \u003ccode\u003ealg\u003c/code\u003e as a string only; actual verification used the algorithm bound to the \u003ccode\u003ePyJWK\u003c/code\u003e. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header \u003ccode\u003ealg\u003c/code\u003e to match the \u003ccode\u003ePyJWK\u003c/code\u003e's algorithm before verification. \u003cem\u003eReported by \u003ca href=\"https://github.com/sushi-gif\"\u003e\u003ccode\u003e@​sushi-gif\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\"\u003e\u003ccode\u003eGHSA-w7vc-732c-9m39\u003c/code\u003e\u003c/a\u003e — DoS via base64 decode of unused payload segment when \u003ccode\u003eb64=false\u003c/code\u003e.\u003c/strong\u003e For detached-payload JWS (\u003ccode\u003eb64=false\u003c/code\u003e), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied \u003ccode\u003edetached_payload\u003c/code\u003e. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. \u003cem\u003eReported by \u003ca href=\"https://github.com/thesmartshadow\"\u003e\u003ccode\u003e@​thesmartshadow\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\"\u003e\u003ccode\u003eGHSA-993g-76c3-p5m4\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e accepts non-HTTP(S) URIs.\u003c/strong\u003e \u003ccode\u003ePyJWKClient.fetch_data\u003c/code\u003e passed its URI to \u003ccode\u003eurllib.request.urlopen\u003c/code\u003e, which by default also handles \u003ccode\u003efile://\u003c/code\u003e, \u003ccode\u003eftp://\u003c/code\u003e, and \u003ccode\u003edata:\u003c/code\u003e schemes. An application that fed an attacker-influenced URI into \u003ccode\u003ePyJWKClient\u003c/code\u003e could be coerced into reading local files or reaching other unintended schemes. \u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects any URI whose scheme isn't \u003ccode\u003ehttp\u003c/code\u003e or \u003ccode\u003ehttps\u003c/code\u003e. \u003cem\u003eReported by \u003ca href=\"https://github.com/KEIJOT\"\u003e\u003ccode\u003e@​KEIJOT\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\"\u003e\u003ccode\u003eGHSA-fhv5-28vv-h8m8\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e cache wiped on fetch error.\u003c/strong\u003e A \u003ccode\u003efinally\u003c/code\u003e-block \u003ccode\u003eput(jwk_set=None)\u003c/code\u003e cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. \u003cem\u003eReported by \u003ca href=\"https://github.com/eddieran\"\u003e\u003ccode\u003e@​eddieran\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReject empty HMAC keys outright in \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e with \u003ccode\u003eInvalidKeyError\u003c/code\u003e instead of accepting them with only a warning. Defends against the \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e footgun. \u003cem\u003eThanks to \u003ca href=\"https://github.com/SnailSploit\"\u003e\u003ccode\u003e@​SnailSploit\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"https://github.com/spartan8806\"\u003e\u003ccode\u003e@​spartan8806\u003c/code\u003e\u003c/a\u003e for the reports.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003eForward per-call \u003ccode\u003eoptions\u003c/code\u003e (including \u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e) from \u003ccode\u003ePyJWT.decode\u003c/code\u003e through to \u003ccode\u003ePyJWS._verify_signature\u003c/code\u003e. The option was previously silently dropped between the two layers, so it only took effect when set on the \u003ccode\u003ePyJWT\u003c/code\u003e instance. \u003cem\u003eThanks to \u003ca href=\"https://github.com/WLUB\"\u003e\u003ccode\u003e@​WLUB\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRFC 7797 §3 compliance for \u003ccode\u003eb64=false\u003c/code\u003e:\u003c/strong\u003e the encoder now auto-adds \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e to \u003ccode\u003ecrit\u003c/code\u003e, and the decoder rejects tokens that set \u003ccode\u003eb64=false\u003c/code\u003e without listing it in \u003ccode\u003ecrit\u003c/code\u003e. \u003cem\u003eThanks to \u003ca href=\"https://github.com/MachineLearning-Nerd\"\u003e\u003ccode\u003e@​MachineLearning-Nerd\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eChanged\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups, by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/pull/1152\"\u003e#1152\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eUpgrade notes\u003c/h2\u003e\n\u003cp\u003eMost fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eEmpty HMAC keys now raise.\u003c/strong\u003e If your app passed \u003ccode\u003e\u0026quot;\u0026quot;\u003c/code\u003e or \u003ccode\u003eb\u0026quot;\u0026quot;\u003c/code\u003e as a secret (often via a missing env var, e.g. \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e), \u003ccode\u003eencode\u003c/code\u003e/\u003ccode\u003edecode\u003c/code\u003e will now raise \u003ccode\u003eInvalidKeyError\u003c/code\u003e. This is the intended behavior — fix the configuration.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWK\u003c/code\u003e decoding now requires the token's \u003ccode\u003ealg\u003c/code\u003e to match the JWK's algorithm.\u003c/strong\u003e Previously a mismatch was silently honored if the header \u003ccode\u003ealg\u003c/code\u003e appeared in the allow-list. Tokens that relied on this mismatch will now fail with \u003ccode\u003eInvalidAlgorithmError\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects non-HTTP(S) URIs at construction time.\u003c/strong\u003e Tests or dev environments that fetched JWKS from \u003ccode\u003efile://\u003c/code\u003e URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct \u003ccode\u003ePyJWKSet.from_dict(...)\u003c/code\u003e directly).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eb64=false\u003c/code\u003e tokens are now strictly RFC 7515 / 7797 compliant.\u003c/strong\u003e Tokens with a non-empty compact-form payload segment, or that omit \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e from \u003ccode\u003ecrit\u003c/code\u003e, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e set per-call now takes effect.\u003c/strong\u003e Callers who passed \u003ccode\u003eoptions={\u0026quot;enforce_minimum_key_length\u0026quot;: True}\u003c/code\u003e to \u003ccode\u003ejwt.decode()\u003c/code\u003e previously got no enforcement; they will now get \u003ccode\u003eInvalidKeyError\u003c/code\u003e on undersized keys, as documented.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull changelog:\u003c/strong\u003e \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\"\u003ehttps://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e2.12.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd typing_extensions dependency for Python \u0026lt; 3.11 by \u003ca href=\"https://github.com/jpadilla\"\u003e\u003ccode\u003e@​jpadilla\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/pull/1151\"\u003ejpadilla/pyjwt#1151\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\"\u003ehttps://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e2.12.0\u003c/h2\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eValidate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by \u003ca href=\"https://github.com/dmbs335\"\u003e\u003ccode\u003e@​dmbs335\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f\"\u003eGHSA-752w-5fwx-jx9f\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst\"\u003epyjwt's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ccode\u003ev2.13.0 \u0026lt;https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u0026gt;\u003c/code\u003e__\u003c/h2\u003e\n\u003cp\u003eSecurity\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject JWK JSON documents passed as raw HMAC secrets in\n  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that\n  the existing PEM/SSH guard did not cover. Reported by @aradona91 in\n  `GHSA-xgmm-8j9v-c9wx \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\u0026gt;`__.\n- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during\n  verification so the caller's ``algorithms=[...]`` allow-list cannot be\n  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported\n  by @sushi-gif in `GHSA-jq35-7prp-9v3f \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\u0026gt;`__.\n- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-\n  influenced URIs cannot read local files or reach unintended schemes via\n  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported\n  by @KEIJOT in `GHSA-993g-76c3-p5m4 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\u0026gt;`__.\n- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.\n  The previous ``finally``-block ``put(None)`` pattern cleared the cache\n  on any transient outage, turning one bad JWKS request into application-\n  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\u0026gt;`__.\n- Skip the unconditional base64 decode of the compact-form payload segment\n  when ``b64=false`` is set in the protected header, and require that\n  segment to be empty (RFC 7515 Appendix F detached form). Closes an\n  unauthenticated DoS amplifier. Reported by @thesmartshadow in\n  `GHSA-w7vc-732c-9m39 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\u0026gt;`__.\n\u003cp\u003eFixed\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with\n  ``InvalidKeyError`` instead of accepting them with only a warning.\n  Thanks to @SnailSploit and @spartan8806 for independently flagging the\n  footgun.\n- Forward per-call ``options`` (including ``enforce_minimum_key_length``)\n  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the\n  option actually takes effect when set at the call site rather than only\n  on the ``PyJWT`` instance. Thanks to @WLUB for the report.\n- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds\n  ``\u0026amp;quot;b64\u0026amp;quot;`` to the ``crit`` header parameter, and the decoder rejects\n  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to\n  @MachineLearning-Nerd for the report.\n\nChanged\n\u003c/code\u003e\u003c/pre\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ccode\u003e[#1152](https://github.com/jpadilla/pyjwt/issues/1152) \u0026amp;lt;https://github.com/jpadilla/pyjwt/pull/1152\u0026amp;gt;\u003c/code\u003e__\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ccode\u003ev2.12.1 \u0026amp;lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\u0026amp;gt;\u003c/code\u003e__\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt;\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff\"\u003e\u003ccode\u003e7144e45\u003c/code\u003e\u003c/a\u003e Apply ruff format\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab\"\u003e\u003ccode\u003ed2f4bec\u003c/code\u003e\u003c/a\u003e Restore \u003ccode\u003ecast()\u003c/code\u003e calls with cross-version \u003ccode\u003etype: ignore\u003c/code\u003e for \u003ccode\u003eprepare_key\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774\"\u003e\u003ccode\u003e22f478c\u003c/code\u003e\u003c/a\u003e Remove redundant casts in \u003ccode\u003eRSAAlgorithm.prepare_key\u003c/code\u003e and `ECAlgorithm.prepare...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81\"\u003e\u003ccode\u003e95791b1\u003c/code\u003e\u003c/a\u003e Bundle security fixes and hardening into 2.13.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508\"\u003e\u003ccode\u003edcc27a9\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1155\"\u003e#1155\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a\"\u003e\u003ccode\u003e9d08a9a\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1146\"\u003e#1146\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64\"\u003e\u003ccode\u003eb87c100\u003c/code\u003e\u003c/a\u003e Bump codecov/codecov-action from 5 to 6 (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1154\"\u003e#1154\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812\"\u003e\u003ccode\u003e40e3147\u003c/code\u003e\u003c/a\u003e Migrate development extras to dependency groups (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1152\"\u003e#1152\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/a4e1a3d1218b01c5806420b8f16d9308ac4adc30\"\u003e\u003ccode\u003ea4e1a3d\u003c/code\u003e\u003c/a\u003e Add typing_extensions dependency for Python \u0026lt; 3.11 (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1151\"\u003e#1151\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/bd9700cca7f9258fadcc429c1034e508025931f2\"\u003e\u003ccode\u003ebd9700c\u003c/code\u003e\u003c/a\u003e Use PyJWK algorithm when encoding without explicit algorithm (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1148\"\u003e#1148\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.6.0...2.13.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pypdf` from 6.7.1 to 6.13.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/py-pdf/pypdf/releases\"\u003epypdf's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.13.3, 2026-06-17\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eApply MAX_DECLARED_STREAM_LENGTH to streams without length as well (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3871\"\u003e#3871\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance Improvements (PI)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAvoid per-pixel getpixel loop for 1-bit indexed images (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3854\"\u003e#3854\u003c/a\u003e) by \u003ca href=\"https://github.com/Samuel-Harris\"\u003e\u003ccode\u003e@​Samuel-Harris\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSeveral fixes by \u003ca href=\"https://github.com/metsw24-max\"\u003e\u003ccode\u003e@​metsw24-max\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaintenance (MAINT)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMake mypy assert messages consistent (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3849\"\u003e#3849\u003c/a\u003e) by \u003ca href=\"https://github.com/j-t-1\"\u003e\u003ccode\u003e@​j-t-1\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.13.2...6.13.3\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.13.2, 2026-06-10\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDetect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3847\"\u003e#3847\u003c/a\u003e) by \u003ca href=\"https://github.com/fredericoschardong\"\u003e\u003ccode\u003e@​fredericoschardong\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix UnboundLocalError in _read_standard_xref_table on a malformed entry (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3841\"\u003e#3841\u003c/a\u003e) by \u003ca href=\"https://github.com/joszamama\"\u003e\u003ccode\u003e@​joszamama\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRaise PdfStreamError on non-hexadecimal bytes in hex readers (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3832\"\u003e#3832\u003c/a\u003e) by \u003ca href=\"https://github.com/metsw24-max\"\u003e\u003ccode\u003e@​metsw24-max\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.13.1...6.13.2\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.13.1, 2026-06-08\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePrevent infinite loops when processing threads/articles (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3839\"\u003e#3839\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.13.0...6.13.1\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.13.0, 2026-06-05\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAvoid infinite loops for outlines and text extraction (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3830\"\u003e#3830\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Japanese predefined CMaps (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3800\"\u003e#3800\u003c/a\u003e) by \u003ca href=\"https://github.com/yasuhiroiwaki\"\u003e\u003ccode\u003e@​yasuhiroiwaki\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFont: Collect all character widths, not only those that can be unicode mapped (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3798\"\u003e#3798\u003c/a\u003e) by \u003ca href=\"https://github.com/PJBrs\"\u003e\u003ccode\u003e@​PJBrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRecover a corrupt trailing startxref pointer (closes \u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3238\"\u003e#3238\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3826\"\u003e#3826\u003c/a\u003e) by \u003ca href=\"https://github.com/gaoflow\"\u003e\u003ccode\u003e@​gaoflow\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eHandle /Pages node without /Kids during flattening (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3825\"\u003e#3825\u003c/a\u003e) by \u003ca href=\"https://github.com/gaoflow\"\u003e\u003ccode\u003e@​gaoflow\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md\"\u003epypdf's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.13.3, 2026-06-17\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eApply MAX_DECLARED_STREAM_LENGTH to streams without length as well (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3871\"\u003e#3871\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance Improvements (PI)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAvoid per-pixel getpixel loop for 1-bit indexed images (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3854\"\u003e#3854\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSeveral fixes\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaintenance (MAINT)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMake mypy assert messages consistent (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3849\"\u003e#3849\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.13.2...6.13.3\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.13.2, 2026-06-10\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDetect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3847\"\u003e#3847\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix UnboundLocalError in _read_standard_xref_table on a malformed entry (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3841\"\u003e#3841\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRaise PdfStreamError on non-hexadecimal bytes in hex readers (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3832\"\u003e#3832\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.13.1...6.13.2\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.13.1, 2026-06-08\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePrevent infinite loops when processing threads/articles (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3839\"\u003e#3839\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.13.0...6.13.1\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.13.0, 2026-06-05\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAvoid infinite loops for outlines and text extraction (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3830\"\u003e#3830\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Japanese predefined CMaps (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3800\"\u003e#3800\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFont: Collect all character widths, not only those that can be unicode mapped (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3798\"\u003e#3798\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRecover a corrupt trailing startxref pointer (closes \u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3238\"\u003e#3238\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3826\"\u003e#3826\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eHandle /Pages node without /Kids during flattening (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3825\"\u003e#3825\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAccept inline image EI marker at the end of a content stream (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3827\"\u003e#3827\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaintenance (MAINT)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eType the always-raising deprecation helpers as \u003ccode\u003eNoReturn\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3819\"\u003e#3819\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/9aa05e7bde29a55e3ddb938347082e0d6e333e17\"\u003e\u003ccode\u003e9aa05e7\u003c/code\u003e\u003c/a\u003e REL: 6.13.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/bbd083d1196d276d9c542418f77ac49e06de3ff1\"\u003e\u003ccode\u003ebbd083d\u003c/code\u003e\u003c/a\u003e SEC: Apply MAX_DECLARED_STREAM_LENGTH to streams without length as well (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3871\"\u003e#3871\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/d5cd26622a871635cb8bc6ae0552c843681b5a6e\"\u003e\u003ccode\u003ed5cd266\u003c/code\u003e\u003c/a\u003e ROB: Guard text operators against missing operands in extract_text (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3861\"\u003e#3861\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/82f1f902a466a42c0e586afdfb35227825572df4\"\u003e\u003ccode\u003e82f1f90\u003c/code\u003e\u003c/a\u003e ROB: Tolerate malformed /Limits in index2label (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3858\"\u003e#3858\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/0276a6fa03a1304a87dfc610ae0335b563cb8788\"\u003e\u003ccode\u003e0276a6f\u003c/code\u003e\u003c/a\u003e PI: Avoid per-pixel getpixel loop for 1-bit indexed images (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3854\"\u003e#3854\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/41a9c3c54f2de0fcb0151e796178c2ed5acb5f79\"\u003e\u003ccode\u003e41a9c3c\u003c/code\u003e\u003c/a\u003e MAINT: Make mypy assert messages consistent (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3849\"\u003e#3849\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/d1bba60c8e22e6fe23d23998dbaea6ea713868e2\"\u003e\u003ccode\u003ed1bba60\u003c/code\u003e\u003c/a\u003e MAINT: Increase readability of PdfDocCommon (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3834\"\u003e#3834\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/53b6fbc71d8596d52002026b821c3436e62060fe\"\u003e\u003ccode\u003e53b6fbc\u003c/code\u003e\u003c/a\u003e DEV: Bump codecov/codecov-action from 6.0.1 to 7.0.0 (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3859\"\u003e#3859\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/e07c223a67fcbaf3fb29b511b65cb5de650edd17\"\u003e\u003ccode\u003ee07c223\u003c/code\u003e\u003c/a\u003e MAINT: Enforce G004 (no f-strings in logging) (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3845\"\u003e#3845\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/5270f76027c5a41be3247b661b58f435e8be479b\"\u003e\u003ccode\u003e5270f76\u003c/code\u003e\u003c/a\u003e ROB: Guard zero unitsPerEm in from_truetype_font_file (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3846\"\u003e#3846\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.7.1...6.13.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `python-dotenv` from 1.2.1 to 1.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/theskumar/python-dotenv/releases\"\u003epython-dotenv's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.2.2\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for Python 3.14, including the free-threaded (3.14t) build. (#)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003edotenv run\u003c/code\u003e command now forwards flags directly to the specified command by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/607\"\u003etheskumar/python-dotenv#607\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved documentation clarity regarding override behavior and the reference page.\u003c/li\u003e\n\u003cli\u003eUpdated PyPy support to version 3.11.\u003c/li\u003e\n\u003cli\u003eDocumentation for FIFO file support.\u003c/li\u003e\n\u003cli\u003eSupport for Python 3.9.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved \u003ccode\u003eset_key\u003c/code\u003e and \u003ccode\u003eunset_key\u003c/code\u003e behavior when interacting with symlinks by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311\"\u003e#790c5\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCorrected the license specifier and added missing Python 3.14 classifiers in package metadata by \u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/590\"\u003etheskumar/python-dotenv#590\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e and \u003ccode\u003edotenv.unset_key\u003c/code\u003e used to follow symlinks in some\nsituations. This is no longer the case. For that behavior to be restored in\nall cases, \u003ccode\u003efollow_symlinks=True\u003c/code\u003e should be used.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the CLI, \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e used to follow symlinks in some situations. This\nis no longer the case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e, \u003ccode\u003edotenv.unset_key\u003c/code\u003e and the CLI commands \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e\nused to reset the file mode of the modified .env file to \u003ccode\u003e0o600\u003c/code\u003e in some\nsituations. This is no longer the case: The original mode of the file is now\npreserved. Is the file needed to be created or wasn't a regular file, mode\n\u003ccode\u003e0o600\u003c/code\u003e is used.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eskip 000 permission tests for root user by \u003ca href=\"https://github.com/burnout-projects\"\u003e\u003ccode\u003e@​burnout-projects\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/561\"\u003etheskumar/python-dotenv#561\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 5 to 6 in the github-actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/593\"\u003etheskumar/python-dotenv#593\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Windows testing to CI by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/604\"\u003etheskumar/python-dotenv#604\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove workflow efficiency with best practices by \u003ca href=\"https://github.com/theskumar\"\u003e...\n\n_Description has been truncated_","html_url":"https://github.com/NYPL/digital-research-books/pull/1165","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/NYPL%2Fdigital-research-books/issues/1165","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/1165/packages"},{"uuid":"4764504409","node_id":"PR_kwDOAHyNm87rl4Y-","number":19376,"state":"open","title":"build(deps): bump lxml from 6.1.0 to 6.1.1","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-29T02:15:18.000Z","updated_at":"2026-06-29T02:16:20.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps)","packages":[{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"}],"path":null,"ecosystem":"pip"},"body":"Bumps [lxml](https://github.com/lxml/lxml) from 6.1.0 to 6.1.1.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lxml\u0026package-manager=uv\u0026previous-version=6.1.0\u0026new-version=6.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/saleor/saleor/pull/19376","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/saleor%2Fsaleor/issues/19376","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/19376/packages"},{"uuid":"4739606925","node_id":"PR_kwDORQ8Eq87qWao8","number":130,"state":"open","title":"build(deps): bump the python-minor-patch group across 1 directory with 11 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-25T00:49:57.000Z","updated_at":"2026-06-25T01:11:06.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps): bump","group_name":"python-minor-patch","update_count":11,"packages":[{"name":"certifi","old_version":"2026.2.25","new_version":"2026.6.17","repository_url":"https://github.com/certifi/python-certifi"},{"name":"charset-normalizer","old_version":"3.4.5","new_version":"3.4.7","repository_url":"https://github.com/jawah/charset_normalizer"},{"name":"docutils","old_version":"0.22.4","new_version":"0.23","repository_url":"https://github.com/rtfd/recommonmark"},{"name":"huggingface-hub","old_version":"1.18.0","new_version":"1.20.1","repository_url":"https://github.com/huggingface/huggingface_hub"},{"name":"idna","old_version":"3.15","new_version":"3.18","repository_url":"https://github.com/kjd/idna"},{"name":"jaraco-context","old_version":"6.1.1","new_version":"6.1.2","repository_url":"https://github.com/jaraco/jaraco.context"},{"name":"jaraco-functools","old_version":"4.4.0","new_version":"4.5.0","repository_url":"https://github.com/jaraco/jaraco.functools"},{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"},{"name":"markdown-it-py","old_version":"4.0.0","new_version":"4.2.0","repository_url":"https://github.com/executablebooks/markdown-it-py"},{"name":"nh3","old_version":"0.3.3","new_version":"0.3.6","repository_url":"https://github.com/messense/nh3"},{"name":"semgrep","old_version":"1.166.0","new_version":"1.168.0","repository_url":"https://github.com/semgrep/semgrep"}],"path":null,"ecosystem":"pip"},"body":"Bumps the python-minor-patch group with 11 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [certifi](https://github.com/certifi/python-certifi) | `2026.2.25` | `2026.6.17` |\n| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.5` | `3.4.7` |\n| [docutils](https://github.com/rtfd/recommonmark) | `0.22.4` | `0.23` |\n| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.18.0` | `1.20.1` |\n| [idna](https://github.com/kjd/idna) | `3.15` | `3.18` |\n| [jaraco-context](https://github.com/jaraco/jaraco.context) | `6.1.1` | `6.1.2` |\n| [jaraco-functools](https://github.com/jaraco/jaraco.functools) | `4.4.0` | `4.5.0` |\n| [lxml](https://github.com/lxml/lxml) | `6.1.0` | `6.1.1` |\n| [markdown-it-py](https://github.com/executablebooks/markdown-it-py) | `4.0.0` | `4.2.0` |\n| [nh3](https://github.com/messense/nh3) | `0.3.3` | `0.3.6` |\n| [semgrep](https://github.com/semgrep/semgrep) | `1.166.0` | `1.168.0` |\n\n\nUpdates `certifi` from 2026.2.25 to 2026.6.17\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/d0ac52f3d93a514224197c7efb66c41b1beae5d1\"\u003e\u003ccode\u003ed0ac52f\u003c/code\u003e\u003c/a\u003e 2026.06.17 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/418\"\u003e#418\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/d46de621787c609158579929f44b91ce731d01b8\"\u003e\u003ccode\u003ed46de62\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6.0.2 to 6.0.3 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/417\"\u003e#417\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/6c183ec39d81135350dd44abd0e5daefc8e35b9d\"\u003e\u003ccode\u003e6c183ec\u003c/code\u003e\u003c/a\u003e fix: update Requests docs link to canonical URL (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/415\"\u003e#415\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/36e35680e0dc42c70cd60bfe440e92e7137f5a1c\"\u003e\u003ccode\u003e36e3568\u003c/code\u003e\u003c/a\u003e Bump dessant/lock-threads from 6.0.0 to 6.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/d7ea151afc2ce6bef0555b9349902bd867e928dd\"\u003e\u003ccode\u003ed7ea151\u003c/code\u003e\u003c/a\u003e 2026.05.20 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/413\"\u003e#413\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/5dddfb072243da27adde885b73ba9b809c3224ca\"\u003e\u003ccode\u003e5dddfb0\u003c/code\u003e\u003c/a\u003e 2026.04.22 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/410\"\u003e#410\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/f99eccdaf87f7c10e521a58a700ca3eb94a0787e\"\u003e\u003ccode\u003ef99eccd\u003c/code\u003e\u003c/a\u003e Bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/404\"\u003e#404\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/918bed055f7291719512af186c1c24710f845660\"\u003e\u003ccode\u003e918bed0\u003c/code\u003e\u003c/a\u003e Bump actions/upload-artifact from 7.0.0 to 7.0.1 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/405\"\u003e#405\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/0a49067eb434e53e1f8df5f7707d5dc05ef9def4\"\u003e\u003ccode\u003e0a49067\u003c/code\u003e\u003c/a\u003e Bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/403\"\u003e#403\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/acf6ce8e39e3b125f4349e11904295e4fe4c1bed\"\u003e\u003ccode\u003eacf6ce8\u003c/code\u003e\u003c/a\u003e Bump actions/download-artifact from 8.0.0 to 8.0.1 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/398\"\u003e#398\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/certifi/python-certifi/compare/2026.02.25...2026.06.17\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `charset-normalizer` from 3.4.5 to 3.4.7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jawah/charset_normalizer/releases\"\u003echarset-normalizer's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 3.4.7\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.6...3.4.7\"\u003e3.4.7\u003c/a\u003e (2026-04-02)\u003c/h2\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePre-built optimized version using mypy[c] v1.20.\u003c/li\u003e\n\u003cli\u003eRelax \u003ccode\u003esetuptools\u003c/code\u003e constraint to \u003ccode\u003esetuptools\u0026gt;=68,\u0026lt;82.1\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eCorrectly remove SIG remnant in utf-7 decoded string. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/718\"\u003e#718\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/716\"\u003e#716\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 3.4.6\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.5...3.4.6\"\u003e3.4.6\u003c/a\u003e (2026-03-15)\u003c/h2\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFlattened the logic in \u003ccode\u003echarset_normalizer.md\u003c/code\u003e for higher performance. Removed \u003ccode\u003eeligible(..)\u003c/code\u003e and \u003ccode\u003efeed(...)\u003c/code\u003e\nin favor of \u003ccode\u003efeed_info(...)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRaised upper bound for mypy[c] to 1.20, for our optimized version.\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003eUNICODE_RANGES_COMBINED\u003c/code\u003e using Unicode blocks v17.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEdge case where noise difference between two candidates can be almost insignificant. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/672\"\u003e#672\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eCLI \u003ccode\u003e--normalize\u003c/code\u003e writing to wrong path when passing multiple files in. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/702\"\u003e#702\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFreethreaded pre-built wheels now shipped in PyPI starting with 3.14t. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/616\"\u003e#616\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md\"\u003echarset-normalizer's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.6...3.4.7\"\u003e3.4.7\u003c/a\u003e (2026-04-02)\u003c/h2\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePre-built optimized version using mypy[c] v1.20.\u003c/li\u003e\n\u003cli\u003eRelax \u003ccode\u003esetuptools\u003c/code\u003e constraint to \u003ccode\u003esetuptools\u0026gt;=68,\u0026lt;82.1\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eCorrectly remove SIG remnant in utf-7 decoded string. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/718\"\u003e#718\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/716\"\u003e#716\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.5...3.4.6\"\u003e3.4.6\u003c/a\u003e (2026-03-15)\u003c/h2\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFlattened the logic in \u003ccode\u003echarset_normalizer.md\u003c/code\u003e for higher performance. Removed \u003ccode\u003eeligible(..)\u003c/code\u003e and \u003ccode\u003efeed(...)\u003c/code\u003e\nin favor of \u003ccode\u003efeed_info(...)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRaised upper bound for mypy[c] to 1.20, for our optimized version.\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003eUNICODE_RANGES_COMBINED\u003c/code\u003e using Unicode blocks v17.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEdge case where noise difference between two candidates can be almost insignificant. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/672\"\u003e#672\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eCLI \u003ccode\u003e--normalize\u003c/code\u003e writing to wrong path when passing multiple files in. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/702\"\u003e#702\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFreethreaded pre-built wheels now shipped in PyPI starting with 3.14t. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/616\"\u003e#616\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/0f07891bf516b5d5231f1bd4dd2d8da7d4d09a9a\"\u003e\u003ccode\u003e0f07891\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/729\"\u003e#729\u003c/a\u003e from jawah/release-3.4.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/fdbeb299479e8f4d737e4d227cd0b2bd5d273dc0\"\u003e\u003ccode\u003efdbeb29\u003c/code\u003e\u003c/a\u003e chore: update dev, and ci requirements\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/b66f922bfbdbdd9dd46af18a8964d4fb888756d4\"\u003e\u003ccode\u003eb66f922\u003c/code\u003e\u003c/a\u003e chore: add ft classifier\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/f94249d0a2c712f2d03124f4de6b77f5e03aaa96\"\u003e\u003ccode\u003ef94249d\u003c/code\u003e\u003c/a\u003e chore: add test cases for utf_7 recent fix\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/95c866f6c984bbd043e7e3ed0628aa4f3f8d5a26\"\u003e\u003ccode\u003e95c866f\u003c/code\u003e\u003c/a\u003e chore: bump version to 3.4.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/4f429bb764c7e893f99bb4bceb60856da1baacfb\"\u003e\u003ccode\u003e4f429bb\u003c/code\u003e\u003c/a\u003e chore: bump mypy pre-commit to v1.20\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/b579cd6cab9bd83aa3fc0ca169d4df022bf4888c\"\u003e\u003ccode\u003eb579cd6\u003c/code\u003e\u003c/a\u003e fix: correctly remove SIG remnant in utf-7 decoded string\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/58bf944a77cc0883fc46a6ee8edac3549fea5d59\"\u003e\u003ccode\u003e58bf944\u003c/code\u003e\u003c/a\u003e :arrow_up: Bump github/codeql-action from 4.32.4 to 4.35.1 (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/728\"\u003e#728\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/44cf8a1b676a2532a8f1694e62e4f4f98f9132e1\"\u003e\u003ccode\u003e44cf8a1\u003c/code\u003e\u003c/a\u003e :arrow_up: Bump actions/download-artifact from 8.0.0 to 8.0.1 (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/726\"\u003e#726\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/362bc20073f737b1ba4ca2f68cffb0c4cc024d20\"\u003e\u003ccode\u003e362bc20\u003c/code\u003e\u003c/a\u003e :arrow_up: Bump docker/setup-qemu-action from 3.7.0 to 4.0.0 (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/725\"\u003e#725\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jawah/charset_normalizer/compare/3.4.5...3.4.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `docutils` from 0.22.4 to 0.23\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/rtfd/recommonmark/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `huggingface-hub` from 1.18.0 to 1.20.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/huggingface/huggingface_hub/releases\"\u003ehuggingface-hub's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e[v1.20.0] Browser-based OAuth login, multi-commit folder uploads, and more\u003c/h2\u003e\n\u003ch2\u003e🔒 Browser-based OAuth login\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003ehf auth login\u003c/code\u003e now defaults to a browser-based OAuth Device Code flow instead of asking you to copy-paste a token. The command prints a URL and a short code, you authorize in the browser, and the CLI retrieves and saves the token for you. The same applies to \u003ccode\u003elogin()\u003c/code\u003e in Python. In an interactive terminal you still get a \u003ccode\u003egh\u003c/code\u003e-style arrow-key menu to pick between browser login and pasting a token, and \u003ccode\u003e--token\u003c/code\u003e works exactly as before.\u003c/p\u003e\n\u003cp\u003eOAuth tokens expire after 30 days, but they come with a refresh token: \u003ccode\u003eget_token()\u003c/code\u003e transparently refreshes them when less than a day of validity remains, so long-running setups keep working without re-authenticating. \u003ccode\u003ehf auth list\u003c/code\u003e now shows the expiry date for OAuth tokens.\u003c/p\u003e\n\u003cpre lang=\"bash\"\u003e\u003ccode\u003e\u0026gt; hf auth login\r\n? How would you like to log in? Log in with your browser\r\n\u003cpre\u003e\u003ccode\u003eOpen this URL in your browser:\r\n    https://hf.co/oauth/device\r\n\r\nAnd enter the code: 52AT-FLYZ\r\n\r\nWaiting for authorization.\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cp\u003eWhen the command is run by an AI agent, it never prompts. Instead it streams structured events so the agent can surface the URL and code to its user, then blocks until a terminal \u003ccode\u003eauth_success\u003c/code\u003e / \u003ccode\u003eauth_error\u003c/code\u003e event:\u003c/p\u003e\n\u003cpre lang=\"console\"\u003e\u003ccode\u003e$ hf auth login --format json\r\n{\u0026quot;event\u0026quot;: \u0026quot;device_code\u0026quot;, \u0026quot;verification_uri\u0026quot;: \u0026quot;https://hf.co/oauth/device\u0026quot;, \u0026quot;user_code\u0026quot;: \u0026quot;52AT-FLYZ\u0026quot;, \u0026quot;verification_uri_complete\u0026quot;: \u0026quot;https://hf.co/oauth/device\u0026quot;, \u0026quot;expires_in\u0026quot;: 300, \u0026quot;interval\u0026quot;: 5}\r\n{\u0026quot;event\u0026quot;: \u0026quot;auth_success\u0026quot;, \u0026quot;user\u0026quot;: \u0026quot;celinah\u0026quot;, \u0026quot;token_name\u0026quot;: \u0026quot;oauth-celinah\u0026quot;}\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003e\u003ccode\u003ehf auth list\u003c/code\u003e surfaces the new expiry column:\u003c/p\u003e\n\u003cpre lang=\"console\"\u003e\u003ccode\u003e$ hf auth list\r\n  name          token       expires\r\n- ------------- ----------- -------------------\r\n  my-token      hf_****5678\r\n* oauth-user    hf_****1234 2026-07-09\r\n  oauth-old     hf_****9999 2026-06-09 (expired)\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eFinally, \u003ccode\u003enotebook_login()\u003c/code\u003e now renders the link and code with plain \u003ccode\u003eIPython.display.HTML\u003c/code\u003e, dropping the \u003ccode\u003eipywidgets\u003c/code\u003e dependency.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e[Auth] Browser-based OAuth login by \u003ca href=\"https://github.com/hanouticelina\"\u003e\u003ccode\u003e@​hanouticelina\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4354\"\u003e#4354\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⚡ Faster, more reliable \u003ccode\u003ehf upload\u003c/code\u003e for large folders\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003ehf upload\u003c/code\u003e and the underlying \u003ccode\u003eupload_folder\u003c/code\u003e have been revamped to be faster and far more robust on large folders. When \u003ccode\u003ehf_xet\u003c/code\u003e is installed (the default), uploads now run through a streamed, multi-commit pipeline built on the \u003ccode\u003eXetSession\u003c/code\u003e API: the folder is scanned and fed into a background Xet upload while previous batches are committed in parallel, and files are hashed in a single read pass while they are chunked (the old flow read every large file twice). Nothing changes in how you call it:\u003c/p\u003e\n\u003cpre lang=\"bash\"\u003e\u003ccode\u003ehf upload \u0026lt;repo-id\u0026gt; \u0026lt;path/to/folder\u0026gt;\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/5efdca0b066740c911e59feba2f14e145ff3dbfb\"\u003e\u003ccode\u003e5efdca0\u003c/code\u003e\u003c/a\u003e Release: v1.20.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/0c3a0622f413923853faced000b97446194a6fae\"\u003e\u003ccode\u003e0c3a062\u003c/code\u003e\u003c/a\u003e [Auth] Fix circular import on \u003ccode\u003efrom huggingface_hub import login\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4384\"\u003e#4384\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4\"\u003e#4\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/8d52526f5d44cf835b9c2a9fb2e4ac03d545c8ed\"\u003e\u003ccode\u003e8d52526\u003c/code\u003e\u003c/a\u003e Release: v1.20.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/9379ae35ee840fdf889147c7f21fadb32c44db03\"\u003e\u003ccode\u003e9379ae3\u003c/code\u003e\u003c/a\u003e Release: v1.20.0.rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/3b3abe38b7ae761eb1bebfb0676b5bd2b9f2a2c1\"\u003e\u003ccode\u003e3b3abe3\u003c/code\u003e\u003c/a\u003e [Spaces] Add \u003ccode\u003ewait_for_space\u003c/code\u003e API and \u003ccode\u003ehf spaces wait\u003c/code\u003e CLI (\u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4380\"\u003e#4380\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/e52fdef6100a9f3a5d08a146fe99910f297807e0\"\u003e\u003ccode\u003ee52fdef\u003c/code\u003e\u003c/a\u003e [CLI] Make \u003ccode\u003ehf jobs ssh\u003c/code\u003e wait for job to be running (\u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4379\"\u003e#4379\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/a0c1dfeeb1ef7468e616012149b62fd3566915b2\"\u003e\u003ccode\u003ea0c1dfe\u003c/code\u003e\u003c/a\u003e [Jobs] Add \u003ccode\u003ehf jobs wait\u003c/code\u003e and \u003ccode\u003eHfApi.wait_for_job\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4345\"\u003e#4345\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/558987464c237d84cd1f6e3062feff420a39b7c5\"\u003e\u003ccode\u003e5589874\u003c/code\u003e\u003c/a\u003e [Inference Endpoints] Custom-container deploy CLI + deprecate protected endpo...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/462d09366e5d215b72b710769326c4c7baf26f9c\"\u003e\u003ccode\u003e462d093\u003c/code\u003e\u003c/a\u003e [CLI] Suggest creating repo/bucket on NotFound errors (\u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4372\"\u003e#4372\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/ebe5315b56c53ad0a912d21ce9558ddc9e9f9be5\"\u003e\u003ccode\u003eebe5315\u003c/code\u003e\u003c/a\u003e Add new JobNotFound error (\u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4367\"\u003e#4367\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/huggingface/huggingface_hub/compare/v1.18.0...v1.20.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 3.15 to 3.18\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.18 (2026-06-02)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWhen decoding a domain, add a \u003ccode\u003edisplay\u003c/code\u003e argument that will pass\nthrough invalid labels rather than raising an exception.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.17 (2026-05-28)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSubstantial 75% reduction in memory usage through new data\nstructures and some optimization in processing speed.\u003c/li\u003e\n\u003cli\u003eAdded a general 1024-character input length cap to the public\nvalidation, conversion, and codec entry points. This is well above\nany legitimate domain or label and guards against pathological\ninputs.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.16 (2026-05-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a command-line interface (\u003ccode\u003epython -m idna\u003c/code\u003e, also available as\nthe \u003ccode\u003eidna\u003c/code\u003e script). Encodes or decodes one or more domains supplied\nas arguments or on standard input, with options to select A-label\nor U-label output and control error handling.\u003c/li\u003e\n\u003cli\u003eRaise the minimum supported Python version to 3.9\u003c/li\u003e\n\u003cli\u003eVarious code quality improvements\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f39ea903ba49eb5a0b2c6723c9a929b41ed4a0f1\"\u003e\u003ccode\u003ef39ea90\u003c/code\u003e\u003c/a\u003e Release 3.18\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/40f4e407bc7452da37c24b0c112dcda9a5b299ba\"\u003e\u003ccode\u003e40f4e40\u003c/code\u003e\u003c/a\u003e Pre-release 3.18rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/1a5bf80f2fa40454589e6144efe5f72015ef9d24\"\u003e\u003ccode\u003e1a5bf80\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/253\"\u003e#253\u003c/a\u003e from kjd/lenient-decode\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/5bbb26fc86e28c4ee1434ae8ae8db76de4c2a5ac\"\u003e\u003ccode\u003e5bbb26f\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into lenient-decode\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/c532bae5270489cef8faf9f6b1eb70cbcb454c6d\"\u003e\u003ccode\u003ec532bae\u003c/code\u003e\u003c/a\u003e Rename decode() lenient= option to display= (issue \u003ca href=\"https://redirect.github.com/kjd/idna/issues/248\"\u003e#248\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/0b1758ba11952a2e88fd6141ffa620409bff0580\"\u003e\u003ccode\u003e0b1758b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/252\"\u003e#252\u003c/a\u003e from kjd/release-3.17\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f48619c4cea6859b938d560fdd9feb898e678567\"\u003e\u003ccode\u003ef48619c\u003c/code\u003e\u003c/a\u003e Release 3.17\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/7421ba8003227f816142ab40178e3a7d204e6847\"\u003e\u003ccode\u003e7421ba8\u003c/code\u003e\u003c/a\u003e Pre-release 3.17rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/22ebb73b164081f209449b50162eb7ce086e96a4\"\u003e\u003ccode\u003e22ebb73\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/251\"\u003e#251\u003c/a\u003e from kjd/structure-optimizations\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/2a7ac0a58c788d50112a5003af545a83807fb108\"\u003e\u003ccode\u003e2a7ac0a\u003c/code\u003e\u003c/a\u003e Drop redundant parallel-arrays comment from uts46data\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kjd/idna/compare/v3.15...v3.18\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `jaraco-context` from 6.1.1 to 6.1.2\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jaraco/jaraco.context/blob/main/NEWS.rst\"\u003ejaraco-context's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ev6.1.2\u003c/h1\u003e\n\u003cp\u003eNo significant changes.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/098f39c911d4504b2c718f2ff483ae24f1c4d378\"\u003e\u003ccode\u003e098f39c\u003c/code\u003e\u003c/a\u003e Finalize\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/926a20e42307a2b5d87b058f2df42345fba61ad4\"\u003e\u003ccode\u003e926a20e\u003c/code\u003e\u003c/a\u003e Fix condition for skipping safety test on Python 3.12 (\u003ca href=\"https://redirect.github.com/jaraco/jaraco.context/issues/20\"\u003e#20\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/19f1cbbcf4811fec84c2fee47e51c1a823b7d368\"\u003e\u003ccode\u003e19f1cbb\u003c/code\u003e\u003c/a\u003e Strict type checking and re-enable mypy (\u003ca href=\"https://redirect.github.com/jaraco/jaraco.context/issues/16\"\u003e#16\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/256995fa4d2bcaf5513d7d14204045de94b4957d\"\u003e\u003ccode\u003e256995f\u003c/code\u003e\u003c/a\u003e Suppress coverage errors.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/0190667b24bd7b7f5f199ec36dc6e974fa31aab2\"\u003e\u003ccode\u003e0190667\u003c/code\u003e\u003c/a\u003e Suppress type errors in test_safety.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/bc0dc8a641a0ef9539bd7b193c961f8de05344e0\"\u003e\u003ccode\u003ebc0dc8a\u003c/code\u003e\u003c/a\u003e Suppress type errors with new property.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/8eee4d0bbf99ee75163865b150e638378e5a0b46\"\u003e\u003ccode\u003e8eee4d0\u003c/code\u003e\u003c/a\u003e Modernize with ruff\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/825171649ef9d312b6f9740d235d206c0e927c3e\"\u003e\u003ccode\u003e8251716\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into Strict-type-checking-and-re-enable-mypy\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/7df1443e0d81d0f7a781231ab05e00fc4173672e\"\u003e\u003ccode\u003e7df1443\u003c/code\u003e\u003c/a\u003e Restore expression algebra.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/616e2d6153eea558d0acf971adefc4d2c9dd6fc9\"\u003e\u003ccode\u003e616e2d6\u003c/code\u003e\u003c/a\u003e Merge \u003ca href=\"https://github.com/jaraco/skeleton\"\u003ehttps://github.com/jaraco/skeleton\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jaraco/jaraco.context/compare/v6.1.1...v6.1.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `jaraco-functools` from 4.4.0 to 4.5.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jaraco/jaraco.functools/blob/main/NEWS.rst\"\u003ejaraco-functools's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ev4.5.0\u003c/h1\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003ebypass_when\u003c/code\u003e and \u003ccode\u003ebypass_unless\u003c/code\u003e now accept callable checks and evaluate\nthem on each invocation instead of binding only at decoration time. (\u003ca href=\"https://redirect.github.com/jaraco/jaraco.functools/issues/36\"\u003e#36\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/0e89d963ab0a2d6d0755df2424e5e3d5b983cf98\"\u003e\u003ccode\u003e0e89d96\u003c/code\u003e\u003c/a\u003e Finalize\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/4df0abd88dc7c36897b4f40abebda9ae7b24d33e\"\u003e\u003ccode\u003e4df0abd\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/jaraco/jaraco.functools/issues/36\"\u003e#36\u003c/a\u003e from jaraco/copilot/enhance-bypass-decorators-callables\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/e3ad23e72c049950d79d4c1c702a9b7e286d6983\"\u003e\u003ccode\u003ee3ad23e\u003c/code\u003e\u003c/a\u003e 👹 Feed the hobgoblins (delint).\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/9ed118eb092ba639e925578576192d0da823d93f\"\u003e\u003ccode\u003e9ed118e\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into copilot/enhance-bypass-decorators-callables\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/d3cdfdf173d8f073d3c51f7d452e3860d783e283\"\u003e\u003ccode\u003ed3cdfdf\u003c/code\u003e\u003c/a\u003e 👹 Feed the hobgoblins (delint).\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/dfc27da53d5b17d1d3b9b04459933f9054a1e3a2\"\u003e\u003ccode\u003edfc27da\u003c/code\u003e\u003c/a\u003e Merge \u003ca href=\"https://github.com/jaraco/skeleton\"\u003ehttps://github.com/jaraco/skeleton\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/dc2a6a50c7b45d357e608b6beafd1339719d2f7c\"\u003e\u003ccode\u003edc2a6a5\u003c/code\u003e\u003c/a\u003e Rename towncrier fragment to PR number\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/a99352800c88bcac801dc3385cb9952f7729e946\"\u003e\u003ccode\u003ea993528\u003c/code\u003e\u003c/a\u003e Add feature news fragment for callable bypass checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/2257f0ecead9b3b4bdc57615edb47485572b1669\"\u003e\u003ccode\u003e2257f0e\u003c/code\u003e\u003c/a\u003e Inline bypass check normalization call\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/4d5cf8b5ba250ee46ef59fa7cd9760806ee06440\"\u003e\u003ccode\u003e4d5cf8b\u003c/code\u003e\u003c/a\u003e Drop redundant bypass unit tests\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jaraco/jaraco.functools/compare/v4.4.0...v4.5.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lxml` from 6.1.0 to 6.1.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `markdown-it-py` from 4.0.0 to 4.2.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/executablebooks/markdown-it-py/releases\"\u003emarkdown-it-py's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e✨ Add \u003ccode\u003emake_fence_rule()\u003c/code\u003e factory for configurable fence markers by \u003ca href=\"https://github.com/chrisjsewell\"\u003e\u003ccode\u003e@​chrisjsewell\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/394\"\u003eexecutablebooks/markdown-it-py#394\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e🚀 RELEASE v4.2.0 by \u003ca href=\"https://github.com/chrisjsewell\"\u003e\u003ccode\u003e@​chrisjsewell\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/395\"\u003eexecutablebooks/markdown-it-py#395\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/executablebooks/markdown-it-py/compare/v4.1.0...v4.2.0\"\u003ehttps://github.com/executablebooks/markdown-it-py/compare/v4.1.0...v4.2.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e✨ Add \u003ccode\u003e--stdin\u003c/code\u003e option to CLI by \u003ca href=\"https://github.com/mcepl\"\u003e\u003ccode\u003e@​mcepl\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/379\"\u003eexecutablebooks/markdown-it-py#379\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd AGENTS.md and copilot-setup-steps workflow by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/380\"\u003eexecutablebooks/markdown-it-py#380\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e🔧 Add typing to Scanner by \u003ca href=\"https://github.com/Alunderin\"\u003e\u003ccode\u003e@​Alunderin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/382\"\u003eexecutablebooks/markdown-it-py#382\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e👌 Fix quadratic complexity in \u003ccode\u003efragments_join\u003c/code\u003e / \u003ccode\u003etext_join\u003c/code\u003e by \u003ca href=\"https://github.com/petricevich\"\u003e\u003ccode\u003e@​petricevich\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/389\"\u003eexecutablebooks/markdown-it-py#389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e✨Allow plugins to register inline terminator characters by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/391\"\u003eexecutablebooks/markdown-it-py#391\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e✨ Add \u003ccode\u003egfm-like2\u003c/code\u003e preset with task lists, alerts, and single-tilde strikethrough by \u003ca href=\"https://github.com/chrisjsewell\"\u003e\u003ccode\u003e@​chrisjsewell\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/388\"\u003eexecutablebooks/markdown-it-py#388\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e🔧 Update pre-commit hooks by \u003ca href=\"https://github.com/chrisjsewell\"\u003e\u003ccode\u003e@​chrisjsewell\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/392\"\u003eexecutablebooks/markdown-it-py#392\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e🚀 RELEASE v4.1.0 by \u003ca href=\"https://github.com/chrisjsewell\"\u003e\u003ccode\u003e@​chrisjsewell\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/393\"\u003eexecutablebooks/markdown-it-py#393\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mcepl\"\u003e\u003ccode\u003e@​mcepl\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/379\"\u003eexecutablebooks/markdown-it-py#379\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/380\"\u003eexecutablebooks/markdown-it-py#380\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Alunderin\"\u003e\u003ccode\u003e@​Alunderin\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/382\"\u003eexecutablebooks/markdown-it-py#382\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/petricevich\"\u003e\u003ccode\u003e@​petricevich\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/389\"\u003eexecutablebooks/markdown-it-py#389\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/executablebooks/markdown-it-py/compare/v4.0.0...v4.1.0\"\u003ehttps://github.com/executablebooks/markdown-it-py/compare/v4.0.0...v4.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/executablebooks/markdown-it-py/blob/master/CHANGELOG.md\"\u003emarkdown-it-py's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e4.2.0 - 2026-05-07\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e✨ Add \u003ccode\u003emake_fence_rule()\u003c/code\u003e factory for configurable fence markers in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/394\"\u003e#394\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.1.0 - 2025-05-06\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e✨ Add \u003ccode\u003egfm-like2\u003c/code\u003e preset with task lists, alerts, and single-tilde strikethrough core plugins in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/388\"\u003e#388\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e✨ Allow plugins to register inline terminator characters in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/391\"\u003e#391\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e👌 Fix quadratic complexity in \u003ccode\u003efragments_join\u003c/code\u003e / \u003ccode\u003etext_join\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/389\"\u003e#389\u003c/a\u003e, thanks to \u003ca href=\"https://github.com/petricevich\"\u003e\u003ccode\u003e@​petricevich\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e👌 Add \u003ccode\u003e--stdin\u003c/code\u003e option to CLI for reading Markdown from standard input in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/379\"\u003e#379\u003c/a\u003e, thanks to \u003ca href=\"https://github.com/mcepl\"\u003e\u003ccode\u003e@​mcepl\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e🔧 Add typing to Scanner in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/382\"\u003e#382\u003c/a\u003e, thanks to \u003ca href=\"https://github.com/Alunderin\"\u003e\u003ccode\u003e@​Alunderin\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/executablebooks/markdown-it-py/compare/v4.0.0...v4.1.0\"\u003ehttps://github.com/executablebooks/markdown-it-py/compare/v4.0.0...v4.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/36c5f547144df2d01970a5792d68c71a3380b227\"\u003e\u003ccode\u003e36c5f54\u003c/code\u003e\u003c/a\u003e 🚀 RELEASE v4.2.0 (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/395\"\u003e#395\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/96cf077ba5a6b3b4b2f862db7e0fc532694a72e9\"\u003e\u003ccode\u003e96cf077\u003c/code\u003e\u003c/a\u003e ✨ Add \u003ccode\u003emake_fence_rule()\u003c/code\u003e factory for configurable fence markers (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/394\"\u003e#394\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/3b4ff6ddd368b679643d12debf09e10ef602d4db\"\u003e\u003ccode\u003e3b4ff6d\u003c/code\u003e\u003c/a\u003e 🚀 RELEASE v4.1.0 (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/393\"\u003e#393\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/8951f267370b03a26ae88600a6dfc707ea290067\"\u003e\u003ccode\u003e8951f26\u003c/code\u003e\u003c/a\u003e 🔧 Update pre-commit hooks (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/392\"\u003e#392\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/693bb24063b6c658d60c7c14203ac6470387e3c6\"\u003e\u003ccode\u003e693bb24\u003c/code\u003e\u003c/a\u003e ✨ Add \u003ccode\u003egfm-like2\u003c/code\u003e preset with task lists, alerts, and single-tilde strikethro...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/df6fd361099cab7fe0259467c3aaa3f284ec8259\"\u003e\u003ccode\u003edf6fd36\u003c/code\u003e\u003c/a\u003e ✨Allow plugins to register inline terminator characters (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/391\"\u003e#391\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/d4ea0ca7f44e3ca86c18a87356502c59e5e49ec3\"\u003e\u003ccode\u003ed4ea0ca\u003c/code\u003e\u003c/a\u003e 👌 Fix quadratic complexity in \u003ccode\u003efragments_join\u003c/code\u003e / \u003ccode\u003etext_join\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/389\"\u003e#389\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/89331476e44c150bc32e2597a5fae4cd15391167\"\u003e\u003ccode\u003e8933147\u003c/code\u003e\u003c/a\u003e 🔧 Add typing to Scanner (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/382\"\u003e#382\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/2f6ae107ba32e9a7bd2d00134d09a78ec805a6a0\"\u003e\u003ccode\u003e2f6ae10\u003c/code\u003e\u003c/a\u003e 🔧 Add AGENTS.md and copilot-setup-steps workflow (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/380\"\u003e#380\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/49043e4445d233598fb893bed6949f7b25ae4e27\"\u003e\u003ccode\u003e49043e4\u003c/code\u003e\u003c/a\u003e Add --stdin option to CLI for reading Markdown from standard input (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/379\"\u003e#379\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/executablebooks/markdown-it-py/compare/v4.0.0...v4.2.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `nh3` from 0.3.3 to 0.3.6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/messense/nh3/releases\"\u003enh3's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.3.6\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eValidate clean_content_tags conflict with tags by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/125\"\u003emessense/nh3#125\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument tag_attribute_values as alternate to attributes by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/126\"\u003emessense/nh3#126\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd nh3.escape alias for clean_text by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/127\"\u003emessense/nh3#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump pyo3 from 0.28.3 to 0.29.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/130\"\u003emessense/nh3#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpose ammonia's url_relative policy via url_relative kwarg by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/131\"\u003emessense/nh3#131\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/messense/nh3/compare/v0.3.5...v0.3.6\"\u003ehttps://github.com/messense/nh3/compare/v0.3.5...v0.3.6\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev0.3.5\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd usage examples for clean() and Cleaner arguments by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/120\"\u003emessense/nh3#120\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd doctest coverage for module docstrings and RST files by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/121\"\u003emessense/nh3#121\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump pyo3 from 0.28.2 to 0.28.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/123\"\u003emessense/nh3#123\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd tags parameter to clean_text by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/122\"\u003emessense/nh3#122\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/messense/nh3/compare/v0.3.4...v0.3.5\"\u003ehttps://github.com/messense/nh3/compare/v0.3.4...v0.3.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev0.3.4\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump pyo3 from 0.28.1 to 0.28.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/114\"\u003emessense/nh3#114\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eValidate rel attribute conflict with link_rel by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/117\"\u003emessense/nh3#117\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpose default clean_content_tags as module constant by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/118\"\u003emessense/nh3#118\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAccept frozenset and Mapping in type stubs by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/119\"\u003emessense/nh3#119\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/117\"\u003emessense/nh3#117\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/messense/nh3/compare/v0.3.3...v0.3.4\"\u003ehttps://github.com/messense/nh3/compare/v0.3.3...v0.3.4\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/bea70dfcdd0b9e246f884416dec9c73f9e8923cf\"\u003e\u003ccode\u003ebea70df\u003c/code\u003e\u003c/a\u003e Bump version to 0.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/788cee289054b95930034eeaedb3424548302456\"\u003e\u003ccode\u003e788cee2\u003c/code\u003e\u003c/a\u003e Expose ammonia's url_relative policy via url_relative kwarg (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/131\"\u003e#131\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/e76a81acc58a98a55992ece96740a1e5a448e222\"\u003e\u003ccode\u003ee76a81a\u003c/code\u003e\u003c/a\u003e Bump pyo3 from 0.28.3 to 0.29.0 (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/130\"\u003e#130\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/8ec45a31335b0df9664d22749067fe41a3e369bc\"\u003e\u003ccode\u003e8ec45a3\u003c/code\u003e\u003c/a\u003e Add nh3.escape alias for clean_text (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/127\"\u003e#127\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/a1e022621e862cf27b929b645cb264d2bf8376df\"\u003e\u003ccode\u003ea1e0226\u003c/code\u003e\u003c/a\u003e Document tag_attribute_values as alternate to attributes (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/126\"\u003e#126\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/389fb797d5203dab4d0691863bd56ff18136a433\"\u003e\u003ccode\u003e389fb79\u003c/code\u003e\u003c/a\u003e Validate clean_content_tags conflict with tags (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/125\"\u003e#125\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/61aad5aaf6c719299b3319e2632c7e96500b0fe6\"\u003e\u003ccode\u003e61aad5a\u003c/code\u003e\u003c/a\u003e Bump uraimo/run-on-arch-action in the github-actions group (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/124\"\u003e#124\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/9e78e6af74267c6789c62e98512460990415fb91\"\u003e\u003ccode\u003e9e78e6a\u003c/code\u003e\u003c/a\u003e Bump version to 0.3.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/5225ec29f6ba74349d158676461fa6081cf804d8\"\u003e\u003ccode\u003e5225ec2\u003c/code\u003e\u003c/a\u003e Add tags parameter to clean_text (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/122\"\u003e#122\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/129df5295dd98b263a3f24bd4f9bd5e43a7bb677\"\u003e\u003ccode\u003e129df52\u003c/code\u003e\u003c/a\u003e Bump pyo3 from 0.28.2 to 0.28.3 (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/123\"\u003e#123\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/messense/nh3/compare/v0.3.3...v0.3.6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `semgrep` from 1.166.0 to 1.168.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/semgrep/semgrep/releases\"\u003esemgrep's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eRelease v1.168.0\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/semgrep/semgrep/releases/tag/v1.168.0\"\u003e1.168.0\u003c/a\u003e - 2026-06-24\u003c/h2\u003e\n\u003ch3\u003e### Added\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdded an experimental \u003ccode\u003e--x-dependency-paths\u003c/code\u003e flag to \u003ccode\u003escan\u003c/code\u003e and \u003ccode\u003eci\u003c/code\u003e that includes the full dependency path(s) for transitive supply-chain findings in \u003ccode\u003e--json\u003c/code\u003e and \u003ccode\u003e--sarif\u003c/code\u003e output. (SC-3547)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMalicious supply chain rules are now labeled \u0026quot;Malicious\u0026quot; instead of \u0026quot;Basic\u0026quot; in the scan analysis summary table. (SC-3504)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Infra/Release Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003esemgrep-core no longer depends on libpcre 8.x; libpcre2 10.x is now the sole regex engine. (drop-libpcre)\u003c/li\u003e\n\u003cli\u003eAliengrep (generic mode) now uses the maintained libpcre2 10.x regular-expression library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (aliengrep-pcre2)\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003emetavariable-regex\u003c/code\u003e and \u003ccode\u003emetavariable-comparison\u003c/code\u003e (\u003ccode\u003ere.match()\u003c/code\u003e) runtimes now use the maintained libpcre2 10.x library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (eval-generic-pcre2)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eRelease v1.167.0\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/semgrep/semgrep/releases/tag/v1.167.0\"\u003e1.167.0\u003c/a\u003e - 2026-06-17\u003c/h2\u003e\n\u003ch3\u003e### Added\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more. (const-folding)\u003c/li\u003e\n\u003cli\u003eAdded a \u003ccode\u003enosemgrep_disabled\u003c/code\u003e field to the scan configuration so the platform can disable \u003ccode\u003enosemgrep\u003c/code\u003e inline ignore comments org-wide for a scan. (APPEX-1122)\u003c/li\u003e\n\u003cli\u003eSemgrep now skips binary files (images, archives, compiled executables,\netc.) during scanning by default, detected via matching file extensions\nto known file-format magic bytes Pass \u003ccode\u003e--no-exclude-binary-files\u003c/code\u003e to\nscan binary files as before. (ENGINE-2708)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Fixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003esemgrep ci\u003c/code\u003e with \u003ccode\u003e--sarif\u003c/code\u003e now correctly populates the output's \u003ccode\u003eignores\u003c/code\u003e\nfield with nosemgrep-suppressed findings, in accordance with other output\nformatters. (\u003ca href=\"https://redirect.github.com/semgrep/semgrep/issues/6651\"\u003egh-6651\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Infra/Release Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdated the \u003ccode\u003eocaml-tree-sitter-core\u003c/code\u003e submodule to the latest upstream \u003ccode\u003emain\u003c/code\u003e, providing\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eimproved thread-safety\u003c/li\u003e\n\u003cli\u003ebumps the tree-sitter CLI option used from 0.20.6 to 0.20.8.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e(ocaml-tree-sitter-core-bump)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/semgrep/semgrep/blob/v1.168.0/CHANGELOG.md\"\u003esemgrep's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/semgrep/semgrep/releases/tag/v1.168.0\"\u003e1.168.0\u003c/a\u003e - 2026-06-24\u003c/h2\u003e\n\u003ch3\u003e### Added\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdded an experimental \u003ccode\u003e--x-dependency-paths\u003c/code\u003e flag to \u003ccode\u003escan\u003c/code\u003e and \u003ccode\u003eci\u003c/code\u003e that includes the full dependency path(s) for transitive supply-chain findings in \u003ccode\u003e--json\u003c/code\u003e and \u003ccode\u003e--sarif\u003c/code\u003e output. (SC-3547)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMalicious supply chain rules are now labeled \u0026quot;Malicious\u0026quot; instead of \u0026quot;Basic\u0026quot; in the scan analysis summary table. (SC-3504)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Infra/Release Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003esemgrep-core no longer depends on libpcre 8.x; libpcre2 10.x is now the sole regex engine. (drop-libpcre)\u003c/li\u003e\n\u003cli\u003eAliengrep (generic mode) now uses the maintained libpcre2 10.x regular-expression library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (aliengrep-pcre2)\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003emetavariable-regex\u003c/code\u003e and \u003ccode\u003emetavariable-comparison\u003c/code\u003e (\u003ccode\u003ere.match()\u003c/code\u003e) runtimes now use the maintained libpcre2 10.x library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (eval-generic-pcre2)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/semgrep/semgrep/releases/tag/v1.167.0\"\u003e1.167.0\u003c/a\u003e - 2026-06-17\u003c/h2\u003e\n\u003ch3\u003e### Added\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more. (const-folding)\u003c/li\u003e\n\u003cli\u003eAdded a \u003ccode\u003enosemgrep_disabled\u003c/code\u003e field to the scan configuration so the platform can disable \u003ccode\u003enosemgrep\u003c/code\u003e inline ignore comments org-wide for a scan. (APPEX-1122)\u003c/li\u003e\n\u003cli\u003eSemgrep now skips binary files (images, archives, compiled executables,\netc.) during scanning by default, detected via matching file extensions\nto known file-format magic bytes Pass \u003ccode\u003e--no-exclude-binary-files\u003c/code\u003e to\nscan binary files as before. (ENGINE-2708)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Fixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003esemgrep ci\u003c/code\u003e with \u003ccode\u003e--sarif\u003c/code\u003e now correctly populates the output's \u003ccode\u003eignores\u003c/code\u003e\nfield with nosemgrep-suppressed findings, in accordance with other output\nformatters. (\u003ca href=\"https://redirect.github.com/semgrep/semgrep/issues/6651\"\u003egh-6651\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Infra/Release Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdated the \u003ccode\u003eocaml-tree-sitter-core\u003c/code\u003e submodule to the latest upstream \u003ccode\u003emain\u003c/code\u003e, providing\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eimproved thread-safety\u003c/li\u003e\n\u003cli\u003ebumps the tree-sitter CLI option used from 0.20.6 to 0.20.8.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e(ocaml-tree-sitter-core-bump)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/3167f9c4edb5ad588c558e311c5a1a03b7f593da\"\u003e\u003ccode\u003e3167f9c\u003c/code\u003e\u003c/a\u003e chore: release 1.168.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/94ac223eb9fade687c2e044936f5ca370dad08c6\"\u003e\u003ccode\u003e94ac223\u003c/code\u003e\u003c/a\u003e\u003ccode\u003esemgrep/semgrep-proprietary#6651\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/fd5e60e96c7d66dcdb43d2c1086f003308d21420\"\u003e\u003ccode\u003efd5e60e\u003c/code\u003e\u003c/a\u003e\u003ccode\u003esemgrep/semgrep-proprietary#6602\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/acf763e9d16e31e1ab8c5ece9d4ab55e8f2e3ee3\"\u003e\u003ccode\u003eacf763e\u003c/code\u003e\u003c/a\u003e\u003ccode\u003esemgrep/semgrep-proprietary#6655\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/b635c1f9e1816b154d2247e1e605532e53f683f6\"\u003e\u003ccode\u003eb635c1f\u003c/code\u003e\u003c/a\u003e\u003ccode\u003esemgrep/semgrep-proprietary#6653\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/b0a3bb4eeb0f55e0f4bd30498294b0e68be390fb\"\u003e\u003ccode\u003eb0a3bb4\u003c/code\u003e\u003c/a\u003e\u003ccode\u003esemgrep/semgrep-proprietary#6654\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/d03aad013dbdac44d934282d744beabef62851e7\"\u003e\u003ccode\u003ed03aad0\u003c/code\u003e\u003c/a\u003e chore(spacegrep): migrate Comment.ml from libpcre 8.x to libpcre2 10.x (semgr...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/8855bc510dd2712f23f82211ff5fe65650555262\"\u003e\u003ccode\u003e8855bc5\u003c/code\u003e\u003c/a\u003e refactor(docker): do not create duplicate unused artifacts (semgrep/semgrep-p...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/51c6552cec03860634f8e451d0af6e6b3ff76cae\"\u003e\u003ccode\u003e51c6552\u003c/code\u003e\u003c/a\u003e refactor(ci): delegate archive-handling to \u003ccode\u003e{download,upload}\u003c/code\u003e-artifact (semg...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/d9d88135564aff166adcc3622911c997fd224989\"\u003e\u003ccode\u003ed9d8813\u003c/code\u003e\u003c/a\u003e\u003ccode\u003esemgrep/semgrep-proprietary#6652\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/semgrep/semgrep/compare/v1.166.0...v1.168.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/anulum/director-ai/pull/130","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/anulum%2Fdirector-ai/issues/130","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/130/packages"},{"uuid":"4636387573","node_id":"PR_kwDORtR3rs7lHOUF","number":5,"state":"open","title":"chore(deps): bump the uv group across 1 directory with 19 updates","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-11T01:29:05.000Z","updated_at":"2026-06-11T01:30:14.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"uv","update_count":19,"packages":[{"name":"flask","old_version":"3.1.2","new_version":"3.1.3","repository_url":"https://github.com/pallets/flask"},{"name":"python-dotenv","old_version":"1.2.1","new_version":"1.2.2","repository_url":"https://github.com/theskumar/python-dotenv"},{"name":"cryptography","old_version":"46.0.3","new_version":"46.0.7","repository_url":"https://github.com/pyca/cryptography"},{"name":"filelock","old_version":"3.20.1","new_version":"3.20.3","repository_url":"https://github.com/tox-dev/py-filelock"},{"name":"idna","old_version":"3.11","new_version":"3.15","repository_url":"https://github.com/kjd/idna"},{"name":"lxml","old_version":"6.0.2","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"},{"name":"marshmallow","old_version":"3.26.1","new_version":"3.26.2","repository_url":"https://github.com/marshmallow-code/marshmallow"},{"name":"mistune","old_version":"3.1.4","new_version":"3.2.1","repository_url":"https://github.com/lepture/mistune"},{"name":"nbconvert","old_version":"7.16.6","new_version":"7.17.1","repository_url":"https://github.com/jupyter/nbconvert"},{"name":"nltk","old_version":"3.9.2","new_version":"3.9.4","repository_url":"https://github.com/nltk/nltk"},{"name":"pypdf","old_version":"6.4.2","new_version":"6.10.2","repository_url":"https://github.com/py-pdf/pypdf"},{"name":"python-multipart","old_version":"0.0.21","new_version":"0.0.27","repository_url":"https://github.com/Kludex/python-multipart"},{"name":"requests","old_version":"2.32.5","new_version":"2.33.0","repository_url":"https://github.com/psf/requests"},{"name":"starlette","old_version":"0.50.0","new_version":"1.0.1","repository_url":"https://github.com/Kludex/starlette"},{"name":"torch","old_version":"2.9.1","new_version":"2.10.0","repository_url":"https://github.com/pytorch/pytorch"},{"name":"tornado","old_version":"6.5.4","new_version":"6.5.5","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"urllib3","old_version":"2.6.2","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"},{"name":"virtualenv","old_version":"20.35.4","new_version":"20.36.1","repository_url":"https://github.com/pypa/virtualenv"},{"name":"werkzeug","old_version":"3.1.4","new_version":"3.1.6","repository_url":"https://github.com/pallets/werkzeug"}],"path":null,"ecosystem":"pip"},"body":"Bumps the uv group with 19 updates in the /backend directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [flask](https://github.com/pallets/flask) | `3.1.2` | `3.1.3` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.1` | `1.2.2` |\n| [cryptography](https://github.com/pyca/cryptography) | `46.0.3` | `46.0.7` |\n| [filelock](https://github.com/tox-dev/py-filelock) | `3.20.1` | `3.20.3` |\n| [idna](https://github.com/kjd/idna) | `3.11` | `3.15` |\n| [lxml](https://github.com/lxml/lxml) | `6.0.2` | `6.1.0` |\n| [marshmallow](https://github.com/marshmallow-code/marshmallow) | `3.26.1` | `3.26.2` |\n| [mistune](https://github.com/lepture/mistune) | `3.1.4` | `3.2.1` |\n| [nbconvert](https://github.com/jupyter/nbconvert) | `7.16.6` | `7.17.1` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.4.2` | `6.10.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.21` | `0.0.27` |\n| [requests](https://github.com/psf/requests) | `2.32.5` | `2.33.0` |\n| [starlette](https://github.com/Kludex/starlette) | `0.50.0` | `1.0.1` |\n| [torch](https://github.com/pytorch/pytorch) | `2.9.1` | `2.10.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.4` | `6.5.5` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.6.2` | `2.7.0` |\n| [virtualenv](https://github.com/pypa/virtualenv) | `20.35.4` | `20.36.1` |\n| [werkzeug](https://github.com/pallets/werkzeug) | `3.1.4` | `3.1.6` |\n\n\nUpdates `flask` from 3.1.2 to 3.1.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pallets/flask/releases\"\u003eflask's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.1.3\u003c/h2\u003e\n\u003cp\u003eThis is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.\u003c/p\u003e\n\u003cp\u003ePyPI: \u003ca href=\"https://pypi.org/project/Flask/3.1.3/\"\u003ehttps://pypi.org/project/Flask/3.1.3/\u003c/a\u003e\nChanges: \u003ca href=\"https://flask.palletsprojects.com/page/changes/#version-3-1-3\"\u003ehttps://flask.palletsprojects.com/page/changes/#version-3-1-3\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe session is marked as accessed for operations that only access the keys but not the values, such as \u003ccode\u003ein\u003c/code\u003e and \u003ccode\u003elen\u003c/code\u003e. \u003ca href=\"https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726\"\u003eGHSA-68rp-wp8r-4726\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pallets/flask/blob/main/CHANGES.rst\"\u003eflask's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 3.1.3\u003c/h2\u003e\n\u003cp\u003eReleased 2026-02-18\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe session is marked as accessed for operations that only access the keys\nbut not the values, such as \u003ccode\u003ein\u003c/code\u003e and \u003ccode\u003elen\u003c/code\u003e. :ghsa:\u003ccode\u003e68rp-wp8r-4726\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/22d924701a6ae2e4cd01e9a15bbaf3946094af65\"\u003e\u003ccode\u003e22d9247\u003c/code\u003e\u003c/a\u003e release version 3.1.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4\"\u003e\u003ccode\u003e089cb86\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/c17f379390731543eea33a570a47bd4ef76a54fa\"\u003e\u003ccode\u003ec17f379\u003c/code\u003e\u003c/a\u003e request context tracks session access\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/27be9338405382445a7cb01151e084559b98d602\"\u003e\u003ccode\u003e27be933\u003c/code\u003e\u003c/a\u003e start version 3.1.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/4e652d3f68b90d50aa2301d3b7e68c3fafd9251d\"\u003e\u003ccode\u003e4e652d3\u003c/code\u003e\u003c/a\u003e Abort if the instance folder cannot be created (\u003ca href=\"https://redirect.github.com/pallets/flask/issues/5903\"\u003e#5903\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/3d03098a97ddc6a908aa4a50c2ef7381f8297d0a\"\u003e\u003ccode\u003e3d03098\u003c/code\u003e\u003c/a\u003e Abort if the instance folder cannot be created\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/407eb76b27884848383a37c7274654f0271e4bc4\"\u003e\u003ccode\u003e407eb76\u003c/code\u003e\u003c/a\u003e document using gevent for async (\u003ca href=\"https://redirect.github.com/pallets/flask/issues/5900\"\u003e#5900\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/ac5664d2281533eacafd64f5cc7d5edcdaccab60\"\u003e\u003ccode\u003eac5664d\u003c/code\u003e\u003c/a\u003e document using gevent for async\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/4f79d5b59a56bc4356a97f2e81a35f98cb18d7b3\"\u003e\u003ccode\u003e4f79d5b\u003c/code\u003e\u003c/a\u003e Increase required flit_core version to 3.11 (\u003ca href=\"https://redirect.github.com/pallets/flask/issues/5865\"\u003e#5865\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/fe3b215d3ade4db68262dae1a3cdc464a1fc524f\"\u003e\u003ccode\u003efe3b215\u003c/code\u003e\u003c/a\u003e Increase required flit_core version to 3.11\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pallets/flask/compare/3.1.2...3.1.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `python-dotenv` from 1.2.1 to 1.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/theskumar/python-dotenv/releases\"\u003epython-dotenv's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.2.2\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for Python 3.14, including the free-threaded (3.14t) build. (#)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003edotenv run\u003c/code\u003e command now forwards flags directly to the specified command by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/607\"\u003etheskumar/python-dotenv#607\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved documentation clarity regarding override behavior and the reference page.\u003c/li\u003e\n\u003cli\u003eUpdated PyPy support to version 3.11.\u003c/li\u003e\n\u003cli\u003eDocumentation for FIFO file support.\u003c/li\u003e\n\u003cli\u003eSupport for Python 3.9.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved \u003ccode\u003eset_key\u003c/code\u003e and \u003ccode\u003eunset_key\u003c/code\u003e behavior when interacting with symlinks by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311\"\u003e#790c5\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCorrected the license specifier and added missing Python 3.14 classifiers in package metadata by \u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/590\"\u003etheskumar/python-dotenv#590\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e and \u003ccode\u003edotenv.unset_key\u003c/code\u003e used to follow symlinks in some\nsituations. This is no longer the case. For that behavior to be restored in\nall cases, \u003ccode\u003efollow_symlinks=True\u003c/code\u003e should be used.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the CLI, \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e used to follow symlinks in some situations. This\nis no longer the case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e, \u003ccode\u003edotenv.unset_key\u003c/code\u003e and the CLI commands \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e\nused to reset the file mode of the modified .env file to \u003ccode\u003e0o600\u003c/code\u003e in some\nsituations. This is no longer the case: The original mode of the file is now\npreserved. Is the file needed to be created or wasn't a regular file, mode\n\u003ccode\u003e0o600\u003c/code\u003e is used.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eskip 000 permission tests for root user by \u003ca href=\"https://github.com/burnout-projects\"\u003e\u003ccode\u003e@​burnout-projects\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/561\"\u003etheskumar/python-dotenv#561\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 5 to 6 in the github-actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/593\"\u003etheskumar/python-dotenv#593\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Windows testing to CI by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/604\"\u003etheskumar/python-dotenv#604\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove workflow efficiency with best practices by \u003ca href=\"https://github.com/theskumar\"\u003e\u003ccode\u003e@​theskumar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/609\"\u003etheskumar/python-dotenv#609\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove the use of \u003ccode\u003esh\u003c/code\u003e in tests by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/612\"\u003etheskumar/python-dotenv#612\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/590\"\u003etheskumar/python-dotenv#590\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/burnout-projects\"\u003e\u003ccode\u003e@​burnout-projects\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/561\"\u003etheskumar/python-dotenv#561\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/cpackham-atlnz\"\u003e\u003ccode\u003e@​cpackham-atlnz\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/597\"\u003etheskumar/python-dotenv#597\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2\"\u003ehttps://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md\"\u003epython-dotenv's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e[1.2.2] - 2026-03-01\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for Python 3.14, including the free-threaded (3.14t) build. (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/588\"\u003e#588\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003edotenv run\u003c/code\u003e command now forwards flags directly to the specified command by [\u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/607\"\u003e#607\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved documentation clarity regarding override behavior and the reference page.\u003c/li\u003e\n\u003cli\u003eUpdated PyPy support to version 3.11.\u003c/li\u003e\n\u003cli\u003eDocumentation for FIFO file support.\u003c/li\u003e\n\u003cli\u003eDropped Support for Python 3.9.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved \u003ccode\u003eset_key\u003c/code\u003e and \u003ccode\u003eunset_key\u003c/code\u003e behavior when interacting with symlinks by [\u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e] in [790c5c0]\u003c/li\u003e\n\u003cli\u003eCorrected the license specifier and added missing Python 3.14 classifiers in package metadata by [\u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/590\"\u003e#590\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e and \u003ccode\u003edotenv.unset_key\u003c/code\u003e used to follow symlinks in some\nsituations. This is no longer the case. For that behavior to be restored in\nall cases, \u003ccode\u003efollow_symlinks=True\u003c/code\u003e should be used.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the CLI, \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e used to follow symlinks in some situations. This\nis no longer the case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e, \u003ccode\u003edotenv.unset_key\u003c/code\u003e and the CLI commands \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e\nused to reset the file mode of the modified .env file to \u003ccode\u003e0o600\u003c/code\u003e in some\nsituations. This is no longer the case: The original mode of the file is now\npreserved. Is the file needed to be created or wasn't a regular file, mode\n\u003ccode\u003e0o600\u003c/code\u003e is used.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/36004e0e34be7665ff2b11a8a4005144f76f176d\"\u003e\u003ccode\u003e36004e0\u003c/code\u003e\u003c/a\u003e Bump version: 1.2.1 → 1.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/eb202520e5933c9daf42501e1e42fdb0144002c8\"\u003e\u003ccode\u003eeb20252\u003c/code\u003e\u003c/a\u003e docs: update changelog for v1.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311\"\u003e\u003ccode\u003e790c5c0\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/43340da220fb4ca4f95357bbe21a3c7f8f1278b1\"\u003e\u003ccode\u003e43340da\u003c/code\u003e\u003c/a\u003e Remove the use of \u003ccode\u003esh\u003c/code\u003e in tests (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/612\"\u003e#612\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/09d7cee32459e7abdcb5c9d8122a552589c06a9c\"\u003e\u003ccode\u003e09d7cee\u003c/code\u003e\u003c/a\u003e docs: clarify override behavior and document FIFO support (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/610\"\u003e#610\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/c8de2887c00198c22842c5ae5e92d1747467363c\"\u003e\u003ccode\u003ec8de288\u003c/code\u003e\u003c/a\u003e ci: improve workflow efficiency with best practices (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/609\"\u003e#609\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/7bd9e3dbfedc0983ad7d56d5570013035242bdf4\"\u003e\u003ccode\u003e7bd9e3d\u003c/code\u003e\u003c/a\u003e Add Windows testing to CI (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/604\"\u003e#604\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/1baaf04f336072e0ee324d5df9563ec767f14f81\"\u003e\u003ccode\u003e1baaf04\u003c/code\u003e\u003c/a\u003e Drop Python 3.9 support and update to PyPy 3.11 (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/608\"\u003e#608\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/4a22cf8993804aeede0c20b75bb1a29d3a99e9dc\"\u003e\u003ccode\u003e4a22cf8\u003c/code\u003e\u003c/a\u003e ci: enable testing on Python 3.14t (free-threaded) (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/588\"\u003e#588\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/e2e8e776b42e382ae38b44d3982dd649e7507dd4\"\u003e\u003ccode\u003ee2e8e77\u003c/code\u003e\u003c/a\u003e Fix license specifier (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/597\"\u003e#597\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `cryptography` from 46.0.3 to 46.0.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst\"\u003ecryptography's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e46.0.7 - 2026-04-07\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be\n  passed to APIs that accept Python buffers, which could lead to buffer\n  overflow. **CVE-2026-39892**\n* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.\n\u003cp\u003e.. _v46-0-6:\u003c/p\u003e\n\u003cp\u003e46.0.6 - 2026-03-25\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eSECURITY ISSUE\u003c/strong\u003e: Fixed a bug where name constraints were not applied\nto peer names during verification when the leaf certificate contains a\nwildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug,\nincluding those used by the Web PKI. Credit to \u003cstrong\u003eOleh Konko (1seal)\u003c/strong\u003e for\nreporting the issue. \u003cstrong\u003eCVE-2026-34073\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. _v46-0-5:\u003c/p\u003e\n\u003cp\u003e46.0.5 - 2026-02-10\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* An attacker could create a malicious public key that reveals portions of your\n  private key when using certain uncommon elliptic curves (binary curves).\n  This version now includes additional security checks to prevent this attack.\n  This issue only affects binary elliptic curves, which are rarely used in\n  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and\n  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.\n  **CVE-2026-26007**\n* Support for ``SECT*`` binary elliptic curves is deprecated and will be\n  removed in the next release.\n\u003cp\u003e.. v46-0-4:\u003c/p\u003e\n\u003cp\u003e46.0.4 - 2026-01-27\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eDropped support for win_arm64 wheels\u003c/code\u003e_.\u003c/li\u003e\n\u003cli\u003eUpdated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. _v46-0-3:\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5\"\u003e\u003ccode\u003e622d672\u003c/code\u003e\u003c/a\u003e 46.0.7 release (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14602\"\u003e#14602\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/91d728897bdad30cd5c79a2b23e207f1f050d587\"\u003e\u003ccode\u003e91d7288\u003c/code\u003e\u003c/a\u003e Cherry-pick \u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14542\"\u003e#14542\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14543\"\u003e#14543\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/06e120e682cb200e3f7050c02f0bcdac90c4c6ad\"\u003e\u003ccode\u003e06e120e\u003c/code\u003e\u003c/a\u003e bump version for 46.0.5 release (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14289\"\u003e#14289\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c\"\u003e\u003ccode\u003e0eebb9d\u003c/code\u003e\u003c/a\u003e EC check key on cofactor \u0026gt; 1 (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14287\"\u003e#14287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/bedf6e186b814f69a3f54f51252c23a71d44ed2e\"\u003e\u003ccode\u003ebedf6e1\u003c/code\u003e\u003c/a\u003e fix openssl version on 46 branch (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14220\"\u003e#14220\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/e6f44fc8e6391f05d719fb9d369692325b87a471\"\u003e\u003ccode\u003ee6f44fc\u003c/code\u003e\u003c/a\u003e bump for 46.0.4 and drop win arm64 due to CI issues (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14217\"\u003e#14217\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/pyca/cryptography/compare/46.0.3...46.0.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `filelock` from 3.20.1 to 3.20.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tox-dev/py-filelock/releases\"\u003efilelock's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.20.3\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix TOCTOU symlink vulnerability in SoftFileLock by \u003ca href=\"https://github.com/gaborbernat\"\u003e\u003ccode\u003e@​gaborbernat\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/tox-dev/filelock/pull/465\"\u003etox-dev/filelock#465\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/tox-dev/filelock/compare/3.20.2...3.20.3\"\u003ehttps://github.com/tox-dev/filelock/compare/3.20.2...3.20.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e3.20.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSupport Unix systems without O_NOFOLLOW by \u003ca href=\"https://github.com/mwilliamson\"\u003e\u003ccode\u003e@​mwilliamson\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/tox-dev/filelock/pull/463\"\u003etox-dev/filelock#463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate by \u003ca href=\"https://github.com/pre-commit-ci\"\u003e\u003ccode\u003e@​pre-commit-ci\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/tox-dev/filelock/pull/464\"\u003etox-dev/filelock#464\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mwilliamson\"\u003e\u003ccode\u003e@​mwilliamson\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/tox-dev/filelock/pull/463\"\u003etox-dev/filelock#463\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/tox-dev/filelock/compare/3.20.1...3.20.2\"\u003ehttps://github.com/tox-dev/filelock/compare/3.20.1...3.20.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst\"\u003efilelock's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e###########\nChangelog\n###########\u003c/p\u003e\n\u003chr /\u003e\n\u003cp\u003e3.29.3 (2026-06-10)\u003c/p\u003e\n\u003chr /\u003e\n\u003cul\u003e\n\u003cli\u003e🐛 fix(ci): restore release environment on tag job :pr:\u003ccode\u003e559\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003evalidate pid range in _parse_lock_holder :pr:\u003ccode\u003e556\u003c/code\u003e - by :user:\u003ccode\u003edxbjavid\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e🔧 ci(release): publish to PyPI on tag push :pr:\u003ccode\u003e557\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 :pr:\u003ccode\u003e558\u003c/code\u003e - by :user:\u003ccode\u003edependabot[bot]\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003cp\u003e3.29.2 (2026-06-10)\u003c/p\u003e\n\u003chr /\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps): bump actions/checkout from 6.0.2 to 6.0.3 :pr:\u003ccode\u003e555\u003c/code\u003e - by :user:\u003ccode\u003edependabot[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e554\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003echeck hostname in is_lock_held_by_us :pr:\u003ccode\u003e553\u003c/code\u003e - by :user:\u003ccode\u003edxbjavid\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e🔒 fix(soft): harden stale-lock breaking and self-heal malformed locks :pr:\u003ccode\u003e551\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eopen marker reads non-blocking to refuse attacker-placed fifo :pr:\u003ccode\u003e549\u003c/code\u003e - by :user:\u003ccode\u003edxbjavid\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003cp\u003e3.29.1 (2026-06-03)\u003c/p\u003e\n\u003chr /\u003e\n\u003cul\u003e\n\u003cli\u003e🐛 fix(soft): refuse to follow symlinks when reading the lock file :pr:\u003ccode\u003e548\u003c/code\u003e - by :user:\u003ccode\u003edxbjavid\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e547\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e546\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003echore: improve filelock maintenance path :pr:\u003ccode\u003e545\u003c/code\u003e - by :user:\u003ccode\u003elphuc2250gma\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003echore: improve filelock maintenance path :pr:\u003ccode\u003e544\u003c/code\u003e - by :user:\u003ccode\u003elphuc2250gma\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003echore: improve filelock maintenance path :pr:\u003ccode\u003e542\u003c/code\u003e - by :user:\u003ccode\u003elphuc2250gma\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003edocs: clarify per-thread scope of FileLock configuration :pr:\u003ccode\u003e543\u003c/code\u003e - by :user:\u003ccode\u003eGares95\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e541\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003edocs: fix API docs of \u003ccode\u003erelease()\u003c/code\u003e :pr:\u003ccode\u003e540\u003c/code\u003e - by :user:\u003ccode\u003eMrAnno\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e539\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e538\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e537\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump astral-sh/setup-uv from 8.0.0 to 8.1.0 :pr:\u003ccode\u003e536\u003c/code\u003e - by :user:\u003ccode\u003edependabot[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e535\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003cp\u003e3.29.0 (2026-04-19)\u003c/p\u003e\n\u003chr /\u003e\n\u003cul\u003e\n\u003cli\u003e✨ feat(soft): enable stale lock detection on Windows :pr:\u003ccode\u003e534\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e🐛 fix(async): use single-thread executor for lock consistency :pr:\u003ccode\u003e533\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 :pr:\u003ccode\u003e530\u003c/code\u003e - by :user:\u003ccode\u003edependabot[bot]\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5\"\u003e\u003ccode\u003e41b42dd\u003c/code\u003e\u003c/a\u003e Fix TOCTOU symlink vulnerability in SoftFileLock (\u003ca href=\"https://redirect.github.com/tox-dev/py-filelock/issues/465\"\u003e#465\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tox-dev/filelock/commit/f2e7d4046b6a2b375a573bcfbad21827b99f8939\"\u003e\u003ccode\u003ef2e7d40\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/tox-dev/py-filelock/issues/464\"\u003e#464\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tox-dev/filelock/commit/50888548eb2f008d372e71f2835a47851ab83836\"\u003e\u003ccode\u003e5088854\u003c/code\u003e\u003c/a\u003e Support Unix systems without O_NOFOLLOW (\u003ca href=\"https://redirect.github.com/tox-dev/py-filelock/issues/463\"\u003e#463\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/tox-dev/py-filelock/compare/3.20.1...3.20.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 3.11 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in \u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining and\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e Release 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e Pre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from kjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e Convert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from kjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from StanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from StanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kjd/idna/compare/v3.11...v3.15\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lxml` from 6.0.2 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.3 (2026-04-09)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSeveral out of memory error cases now raise \u003ccode\u003eMemoryError\u003c/code\u003e that were not handled before.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSlicing with large step values (outside of \u003ccode\u003e+/- sys.maxsize\u003c/code\u003e) could trigger undefined C behaviour.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2125399: Some failing tests were fixed or disabled in PyPy.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2138421: Memory leak in error cases when setting the \u003ccode\u003epublic_id\u003c/code\u003e or \u003ccode\u003esystem_url\u003c/code\u003e of a document.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c7d76d6cb817c8e1f316e43b16cab5e6ad669ad0\"\u003e\u003ccode\u003ec7d76d6\u003c/code\u003e\u003c/a\u003e Change security policy to point to Github security advisories.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/378ccf82db8160928807c55ed580c0443aa94f42\"\u003e\u003ccode\u003e378ccf8\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/315270b810a9e3276c60daba549299d204ac962b\"\u003e\u003ccode\u003e315270b\u003c/code\u003e\u003c/a\u003e Docs: Reduce TOC depth of package pages and move module contents first.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6dbba7f3c72f655b05b26ef453fdee31af13ccf5\"\u003e\u003ccode\u003e6dbba7f\u003c/code\u003e\u003c/a\u003e Docs: Show current year in copyright line.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/e4385bfa5d79527350d5ef17372fb70ba80b4cce\"\u003e\u003ccode\u003ee4385bf\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5bed1e1a227cd9ba5a879aaeacdf504093a3f6e8\"\u003e\u003ccode\u003e5bed1e1\u003c/code\u003e\u003c/a\u003e Validate file hashes in release download script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c13ee10a429f1144779bb1cbf6ae3bec808ae9c1\"\u003e\u003ccode\u003ec13ee10\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.0.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.0.2...lxml-6.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `marshmallow` from 3.26.1 to 3.26.2\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst\"\u003emarshmallow's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.26.2 (2025-12-19)\u003c/h2\u003e\n\u003cp\u003eBug fixes:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e:cve:\u003ccode\u003e2025-68480\u003c/code\u003e: Merge error store messages without rebuilding collections.\nThanks 카푸치노 for reporting and :user:\u003ccode\u003edeckar01\u003c/code\u003e for the fix.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/1407d5102ae020421ddc8425474e976325a9539e\"\u003e\u003ccode\u003e1407d51\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/marshmallow-code/marshmallow/issues/2878\"\u003e#2878\u003c/a\u003e from marshmallow-code/3.x-mypy-unreachable\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/b2292f513845ccbd134bd55501a9bcbcdd18f8ac\"\u003e\u003ccode\u003eb2292f5\u003c/code\u003e\u003c/a\u003e Fix mypy errors\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/8acd211847244fa28e0174728ff310fddf0d7fa2\"\u003e\u003ccode\u003e8acd211\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/marshmallow-code/marshmallow/issues/2877\"\u003e#2877\u003c/a\u003e from marshmallow-code/3.x-delint\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/b4bcb4a96f16a3b94c1b52ac82a66b57bbee1d88\"\u003e\u003ccode\u003eb4bcb4a\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] auto fixes from pre-commit.com hooks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/b78af7a0ea3102f8c2379bebe115a015e4018a62\"\u003e\u003ccode\u003eb78af7a\u003c/code\u003e\u003c/a\u003e Delint\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/2c4451e5129411da79161add51cfc76fe852549d\"\u003e\u003ccode\u003e2c4451e\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/86d101a1aee2fe0a521c976015d1940437493cde\"\u003e\u003ccode\u003e86d101a\u003c/code\u003e\u003c/a\u003e Bump version and update changelog\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/489a8d421dc7955bb53b89e962d69465fbc5b6af\"\u003e\u003ccode\u003e489a8d4\u003c/code\u003e\u003c/a\u003e Only deep copy error message collections\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/6d4a17dad54ea9711040c6aa6ba4d59267242a41\"\u003e\u003ccode\u003e6d4a17d\u003c/code\u003e\u003c/a\u003e Add test coverage for error message modification\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/0356a3f1c307830f8ded56d823abca5611c594c9\"\u003e\u003ccode\u003e0356a3f\u003c/code\u003e\u003c/a\u003e Merge error store messages without rebuilding collections\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/marshmallow-code/marshmallow/compare/3.26.1...3.26.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `mistune` from 3.1.4 to 3.2.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lepture/mistune/releases\"\u003emistune's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.2.1\u003c/h2\u003e\n\u003ch3\u003e   🐞 Bug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eResolve Windows compatibility issues in file inclusion and tests  -  by \u003ca href=\"https://github.com/Yuki9814\"\u003e\u003ccode\u003e@​Yuki9814\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/2547102\"\u003e\u003c!-- raw HTML omitted --\u003e(25471)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEscape html text  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/a3cb6e5\"\u003e\u003c!-- raw HTML omitted --\u003e(a3cb6)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate link reference  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/85eb54f\"\u003e\u003c!-- raw HTML omitted --\u003e(85eb5)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eHandle escaped dollar signs in inline math  -  by \u003ca href=\"https://github.com/saschabuehrle\"\u003e\u003ccode\u003e@​saschabuehrle\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/lepture/mistune/issues/370\"\u003elepture/mistune#370\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/7bd5709\"\u003e\u003c!-- raw HTML omitted --\u003e(7bd57)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEscape id of toc  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/04880a0\"\u003e\u003c!-- raw HTML omitted --\u003e(04880)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEscape id of headings  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/2855622\"\u003e\u003c!-- raw HTML omitted --\u003e(28556)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove double-encoding of image alt text  -  by \u003ca href=\"https://github.com/lawrence3699\"\u003e\u003ccode\u003e@​lawrence3699\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/0d6f3d8\"\u003e\u003c!-- raw HTML omitted --\u003e(0d6f3)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEscape xml for math plugin  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/5fa092e\"\u003e\u003c!-- raw HTML omitted --\u003e(5fa09)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse strict regex for image's height and width  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/8d0cb75\"\u003e\u003c!-- raw HTML omitted --\u003e(8d0cb)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch5\u003e    \u003ca href=\"https://github.com/lepture/mistune/compare/v3.2.0...v3.2.1\"\u003eView changes on GitHub\u003c/a\u003e\u003c/h5\u003e\n\u003ch2\u003ev3.2.0\u003c/h2\u003e\n\u003ch3\u003e   🚀 Features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport footnotes that start on the next line.  -  by \u003ca href=\"https://github.com/kylechui\"\u003e\u003ccode\u003e@​kylechui\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/2677e2d\"\u003e\u003c!-- raw HTML omitted --\u003e(2677e)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eProperly handle code blocks inside footnotes.  -  by \u003ca href=\"https://github.com/kylechui\"\u003e\u003ccode\u003e@​kylechui\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/0516c9e\"\u003e\u003c!-- raw HTML omitted --\u003e(0516c)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport python 3.14  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/7e0eb65\"\u003e\u003c!-- raw HTML omitted --\u003e(7e0eb)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e   🐞 Bug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRender ref links and footnotes in footnotes.  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/bd90e44\"\u003e\u003c!-- raw HTML omitted --\u003e(bd90e)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRender ref links in TOC.  -  by \u003ca href=\"https://github.com/lemon24\"\u003e\u003ccode\u003e@​lemon24\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/a0a0148\"\u003e\u003c!-- raw HTML omitted --\u003e(a0a01)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate typing for mypy upgrades  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/8d49cba\"\u003e\u003c!-- raw HTML omitted --\u003e(8d49c)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRender correct html for footnotes  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/9b62204\"\u003e\u003c!-- raw HTML omitted --\u003e(9b622)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch5\u003e    \u003ca href=\"https://github.com/lepture/mistune/compare/v3.1.4...v3.2.0\"\u003eView changes on GitHub\u003c/a\u003e\u003c/h5\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lepture/mistune/blob/main/docs/changes.rst\"\u003emistune's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 3.2.1\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on May 3, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eEscape link in \u003ccode\u003erender_toc_ul\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eEscape text in math plugin.\u003c/li\u003e\n\u003cli\u003eFix regex for math plugin.\u003c/li\u003e\n\u003cli\u003eEscape heading's ID attribute.\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eLINK_TITLE_RE\u003c/code\u003e to prevent DoS.\u003c/li\u003e\n\u003cli\u003eEscape class attribute for admonition directive.\u003c/li\u003e\n\u003cli\u003eRemove double-encoding of image alt text.\u003c/li\u003e\n\u003cli\u003eEscape class attribute for image directive.\u003c/li\u003e\n\u003cli\u003eFix width/height attribute for image directive.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 3.2.0\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Dec 23, 2025\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAnnounce supports for python 3.14\u003c/li\u003e\n\u003cli\u003eFix footnotes plugins for code blocks, ref links, blockquote and etc.\u003c/li\u003e\n\u003cli\u003eFix ref links in TOC.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/067f90861088a496942f5eb43236135352b85d39\"\u003e\u003ccode\u003e067f908\u003c/code\u003e\u003c/a\u003e chore: release 3.2.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/bf5503067a7d8c3b065fb143f67a3a08eca77bb6\"\u003e\u003ccode\u003ebf55030\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/lepture/mistune/issues/438\"\u003e#438\u003c/a\u003e from saschabuehrle/fix/issue-370\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/8d0cb7539a9ac82e633b98476b9922632eb8b948\"\u003e\u003ccode\u003e8d0cb75\u003c/code\u003e\u003c/a\u003e fix: use strict regex for image's height and width\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/5fa092e3053b86f16e4c49b9d3ba0b7ab63f09ab\"\u003e\u003ccode\u003e5fa092e\u003c/code\u003e\u003c/a\u003e fix: escape xml for math plugin\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/71ec9477ebfcf8dab0068804baf2c77461d77fbb\"\u003e\u003ccode\u003e71ec947\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/lepture/mistune/issues/440\"\u003e#440\u003c/a\u003e from lawrence3699/fix/image-alt-double-encoding\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/0d6f3d850283d51e9c60e5a1b3c9343a18df3722\"\u003e\u003ccode\u003e0d6f3d8\u003c/code\u003e\u003c/a\u003e fix: remove double-encoding of image alt text\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/2855622d7fe235c6c805716edff943b5945d1eea\"\u003e\u003ccode\u003e2855622\u003c/code\u003e\u003c/a\u003e fix: escape id of headings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/04880a004cb28318e5ebd7ee9e63c79fc9f9ed04\"\u003e\u003ccode\u003e04880a0\u003c/code\u003e\u003c/a\u003e fix: escape id of toc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/7bd57096715385062505b3f78972be9fa823d6d4\"\u003e\u003ccode\u003e7bd5709\u003c/code\u003e\u003c/a\u003e fix: handle escaped dollar signs in inline math (fixes \u003ca href=\"https://redirect.github.com/lepture/mistune/issues/370\"\u003e#370\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/85eb54ff17da26327399bf188f9ff9b8fd515278\"\u003e\u003ccode\u003e85eb54f\u003c/code\u003e\u003c/a\u003e fix: update link reference\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lepture/mistune/compare/v3.1.4...v3.2.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `nbconvert` from 7.16.6 to 7.17.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jupyter/nbconvert/releases\"\u003enbconvert's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.17.1\u003c/h2\u003e\n\u003ch2\u003e7.17.1\u003c/h2\u003e\n\u003cp\u003eThis is a security release, fixing two CVEs:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg\"\u003eCVE-2026-39377\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9\"\u003eCVE-2026-39378\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e(full advisories will be published seven days after release, on 2026-04-14).\u003c/p\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter/nbconvert/compare/v7.17.0...b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3\"\u003eFull Changelog\u003c/a\u003e)\u003c/p\u003e\n\u003ch3\u003eEnhancements made\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAllow configureable WebPDF JavaScript processing timeout \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2250\"\u003e#2250\u003c/a\u003e (\u003ca href=\"https://github.com/timkpaine\"\u003e\u003ccode\u003e@​timkpaine\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBugs fixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003ePermissionError\u003c/code\u003e when checking template paths on shared filesystems \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2252\"\u003e#2252\u003c/a\u003e (\u003ca href=\"https://github.com/ctcjab\"\u003e\u003ccode\u003e@​ctcjab\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eTweak webpdf template logic to fix duplicate extension problem \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2249\"\u003e#2249\u003c/a\u003e (\u003ca href=\"https://github.com/timkpaine\"\u003e\u003ccode\u003e@​timkpaine\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaintenance and upkeep improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003especify python version for pre \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2276\"\u003e#2276\u003c/a\u003e (\u003ca href=\"https://github.com/minrk\"\u003e\u003ccode\u003e@​minrk\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eContributors to this release\u003c/h3\u003e\n\u003cp\u003eThe following people contributed discussions, new ideas, code and documentation contributions, and review.\nSee \u003ca href=\"https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports\"\u003eour definition of contributors\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-01-29\u0026amp;to=2026-04-08\u0026amp;type=c\"\u003eGitHub contributors page for this release\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/akhmerov\"\u003e\u003ccode\u003e@​akhmerov\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aakhmerov+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/bollwyvl\"\u003e\u003ccode\u003e@​bollwyvl\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Abollwyvl+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/ctcjab\"\u003e\u003ccode\u003e@​ctcjab\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Actcjab+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/davidbrochart\"\u003e\u003ccode\u003e@​davidbrochart\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Adavidbrochart+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/Ken-B\"\u003e\u003ccode\u003e@​Ken-B\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AKen-B+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Akrassowski+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/mgeier\"\u003e\u003ccode\u003e@​mgeier\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Amgeier+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/minrk\"\u003e\u003ccode\u003e@​minrk\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/mpacer\"\u003e\u003ccode\u003e@​mpacer\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Ampacer+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/MSeal\"\u003e\u003ccode\u003e@​MSeal\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AMSeal+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/SylvainCorlay\"\u003e\u003ccode\u003e@​SylvainCorlay\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ASylvainCorlay+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/takluyver\"\u003e\u003ccode\u003e@​takluyver\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atakluyver+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/timkpaine\"\u003e\u003ccode\u003e@​timkpaine\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atimkpaine+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003ev7.17.0\u003c/h2\u003e\n\u003ch2\u003e7.17.0\u003c/h2\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter/nbconvert/compare/v7.16.6...c9ac1d1040459ed1ff9eb34e9918ce5a87cf9d71\"\u003eFull Changelog\u003c/a\u003e)\u003c/p\u003e\n\u003ch3\u003eEnhancements made\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for arbitrary browser arguments \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2227\"\u003e#2227\u003c/a\u003e (\u003ca href=\"https://github.com/shreve\"\u003e\u003ccode\u003e@​shreve\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBugs fixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix QtPNGExporter returning empty bytes on macOS \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2264\"\u003e#2264\u003c/a\u003e (\u003ca href=\"https://github.com/h3pdesign\"\u003e\u003ccode\u003e@​h3pdesign\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/QuLogic\"\u003e\u003ccode\u003e@​QuLogic\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jupyter/nbconvert/blob/main/CHANGELOG.md\"\u003enbconvert's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e7.17.1\u003c/h2\u003e\n\u003cp\u003eThis is a security release, fixing two CVEs:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg\"\u003eCVE-2026-39377\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9\"\u003eCVE-2026-39378\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e(full advisories will be published seven days after release, on 2026-04-14).\u003c/p\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter/nbconvert/compare/v7.17.0...b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3\"\u003eFull Changelog\u003c/a\u003e)\u003c/p\u003e\n\u003ch3\u003eEnhancements made\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAllow configureable WebPDF JavaScript processing timeout \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2250\"\u003e#2250\u003c/a\u003e (\u003ca href=\"https://github.com/timkpaine\"\u003e\u003ccode\u003e@​timkpaine\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBugs fixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003ePermissionError\u003c/code\u003e when checking template paths on shared filesystems \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2252\"\u003e#2252\u003c/a\u003e (\u003ca href=\"https://github.com/ctcjab\"\u003e\u003ccode\u003e@​ctcjab\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eTweak webpdf template logic to fix duplicate extension problem \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2249\"\u003e#2249\u003c/a\u003e (\u003ca href=\"https://github.com/timkpaine\"\u003e\u003ccode\u003e@​timkpaine\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaintenance and upkeep improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003especify python version for pre \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2276\"\u003e#2276\u003c/a\u003e (\u003ca href=\"https://github.com/minrk\"\u003e\u003ccode\u003e@​minrk\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eContributors to this release\u003c/h3\u003e\n\u003cp\u003eThe following people contributed discussions, new ideas, code and documentation contributions, and review.\nSee \u003ca href=\"https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports\"\u003eour definition of contributors\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-01-29\u0026amp;to=2026-04-08\u0026amp;type=c\"\u003eGitHub contributors page for this release\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/akhmerov\"\u003e\u003ccode\u003e@​akhmerov\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aakhmerov+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/bollwyvl\"\u003e\u003ccode\u003e@​bollwyvl\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Abollwyvl+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/ctcjab\"\u003e\u003ccode\u003e@​ctcjab\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Actcjab+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/davidbrochart\"\u003e\u003ccode\u003e@​davidbrochart\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Adavidbrochart+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/Ken-B\"\u003e\u003ccode\u003e@​Ken-B\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AKen-B+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Akrassowski+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/mgeier\"\u003e\u003ccode\u003e@​mgeier\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Amgeier+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/minrk\"\u003e\u003ccode\u003e@​minrk\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/mpacer\"\u003e\u003ccode\u003e@​mpacer\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Ampacer+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/MSeal\"\u003e\u003ccode\u003e@​MSeal\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AMSeal+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/SylvainCorlay\"\u003e\u003ccode\u003e@​SylvainCorlay\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ASylvainCorlay+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/takluyver\"\u003e\u003ccode\u003e@​takluyver\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atakluyver+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/timkpaine\"\u003e\u003ccode\u003e@​timkpaine\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atimkpaine+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e)\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e7.17.0\u003c/h2\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter/nbconvert/compare/v7.16.6...c9ac1d1040459ed1ff9eb34e9918ce5a87cf9d71\"\u003eFull Changelog\u003c/a\u003e)\u003c/p\u003e\n\u003ch3\u003eEnhancements made\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for arbitrary browser arguments \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2227\"\u003e#2227\u003c/a\u003e (\u003ca href=\"https://github.com/shreve\"\u003e\u003ccode\u003e@​shreve\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBugs fixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix QtPNGExporter returning empty bytes on macOS \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2264\"\u003e#2264\u003c/a\u003e (\u003ca href=\"https://github.com/h3pdesign\"\u003e\u003ccode\u003e@​h3pdesign\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/QuLogic\"\u003e\u003ccode\u003e@​QuLogic\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD) \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2261\"\u003e#2261\u003c/a\u003e (\u003ca href=\"https://github.com/h3pdesign\"\u003e\u003ccode\u003e@​h3pdesign\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/mberlanda\"\u003e\u003ccode\u003e@​mberlanda\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/minrk\"\u003e\u003ccode\u003e@​minrk\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/salmankadaya\"\u003e\u003ccode\u003e@​salmankadaya\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/th3gowtham\"\u003e\u003ccode\u003e@​th3gowtham\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix get_export_names and get_exporter default args \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2228\"\u003e#2228\u003c/a\u003e (\u003ca href=\"https://github.com/shreve\"\u003e\u003ccode\u003e@​shreve\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003ePyPA-Compliant Summary \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2226\"\u003e#2226\u003c/a\u003e (\u003ca href=\"https://github.com/hackowitz-af\"\u003e\u003ccode\u003e@​hackowitz-af\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/78ed30837a607deab7cf0a12dca072bf3f63417a\"\u003e\u003ccode\u003e78ed308\u003c/code\u003e\u003c/a\u003e Publish 7.17.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/f090a64606fde4c7f87cbf478f51b4aa46a425ec\"\u003e\u003ccode\u003ef090a64\u003c/code\u003e\u003c/a\u003e ruff format\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3\"\u003e\u003ccode\u003eb3b6ec0\u003c/code\u003e\u003c/a\u003e chore: update pre-commit hooks (\u003ca href=\"https://redirect.github.com/jupyter/nbconvert/issues/2277\"\u003e#2277\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/be4841f7da51c499b1937e41e6e71926dbe0daa3\"\u003e\u003ccode\u003ebe4841f\u003c/code\u003e\u003c/a\u003e ignore silly security lint in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/26d57b295870f5572d9bd0535acee4a120339c10\"\u003e\u003ccode\u003e26d57b2\u003c/code\u003e\u003c/a\u003e fix type annotation on Lexer\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/0e6b8ccabf2aca6c18fac8c574f22b7155f441fb\"\u003e\u003ccode\u003e0e6b8cc\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/ba5e5cdd737704388251fa55fa9e58f5752fa39d\"\u003e\u003ccode\u003eba5e5cd\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/1db0c88d865146ce02b6405a8d96753d3d0cd0c2\"\u003e\u003ccode\u003e1db0c88\u003c/code\u003e\u003c/a\u003e Specify python version for pre (\u003ca href=\"https://redirect.github.com/jupyter/nbconvert/issues/2276\"\u003e#2276\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/7473fc3037a6317bff54380e3a7162d73bf089b3\"\u003e\u003ccode\u003e7473fc3\u003c/code\u003e\u003c/a\u003e chore: update pre-commit hooks (\u003ca href=\"https://redirect.github.com/jupyter/nbconvert/issues/2242\"\u003e#2242\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/4322f7f290694929f414cefadc942111afad3762\"\u003e\u003ccode\u003e4322f7f\u003c/code\u003e\u003c/a\u003e Bump the actions group across 1 directory with 2 updates (\u003ca href=\"https://redirect.github.com/jupyter/nbconvert/issues/2273\"\u003e#2273\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jupyter/nbconvert/compare/v7.16.6...v7.17.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `nltk` from 3.9.2 to 3.9.4\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/nltk/nltk/blob/develop/ChangeLog\"\u003enltk's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eVersion 3.9.4 2026-03-24\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eSupport Python 3.14\u003c/li\u003e\n\u003cli\u003eFix bug in Levenshtein distance when substitution_cost \u0026gt; 2\u003c/li\u003e\n\u003cli\u003eFix bug in Treebank detokeniser re quote ordering\u003c/li\u003e\n\u003cli\u003eFix bug in Jaro similarity for empty strings\u003c/li\u003e\n\u003cli\u003eSeveral security enhancements\u003c/li\u003e\n\u003cli\u003eFix GHSA-rf74-v2fm-23pw: unbounded recursion in JSONTaggedDecoder\u003c/li\u003e\n\u003cli\u003eImplement TextTiling vocabulary introduction method (Hearst 1997)\u003c/li\u003e\n\u003cli\u003eFix ALINE feature matrix errors and add comprehensive tests\u003c/li\u003e\n\u003cli\u003eSupport multiple VerbNet versions, fix longid/shortid regex for VerbNet ids\u003c/li\u003e\n\u003cli\u003eLet downloader fallback to md5 when sha256 is unavailable\u003c/li\u003e\n\u003cli\u003eSeveral other minor bugfixes and code cleanups\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to the following contributors to 3.9.4:\nMin-Yen Kan, Eric Kafe, Emily Voss, bowiechen, Hrudhai01,\njancallewaert, Mr-Neutr0n, pollak.peter89, ylwango613,\u003c/p\u003e\n\u003cp\u003eVersion 3.9.3 2026-02-21\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix CVE-2025-14009: secure ZIP extraction in nltk.downloader (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3468\"\u003e#3468\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBlock path traversal/arbitrary reads in nltk.data for protocol-less refs (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3467\"\u003e#3467\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBlock path traversal/abs paths in corpus readers and FS pointers (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3479\"\u003e#3479\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3480\"\u003e#3480\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eValidate external StanfordSegmenter JARs using SHA256 (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3477\"\u003e#3477\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd optional sandbox enforcement for filestring() (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3485\"\u003e#3485\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eMaintenance: downloader/zipped models, CI/tooling updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to the following contributors to 3.9.3:\nChris Clauss, Eric Kafe, HyperPS, purificant, Shivansh-Game, Christopher Smith\u003c/p\u003e\n\u003cp\u003eVersion 3.9.2 2025-10-01\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate download checksums to use SHA256 in built index\u003c/li\u003e\n\u003cli\u003eFix percentage escape in new-style string formatting\u003c/li\u003e\n\u003cli\u003ereplace shortened URLs using goo.gl\u003c/li\u003e\n\u003cli\u003eMake Wordnet interoperable with various taggers and tagged corpora\u003c/li\u003e\n\u003cli\u003eFix saving PerceptronTagger\u003c/li\u003e\n\u003cli\u003eDocument how to reproduce old Wordnet studies\u003c/li\u003e\n\u003cli\u003eproperly initialize Portuguese corpus reader\u003c/li\u003e\n\u003cli\u003esupport for mixed rules conversion into Chomsky Normal Form\u003c/li\u003e\n\u003cli\u003eonly import tkinter if a GUI is needed\u003c/li\u003e\n\u003cli\u003eissue \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/2112\"\u003e#2112\u003c/a\u003e with Corenlp\u003c/li\u003e\n\u003cli\u003enew environment variable NLTK_DOWNLOADER_FORCE_INTERACTIVE_SHELL\u003c/li\u003e\n\u003cli\u003eLesk defaults to most frequent sense in case of ties\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to the following contributors to 3.9.2:\nJose Cols, Peter de Blanc, GeneralPoxter, Eric Kafe, William LaCroix, Jason Liu,\nSamer Masterson, Mike014, purificant, Andrew Ernest Ritz, samertm, Ikram Ul Haq,\nChristopher Smith, Ryan Mannion\u003c/p\u003e\n\u003cp\u003eVersion 3.9.1 2024-08-19\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/ad9c96ba00a16923ffe917eacf63f1707bfa2d08\"\u003e\u003ccode\u003ead9c96b\u003c/code\u003e\u003c/a\u003e Update copyright year\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/7edcddfda566627b897397397cc4d10ae91cb86d\"\u003e\u003ccode\u003e7edcddf\u003c/code\u003e\u003c/a\u003e Updates for 3.9.4 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/67a2736f89b286b028db08bd247134f17a11fc6b\"\u003e\u003ccode\u003e67a2736\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3180\"\u003e#3180\u003c/a\u003e from yzhaoinuw/bug-on-edit_distance_align\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/2b17ac5358a1c8d4b97455766efde0b786e6cdb2\"\u003e\u003ccode\u003e2b17ac5\u003c/code\u003e\u003c/a\u003e Fix edit_distance_align backtrace for high substitution costs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/4b72976a6ff3d180ed4012f11843e611a8f89516\"\u003e\u003ccode\u003e4b72976\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3018\"\u003e#3018\u003c/a\u003e from JuanIMartinezB/bug/shortid-longid\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/8a5619f53a281149e5342b1a00fe05fe2fc6517f\"\u003e\u003ccode\u003e8a5619f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3222\"\u003e#3222\u003c/a\u003e from Syzygy2048/feature/texttiling-vocabulary-introd...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/c6574d755e02b6163d9cd1d0b407076940e08864\"\u003e\u003ccode\u003ec6574d7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3289\"\u003e#3289\u003c/a\u003e from ihitamandal/codeflash/optimize-windowdiff-2024-...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/98ff5d9eaa1a81511873b9aef857944519c28dc4\"\u003e\u003ccode\u003e98ff5d9\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3435\"\u003e#3435\u003c/a\u003e from Hrudhai01/fix-3260-detokenize-quotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/aec4fce1b84ad725b8975f7365b23a4f626572a9\"\u003e\u003ccode\u003eaec4fce\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3522\"\u003e#3522\u003c/a\u003e from ekaf/pathsec\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/eec4ee3591cb9cb8b8c2989f08012608c841d532\"\u003e\u003ccode\u003eeec4ee3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3526\"\u003e#3526\u003c/a\u003e from nltk/update-contributing\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/nltk/nltk/compare/3.9.2...3.9.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pypdf` from 6.4.2 to 6.10.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/py-pdf/pypdf/releases\"\u003epypdf's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.10.2, 2026-04-15\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDo not rely on possibly invalid /Size for incremental cloning (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3735\"\u003e#3735\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIntroduce limits for FlateDecode parameters and image decoding (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3734\"\u003e#3734\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.10.1...6.10.2\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.10.1, 2026-04-14\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eLimit the allowed size of xref and object streams (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3733\"\u003e#3733\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eConsider strict mode setting for decryption errors (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3731\"\u003e#3731\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation (DOC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUse new parameter names for compress_identical_objects by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.10.0...6.10.1\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.10.0, 2026-04-10\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDisallow custom XML entity declarations for XMP metadata (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3724\"\u003e#3724\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6...\n\n_Description has been truncated_","html_url":"https://github.com/tabrezahmed51/MiroFish_0118/pull/5","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/tabrezahmed51%2FMiroFish_0118/issues/5","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/5/packages"},{"uuid":"4625988340","node_id":"PR_kwDOSX4Rvc7klKWS","number":2,"state":"closed","title":"chore(deps): bump the pip group across 8 directories with 13 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-09T22:21:51.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-09T22:06:21.000Z","updated_at":"2026-06-09T22:21:53.000Z","time_to_close":930,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"pip","update_count":13,"packages":[{"name":"certifi","old_version":"2022.12.7","new_version":"2024.7.4","repository_url":"https://github.com/certifi/python-certifi"},{"name":"cryptography","old_version":"36.0.1","new_version":"46.0.7","repository_url":"https://github.com/pyca/cryptography"},{"name":"h11","old_version":"0.13.0","new_version":"0.16.0","repository_url":"https://github.com/python-hyper/h11"},{"name":"idna","old_version":"3.3","new_version":"3.15","repository_url":"https://github.com/kjd/idna"},{"name":"lxml","old_version":"4.9.1","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"},{"name":"pyopenssl","old_version":"22.0.0","new_version":"26.0.0","repository_url":"https://github.com/pyca/pyopenssl"},{"name":"requests","old_version":"2.27.1","new_version":"2.33.0","repository_url":"https://github.com/psf/requests"},{"name":"tqdm","old_version":"4.63.0","new_version":"4.66.3","repository_url":"https://github.com/tqdm/tqdm"},{"name":"urllib3","old_version":"1.26.19","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"}],"path":null,"ecosystem":"pip"},"body":"Bumps the pip group with 1 update in the /examples/benchmarks/Localformer directory: [torch](https://github.com/pytorch/pytorch).\nBumps the pip group with 1 update in the /examples/benchmarks/TFT directory: [tensorflow-gpu](https://github.com/tensorflow/tensorflow).\nBumps the pip group with 2 updates in the /examples/benchmarks/TRA directory: [torch](https://github.com/pytorch/pytorch) and [scikit-learn](https://github.com/scikit-learn/scikit-learn).\nBumps the pip group with 2 updates in the /examples/benchmarks/TabNet directory: [torch](https://github.com/pytorch/pytorch) and [scikit-learn](https://github.com/scikit-learn/scikit-learn).\nBumps the pip group with 1 update in the /examples/benchmarks/Transformer directory: [torch](https://github.com/pytorch/pytorch).\nBumps the pip group with 1 update in the /examples/benchmarks_dynamic/DDG-DA directory: [torch](https://github.com/pytorch/pytorch).\nBumps the pip group with 1 update in the /examples/hyperparameter/LightGBM directory: [lightgbm](https://github.com/microsoft/LightGBM).\nBumps the pip group with 9 updates in the /scripts/data_collector/br_index directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [certifi](https://github.com/certifi/python-certifi) | `2022.12.7` | `2024.7.4` |\n| [cryptography](https://github.com/pyca/cryptography) | `36.0.1` | `46.0.7` |\n| [h11](https://github.com/python-hyper/h11) | `0.13.0` | `0.16.0` |\n| [idna](https://github.com/kjd/idna) | `3.3` | `3.15` |\n| [lxml](https://github.com/lxml/lxml) | `4.9.1` | `6.1.0` |\n| [pyopenssl](https://github.com/pyca/pyopenssl) | `22.0.0` | `26.0.0` |\n| [requests](https://github.com/psf/requests) | `2.27.1` | `2.33.0` |\n| [tqdm](https://github.com/tqdm/tqdm) | `4.63.0` | `4.66.3` |\n| [urllib3](https://github.com/urllib3/urllib3) | `1.26.19` | `2.7.0` |\n\n\nUpdates `torch` from 1.2.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/releases\"\u003etorch's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ePyTorch 2.8.0 Release Notes\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#highlights\"\u003eHighlights\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes\"\u003eBackwards Incompatible Changes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#deprecations\"\u003eDeprecations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#new-features\"\u003eNew Features\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#improvements\"\u003eImprovements\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes\"\u003eBug fixes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#performance\"\u003ePerformance\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#documentation\"\u003eDocumentation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#developers\"\u003eDevelopers\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eHighlights\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/blob/main/RELEASE.md\"\u003etorch's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleasing PyTorch\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-compatibility-matrix\"\u003eRelease Compatibility Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-cuda-support-matrix\"\u003ePyTorch CUDA Support Matrix\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-cadence\"\u003eRelease Cadence\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#general-overview\"\u003eGeneral Overview\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#frequently-asked-questions\"\u003eFrequently Asked Questions\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-a-release-branch-preparations\"\u003eCutting a release branch preparations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-release-branches\"\u003eCutting release branches\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorchpytorch\"\u003e\u003ccode\u003epytorch/pytorch\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-ecosystem-libraries\"\u003ePyTorch ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-pytorch\"\u003eMaking release branch specific changes for PyTorch\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-ecosystem-libraries\"\u003eMaking release branch specific changes for ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#running-launch-execution-team-core-xfn-sync\"\u003eRunning Launch Execution team Core XFN sync\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#drafting-rcs-release-candidates-for-pytorch-and-domain-libraries\"\u003eDrafting RCs (https://github.com/pytorch/pytorch/blob/main/Release Candidates) for PyTorch and domain libraries\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-storage\"\u003eRelease Candidate Storage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-health-validation\"\u003eRelease Candidate health validation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-fixes\"\u003eCherry Picking Fixes\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#how-to-do-cherry-picking\"\u003eHow to do Cherry Picking\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-reverts\"\u003eCherry Picking Reverts\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#preparing-and-creating-final-release-candidate\"\u003ePreparing and Creating Final Release Candidate\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#promoting-rcs-to-stable\"\u003ePromoting RCs to Stable\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#additional-steps-to-prepare-for-release-day\"\u003eAdditional Steps to prepare for release day\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#modify-release-matrix\"\u003eModify release matrix\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#open-google-colab-issue\"\u003eOpen Google Colab issue\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-releases\"\u003ePatch Releases\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-criteria\"\u003ePatch Release Criteria\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process\"\u003ePatch Release Process\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process-description\"\u003ePatch Release Process Description\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triage\"\u003eTriage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#issue-tracker-for-patch-releases\"\u003eIssue Tracker for Patch releases\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-a-release-schedule--cherry-picking\"\u003eBuilding a release schedule / cherry picking\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-binaries--promotion-to-stable\"\u003eBuilding Binaries / Promotion to Stable\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#hardware--software-support-in-binary-build-matrix\"\u003eHardware / Software Support in Binary Build Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#python\"\u003ePython\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#accelerator-software\"\u003eAccelerator Software\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-support-cases\"\u003eSpecial support cases\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#operating-systems\"\u003eOperating Systems\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#submitting-tutorials\"\u003eSubmitting Tutorials\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-topics\"\u003eSpecial Topics\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#updating-submodules-for-a-release\"\u003eUpdating submodules for a release\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triton-dependency-for-the-release\"\u003eTriton dependency for the release\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003eRelease Compatibility Matrix\u003c/h2\u003e\n\u003cp\u003eFollowing is the Release Compatibility Matrix for PyTorch releases:\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/ba56102387ef21a3b04b357e5b183d48f0afefc7\"\u003e\u003ccode\u003eba56102\u003c/code\u003e\u003c/a\u003e Cherrypick: Add the RunLLM widget to the website (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/159592\"\u003e#159592\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c525a02c89217181b5731d8043c7309a84e84066\"\u003e\u003ccode\u003ec525a02\u003c/code\u003e\u003c/a\u003e [dynamo, docs] cherry pick torch.compile programming model docs into 2.8 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/15\"\u003e#15\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a1cb3cc05d46d198467bebbb6e8fba50a325d4e7\"\u003e\u003ccode\u003ea1cb3cc\u003c/code\u003e\u003c/a\u003e [Release Only] Remove nvshmem from list of preload libraries (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158925\"\u003e#158925\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c76b2356bc31654de2af0c98cce1bef291f06f89\"\u003e\u003ccode\u003ec76b235\u003c/code\u003e\u003c/a\u003e Move out super large one off foreach_copy test (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158880\"\u003e#158880\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/20a0e225a01d4ebbffd44a6a59acff628359c772\"\u003e\u003ccode\u003e20a0e22\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;[Dynamo] Allow inlining into AO quantization modules (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/152934\"\u003e#152934\u003c/a\u003e)\u0026quot; (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158\"\u003e#158\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/9167ac8c75481e2beb3746aa37b7f48a213c631e\"\u003e\u003ccode\u003e9167ac8\u003c/code\u003e\u003c/a\u003e [MPS] Switch Cholesky  decomp to column wise (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158237\"\u003e#158237\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/5534685c62399db8d1e51b47e2dcbc17deaab230\"\u003e\u003ccode\u003e5534685\u003c/code\u003e\u003c/a\u003e [MPS] Reimplement \u003ccode\u003etri[ul]\u003c/code\u003e as Metal shaders (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158867\"\u003e#158867\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/d19e08d74b2a27e661bf57a9015014b757e8ea31\"\u003e\u003ccode\u003ed19e08d\u003c/code\u003e\u003c/a\u003e Cherry pick PR 158746 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158801\"\u003e#158801\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a6c044ab9aa14f0864c6a572f7c023432511c5ea\"\u003e\u003ccode\u003ea6c044a\u003c/code\u003e\u003c/a\u003e [cherry-pick] Unify torch.tensor and torch.ops.aten.scalar_tensor behavior (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/620ebd0646252bbb22524f5c252ec7e9ab977bee\"\u003e\u003ccode\u003e620ebd0\u003c/code\u003e\u003c/a\u003e [Dynamo] Use proper sources for constructing dataclass defaults (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158689\"\u003e#158689\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pytorch/pytorch/compare/v1.2.0...v2.8.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tensorflow-gpu` from 1.15.0 to 2.12.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tensorflow/tensorflow/releases\"\u003etensorflow-gpu's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eTensorFlow 2.12.0\u003c/h2\u003e\n\u003ch1\u003eRelease 2.12.0\u003c/h1\u003e\n\u003ch2\u003eTensorFlow\u003c/h2\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eBuild, Compilation and Packaging\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved redundant packages \u003ccode\u003etensorflow-gpu\u003c/code\u003e and \u003ccode\u003etf-nightly-gpu\u003c/code\u003e. These packages were removed and replaced with packages that direct users to switch to \u003ccode\u003etensorflow\u003c/code\u003e or \u003ccode\u003etf-nightly\u003c/code\u003e respectively. Since TensorFlow 2.1, the only difference between these two sets of packages was their names, so there is no loss of functionality or GPU support. See \u003ca href=\"https://pypi.org/project/tensorflow-gpu\"\u003ehttps://pypi.org/project/tensorflow-gpu\u003c/a\u003e for more details.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.function\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003etf.function\u003c/code\u003e now uses the Python inspect library directly for parsing the signature of the Python function it is decorated on. This change may break code where the function signature is malformed, but was ignored previously, such as:\n\u003cul\u003e\n\u003cli\u003eUsing \u003ccode\u003efunctools.wraps\u003c/code\u003e on a function with different signature\u003c/li\u003e\n\u003cli\u003eUsing \u003ccode\u003efunctools.partial\u003c/code\u003e with an invalid \u003ccode\u003etf.function\u003c/code\u003e input\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etf.function\u003c/code\u003e now enforces input parameter names to be valid Python identifiers. Incompatible names are automatically sanitized similarly to existing SavedModel signature behavior.\u003c/li\u003e\n\u003cli\u003eParameterless \u003ccode\u003etf.function\u003c/code\u003es are assumed to have an empty \u003ccode\u003einput_signature\u003c/code\u003e instead of an undefined one even if the \u003ccode\u003einput_signature\u003c/code\u003e is unspecified.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etf.types.experimental.TraceType\u003c/code\u003e now requires an additional \u003ccode\u003eplaceholder_value\u003c/code\u003e method to be defined.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etf.function\u003c/code\u003e now traces with placeholder values generated by TraceType instead of the value itself.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eExperimental APIs \u003ccode\u003etf.config.experimental.enable_mlir_graph_optimization\u003c/code\u003e and \u003ccode\u003etf.config.experimental.disable_mlir_graph_optimization\u003c/code\u003e were removed.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMajor Features and Improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSupport for Python 3.11 has been added.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSupport for Python 3.7 has been removed. We are not releasing any more patches for Python 3.7.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.lite\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd 16-bit float type support for built-in op \u003ccode\u003efill\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eTranspose now supports 6D tensors.\u003c/li\u003e\n\u003cli\u003eFloat LSTM now supports diagonal recurrent tensors: \u003ca href=\"https://arxiv.org/abs/1903.08023\"\u003ehttps://arxiv.org/abs/1903.08023\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.experimental.dtensor\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCoordination service now works with \u003ccode\u003edtensor.initialize_accelerator_system\u003c/code\u003e, and enabled by default.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003etf.experimental.dtensor.is_dtensor\u003c/code\u003e to check if a tensor is a DTensor instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.data\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for alternative checkpointing protocol which makes it possible to checkpoint the state of the input pipeline without having to store the contents of internal buffers. The new functionality can be enabled through the \u003ccode\u003eexperimental_symbolic_checkpoint\u003c/code\u003e option of \u003ccode\u003etf.data.Options()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAdded a new \u003ccode\u003ererandomize_each_iteration\u003c/code\u003e argument for the \u003ccode\u003etf.data.Dataset.random()\u003c/code\u003e operation, which controls whether the sequence of generated random numbers should be re-randomized every epoch or not (the default behavior). If \u003ccode\u003eseed\u003c/code\u003e is set and \u003ccode\u003ererandomize_each_iteration=True\u003c/code\u003e, the \u003ccode\u003erandom()\u003c/code\u003e operation will produce a different (deterministic) sequence of numbers every epoch.\u003c/li\u003e\n\u003cli\u003eAdded a new \u003ccode\u003ererandomize_each_iteration\u003c/code\u003e argument for the \u003ccode\u003etf.data.Dataset.sample_from_datasets()\u003c/code\u003e operation, which controls whether the sequence of generated random numbers used for sampling should be re-randomized every epoch or not. If \u003ccode\u003eseed\u003c/code\u003e is set and \u003ccode\u003ererandomize_each_iteration=True\u003c/code\u003e, the \u003ccode\u003esample_from_datasets()\u003c/code\u003e operation will use a different (deterministic) sequence of numbers every epoch.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.test\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003etf.test.experimental.sync_devices\u003c/code\u003e, which is useful for accurately measuring performance in benchmarks.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.experimental.dtensor\u003c/code\u003e:\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tensorflow/tensorflow/blob/master/RELEASE.md\"\u003etensorflow-gpu's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease 2.12.0\u003c/h1\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eBuild, Compilation and Packaging\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved redundant packages \u003ccode\u003etensorflow-gpu\u003c/code\u003e and \u003ccode\u003etf-nightly-gpu\u003c/code\u003e. These packages were removed and replaced with packages that direct users to switch to \u003ccode\u003etensorflow\u003c/code\u003e or \u003ccode\u003etf-nightly\u003c/code\u003e respectively. Since TensorFlow 2.1, the only difference between these two sets of packages was their names, so there is no loss of functionality or GPU support. See \u003ca href=\"https://pypi.org/project/tensorflow-gpu\"\u003ehttps://pypi.org/project/tensorflow-gpu\u003c/a\u003e for more details.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.function\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003etf.function\u003c/code\u003e now uses the Python inspect library directly for parsing the signature of the Python function it is decorated on. This change may break code where the function signature is malformed, but was ignored previously, such as:\n\u003cul\u003e\n\u003cli\u003eUsing \u003ccode\u003efunctools.wraps\u003c/code\u003e on a function with different signature\u003c/li\u003e\n\u003cli\u003eUsing \u003ccode\u003efunctools.partial\u003c/code\u003e with an invalid \u003ccode\u003etf.function\u003c/code\u003e input\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etf.function\u003c/code\u003e now enforces input parameter names to be valid Python identifiers. Incompatible names are automatically sanitized similarly to existing SavedModel signature behavior.\u003c/li\u003e\n\u003cli\u003eParameterless \u003ccode\u003etf.function\u003c/code\u003es are assumed to have an empty \u003ccode\u003einput_signature\u003c/code\u003e instead of an undefined one even if the \u003ccode\u003einput_signature\u003c/code\u003e is unspecified.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etf.types.experimental.TraceType\u003c/code\u003e now requires an additional \u003ccode\u003eplaceholder_value\u003c/code\u003e method to be defined.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etf.function\u003c/code\u003e now traces with placeholder values generated by TraceType instead of the value itself.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eExperimental APIs \u003ccode\u003etf.config.experimental.enable_mlir_graph_optimization\u003c/code\u003e and \u003ccode\u003etf.config.experimental.disable_mlir_graph_optimization\u003c/code\u003e were removed.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMajor Features and Improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSupport for Python 3.11 has been added.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSupport for Python 3.7 has been removed. We are not releasing any more patches for Python 3.7.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.lite\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd 16-bit float type support for built-in op \u003ccode\u003efill\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eTranspose now supports 6D tensors.\u003c/li\u003e\n\u003cli\u003eFloat LSTM now supports diagonal recurrent tensors: \u003ca href=\"https://arxiv.org/abs/1903.08023\"\u003ehttps://arxiv.org/abs/1903.08023\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.experimental.dtensor\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCoordination service now works with \u003ccode\u003edtensor.initialize_accelerator_system\u003c/code\u003e, and enabled by default.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003etf.experimental.dtensor.is_dtensor\u003c/code\u003e to check if a tensor is a DTensor instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.data\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for alternative checkpointing protocol which makes it possible to checkpoint the state of the input pipeline without having to store the contents of internal buffers. The new functionality can be enabled through the \u003ccode\u003eexperimental_symbolic_checkpoint\u003c/code\u003e option of \u003ccode\u003etf.data.Options()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAdded a new \u003ccode\u003ererandomize_each_iteration\u003c/code\u003e argument for the \u003ccode\u003etf.data.Dataset.random()\u003c/code\u003e operation, which controls whether the sequence of generated random numbers should be re-randomized every epoch or not (the default behavior). If \u003ccode\u003eseed\u003c/code\u003e is set and \u003ccode\u003ererandomize_each_iteration=True\u003c/code\u003e, the \u003ccode\u003erandom()\u003c/code\u003e operation will produce a different (deterministic) sequence of numbers every epoch.\u003c/li\u003e\n\u003cli\u003eAdded a new \u003ccode\u003ererandomize_each_iteration\u003c/code\u003e argument for the \u003ccode\u003etf.data.Dataset.sample_from_datasets()\u003c/code\u003e operation, which controls whether the sequence of generated random numbers used for sampling should be re-randomized every epoch or not. If \u003ccode\u003eseed\u003c/code\u003e is set and \u003ccode\u003ererandomize_each_iteration=True\u003c/code\u003e, the \u003ccode\u003esample_from_datasets()\u003c/code\u003e operation will use a different (deterministic) sequence of numbers every epoch.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.test\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003etf.test.experimental.sync_devices\u003c/code\u003e, which is useful for accurately measuring performance in benchmarks.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.experimental.dtensor\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded experimental support to ReduceScatter fuse on GPU (NCCL).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/0db597d0d758aba578783b5bf46c889700a45085\"\u003e\u003ccode\u003e0db597d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tensorflow/tensorflow/issues/60051\"\u003e#60051\u003c/a\u003e from tensorflow/venkat2469-patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/1a12f5939238da4c4372a095e589f2801baecf41\"\u003e\u003ccode\u003e1a12f59\u003c/code\u003e\u003c/a\u003e Update RELEASE.md\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/aa4d558019c48a7ab5ff403b56e7d80fda4d13ce\"\u003e\u003ccode\u003eaa4d558\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tensorflow/tensorflow/issues/60050\"\u003e#60050\u003c/a\u003e from tensorflow/venkat-patch-6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/bd1ab8a9ef0df2fbaefd6cfa994687c0aa1dca55\"\u003e\u003ccode\u003ebd1ab8a\u003c/code\u003e\u003c/a\u003e Update the security section in RELEASE.md\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/4905be05fd63d9943dec222ee83dcc6f522b671b\"\u003e\u003ccode\u003e4905be0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tensorflow/tensorflow/issues/60049\"\u003e#60049\u003c/a\u003e from tensorflow/venkat-patch-5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/9f96caad340d0f4bdb10a1addd61fe8a40fa6fdb\"\u003e\u003ccode\u003e9f96caa\u003c/code\u003e\u003c/a\u003e Update setup.py on TF release branch with released version of Estimator and k...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/e719b6b83b60fb03ff06c5397686888834fc5296\"\u003e\u003ccode\u003ee719b6b\u003c/code\u003e\u003c/a\u003e Update Relese.md (\u003ca href=\"https://redirect.github.com/tensorflow/tensorflow/issues/60033\"\u003e#60033\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/64a9d548b520659a9a226250dfd204e0038069bc\"\u003e\u003ccode\u003e64a9d54\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tensorflow/tensorflow/issues/60017\"\u003e#60017\u003c/a\u003e from tensorflow/joefernandez-patch-2.12-release-notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/7a4ebfd7f814a1b45a9d57c880fcbf8abb111fff\"\u003e\u003ccode\u003e7a4ebfd\u003c/code\u003e\u003c/a\u003e Update RELEASE.md\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/e0e10a9f2e3e09656f14b7b1339d94c7b43f84e6\"\u003e\u003ccode\u003ee0e10a9\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tensorflow/tensorflow/issues/59988\"\u003e#59988\u003c/a\u003e from tensorflow-jenkins/version-numbers-2.12.0-8756\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tensorflow/tensorflow/compare/v1.15.0...v2.12.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `torch` from 1.7.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/releases\"\u003etorch's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ePyTorch 2.8.0 Release Notes\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#highlights\"\u003eHighlights\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes\"\u003eBackwards Incompatible Changes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#deprecations\"\u003eDeprecations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#new-features\"\u003eNew Features\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#improvements\"\u003eImprovements\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes\"\u003eBug fixes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#performance\"\u003ePerformance\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#documentation\"\u003eDocumentation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#developers\"\u003eDevelopers\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eHighlights\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/blob/main/RELEASE.md\"\u003etorch's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleasing PyTorch\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-compatibility-matrix\"\u003eRelease Compatibility Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-cuda-support-matrix\"\u003ePyTorch CUDA Support Matrix\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-cadence\"\u003eRelease Cadence\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#general-overview\"\u003eGeneral Overview\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#frequently-asked-questions\"\u003eFrequently Asked Questions\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-a-release-branch-preparations\"\u003eCutting a release branch preparations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-release-branches\"\u003eCutting release branches\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorchpytorch\"\u003e\u003ccode\u003epytorch/pytorch\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-ecosystem-libraries\"\u003ePyTorch ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-pytorch\"\u003eMaking release branch specific changes for PyTorch\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-ecosystem-libraries\"\u003eMaking release branch specific changes for ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#running-launch-execution-team-core-xfn-sync\"\u003eRunning Launch Execution team Core XFN sync\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#drafting-rcs-release-candidates-for-pytorch-and-domain-libraries\"\u003eDrafting RCs (https://github.com/pytorch/pytorch/blob/main/Release Candidates) for PyTorch and domain libraries\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-storage\"\u003eRelease Candidate Storage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-health-validation\"\u003eRelease Candidate health validation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-fixes\"\u003eCherry Picking Fixes\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#how-to-do-cherry-picking\"\u003eHow to do Cherry Picking\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-reverts\"\u003eCherry Picking Reverts\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#preparing-and-creating-final-release-candidate\"\u003ePreparing and Creating Final Release Candidate\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#promoting-rcs-to-stable\"\u003ePromoting RCs to Stable\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#additional-steps-to-prepare-for-release-day\"\u003eAdditional Steps to prepare for release day\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#modify-release-matrix\"\u003eModify release matrix\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#open-google-colab-issue\"\u003eOpen Google Colab issue\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-releases\"\u003ePatch Releases\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-criteria\"\u003ePatch Release Criteria\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process\"\u003ePatch Release Process\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process-description\"\u003ePatch Release Process Description\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triage\"\u003eTriage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#issue-tracker-for-patch-releases\"\u003eIssue Tracker for Patch releases\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-a-release-schedule--cherry-picking\"\u003eBuilding a release schedule / cherry picking\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-binaries--promotion-to-stable\"\u003eBuilding Binaries / Promotion to Stable\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#hardware--software-support-in-binary-build-matrix\"\u003eHardware / Software Support in Binary Build Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#python\"\u003ePython\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#accelerator-software\"\u003eAccelerator Software\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-support-cases\"\u003eSpecial support cases\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#operating-systems\"\u003eOperating Systems\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#submitting-tutorials\"\u003eSubmitting Tutorials\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-topics\"\u003eSpecial Topics\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#updating-submodules-for-a-release\"\u003eUpdating submodules for a release\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triton-dependency-for-the-release\"\u003eTriton dependency for the release\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003eRelease Compatibility Matrix\u003c/h2\u003e\n\u003cp\u003eFollowing is the Release Compatibility Matrix for PyTorch releases:\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/ba56102387ef21a3b04b357e5b183d48f0afefc7\"\u003e\u003ccode\u003eba56102\u003c/code\u003e\u003c/a\u003e Cherrypick: Add the RunLLM widget to the website (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/159592\"\u003e#159592\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c525a02c89217181b5731d8043c7309a84e84066\"\u003e\u003ccode\u003ec525a02\u003c/code\u003e\u003c/a\u003e [dynamo, docs] cherry pick torch.compile programming model docs into 2.8 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/15\"\u003e#15\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a1cb3cc05d46d198467bebbb6e8fba50a325d4e7\"\u003e\u003ccode\u003ea1cb3cc\u003c/code\u003e\u003c/a\u003e [Release Only] Remove nvshmem from list of preload libraries (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158925\"\u003e#158925\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c76b2356bc31654de2af0c98cce1bef291f06f89\"\u003e\u003ccode\u003ec76b235\u003c/code\u003e\u003c/a\u003e Move out super large one off foreach_copy test (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158880\"\u003e#158880\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/20a0e225a01d4ebbffd44a6a59acff628359c772\"\u003e\u003ccode\u003e20a0e22\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;[Dynamo] Allow inlining into AO quantization modules (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/152934\"\u003e#152934\u003c/a\u003e)\u0026quot; (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158\"\u003e#158\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/9167ac8c75481e2beb3746aa37b7f48a213c631e\"\u003e\u003ccode\u003e9167ac8\u003c/code\u003e\u003c/a\u003e [MPS] Switch Cholesky  decomp to column wise (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158237\"\u003e#158237\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/5534685c62399db8d1e51b47e2dcbc17deaab230\"\u003e\u003ccode\u003e5534685\u003c/code\u003e\u003c/a\u003e [MPS] Reimplement \u003ccode\u003etri[ul]\u003c/code\u003e as Metal shaders (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158867\"\u003e#158867\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/d19e08d74b2a27e661bf57a9015014b757e8ea31\"\u003e\u003ccode\u003ed19e08d\u003c/code\u003e\u003c/a\u003e Cherry pick PR 158746 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158801\"\u003e#158801\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a6c044ab9aa14f0864c6a572f7c023432511c5ea\"\u003e\u003ccode\u003ea6c044a\u003c/code\u003e\u003c/a\u003e [cherry-pick] Unify torch.tensor and torch.ops.aten.scalar_tensor behavior (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/620ebd0646252bbb22524f5c252ec7e9ab977bee\"\u003e\u003ccode\u003e620ebd0\u003c/code\u003e\u003c/a\u003e [Dynamo] Use proper sources for constructing dataclass defaults (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158689\"\u003e#158689\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pytorch/pytorch/compare/v1.2.0...v2.8.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `scikit-learn` from 0.23.2 to 1.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/scikit-learn/scikit-learn/releases\"\u003escikit-learn's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eScikit-learn 1.5.0\u003c/h2\u003e\n\u003cp\u003eWe're happy to announce the 1.5.0 release.\u003c/p\u003e\n\u003cp\u003eYou can read the release highlights under \u003ca href=\"https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_5_0.html\"\u003ehttps://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_5_0.html\u003c/a\u003e and the long version of the change log under \u003ca href=\"https://scikit-learn.org/stable/whats_new/v1.5.html\"\u003ehttps://scikit-learn.org/stable/whats_new/v1.5.html\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThis version supports Python versions 3.9 to 3.12.\u003c/p\u003e\n\u003cp\u003eYou can upgrade with pip as usual:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003epip install -U scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThe conda-forge builds can be installed using:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003econda install -c conda-forge scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003ch2\u003eScikit-learn 1.4.2\u003c/h2\u003e\n\u003cp\u003eWe're happy to announce the 1.4.2 release.\u003c/p\u003e\n\u003cp\u003eThis release only includes support for numpy 2.\u003c/p\u003e\n\u003cp\u003eThis version supports Python versions 3.9 to 3.12.\u003c/p\u003e\n\u003cp\u003eYou can upgrade with pip as usual:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003epip install -U scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003ch2\u003eScikit-learn 1.4.1.post1\u003c/h2\u003e\n\u003cp\u003eWe're happy to announce the 1.4.1.post1 release.\u003c/p\u003e\n\u003cp\u003eYou can see the changelog here: \u003ca href=\"https://scikit-learn.org/stable/whats_new/v1.4.html#version-1-4-1-post1\"\u003ehttps://scikit-learn.org/stable/whats_new/v1.4.html#version-1-4-1-post1\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThis version supports Python versions 3.9 to 3.12.\u003c/p\u003e\n\u003cp\u003eYou can upgrade with pip as usual:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003epip install -U scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThe conda-forge builds can be installed using:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003econda install -c conda-forge scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/b51d0c9648241d1fd53dc9151689f62a61633a3d\"\u003e\u003ccode\u003eb51d0c9\u003c/code\u003e\u003c/a\u003e trigger whell builder [cd build]\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/919ae9bf72554a180baa3d8f4537b49c730b7580\"\u003e\u003ccode\u003e919ae9b\u003c/code\u003e\u003c/a\u003e MAINT Reoder what's new for 1.5 (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/29039\"\u003e#29039\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/0ac28ade871ca71a89a71c834a7b47829b075829\"\u003e\u003ccode\u003e0ac28ad\u003c/code\u003e\u003c/a\u003e DOC Release highlights 1.5 (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/29007\"\u003e#29007\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/729b54d5af208432f788ae7945842f0cf597bd36\"\u003e\u003ccode\u003e729b54d\u003c/code\u003e\u003c/a\u003e test py3.12 against numpy 2 [cd build]\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/1e50434f18275bb8727c2a2e24cb953db143d8a5\"\u003e\u003ccode\u003e1e50434\u003c/code\u003e\u003c/a\u003e set version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/ffbe4ab45bd9a113737231721fa2f55a70f3d0ab\"\u003e\u003ccode\u003effbe4ab\u003c/code\u003e\u003c/a\u003e DOC remove obsolete SVM example (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/27108\"\u003e#27108\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/4647729e5ee8c46e4fedace2d3c50c37f0a6693d\"\u003e\u003ccode\u003e4647729\u003c/code\u003e\u003c/a\u003e DOC Fix time complexity of MLP (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/28592\"\u003e#28592\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/9bd7047b4a6c673bcfd2911997f124e265f8ad57\"\u003e\u003ccode\u003e9bd7047\u003c/code\u003e\u003c/a\u003e FIX convergence criterion of MeanShift (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/28951\"\u003e#28951\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/b79420f1c2e82d814dec8026e96421751bfc9c96\"\u003e\u003ccode\u003eb79420f\u003c/code\u003e\u003c/a\u003e FIX add long long for int32/int64 windows compat in NumPy 2.0 (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/29029\"\u003e#29029\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/37f544db78503ed1a50da02cbb4f1a4e466fb0a7\"\u003e\u003ccode\u003e37f544d\u003c/code\u003e\u003c/a\u003e DOC replace pandas with Polars in examples/gaussian_process/plot_gpr_co2.py (...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/scikit-learn/scikit-learn/compare/0.23.2...1.5.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `torch` from 1.7.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/releases\"\u003etorch's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ePyTorch 2.8.0 Release Notes\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#highlights\"\u003eHighlights\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes\"\u003eBackwards Incompatible Changes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#deprecations\"\u003eDeprecations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#new-features\"\u003eNew Features\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#improvements\"\u003eImprovements\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes\"\u003eBug fixes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#performance\"\u003ePerformance\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#documentation\"\u003eDocumentation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#developers\"\u003eDevelopers\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eHighlights\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/blob/main/RELEASE.md\"\u003etorch's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleasing PyTorch\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-compatibility-matrix\"\u003eRelease Compatibility Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-cuda-support-matrix\"\u003ePyTorch CUDA Support Matrix\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-cadence\"\u003eRelease Cadence\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#general-overview\"\u003eGeneral Overview\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#frequently-asked-questions\"\u003eFrequently Asked Questions\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-a-release-branch-preparations\"\u003eCutting a release branch preparations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-release-branches\"\u003eCutting release branches\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorchpytorch\"\u003e\u003ccode\u003epytorch/pytorch\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-ecosystem-libraries\"\u003ePyTorch ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-pytorch\"\u003eMaking release branch specific changes for PyTorch\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-ecosystem-libraries\"\u003eMaking release branch specific changes for ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#running-launch-execution-team-core-xfn-sync\"\u003eRunning Launch Execution team Core XFN sync\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#drafting-rcs-release-candidates-for-pytorch-and-domain-libraries\"\u003eDrafting RCs (https://github.com/pytorch/pytorch/blob/main/Release Candidates) for PyTorch and domain libraries\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-storage\"\u003eRelease Candidate Storage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-health-validation\"\u003eRelease Candidate health validation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-fixes\"\u003eCherry Picking Fixes\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#how-to-do-cherry-picking\"\u003eHow to do Cherry Picking\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-reverts\"\u003eCherry Picking Reverts\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#preparing-and-creating-final-release-candidate\"\u003ePreparing and Creating Final Release Candidate\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#promoting-rcs-to-stable\"\u003ePromoting RCs to Stable\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#additional-steps-to-prepare-for-release-day\"\u003eAdditional Steps to prepare for release day\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#modify-release-matrix\"\u003eModify release matrix\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#open-google-colab-issue\"\u003eOpen Google Colab issue\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-releases\"\u003ePatch Releases\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-criteria\"\u003ePatch Release Criteria\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process\"\u003ePatch Release Process\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process-description\"\u003ePatch Release Process Description\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triage\"\u003eTriage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#issue-tracker-for-patch-releases\"\u003eIssue Tracker for Patch releases\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-a-release-schedule--cherry-picking\"\u003eBuilding a release schedule / cherry picking\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-binaries--promotion-to-stable\"\u003eBuilding Binaries / Promotion to Stable\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#hardware--software-support-in-binary-build-matrix\"\u003eHardware / Software Support in Binary Build Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#python\"\u003ePython\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#accelerator-software\"\u003eAccelerator Software\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-support-cases\"\u003eSpecial support cases\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#operating-systems\"\u003eOperating Systems\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#submitting-tutorials\"\u003eSubmitting Tutorials\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-topics\"\u003eSpecial Topics\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#updating-submodules-for-a-release\"\u003eUpdating submodules for a release\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triton-dependency-for-the-release\"\u003eTriton dependency for the release\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003eRelease Compatibility Matrix\u003c/h2\u003e\n\u003cp\u003eFollowing is the Release Compatibility Matrix for PyTorch releases:\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/ba56102387ef21a3b04b357e5b183d48f0afefc7\"\u003e\u003ccode\u003eba56102\u003c/code\u003e\u003c/a\u003e Cherrypick: Add the RunLLM widget to the website (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/159592\"\u003e#159592\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c525a02c89217181b5731d8043c7309a84e84066\"\u003e\u003ccode\u003ec525a02\u003c/code\u003e\u003c/a\u003e [dynamo, docs] cherry pick torch.compile programming model docs into 2.8 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/15\"\u003e#15\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a1cb3cc05d46d198467bebbb6e8fba50a325d4e7\"\u003e\u003ccode\u003ea1cb3cc\u003c/code\u003e\u003c/a\u003e [Release Only] Remove nvshmem from list of preload libraries (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158925\"\u003e#158925\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c76b2356bc31654de2af0c98cce1bef291f06f89\"\u003e\u003ccode\u003ec76b235\u003c/code\u003e\u003c/a\u003e Move out super large one off foreach_copy test (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158880\"\u003e#158880\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/20a0e225a01d4ebbffd44a6a59acff628359c772\"\u003e\u003ccode\u003e20a0e22\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;[Dynamo] Allow inlining into AO quantization modules (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/152934\"\u003e#152934\u003c/a\u003e)\u0026quot; (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158\"\u003e#158\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/9167ac8c75481e2beb3746aa37b7f48a213c631e\"\u003e\u003ccode\u003e9167ac8\u003c/code\u003e\u003c/a\u003e [MPS] Switch Cholesky  decomp to column wise (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158237\"\u003e#158237\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/5534685c62399db8d1e51b47e2dcbc17deaab230\"\u003e\u003ccode\u003e5534685\u003c/code\u003e\u003c/a\u003e [MPS] Reimplement \u003ccode\u003etri[ul]\u003c/code\u003e as Metal shaders (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158867\"\u003e#158867\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/d19e08d74b2a27e661bf57a9015014b757e8ea31\"\u003e\u003ccode\u003ed19e08d\u003c/code\u003e\u003c/a\u003e Cherry pick PR 158746 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158801\"\u003e#158801\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a6c044ab9aa14f0864c6a572f7c023432511c5ea\"\u003e\u003ccode\u003ea6c044a\u003c/code\u003e\u003c/a\u003e [cherry-pick] Unify torch.tensor and torch.ops.aten.scalar_tensor behavior (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/620ebd0646252bbb22524f5c252ec7e9ab977bee\"\u003e\u003ccode\u003e620ebd0\u003c/code\u003e\u003c/a\u003e [Dynamo] Use proper sources for constructing dataclass defaults (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158689\"\u003e#158689\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pytorch/pytorch/compare/v1.2.0...v2.8.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `scikit-learn` from 0.23.2 to 1.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/scikit-learn/scikit-learn/releases\"\u003escikit-learn's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eScikit-learn 1.5.0\u003c/h2\u003e\n\u003cp\u003eWe're happy to announce the 1.5.0 release.\u003c/p\u003e\n\u003cp\u003eYou can read the release highlights under \u003ca href=\"https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_5_0.html\"\u003ehttps://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_5_0.html\u003c/a\u003e and the long version of the change log under \u003ca href=\"https://scikit-learn.org/stable/whats_new/v1.5.html\"\u003ehttps://scikit-learn.org/stable/whats_new/v1.5.html\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThis version supports Python versions 3.9 to 3.12.\u003c/p\u003e\n\u003cp\u003eYou can upgrade with pip as usual:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003epip install -U scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThe conda-forge builds can be installed using:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003econda install -c conda-forge scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003ch2\u003eScikit-learn 1.4.2\u003c/h2\u003e\n\u003cp\u003eWe're happy to announce the 1.4.2 release.\u003c/p\u003e\n\u003cp\u003eThis release only includes support for numpy 2.\u003c/p\u003e\n\u003cp\u003eThis version supports Python versions 3.9 to 3.12.\u003c/p\u003e\n\u003cp\u003eYou can upgrade with pip as usual:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003epip install -U scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003ch2\u003eScikit-learn 1.4.1.post1\u003c/h2\u003e\n\u003cp\u003eWe're happy to announce the 1.4.1.post1 release.\u003c/p\u003e\n\u003cp\u003eYou can see the changelog here: \u003ca href=\"https://scikit-learn.org/stable/whats_new/v1.4.html#version-1-4-1-post1\"\u003ehttps://scikit-learn.org/stable/whats_new/v1.4.html#version-1-4-1-post1\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThis version supports Python versions 3.9 to 3.12.\u003c/p\u003e\n\u003cp\u003eYou can upgrade with pip as usual:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003epip install -U scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThe conda-forge builds can be installed using:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003econda install -c conda-forge scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/b51d0c9648241d1fd53dc9151689f62a61633a3d\"\u003e\u003ccode\u003eb51d0c9\u003c/code\u003e\u003c/a\u003e trigger whell builder [cd build]\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/919ae9bf72554a180baa3d8f4537b49c730b7580\"\u003e\u003ccode\u003e919ae9b\u003c/code\u003e\u003c/a\u003e MAINT Reoder what's new for 1.5 (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/29039\"\u003e#29039\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/0ac28ade871ca71a89a71c834a7b47829b075829\"\u003e\u003ccode\u003e0ac28ad\u003c/code\u003e\u003c/a\u003e DOC Release highlights 1.5 (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/29007\"\u003e#29007\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/729b54d5af208432f788ae7945842f0cf597bd36\"\u003e\u003ccode\u003e729b54d\u003c/code\u003e\u003c/a\u003e test py3.12 against numpy 2 [cd build]\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/1e50434f18275bb8727c2a2e24cb953db143d8a5\"\u003e\u003ccode\u003e1e50434\u003c/code\u003e\u003c/a\u003e set version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/ffbe4ab45bd9a113737231721fa2f55a70f3d0ab\"\u003e\u003ccode\u003effbe4ab\u003c/code\u003e\u003c/a\u003e DOC remove obsolete SVM example (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/27108\"\u003e#27108\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/4647729e5ee8c46e4fedace2d3c50c37f0a6693d\"\u003e\u003ccode\u003e4647729\u003c/code\u003e\u003c/a\u003e DOC Fix time complexity of MLP (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/28592\"\u003e#28592\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/9bd7047b4a6c673bcfd2911997f124e265f8ad57\"\u003e\u003ccode\u003e9bd7047\u003c/code\u003e\u003c/a\u003e FIX convergence criterion of MeanShift (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/28951\"\u003e#28951\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/b79420f1c2e82d814dec8026e96421751bfc9c96\"\u003e\u003ccode\u003eb79420f\u003c/code\u003e\u003c/a\u003e FIX add long long for int32/int64 windows compat in NumPy 2.0 (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/29029\"\u003e#29029\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/37f544db78503ed1a50da02cbb4f1a4e466fb0a7\"\u003e\u003ccode\u003e37f544d\u003c/code\u003e\u003c/a\u003e DOC replace pandas with Polars in examples/gaussian_process/plot_gpr_co2.py (...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/scikit-learn/scikit-learn/compare/0.23.2...1.5.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `torch` from 1.2.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/releases\"\u003etorch's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ePyTorch 2.8.0 Release Notes\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#highlights\"\u003eHighlights\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes\"\u003eBackwards Incompatible Changes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#deprecations\"\u003eDeprecations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#new-features\"\u003eNew Features\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#improvements\"\u003eImprovements\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes\"\u003eBug fixes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#performance\"\u003ePerformance\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#documentation\"\u003eDocumentation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#developers\"\u003eDevelopers\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eHighlights\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/blob/main/RELEASE.md\"\u003etorch's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleasing PyTorch\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-compatibility-matrix\"\u003eRelease Compatibility Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-cuda-support-matrix\"\u003ePyTorch CUDA Support Matrix\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-cadence\"\u003eRelease Cadence\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#general-overview\"\u003eGeneral Overview\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#frequently-asked-questions\"\u003eFrequently Asked Questions\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-a-release-branch-preparations\"\u003eCutting a release branch preparations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-release-branches\"\u003eCutting release branches\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorchpytorch\"\u003e\u003ccode\u003epytorch/pytorch\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-ecosystem-libraries\"\u003ePyTorch ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-pytorch\"\u003eMaking release branch specific changes for PyTorch\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-ecosystem-libraries\"\u003eMaking release branch specific changes for ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#running-launch-execution-team-core-xfn-sync\"\u003eRunning Launch Execution team Core XFN sync\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#drafting-rcs-release-candidates-for-pytorch-and-domain-libraries\"\u003eDrafting RCs (https://github.com/pytorch/pytorch/blob/main/Release Candidates) for PyTorch and domain libraries\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-storage\"\u003eRelease Candidate Storage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-health-validation\"\u003eRelease Candidate health validation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-fixes\"\u003eCherry Picking Fixes\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#how-to-do-cherry-picking\"\u003eHow to do Cherry Picking\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-reverts\"\u003eCherry Picking Reverts\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#preparing-and-creating-final-release-candidate\"\u003ePreparing and Creating Final Release Candidate\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#promoting-rcs-to-stable\"\u003ePromoting RCs to Stable\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#additional-steps-to-prepare-for-release-day\"\u003eAdditional Steps to prepare for release day\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#modify-release-matrix\"\u003eModify release matrix\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#open-google-colab-issue\"\u003eOpen Google Colab issue\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-releases\"\u003ePatch Releases\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-criteria\"\u003ePatch Release Criteria\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process\"\u003ePatch Release Process\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process-description\"\u003ePatch Release Process Description\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triage\"\u003eTriage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#issue-tracker-for-patch-releases\"\u003eIssue Tracker for Patch releases\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-a-release-schedule--cherry-picking\"\u003eBuilding a release schedule / cherry picking\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-binaries--promotion-to-stable\"\u003eBuilding Binaries / Promotion to Stable\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#hardware--software-support-in-binary-build-matrix\"\u003eHardware / Software Support in Binary Build Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#python\"\u003ePython\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#accelerator-software\"\u003eAccelerator Software\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-support-cases\"\u003eSpecial support cases\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#operating-systems\"\u003eOperating Systems\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#submitting-tutorials\"\u003eSubmitting Tutorials\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-topics\"\u003eSpecial Topics\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#updating-submodules-for-a-release\"\u003eUpdating submodules for a release\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triton-dependency-for-the-release\"\u003eTriton dependency for the release\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003eRelease Compatibility Matrix\u003c/h2\u003e\n\u003cp\u003eFollowing is the Release Compatibility Matrix for PyTorch releases:\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/ba56102387ef21a3b04b357e5b183d48f0afefc7\"\u003e\u003ccode\u003eba56102\u003c/code\u003e\u003c/a\u003e Cherrypick: Add the RunLLM widget to the website (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/159592\"\u003e#159592\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c525a02c89217181b5731d8043c7309a84e84066\"\u003e\u003ccode\u003ec525a02\u003c/code\u003e\u003c/a\u003e [dynamo, docs] cherry pick torch.compile programming model docs into 2.8 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/15\"\u003e#15\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a1cb3cc05d46d198467bebbb6e8fba50a325d4e7\"\u003e\u003ccode\u003ea1cb3cc\u003c/code\u003e\u003c/a\u003e [Release Only] Remove nvshmem from list of preload libraries (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158925\"\u003e#158925\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c76b2356bc31654de2af0c98cce1bef291f06f89\"\u003e\u003ccode\u003ec76b235\u003c/code\u003e\u003c/a\u003e Move out super large one off foreach_copy test (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158880\"\u003e#158880\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/20a0e225a01d4ebbffd44a6a59acff628359c772\"\u003e\u003ccode\u003e20a0e22\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;[Dynamo] Allow inlining into AO quantization modules (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/152934\"\u003e#152934\u003c/a\u003e)\u0026quot; (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158\"\u003e#158\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/9167ac8c75481e2beb3746aa37b7f48a213c631e\"\u003e\u003ccode\u003e9167ac8\u003c/code\u003e\u003c/a\u003e [MPS] Switch Cholesky  decomp to column wise (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158237\"\u003e#158237\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/5534685c62399db8d1e51b47e2dcbc17deaab230\"\u003e\u003ccode\u003e5534685\u003c/code\u003e\u003c/a\u003e [MPS] Reimplement \u003ccode\u003etri[ul]\u003c/code\u003e as Metal shaders (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158867\"\u003e#158867\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/d19e08d74b2a27e661bf57a9015014b757e8ea31\"\u003e\u003ccode\u003ed19e08d\u003c/code\u003e\u003c/a\u003e Cherry pick PR 158746 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158801\"\u003e#158801\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a6c044ab9aa14f0864c6a572f7c023432511c5ea\"\u003e\u003ccode\u003ea6c044a\u003c/code\u003e\u003c/a\u003e [cherry-pick] Unify torch.tensor and torch.ops.aten.scalar_tensor behavior (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/620ebd0646252bbb22524f5c252ec7e9ab977bee\"\u003e\u003ccode\u003e620ebd0\u003c/code\u003e\u003c/a\u003e [Dynamo] Use proper sources for constructing dataclass defaults (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158689\"\u003e#158689\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pytorch/pytorch/compare/v1.2.0...v2.8.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `torch` from 1.10.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/releases\"\u003etorch's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ePyTorch 2.8.0 Release Notes\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#highlights\"\u003eHighlights\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes\"\u003eBackwards Incompatible Changes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#deprecations\"\u003eDeprecations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#new-features\"\u003eNew Features\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#improvements\"\u003eImprovements\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes\"\u003eBug fixes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#performance\"\u003ePerformance\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#documentation\"\u003eDocumentation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#developers\"\u003eDevelopers\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eHighlights\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/blob/main/RELEASE.md\"\u003etorch's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleasing PyTorch\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-compatibility-matrix\"\u003eRelease Compatibility Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-cuda-support-matrix\"\u003ePyTorch CUDA Support Matrix\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-cadence\"\u003eRelease Cadence\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#general-overview\"\u003eGeneral Overview\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#frequently-asked-questions\"\u003eFrequently Asked Questions\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-a-release-branch-preparations\"\u003eCutting a release branch preparations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-release-branches\"\u003eCutting release branches\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorchpytorch\"\u003e\u003ccode\u003epytorch/pytorch\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-ecosystem-libraries\"\u003ePyTorch ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-pytorch\"\u003eMaking release branch specific changes for PyTorch\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-ecosystem-libraries\"\u003eMaking release branch specific changes for ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#running-launch-execution-team-core-xfn-sync\"\u003eRunning Launch Execution team Core XFN sync\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#drafting-rcs-release-candidates-for-pytorch-and-domain-libraries\"\u003eDrafting RCs (https://github.com/pytorch/pytorch/blob/main/Release Candidates) for PyTorch and domain libraries\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-storage\"\u003eRelease Candidate Storage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-health-validation\"\u003eRelease Candidate health validation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-fixes\"\u003eCherry Picking Fixes\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#how-to-do-cherry-picking\"\u003eHow to do Cherry Picking\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-reverts\"\u003eCherry Picking Reverts\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n...\n\n_Description has been truncated_","html_url":"https://github.com/dsplab75/qlib/pull/2","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/dsplab75%2Fqlib/issues/2","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2/packages"},{"uuid":"4614401471","node_id":"PR_kwDOOdzCTc7j-u8W","number":3,"state":"closed","title":"chore(deps): bump lxml from 5.3.1 to 6.1.0 in /workshops/rag/solution","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-06-10T01:38:08.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-08T15:54:59.000Z","updated_at":"2026-06-10T01:38:09.000Z","time_to_close":121389,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps)","packages":[{"name":"lxml","old_version":"5.3.1","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"}],"path":"/workshops/rag/solution","ecosystem":"pip"},"body":"Bumps [lxml](https://github.com/lxml/lxml) from 5.3.1 to 6.1.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/releases\"\u003elxml's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elxml-6.1.0\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.4\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.3\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.2\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.1\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.0\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-5.4.0\u003c/h2\u003e\n\u003ch1\u003e5.4.0 (2025-04-22)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2107279: Binary wheels use libxml2 2.13.8 and libxslt 1.1.43 to resolve several CVEs.\n(Binary wheels for Windows continue to use a patched libxml2 2.11.9 and libxslt 1.1.39.)\nIssue found by Anatoly Katyushin, see \u003ca href=\"https://bugs.launchpad.net/lxml/+bug/2107279\"\u003ehttps://bugs.launchpad.net/lxml/+bug/2107279\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003elxml-5.3.2\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.3 (2026-04-09)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSeveral out of memory error cases now raise \u003ccode\u003eMemoryError\u003c/code\u003e that were not handled before.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSlicing with large step values (outside of \u003ccode\u003e+/- sys.maxsize\u003c/code\u003e) could trigger undefined C behaviour.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2125399: Some failing tests were fixed or disabled in PyPy.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2138421: Memory leak in error cases when setting the \u003ccode\u003epublic_id\u003c/code\u003e or \u003ccode\u003esystem_url\u003c/code\u003e of a document.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c7d76d6cb817c8e1f316e43b16cab5e6ad669ad0\"\u003e\u003ccode\u003ec7d76d6\u003c/code\u003e\u003c/a\u003e Change security policy to point to Github security advisories.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/378ccf82db8160928807c55ed580c0443aa94f42\"\u003e\u003ccode\u003e378ccf8\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/315270b810a9e3276c60daba549299d204ac962b\"\u003e\u003ccode\u003e315270b\u003c/code\u003e\u003c/a\u003e Docs: Reduce TOC depth of package pages and move module contents first.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6dbba7f3c72f655b05b26ef453fdee31af13ccf5\"\u003e\u003ccode\u003e6dbba7f\u003c/code\u003e\u003c/a\u003e Docs: Show current year in copyright line.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/e4385bfa5d79527350d5ef17372fb70ba80b4cce\"\u003e\u003ccode\u003ee4385bf\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5bed1e1a227cd9ba5a879aaeacdf504093a3f6e8\"\u003e\u003ccode\u003e5bed1e1\u003c/code\u003e\u003c/a\u003e Validate file hashes in release download script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c13ee10a429f1144779bb1cbf6ae3bec808ae9c1\"\u003e\u003ccode\u003ec13ee10\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.0.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-5.3.1...lxml-6.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lxml\u0026package-manager=uv\u0026previous-version=5.3.1\u0026new-version=6.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/lisaross/second-brain-ai-assistant-course/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/lisaross/second-brain-ai-assistant-course/pull/3","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/lisaross%2Fsecond-brain-ai-assistant-course/issues/3","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/3/packages"},{"uuid":"4605702553","node_id":"PR_kwDOM8hlPc7ji2P7","number":10,"state":"closed","title":"Bump lxml from 6.0.2 to 6.1.0","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-07T01:15:29.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-07T01:11:06.000Z","updated_at":"2026-06-07T01:15:30.000Z","time_to_close":263,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"lxml","old_version":"6.0.2","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"}],"path":null,"ecosystem":"pip"},"body":"Bumps [lxml](https://github.com/lxml/lxml) from 6.0.2 to 6.1.0.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.3 (2026-04-09)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSeveral out of memory error cases now raise \u003ccode\u003eMemoryError\u003c/code\u003e that were not handled before.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSlicing with large step values (outside of \u003ccode\u003e+/- sys.maxsize\u003c/code\u003e) could trigger undefined C behaviour.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2125399: Some failing tests were fixed or disabled in PyPy.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2138421: Memory leak in error cases when setting the \u003ccode\u003epublic_id\u003c/code\u003e or \u003ccode\u003esystem_url\u003c/code\u003e of a document.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c7d76d6cb817c8e1f316e43b16cab5e6ad669ad0\"\u003e\u003ccode\u003ec7d76d6\u003c/code\u003e\u003c/a\u003e Change security policy to point to Github security advisories.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/378ccf82db8160928807c55ed580c0443aa94f42\"\u003e\u003ccode\u003e378ccf8\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/315270b810a9e3276c60daba549299d204ac962b\"\u003e\u003ccode\u003e315270b\u003c/code\u003e\u003c/a\u003e Docs: Reduce TOC depth of package pages and move module contents first.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6dbba7f3c72f655b05b26ef453fdee31af13ccf5\"\u003e\u003ccode\u003e6dbba7f\u003c/code\u003e\u003c/a\u003e Docs: Show current year in copyright line.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/e4385bfa5d79527350d5ef17372fb70ba80b4cce\"\u003e\u003ccode\u003ee4385bf\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5bed1e1a227cd9ba5a879aaeacdf504093a3f6e8\"\u003e\u003ccode\u003e5bed1e1\u003c/code\u003e\u003c/a\u003e Validate file hashes in release download script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c13ee10a429f1144779bb1cbf6ae3bec808ae9c1\"\u003e\u003ccode\u003ec13ee10\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.0.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.0.2...lxml-6.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lxml\u0026package-manager=uv\u0026previous-version=6.0.2\u0026new-version=6.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ewjoachim/writober/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/ewjoachim/writober/pull/10","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/ewjoachim%2Fwritober/issues/10","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/10/packages"},{"uuid":"4589995774","node_id":"PR_kwDOONC7l87ivg_q","number":8,"state":"closed","title":"Bump the uv group across 4 directories with 9 updates","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-17T02:39:43.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-04T15:32:38.000Z","updated_at":"2026-06-17T02:39:45.000Z","time_to_close":1076825,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","group_name":"uv","update_count":9,"packages":[{"name":"mcp","old_version":"1.2.0","new_version":"1.23.0","repository_url":"https://github.com/modelcontextprotocol/python-sdk"},{"name":"requests","old_version":"2.32.3","new_version":"2.33.0","repository_url":"https://github.com/psf/requests"},{"name":"h11","old_version":"0.14.0","new_version":"0.16.0","repository_url":"https://github.com/python-hyper/h11"},{"name":"idna","old_version":"3.10","new_version":"3.15","repository_url":"https://github.com/kjd/idna"},{"name":"lxml","old_version":"5.3.0","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"},{"name":"python-dotenv","old_version":"1.0.1","new_version":"1.2.2","repository_url":"https://github.com/theskumar/python-dotenv"},{"name":"starlette","old_version":"0.41.2","new_version":"1.0.1","repository_url":"https://github.com/Kludex/starlette"},{"name":"urllib3","old_version":"2.2.3","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"}],"path":null,"ecosystem":"pip"},"body":"Bumps the uv group with 8 updates in the /src/fetch directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.2.0` | `1.23.0` |\n| [requests](https://github.com/psf/requests) | `2.32.3` | `2.33.0` |\n| [h11](https://github.com/python-hyper/h11) | `0.14.0` | `0.16.0` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.0.1` | `1.2.2` |\n| [starlette](https://github.com/Kludex/starlette) | `0.41.2` | `1.0.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.2.3` | `2.7.0` |\n\nBumps the uv group with 5 updates in the /src/sentry directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.0.0` | `1.23.0` |\n| [h11](https://github.com/python-hyper/h11) | `0.14.0` | `0.16.0` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [starlette](https://github.com/Kludex/starlette) | `0.41.3` | `1.0.1` |\n| [pytest](https://github.com/pytest-dev/pytest) | `8.3.3` | `9.0.3` |\n\nBumps the uv group with 4 updates in the /src/sqlite directory: [mcp](https://github.com/modelcontextprotocol/python-sdk), [h11](https://github.com/python-hyper/h11), [idna](https://github.com/kjd/idna) and [starlette](https://github.com/Kludex/starlette).\nBumps the uv group with 5 updates in the /src/time directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.0.0` | `1.23.0` |\n| [h11](https://github.com/python-hyper/h11) | `0.14.0` | `0.16.0` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [starlette](https://github.com/Kludex/starlette) | `0.41.3` | `1.0.1` |\n| [pytest](https://github.com/pytest-dev/pytest) | `8.3.3` | `9.0.3` |\n\n\nUpdates `mcp` from 1.2.0 to 1.23.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/releases\"\u003emcp's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.23.0\u003c/h2\u003e\n\u003ch2\u003eSummary\u003c/h2\u003e\n\u003cp\u003eThis release brings us up to speed with the latest MCP spec \u003ccode\u003e2025-11-25\u003c/code\u003e. Take a look at the \u003ca href=\"https://modelcontextprotocol.io/specification/2025-11-25\"\u003elatest spec\u003c/a\u003e as well as the release \u003ca href=\"https://blog.modelcontextprotocol.io/posts/2025-11-25-first-mcp-anniversary/\"\u003eblog post.\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd tests for JSON Schema 2020-12 field preservation (SEP-1613) by \u003ca href=\"https://github.com/felixweinberger\"\u003e\u003ccode\u003e@​felixweinberger\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1649\"\u003emodelcontextprotocol/python-sdk#1649\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd client_secret_basic authentication support by \u003ca href=\"https://github.com/jonshea\"\u003e\u003ccode\u003e@​jonshea\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1334\"\u003emodelcontextprotocol/python-sdk#1334\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImplement SEP-1577 - Sampling With Tools by \u003ca href=\"https://github.com/ochafik\"\u003e\u003ccode\u003e@​ochafik\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1594\"\u003emodelcontextprotocol/python-sdk#1594\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSEP-1330: Elicitation Enum Schema Improvements and Standards Compliance by \u003ca href=\"https://github.com/chughtapan\"\u003e\u003ccode\u003e@​chughtapan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1246\"\u003emodelcontextprotocol/python-sdk#1246\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[auth][conformance] add conformance auth client by \u003ca href=\"https://github.com/pcarleton\"\u003e\u003ccode\u003e@​pcarleton\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1640\"\u003emodelcontextprotocol/python-sdk#1640\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImplement SEP-986: Tool name validation by \u003ca href=\"https://github.com/felixweinberger\"\u003e\u003ccode\u003e@​felixweinberger\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1655\"\u003emodelcontextprotocol/python-sdk#1655\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: url for spec by \u003ca href=\"https://github.com/felixweinberger\"\u003e\u003ccode\u003e@​felixweinberger\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1659\"\u003emodelcontextprotocol/python-sdk#1659\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: implement SEP-991 URL-based client ID (CIMD) support by \u003ca href=\"https://github.com/pcarleton\"\u003e\u003ccode\u003e@​pcarleton\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1652\"\u003emodelcontextprotocol/python-sdk#1652\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate doc string on custom_route by \u003ca href=\"https://github.com/pcarleton\"\u003e\u003ccode\u003e@​pcarleton\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1660\"\u003emodelcontextprotocol/python-sdk#1660\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImplement SEP-1036: URL mode elicitation for secure out-of-band interactions by \u003ca href=\"https://github.com/cbcoutinho\"\u003e\u003ccode\u003e@​cbcoutinho\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1580\"\u003emodelcontextprotocol/python-sdk#1580\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSkip empty SSE data to avoid parsing errors by \u003ca href=\"https://github.com/felixweinberger\"\u003e\u003ccode\u003e@​felixweinberger\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1670\"\u003emodelcontextprotocol/python-sdk#1670\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSEP-1686: Tasks by \u003ca href=\"https://github.com/maxisbey\"\u003e\u003ccode\u003e@​maxisbey\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1645\"\u003emodelcontextprotocol/python-sdk#1645\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd on_session_created callback option by \u003ca href=\"https://github.com/crondinini-ant\"\u003e\u003ccode\u003e@​crondinini-ant\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1710\"\u003emodelcontextprotocol/python-sdk#1710\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd SSE polling support (SEP-1699) by \u003ca href=\"https://github.com/felixweinberger\"\u003e\u003ccode\u003e@​felixweinberger\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1654\"\u003emodelcontextprotocol/python-sdk#1654\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport client_credentials flow with JWT and Basic auth by \u003ca href=\"https://github.com/pcarleton\"\u003e\u003ccode\u003e@​pcarleton\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1663\"\u003emodelcontextprotocol/python-sdk#1663\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: backwards-compatible create_message overloads for SEP-1577 by \u003ca href=\"https://github.com/felixweinberger\"\u003e\u003ccode\u003e@​felixweinberger\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1713\"\u003emodelcontextprotocol/python-sdk#1713\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAuto-enable DNS rebinding protection for localhost servers by \u003ca href=\"https://github.com/pcarleton\"\u003e\u003ccode\u003e@​pcarleton\u003c/code\u003e\u003c/a\u003e  (d3a184119e4479ea6a63590bc41f01dc06e3fa99)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ochafik\"\u003e\u003ccode\u003e@​ochafik\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1594\"\u003emodelcontextprotocol/python-sdk#1594\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/compare/v1.22.0...v1.23.0\"\u003ehttps://github.com/modelcontextprotocol/python-sdk/compare/v1.22.0...v1.23.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.22.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: Pass through and expose additional parameters in \u003ccode\u003eClientSessionGroup.call_tool\u003c/code\u003e and \u003ccode\u003e.connect_to_server\u003c/code\u003e by \u003ca href=\"https://github.com/inaku-Gyan\"\u003e\u003ccode\u003e@​inaku-Gyan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1576\"\u003emodelcontextprotocol/python-sdk#1576\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: Lazy import \u003ccode\u003ejsonschema\u003c/code\u003e library by \u003ca href=\"https://github.com/wuliang229\"\u003e\u003ccode\u003e@​wuliang229\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1596\"\u003emodelcontextprotocol/python-sdk#1596\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Update examples to use stateless HTTP with JSON responses by \u003ca href=\"https://github.com/domdomegg\"\u003e\u003ccode\u003e@​domdomegg\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1499\"\u003emodelcontextprotocol/python-sdk#1499\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/wuliang229\"\u003e\u003ccode\u003e@​wuliang229\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1596\"\u003emodelcontextprotocol/python-sdk#1596\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/compare/v1.21.1...v1.22.0\"\u003ehttps://github.com/modelcontextprotocol/python-sdk/compare/v1.21.1...v1.22.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.21.2\u003c/h2\u003e\n\u003ch2\u003eHotfix Release\u003c/h2\u003e\n\u003cp\u003eThis is a hotfix release to address a critical bug in OAuth scope handling that caused failures on 401 responses.\u003c/p\u003e\n\u003ch3\u003eRelated:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1630\"\u003emodelcontextprotocol/python-sdk#1630\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1632\"\u003emodelcontextprotocol/python-sdk#1632\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/d3a184119e4479ea6a63590bc41f01dc06e3fa99\"\u003e\u003ccode\u003ed3a1841\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/fa851d93a2036a37cce73e098f7dbc80a6c48765\"\u003e\u003ccode\u003efa851d9\u003c/code\u003e\u003c/a\u003e feat: backwards-compatible create_message overloads for SEP-1577 (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1713\"\u003e#1713\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/f82b0c937178815c1e96460455778578050c6d1a\"\u003e\u003ccode\u003ef82b0c9\u003c/code\u003e\u003c/a\u003e Support client_credentials flow with JWT and Basic auth (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1663\"\u003e#1663\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/281fd4765e0fc2efaf2039d248c3bc0698416a8a\"\u003e\u003ccode\u003e281fd47\u003c/code\u003e\u003c/a\u003e Add SSE polling support (SEP-1699) (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1654\"\u003e#1654\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/2cd178a962ab454e3add228ecd721784b7b36e99\"\u003e\u003ccode\u003e2cd178a\u003c/code\u003e\u003c/a\u003e Add on_session_created callback option (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1710\"\u003e#1710\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/c92bb2f7ffaa61813d7cc350887f4ece38307769\"\u003e\u003ccode\u003ec92bb2f\u003c/code\u003e\u003c/a\u003e SEP-1686: Tasks (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1645\"\u003e#1645\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/5983a650cc07d2dc6c6ba098e99d3545889157a9\"\u003e\u003ccode\u003e5983a65\u003c/code\u003e\u003c/a\u003e Skip empty SSE data to avoid parsing errors (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1670\"\u003e#1670\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/02b78899296ce3631565345501e3d956b83ffe94\"\u003e\u003ccode\u003e02b7889\u003c/code\u003e\u003c/a\u003e Implement SEP-1036: URL mode elicitation for secure out-of-band interactions ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/27279bc157cbc03f7fe7758fd55a4b34c5652f42\"\u003e\u003ccode\u003e27279bc\u003c/code\u003e\u003c/a\u003e Update doc string on custom_route (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1660\"\u003e#1660\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/f22501315eab5b8358c603ac7f730f77bb09e4c4\"\u003e\u003ccode\u003ef225013\u003c/code\u003e\u003c/a\u003e feat: implement SEP-991 URL-based client ID (CIMD) support (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1652\"\u003e#1652\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/compare/v1.2.0...v1.23.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.32.3 to 2.33.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/releases\"\u003erequests's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.33.0\u003c/h2\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at \u003ca href=\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e. Give it a try, and report any gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/M0d3v1\"\u003e\u003ccode\u003e@​M0d3v1\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6865\"\u003epsf/requests#6865\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/aminvakil\"\u003e\u003ccode\u003e@​aminvakil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7220\"\u003epsf/requests#7220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/E8Price\"\u003e\u003ccode\u003e@​E8Price\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6960\"\u003epsf/requests#6960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mitre88\"\u003e\u003ccode\u003e@​mitre88\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7244\"\u003epsf/requests#7244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/magsen\"\u003e\u003ccode\u003e@​magsen\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6553\"\u003epsf/requests#6553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Rohan5commit\"\u003e\u003ccode\u003e@​Rohan5commit\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7227\"\u003epsf/requests#7227\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.32.5\u003c/h2\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has created\na new class of issues in Requests that have had negative impact across a number\nof use cases. The Requests team has decided to revert this feature as long term\nmaintenance of it is proving to be unsustainable in its current iteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev2.32.4\u003c/h2\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base that\nuses Requests, please take a look at \u003ca href=\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e. Give it a try, and report\nany gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now extracts\ncontents to a non-deterministic location to prevent malicious file\nreplacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause\nmalformed authentication to be applied to Requests on\nPython 3.11+. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has created\na new class of issues in Requests that have had negative impact across a number\nof use cases. The Requests team has decided to revert this feature as long term\nmaintenance of it is proving to be unsustainable in its current iteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted\nenvironment will retrieve credentials for the wrong hostname/machine from a\nnetrc file.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761\"\u003e\u003ccode\u003ebc04dfd\u003c/code\u003e\u003c/a\u003e v2.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"\u003e\u003ccode\u003e66d21cb\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028\"\u003e\u003ccode\u003e8b9bc8f\u003c/code\u003e\u003c/a\u003e Move badges to top of README (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7293\"\u003e#7293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286\"\u003e\u003ccode\u003ee331a28\u003c/code\u003e\u003c/a\u003e Remove unused extraction call (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7292\"\u003e#7292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29\"\u003e\u003ccode\u003e753fd08\u003c/code\u003e\u003c/a\u003e docs: fix FAQ grammar in httplib2 example\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71\"\u003e\u003ccode\u003e774a0b8\u003c/code\u003e\u003c/a\u003e docs(socks): same block as other sections\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303\"\u003e\u003ccode\u003e9c72a41\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 4.33.0 to 4.34.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be\"\u003e\u003ccode\u003eebf7190\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 4.32.0 to 4.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798\"\u003e\u003ccode\u003e0e4ae38\u003c/code\u003e\u003c/a\u003e docs: exclude Response.is_permanent_redirect from API docs (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7244\"\u003e#7244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a\"\u003e\u003ccode\u003ed568f47\u003c/code\u003e\u003c/a\u003e docs: clarify Quickstart POST example (\u003ca href=\"https://redirect.github.com/psf/requests/issues/6960\"\u003e#6960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/psf/requests/compare/v2.32.3...v2.33.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `h11` from 0.14.0 to 0.16.0\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/1c5b07581f058886c8bdd87adababd7d959dc7ca\"\u003e\u003ccode\u003e1c5b075\u003c/code\u003e\u003c/a\u003e this time for surer\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/d9c369935e853a7ee1aeb7e481f6dddf9b9c9b8a\"\u003e\u003ccode\u003ed9c3699\u003c/code\u003e\u003c/a\u003e this time for sure...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/d91b9dd2290a25c8c3f5ec15feb57de5873e6e39\"\u003e\u003ccode\u003ed91b9dd\u003c/code\u003e\u003c/a\u003e blacken\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/5a4683ca466b59bbab9b19cfea20ee157b31cee0\"\u003e\u003ccode\u003e5a4683c\u003c/code\u003e\u003c/a\u003e Soothe mypy\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/9c9567f0a92d13a83a8d8ebdbc757c8c2d384536\"\u003e\u003ccode\u003e9c9567f\u003c/code\u003e\u003c/a\u003e Bump version to 0.16.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/114803a29ce50116dc47951c690ad4892b1a36ed\"\u003e\u003ccode\u003e114803a\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/9462006f6ce4941661888228cbd4ac1ea80689b0\"\u003e\u003ccode\u003e9462006\u003c/code\u003e\u003c/a\u003e Bump version to 0.15.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/70a96bea8e55403e5d92db14c111432c6d7a8685\"\u003e\u003ccode\u003e70a96be\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/python-hyper/h11/issues/181\"\u003e#181\u003c/a\u003e from Julien00859/Julien00859/get_int_max_str_digits\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/60782ad107e538b9312aac7e1c119c8358bf797c\"\u003e\u003ccode\u003e60782ad\u003c/code\u003e\u003c/a\u003e Reject Content-Length longer 1 billion TB\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/dff7cc397a26ed4acdedd92d1bda6c8f18a6ed9f\"\u003e\u003ccode\u003edff7cc3\u003c/code\u003e\u003c/a\u003e Validate Chunked-Encoding chunk footer\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 3.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in \u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining and\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e Release 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e Pre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from kjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e Convert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from kjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from StanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from StanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kjd/idna/compare/v3.10...v3.15\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lxml` from 5.3.0 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/releases\"\u003elxml's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elxml-6.1.0\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.4\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.3\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.2\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.1\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.0\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-5.4.0\u003c/h2\u003e\n\u003ch1\u003e5.4.0 (2025-04-22)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2107279: Binary wheels use libxml2 2.13.8 and libxslt 1.1.43 to resolve several CVEs.\n(Binary wheels for Windows continue to use a patched libxml2 2.11.9 and libxslt 1.1.39.)\nIssue found by Anatoly Katyushin, see \u003ca href=\"https://bugs.launchpad.net/lxml/+bug/2107279\"\u003ehttps://bugs.launchpad.net/lxml/+bug/2107279\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003elxml-5.3.2\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-5.3.1\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.3 (2026-04-09)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSeveral out of memory error cases now raise \u003ccode\u003eMemoryError\u003c/code\u003e that were not handled before.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSlicing with large step values (outside of \u003ccode\u003e+/- sys.maxsize\u003c/code\u003e) could trigger undefined C behaviour.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2125399: Some failing tests were fixed or disabled in PyPy.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2138421: Memory leak in error cases when setting the \u003ccode\u003epublic_id\u003c/code\u003e or \u003ccode\u003esystem_url\u003c/code\u003e of a document.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c7d76d6cb817c8e1f316e43b16cab5e6ad669ad0\"\u003e\u003ccode\u003ec7d76d6\u003c/code\u003e\u003c/a\u003e Change security policy to point to Github security advisories.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/378ccf82db8160928807c55ed580c0443aa94f42\"\u003e\u003ccode\u003e378ccf8\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/315270b810a9e3276c60daba549299d204ac962b\"\u003e\u003ccode\u003e315270b\u003c/code\u003e\u003c/a\u003e Docs: Reduce TOC depth of package pages and move module contents first.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6dbba7f3c72f655b05b26ef453fdee31af13ccf5\"\u003e\u003ccode\u003e6dbba7f\u003c/code\u003e\u003c/a\u003e Docs: Show current year in copyright line.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/e4385bfa5d79527350d5ef17372fb70ba80b4cce\"\u003e\u003ccode\u003ee4385bf\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5bed1e1a227cd9ba5a879aaeacdf504093a3f6e8\"\u003e\u003ccode\u003e5bed1e1\u003c/code\u003e\u003c/a\u003e Validate file hashes in release download script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c13ee10a429f1144779bb1cbf6ae3bec808ae9c1\"\u003e\u003ccode\u003ec13ee10\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.0.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-5.3.0...lxml-6.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `python-dotenv` from 1.0.1 to 1.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/theskumar/python-dotenv/releases\"\u003epython-dotenv's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.2.2\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for Python 3.14, including the free-threaded (3.14t) build. (#)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003edotenv run\u003c/code\u003e command now forwards flags directly to the specified command by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/607\"\u003etheskumar/python-dotenv#607\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved documentation clarity regarding override behavior and the reference page.\u003c/li\u003e\n\u003cli\u003eUpdated PyPy support to version 3.11.\u003c/li\u003e\n\u003cli\u003eDocumentation for FIFO file support.\u003c/li\u003e\n\u003cli\u003eSupport for Python 3.9.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved \u003ccode\u003eset_key\u003c/code\u003e and \u003ccode\u003eunset_key\u003c/code\u003e behavior when interacting with symlinks by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311\"\u003e#790c5\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCorrected the license specifier and added missing Python 3.14 classifiers in package metadata by \u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/590\"\u003etheskumar/python-dotenv#590\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e and \u003ccode\u003edotenv.unset_key\u003c/code\u003e used to follow symlinks in some\nsituations. This is no longer the case. For that behavior to be restored in\nall cases, \u003ccode\u003efollow_symlinks=True\u003c/code\u003e should be used.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the CLI, \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e used to follow symlinks in some situations. This\nis no longer the case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e, \u003ccode\u003edotenv.unset_key\u003c/code\u003e and the CLI commands \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e\nused to reset the file mode of the modified .env file to \u003ccode\u003e0o600\u003c/code\u003e in some\nsituations. This is no longer the case: The original mode of the file is now\npreserved. Is the file needed to be created or wasn't a regular file, mode\n\u003ccode\u003e0o600\u003c/code\u003e is used.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eskip 000 permission tests for root user by \u003ca href=\"https://github.com/burnout-projects\"\u003e\u003ccode\u003e@​burnout-projects\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/561\"\u003etheskumar/python-dotenv#561\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 5 to 6 in the github-actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/593\"\u003etheskumar/python-dotenv#593\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Windows testing to CI by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/604\"\u003etheskumar/python-dotenv#604\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove workflow efficiency with best practices by \u003ca href=\"https://github.com/theskumar\"\u003e\u003ccode\u003e@​theskumar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/609\"\u003etheskumar/python-dotenv#609\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove the use of \u003ccode\u003esh\u003c/code\u003e in tests by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/612\"\u003etheskumar/python-dotenv#612\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/590\"\u003etheskumar/python-dotenv#590\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/burnout-projects\"\u003e\u003ccode\u003e@​burnout-projects\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/561\"\u003etheskumar/python-dotenv#561\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/cpackham-atlnz\"\u003e\u003ccode\u003e@​cpackham-atlnz\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/597\"\u003etheskumar/python-dotenv#597\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2\"\u003ehttps://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.2.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md\"\u003epython-dotenv's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e[1.2.2] - 2026-03-01\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for Python 3.14, including the free-threaded (3.14t) build. (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/588\"\u003e#588\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003edotenv run\u003c/code\u003e command now forwards flags directly to the specified command by [\u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/607\"\u003e#607\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved documentation clarity regarding override behavior and the reference page.\u003c/li\u003e\n\u003cli\u003eUpdated PyPy support to version 3.11.\u003c/li\u003e\n\u003cli\u003eDocumentation for FIFO file support.\u003c/li\u003e\n\u003cli\u003eDropped Support for Python 3.9.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved \u003ccode\u003eset_key\u003c/code\u003e and \u003ccode\u003eunset_key\u003c/code\u003e behavior when interacting with symlinks by [\u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e] in [790c5c0]\u003c/li\u003e\n\u003cli\u003eCorrected the license specifier and added missing Python 3.14 classifiers in package metadata by [\u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/590\"\u003e#590\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e and \u003ccode\u003edotenv.unset_key\u003c/code\u003e used to follow symlinks in some\nsituations. This is no longer the case. For that behavior to be restored in\nall cases, \u003ccode\u003efollow_symlinks=True\u003c/code\u003e should be used.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the CLI, \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e used to follow symlinks in some situations. This\nis no longer the case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e, \u003ccode\u003edotenv.unset_key\u003c/code\u003e and the CLI commands \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e\nused to reset the file mode of the modified .env file to \u003ccode\u003e0o600\u003c/code\u003e in some\nsituations. This is no longer the case: The original mode of the file is now\npreserved. Is the file needed to be created or wasn't a regular file, mode\n\u003ccode\u003e0o600\u003c/code\u003e is used.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.2.1] - 2025-10-26\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMove more config to \u003ccode\u003epyproject.toml\u003c/code\u003e, removed \u003ccode\u003esetup.cfg\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for reading \u003ccode\u003e.env\u003c/code\u003e from FIFOs (Unix) by [\u003ca href=\"https://github.com/sidharth-sudhir\"\u003e\u003ccode\u003e@​sidharth-sudhir\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/586\"\u003e#586\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.2.0] - 2025-10-26\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade build system to use PEP 517 \u0026amp; PEP 518 to use \u003ccode\u003ebuild\u003c/code\u003e and \u003ccode\u003epyproject.toml\u003c/code\u003e by [\u003ca href=\"https://github.com/EpicWink\"\u003e\u003ccode\u003e@​EpicWink\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/583\"\u003e#583\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for Python 3.14 by [\u003ca href=\"https://github.com/23f3001135\"\u003e\u003ccode\u003e@​23f3001135\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/579\"\u003e#579\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for disabling of \u003ccode\u003eload_dotenv()\u003c/code\u003e using \u003ccode\u003ePYTHON_DOTENV_DISABLED\u003c/code\u003e env var. by [\u003ca href=\"https://github.com/matthewfranglen\"\u003e\u003ccode\u003e@​matthewfranglen\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/569\"\u003e#569\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.1.1] - 2025-06-24\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eCLI: Ensure \u003ccode\u003efind_dotenv\u003c/code\u003e work reliably on python 3.13 by [\u003ca href=\"https://github.com/theskumar\"\u003e\u003ccode\u003e@​theskumar\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/563\"\u003e#563\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/36004e0e34be7665ff2b11a8a4005144f76f176d\"\u003e\u003ccode\u003e36004e0\u003c/code\u003e\u003c/a\u003e Bump version: 1.2.1 → 1.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/eb202520e5933c9daf42501e1e42fdb0144002c8\"\u003e\u003ccode\u003eeb20252\u003c/code\u003e\u003c/a\u003e docs: update changelog for v1.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311\"\u003e\u003ccode\u003e790c5c0\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/43340da220fb4ca4f95357bbe21a3c7f8f1278b1\"\u003e\u003ccode\u003e43340da\u003c/code\u003e\u003c/a\u003e Remove the use of \u003ccode\u003esh\u003c/code\u003e in tests (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/612\"\u003e#612\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/09d7cee32459e7abdcb5c9d8122a552589c06a9c\"\u003e\u003ccode\u003e09d7cee\u003c/code\u003e\u003c/a\u003e docs: clarify override behavior and document FIFO support (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/610\"\u003e#610\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/c8de2887c00198c22842c5ae5e92d1747467363c\"\u003e\u003ccode\u003ec8de288\u003c/code\u003e\u003c/a\u003e ci: improve workflow efficiency with best practices (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/609\"\u003e#609\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/7bd9e3dbfedc0983ad7d56d5570013035242bdf4\"\u003e\u003ccode\u003e7bd9e3d\u003c/code\u003e\u003c/a\u003e Add Windows testing to CI (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/604\"\u003e#604\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/1baaf04f336072e0ee324d5df9563ec767f14f81\"\u003e\u003ccode\u003e1baaf04\u003c/code\u003e\u003c/a\u003e Drop Python 3.9 support and update to PyPy 3.11 (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/608\"\u003e#608\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/4a22cf8993804aeede0c20b75bb1a29d3a99e9dc\"\u003e\u003ccode\u003e4a22cf8\u003c/code\u003e\u003c/a\u003e ci: enable testing on Python 3.14t (free-threaded) (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/588\"\u003e#588\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/e2e8e776b42e382ae38b44d3982dd649e7507dd4\"\u003e\u003ccode\u003ee2e8e77\u003c/code\u003e\u003c/a\u003e Fix license specifier (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/597\"\u003e#597\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/theskumar/python-dotenv/compare/v1.0.1...v1.2.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `starlette` from 0.41.2 to 1.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/starlette/releases\"\u003estarlette's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 1.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore malformed \u003ccode\u003eHost\u003c/code\u003e header when constructing \u003ccode\u003erequest.url\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3279\"\u003eKludex/starlette#3279\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/1.0.0...1.0.1\"\u003ehttps://github.com/Kludex/starlette/compare/1.0.0...1.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 1.0.0\u003c/h2\u003e\n\u003cp\u003eStarlette 1.0 is here! 🎉\u003c/p\u003e\n\u003cp\u003eAfter nearly eight years since its creation, Starlette has reached its first stable release.\u003c/p\u003e\n\u003cp\u003eA special thank you to \u003ca href=\"https://github.com/lovelydinosaur\"\u003e\u003ccode\u003e@​lovelydinosaur\u003c/code\u003e\u003c/a\u003e, the creator of Starlette, Uvicorn, HTTPX and MkDocs, whose work helped to lay the foundation for the modern async Python ecosystem. 🙏\u003c/p\u003e\n\u003cp\u003eThank you to \u003ca href=\"https://github.com/adriangb\"\u003e\u003ccode\u003e@​adriangb\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/graingert\"\u003e\u003ccode\u003e@​graingert\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/agronholm\"\u003e\u003ccode\u003e@​agronholm\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/florimondmanca\"\u003e\u003ccode\u003e@​florimondmanca\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/aminalaee\"\u003e\u003ccode\u003e@​aminalaee\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/alex-oleshkevich\"\u003e\u003ccode\u003e@​alex-oleshkevich\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/abersheeran\"\u003e\u003ccode\u003e@​abersheeran\u003c/code\u003e\u003c/a\u003e, and \u003ca href=\"https://github.com/uSpike\"\u003e\u003ccode\u003e@​uSpike\u003c/code\u003e\u003c/a\u003e for helping make Starlette what it is today. And to all my sponsors - especially \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/huggingface\"\u003e\u003ccode\u003e@​huggingface\u003c/code\u003e\u003c/a\u003e, and \u003ca href=\"https://github.com/elevenlabs\"\u003e\u003ccode\u003e@​elevenlabs\u003c/code\u003e\u003c/a\u003e - thank you for your support!\u003c/p\u003e\n\u003cp\u003eThank you to all \u003ca href=\"https://github.com/encode/starlette/graphs/contributors\"\u003e290+ contributors\u003c/a\u003e who have shaped Starlette over the years! ❤️\u003c/p\u003e\n\u003cp\u003eRead more on the \u003ca href=\"https://marcelotryle.com/blog/2026/03/22/starlette-10-is-here/\"\u003eblog post\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eCheck out the full release notes at \u003ca href=\"https://www.starlette.io/release-notes/#100-march-22-2026\"\u003ehttps://www.starlette.io/release-notes/#100-march-22-2026\u003c/a\u003e\u003c/p\u003e\n\u003chr /\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/encode/starlette/compare/1.0.0rc1...1.0.0\"\u003ehttps://github.com/encode/starlette/compare/1.0.0rc1...1.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 1.0.0rc1\u003c/h2\u003e\n\u003cp\u003eWe're ready! 🚀\u003c/p\u003e\n\u003cp\u003eThe first release candidate for Starlette 1.0 is here! After years on ZeroVer, we're finally making the jump.\u003c/p\u003e\n\u003cp\u003eThis release removes all deprecated features marked for 1.0.0, along with some last-minute bug fixes.\u003c/p\u003e\n\u003cp\u003eA special thank you to \u003ca href=\"https://github.com/lovelydinosaur\"\u003e\u003ccode\u003e@​lovelydinosaur\u003c/code\u003e\u003c/a\u003e, the creator of Starlette, Uvicorn, HTTPX and MkDocs, whose work helped to lay the foundation for the modern async Python ecosystem. 🙏\u003c/p\u003e\n\u003cp\u003eThank you to \u003ca href=\"https://github.com/adriangb\"\u003e\u003ccode\u003e@​adriangb\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/graingert\"\u003e\u003ccode\u003e@​graingert\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/agronholm\"\u003e\u003ccode\u003e@​agronholm\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/florimondmanca\"\u003e\u003ccode\u003e@​florimondmanca\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/aminalaee\"\u003e\u003ccode\u003e@​aminalaee\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/alex-oleshkevich\"\u003e\u003ccode\u003e@​alex-oleshkevich\u003c/code\u003e\u003c/a\u003e, and \u003ca href=\"https://github.com/abersheeran\"\u003e\u003ccode\u003e@​abersheeran\u003c/code\u003e\u003c/a\u003e for helping make Starlette what it is today. And to all my sponsors - especially \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/huggingface\"\u003e\u003ccode\u003e@​huggingface\u003c/code\u003e\u003c/a\u003e, and \u003ca href=\"https://github.com/elevenlabs\"\u003e\u003ccode\u003e@​elevenlabs\u003c/code\u003e\u003c/a\u003e - thank you for your support!\u003c/p\u003e\n\u003cp\u003eThank you to all \u003ca href=\"https://github.com/encode/starlette/graphs/contributors\"\u003e290+ contributors\u003c/a\u003e who have shaped Starlette over the years!\u003c/p\u003e\n\u003cp\u003eCheck out the full release notes at \u003ca href=\"https://www.starlette.io/release-notes/#100rc1-february-23-2026\"\u003ehttps://www.starlette.io/release-notes/#100rc1-february-23-2026\u003c/a\u003e\u003c/p\u003e\n\u003chr /\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/0.52.1...1.0.0rc1\"\u003ehttps://github.com/Kludex/starlette/compare/0.52.1...1.0.0rc1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 0.52.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOnly use \u003ccode\u003etyping_extensions\u003c/code\u003e in older Python versions by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3109\"\u003eKludex/starlette#3109\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/starlette/blob/main/docs/release-notes.md\"\u003estarlette's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.0.1 (May 21, 2026)\u003c/h2\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore malformed \u003ccode\u003eHost\u003c/code\u003e header when constructing \u003ccode\u003erequest.url\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3279\"\u003e#3279\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.0.0 (March 22, 2026)\u003c/h2\u003e\n\u003cp\u003eStarlette 1.0 is here!\u003c/p\u003e\n\u003cp\u003eAfter nearly eight years since its creation, Starlette has reached its first stable release.\nThank you to everyone who tested the release candidate and reported issues.\u003c/p\u003e\n\u003cp\u003eYou can read more on the \u003ca href=\"https://marcelotryle.com/blog/2026/03/22/starlette-10-is-here/\"\u003eblog post\u003c/a\u003e.\u003c/p\u003e\n\u003ch4\u003eAdded\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eTrack session access and modification in \u003ccode\u003eSessionMiddleware\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3166\"\u003e#3166\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eHandle websocket denial responses in \u003ccode\u003eStreamingResponse\u003c/code\u003e and \u003ccode\u003eFileResponse\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3189\"\u003e#3189\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003ebytearray\u003c/code\u003e for field accumulation in \u003ccode\u003eFormParser\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3179\"\u003e#3179\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eMove \u003ccode\u003eparser.finalize()\u003c/code\u003e inside try/except in \u003ccode\u003eMultiPartParser.parse()\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3153\"\u003e#3153\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.0.0rc1 (February 23, 2026)\u003c/h2\u003e\n\u003cp\u003eWe're ready! I'm thrilled to announce the first release candidate for Starlette 1.0.\u003c/p\u003e\n\u003cp\u003eStarlette was created in June 2018 by Tom Christie, and has been on ZeroVer for years. Today, it's downloaded\nalmost \u003ca href=\"https://pypistats.org/packages/starlette\"\u003e10 million times a day\u003c/a\u003e, serves as the foundation for FastAPI,\nand has inspired many other frameworks. In the age of AI, Starlette continues to play an important role as a\ndependency of the Python MCP SDK.\u003c/p\u003e\n\u003cp\u003eThis release focuses on removing deprecated features that were marked for removal in 1.0.0, along with some\nlast minute bug fixes. It's a release candidate, so we can gather feedback from the community before the final\n1.0.0 release soon.\u003c/p\u003e\n\u003cp\u003eA huge thank you to all the contributors who have helped make Starlette what it is today.\nIn particular, I'd like to recognize:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lovelydinosaur\"\u003eKim Christie\u003c/a\u003e - The original creator of Starlette, Uvicorn, and MkDocs, and the\ncurrent maintainer of HTTPX. Kim's work helped lay the foundation for the modern async Python ecosystem.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/adriangb\"\u003eAdrian Garcia Badaracco\u003c/a\u003e - One of the smartest people I know, whom I have the pleasure of working with at Pydantic.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/graingert\"\u003eThomas Grainger\u003c/a\u003e - My async teacher, always ready to help with questions.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/agronholm\"\u003eAlex Grönholm\u003c/a\u003e - Another async mentor, always prompt to help with questions.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/florimondmanca\"\u003eFlorimond Manca\u003c/a\u003e - Always present in the early days of both Starlette and Uvicorn, and helped a lot in the ecosystem.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/aminalaee\"\u003eAmin Alaee\u003c/a\u003e - Contributed a lot with file-related PRs.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tiangolo\"\u003eSebastián Ramírez\u003c/a\u003e - Maintains FastAPI upstream, and always in contact to help with upstream issues.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/alex-oleshkevich\"\u003eAlex Oleshkevich\u003c/a\u003e - Helped a lot on templates and many discussions.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/48f8e331b23ca692f4713ac1f370bff1b5cd034c\"\u003e\u003ccode\u003e48f8e33\u003c/code\u003e\u003c/a\u003e Version 1.0.1 (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3281\"\u003e#3281\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/f078832be1aa27ab0e7ec3153479a347749e967a\"\u003e\u003ccode\u003ef078832\u003c/code\u003e\u003c/a\u003e Remove Hugging Face sponsor block from docs (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3280\"\u003e#3280\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/472951eba8f6e35be845fd1b91625a1b5488294b\"\u003e\u003ccode\u003e472951e\u003c/code\u003e\u003c/a\u003e chore(deps): bump the github-actions group with 2 updates (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3277\"\u003e#3277\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6\"\u003e\u003ccode\u003e764dab0\u003c/code\u003e\u003c/a\u003e Ignore malformed \u003ccode\u003eHost\u003c/code\u003e header when constructing \u003ccode\u003erequest.url\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3279\"\u003e#3279\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/19d08115ce56da8d4da2838ecdd9c5882cb2b365\"\u003e\u003ccode\u003e19d0811\u003c/code\u003e\u003c/a\u003e Harden GitHub Actions workflows and Dependabot config (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3276\"\u003e#3276\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/01f46378120fe2c6312074ed7e997e3b5f7d8c20\"\u003e\u003ccode\u003e01f4637\u003c/code\u003e\u003c/a\u003e chore(deps): bump idna from 3.10 to 3.15 (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3274\"\u003e#3274\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/b8fa5140d2ef9f22483d777e936ab4c2df897179\"\u003e\u003ccode\u003eb8fa514\u003c/code\u003e\u003c/a\u003e docs: fix typos in TestClient docs and test_requests comment (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3266\"\u003e#3266\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/e935b6b5d4616c2317bbdadfb4cf07a8e7637955\"\u003e\u003ccode\u003ee935b6b\u003c/code\u003e\u003c/a\u003e fix uvicorn domain (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3269\"\u003e#3269\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/96af9521a7e46bc0d00b5227186f03b70b6d242f\"\u003e\u003ccode\u003e96af952\u003c/code\u003e\u003c/a\u003e Add 7-day cooldown for dependency resolution via uv exclude-newer (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3265\"\u003e#3265\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/61e385bd6dc438a90493c50f65ed232430f873fb\"\u003e\u003ccode\u003e61e385b\u003c/code\u003e\u003c/a\u003e Add zizmor GitHub Actions security analysis workflow (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3264\"\u003e#3264\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/Kludex/starlette/compare/0.41.2...1.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 2.2.3 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3 is raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects \u003ca href=\"https://opencollective.com/urllib3\"\u003eplease consider contributing financially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been read and decompressed partially. (Reported by \u003ca href=\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or \u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed using the official \u003ca href=\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by \u003ca href=\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca href=\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed data buffered from previous partial reads. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the response after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt=0\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing \u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior of chunked request bodies. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling schemeless URIs were passed to \u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to accept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e, matching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling use with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3 is raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects \u003ca href=\"https://opencollective.com/urllib3\"\u003eplease consider contributing financially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the streaming API were bypassed when HTTP redirects were followed. (CVE-2026-21441 reported by \u003ca href=\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High, GHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours as 6 hours by default. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on Emscripten. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed\nusing the official \u003ccode\u003eBrotli \u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763) \u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720) \u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979) \u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777) \u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636) \u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the\nresponse after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e Release 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e Fix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e Switch to nightly PyPy3.11 in CI for now (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e Avoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when \u003ccode\u003eamt=0\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e Bump dev dependencies (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e Upgrade mypy to version 1.20.2 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e Drop support for EOL PyPy3.10 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e Upgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix warnings (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/urllib3/urllib3/compare/2.2.3...2.7.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `mcp` from 1.0.0 to 1.23.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/releases\"\u003emcp's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.23.0\u003c/h2\u003e\n\u003ch2\u003eSummary\u003c/h2\u003e\n\u003cp\u003eThis release brings us up to speed with the latest MCP spec \u003ccode\u003e2025-11-25\u003c/code\u003e. Take a look at the \u003ca href=\"https://modelcontextprotocol.io/specification/2025-11-25\"\u003elatest spec\u003c/a\u003e as well as the release \u003ca href=\"https://blog.modelcontextprotocol.io/posts/2025-11-25-first-mcp-anniversary/\"\u003eblog post.\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd tests for JSON Schema 2020-12 field preservation (SEP-1613) by \u003ca href=\"https://github.com/felixweinberger\"\u003e\u003ccode\u003e@​felixweinberger\u003c/code...\n\n_Description has been truncated_","html_url":"https://github.com/dporkka/mcpservers/pull/8","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/dporkka%2Fmcpservers/issues/8","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/8/packages"},{"uuid":"4568869913","node_id":"PR_kwDORUBXS87hp-85","number":27,"state":"open","title":"chore(deps): update lxml requirement from \u003e=5.0.0 to \u003e=6.1.1","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-02T05:59:22.000Z","updated_at":"2026-06-02T05:59:23.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): update","packages":[{"name":"lxml","old_version":"\u003e=5.0.0","new_version":"\u003e=6.1.1","repository_url":"https://github.com/lxml/lxml"}],"path":null,"ecosystem":"pip"},"body":"Updates the requirements on [lxml](https://github.com/lxml/lxml) to permit the latest version.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-5.0.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/bess-solutions/open-bess-edge/pull/27","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/bess-solutions%2Fopen-bess-edge/issues/27","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/27/packages"},{"uuid":"4558984415","node_id":"PR_kwDOSgX7gc7hJ8AC","number":3,"state":"closed","title":"chore(deps): bump the python-minor-patch group with 5 updates","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-06-08T03:11:49.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-31T20:58:13.000Z","updated_at":"2026-06-08T03:11:51.000Z","time_to_close":627216,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"python-minor-patch","update_count":5,"packages":[{"name":"numpy","old_version":"2.4.4","new_version":"2.4.6","repository_url":"https://github.com/numpy/numpy"},{"name":"gymnasium","old_version":"1.2.3","new_version":"1.3.0","repository_url":"https://github.com/Farama-Foundation/Gymnasium"},{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"},{"name":"requests","old_version":"2.34.1","new_version":"2.34.2","repository_url":"https://github.com/psf/requests"},{"name":"ruff","old_version":"0.15.12","new_version":"0.15.15","repository_url":"https://github.com/astral-sh/ruff"}],"path":null,"ecosystem":"pip"},"body":"Bumps the python-minor-patch group with 5 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [numpy](https://github.com/numpy/numpy) | `2.4.4` | `2.4.6` |\n| [gymnasium](https://github.com/Farama-Foundation/Gymnasium) | `1.2.3` | `1.3.0` |\n| [lxml](https://github.com/lxml/lxml) | `6.1.0` | `6.1.1` |\n| [requests](https://github.com/psf/requests) | `2.34.1` | `2.34.2` |\n| [ruff](https://github.com/astral-sh/ruff) | `0.15.12` | `0.15.15` |\n\nUpdates `numpy` from 2.4.4 to 2.4.6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/numpy/numpy/releases\"\u003enumpy's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.4.6 (May 18, 2026)\u003c/h2\u003e\n\u003ch1\u003eNumPy 2.4.6 Release Notes\u003c/h1\u003e\n\u003cp\u003eNumPy 2.4.6 is a quick release that fixes a regression discovered in the 2.4.5\nrelease.\u003c/p\u003e\n\u003cp\u003eThis release supports Python versions 3.11-3.14\u003c/p\u003e\n\u003ch2\u003eContributors\u003c/h2\u003e\n\u003cp\u003eA total of 4 people contributed to this release. People with a \u0026quot;+\u0026quot; by their\nnames contributed a patch for the first time.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e!EarlMilktea\u003c/li\u003e\n\u003cli\u003eCharles Harris\u003c/li\u003e\n\u003cli\u003eSebastian Berg\u003c/li\u003e\n\u003cli\u003eWarren Weckesser\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ePull requests merged\u003c/h2\u003e\n\u003cp\u003eA total of 4 pull requests were merged for this release.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31444\"\u003e#31444\u003c/a\u003e: MAINT: Prepare 2.4.x for further development\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31453\"\u003e#31453\u003c/a\u003e: BUG: Fix regression in \u003ccode\u003earr.conj()\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31459\"\u003e#31459\u003c/a\u003e: BUG: \u003ccode\u003enp.linalg.svd(..., hermitian=True)\u003c/code\u003e returns non-unitary...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31460\"\u003e#31460\u003c/a\u003e: BUG: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator...\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev2.4.5 (May 15, 2026)\u003c/h2\u003e\n\u003ch1\u003eNumPy 2.4.5 Release Notes\u003c/h1\u003e\n\u003cp\u003eNumPy 2.4.5 is a patch release that fixes bugs discovered after the 2.4.4\nrelease, has some typing improvements, and maintains infrastructure.\u003c/p\u003e\n\u003cp\u003eThis release supports Python versions 3.11-3.14\u003c/p\u003e\n\u003ch2\u003eContributors\u003c/h2\u003e\n\u003cp\u003eA total of 17 people contributed to this release. People with a \u0026quot;+\u0026quot; by their\nnames contributed a patch for the first time.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAleksei Nikiforov\u003c/li\u003e\n\u003cli\u003eAnarion Zuo +\u003c/li\u003e\n\u003cli\u003eAnkit Ahlawat\u003c/li\u003e\n\u003cli\u003eBreno Favaretto +\u003c/li\u003e\n\u003cli\u003eCharles Harris\u003c/li\u003e\n\u003cli\u003eIgor Krivenko +\u003c/li\u003e\n\u003cli\u003eIjtihed Kilani +\u003c/li\u003e\n\u003cli\u003eJoren Hammudoglu\u003c/li\u003e\n\u003cli\u003eMaarten Baert +\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/b832a09cf2a169c833dd2371e7c07aa00b293242\"\u003e\u003ccode\u003eb832a09\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31462\"\u003e#31462\u003c/a\u003e from charris/prepare-2.4.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/57cc147d2ceacffc6534642bfbdebb3a80428e1e\"\u003e\u003ccode\u003e57cc147\u003c/code\u003e\u003c/a\u003e REL: Prepare for the NumPy 2.4.6 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/0c72b0b53b6b83c004e434b2c7855e73c000d21e\"\u003e\u003ccode\u003e0c72b0b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31459\"\u003e#31459\u003c/a\u003e from charris/backport-31347\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/9778d26e0475d381ccb7817c3b4dd8cacef2b9eb\"\u003e\u003ccode\u003e9778d26\u003c/code\u003e\u003c/a\u003e BUG: core: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator. (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/e0e38767d5d0f848ab44befeedcad71e8ef589c7\"\u003e\u003ccode\u003ee0e3876\u003c/code\u003e\u003c/a\u003e BUG: core: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator. (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/d1bffeb9ec4ec0bf029c94ea35abffa92d5c30f2\"\u003e\u003ccode\u003ed1bffeb\u003c/code\u003e\u003c/a\u003e BUG: \u003ccode\u003enp.linalg.svd(..., hermitian=True)\u003c/code\u003e returns non-unitary \u003ccode\u003evh\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31347\"\u003e#31347\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/8d8d7e5a14a1da0bfb0faf609a7a7610c431e6e9\"\u003e\u003ccode\u003e8d8d7e5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31453\"\u003e#31453\u003c/a\u003e from seberg/issue-31452\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/bddaab7ace45f90148d8f2bb6e67daab2d45ec76\"\u003e\u003ccode\u003ebddaab7\u003c/code\u003e\u003c/a\u003e BUG: Fix regression in \u003ccode\u003earr.conj()\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/37a1ecca8dff09b2c579a991194ac55b9971f3a7\"\u003e\u003ccode\u003e37a1ecc\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31444\"\u003e#31444\u003c/a\u003e from charris/begin-2.4.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/3c0e043217a759a8a948ade158fec14348c3b459\"\u003e\u003ccode\u003e3c0e043\u003c/code\u003e\u003c/a\u003e MAINT: Prepare 2.4.x for further development\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/numpy/numpy/compare/v2.4.4...v2.4.6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `gymnasium` from 1.2.3 to 1.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/releases\"\u003egymnasium's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.3.0\u003c/h2\u003e\n\u003ch1\u003eGymnasium v1.3.0\u003c/h1\u003e\n\u003cp\u003eThis release brings a new Taxi environment version, a new \u003ccode\u003eRepeatAction\u003c/code\u003e wrapper, and a range of bug fixes across vector environments and wrappers.\u003c/p\u003e\n\u003ch2\u003eCore Changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003eTaxi\u003c/code\u003e environment has been updated to \u003ccode\u003ev4\u003c/code\u003e to correct the \u003ccode\u003eis_rainy\u003c/code\u003e implementation, which previously did not behave as documented by \u003ca href=\"https://github.com/pseudo-rnd-thoughts\"\u003e\u003ccode\u003e@​pseudo-rnd-thoughts\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1561\"\u003eFarama-Foundation/Gymnasium#1561\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epygame\u003c/code\u003e has been replaced with \u003ca href=\"https://pyga.me/\"\u003e\u003ccode\u003epygame-ce\u003c/code\u003e\u003c/a\u003e, unlocking Python 3.14 compatibility. The drop-in replacement preserves the existing rendering behaviour by \u003ca href=\"https://github.com/mwydmuch\"\u003e\u003ccode\u003e@​mwydmuch\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1512\"\u003eFarama-Foundation/Gymnasium#1512\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdded \u003ccode\u003eRepeatAction\u003c/code\u003e wrapper that repeats a given action for a fixed number of steps, useful for frame-skipping and coarser control loops by \u003ca href=\"https://github.com/Lidang-Jiang\"\u003e\u003ccode\u003e@​Lidang-Jiang\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1553\"\u003eFarama-Foundation/Gymnasium#1553\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eOptimised \u003ccode\u003eBox.__init__\u003c/code\u003e to reduce overhead through lazy evaluation of variables by \u003ca href=\"https://github.com/pseudo-rnd-thoughts\"\u003e\u003ccode\u003e@​pseudo-rnd-thoughts\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1529\"\u003eFarama-Foundation/Gymnasium#1529\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix vector \u003ccode\u003eRecordVideo\u003c/code\u003e wrapper to remove memory leaks across episodes by \u003ca href=\"https://github.com/JonahFSD\"\u003e\u003ccode\u003e@​JonahFSD\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1527\"\u003eFarama-Foundation/Gymnasium#1527\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix Vector \u003ccode\u003eNormalizeReward\u003c/code\u003e wrapper to work identically as the non-vectorized version by \u003ca href=\"https://github.com/JonahFSD\"\u003e\u003ccode\u003e@​JonahFSD\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1526\"\u003eFarama-Foundation/Gymnasium#1526\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved the \u003ccode\u003eVectorEnv\u003c/code\u003e destructor, which was causing \u003ccode\u003eVectorEnv.close()\u003c/code\u003e to be called unintentionally by \u003ca href=\"https://github.com/TimSchneider42\"\u003e\u003ccode\u003e@​TimSchneider42\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1522\"\u003eFarama-Foundation/Gymnasium#1522\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eNormalizeObservation\u003c/code\u003e vectorized wrapper to override the \u003ccode\u003eobservation_space\u003c/code\u003e and a \u003ccode\u003efloat32\u003c/code\u003e cast by \u003ca href=\"https://github.com/JonahFSD\"\u003e\u003ccode\u003e@​JonahFSD\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1528\"\u003eFarama-Foundation/Gymnasium#1528\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eRenderFrame\u003c/code\u003e's typing by \u003ca href=\"https://github.com/jorenham\"\u003e\u003ccode\u003e@​jorenham\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1560\"\u003eFarama-Foundation/Gymnasium#1560\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed A2C tutorial's entropy computation when a scalar (rather than tensor) is passed to the loss function by \u003ca href=\"https://github.com/epoint95\"\u003e\u003ccode\u003e@​epoint95\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1524\"\u003eFarama-Foundation/Gymnasium#1524\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eThird-Party Environments\u003c/h2\u003e\n\u003cp\u003e10 new community environments have been added to the \u003ca href=\"https://gymnasium.farama.org/environments/third_party_environments/\"\u003ethird-party environments list\u003c/a\u003e, including a new Cybersecurity environments section.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog:\u003c/strong\u003e \u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/compare/v1.2.3...v1.3.0\"\u003ehttps://github.com/Farama-Foundation/Gymnasium/compare/v1.2.3...v1.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/eb5c00e00df3a17cef75dca144cda25a0f6556f6\"\u003e\u003ccode\u003eeb5c00e\u003c/code\u003e\u003c/a\u003e Update to use Taxi-v4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/4436f89e262a795e4f7d33726013848285377a86\"\u003e\u003ccode\u003e4436f89\u003c/code\u003e\u003c/a\u003e fix incorrect \u003ccode\u003eTypeVar\u003c/code\u003e use in \u003ccode\u003ecore\u003c/code\u003e for \u003ccode\u003eRenderFrame\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/issues/1560\"\u003e#1560\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/877ba301b041cb0454f25b0234f1ec6d298d533c\"\u003e\u003ccode\u003e877ba30\u003c/code\u003e\u003c/a\u003e Update to 1.3.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/c3b809fe2e51dcdcd805e7dd4ee20b31e3b444fb\"\u003e\u003ccode\u003ec3b809f\u003c/code\u003e\u003c/a\u003e Update Taxi to V4 and fix \u003ccode\u003eis_rainy\u003c/code\u003e implementation (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/issues/1561\"\u003e#1561\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/9e6f8555a9952439444cd24ee6729116f4e2a12e\"\u003e\u003ccode\u003e9e6f855\u003c/code\u003e\u003c/a\u003e Add \u003ccode\u003eRepeatAction\u003c/code\u003e wrapper (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/issues/1553\"\u003e#1553\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/1532e667c22c0c201340228982f22792f43eb9dc\"\u003e\u003ccode\u003e1532e66\u003c/code\u003e\u003c/a\u003e Add external environment Hill Climb Racing Env (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/issues/1554\"\u003e#1554\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/df8704c73c75475a23db092fda0308435ae6c664\"\u003e\u003ccode\u003edf8704c\u003c/code\u003e\u003c/a\u003e Add boltcrypt to third party environments (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/issues/1557\"\u003e#1557\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/01c0d3969157c8ab499e7291c35902960683ee1f\"\u003e\u003ccode\u003e01c0d39\u003c/code\u003e\u003c/a\u003e Add external environment firecastrl (wildfire env) (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/issues/1551\"\u003e#1551\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/9edc68ea69ee5336aa70ffcb0b6b733e8558a812\"\u003e\u003ccode\u003e9edc68e\u003c/code\u003e\u003c/a\u003e Fix spelling in \u003ccode\u003etest_mujoco_v5.py\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/issues/1550\"\u003e#1550\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/a31fa4b11334f761fefc8440256d02dd524be408\"\u003e\u003ccode\u003ea31fa4b\u003c/code\u003e\u003c/a\u003e Change action seed for \u003ccode\u003eMuJoCo/test_verify_reward_survive\u003c/code\u003e test, to be valid ...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/compare/v1.2.3...v1.3.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lxml` from 6.1.0 to 6.1.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.34.1 to 2.34.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/releases\"\u003erequests's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.34.2\u003c/h2\u003e\n\u003ch2\u003e2.34.2 (2026-05-14)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMoved \u003ccode\u003eheaders\u003c/code\u003e input type back to \u003ccode\u003eMapping\u003c/code\u003e to avoid invariance issues with \u003ccode\u003eMutableMapping\u003c/code\u003e and inferred dict types. Users calling \u003ccode\u003eRequest.headers.update()\u003c/code\u003e may need to narrow typing in their code. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7441\"\u003e#7441\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.34.2 (2026-05-14)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMoved \u003ccode\u003eheaders\u003c/code\u003e input type back to \u003ccode\u003eMapping\u003c/code\u003e to avoid invariance issues\nwith \u003ccode\u003eMutableMapping\u003c/code\u003e and inferred dict types. Users calling\n\u003ccode\u003eRequest.headers.update()\u003c/code\u003e may need to narrow typing in their code. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7441\"\u003e#7441\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/6e83187b8feb273ed4c6cdab5efd8d54901dfab3\"\u003e\u003ccode\u003e6e83187\u003c/code\u003e\u003c/a\u003e v2.34.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/84d10f0be83e8f6aeca8a05230c52216431c4d0b\"\u003e\u003ccode\u003e84d10f0\u003c/code\u003e\u003c/a\u003e Move Request.headers back to Mapping (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7441\"\u003e#7441\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/psf/requests/compare/v2.34.1...v2.34.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ruff` from 0.15.12 to 0.15.15\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/astral-sh/ruff/releases\"\u003eruff's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.15.15\u003c/h2\u003e\n\u003ch2\u003eRelease Notes\u003c/h2\u003e\n\u003cp\u003eReleased on 2026-05-28.\u003c/p\u003e\n\u003ch3\u003ePreview features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix Markdown closing fence handling (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25310\"\u003e#25310\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003epyflakes\u003c/code\u003e] Report duplicate imports in \u003ccode\u003etyping.TYPE_CHECKING\u003c/code\u003e block (\u003ccode\u003eF811\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/22560\"\u003e#22560\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[\u003ccode\u003epyflakes\u003c/code\u003e] Treat function-scope bare annotations as locals per PEP 526 (\u003ccode\u003eF821\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/21540\"\u003e#21540\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAvoid redundant \u003ccode\u003eTokenValue\u003c/code\u003e drops in the lexer (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25300\"\u003e#25300\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eReduce memory usage by dropping token-excess capacity and improve performance by approximating the initial tokens \u003ccode\u003eVec\u003c/code\u003e size (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25354\"\u003e#25354\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eThinVec\u003c/code\u003e in AST to shrink \u003ccode\u003eStmt\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25361\"\u003e#25361\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003eline-length\u003c/code\u003e example for \u003ccode\u003e--config\u003c/code\u003e option (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25389\"\u003e#25389\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003eflake8-comprehensions\u003c/code\u003e] Document \u003ccode\u003eRecursionError\u003c/code\u003e edge case in \u003ccode\u003e__len__\u003c/code\u003e (\u003ccode\u003eC416\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25286\"\u003e#25286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003emccabe\u003c/code\u003e] Improve example (\u003ccode\u003eC901\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25287\"\u003e#25287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003epyupgrade\u003c/code\u003e] Clarify fix safety docs (\u003ccode\u003eUP007\u003c/code\u003e, \u003ccode\u003eUP045\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25288\"\u003e#25288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003erefurb\u003c/code\u003e] Document \u003ccode\u003eFURB192\u003c/code\u003e exception change for empty sequences (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25317\"\u003e#25317\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003eruff\u003c/code\u003e] Document false negative for user-defined types (\u003ccode\u003eRUF013\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25289\"\u003e#25289\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFormatter\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix formatting of lambdas nested within f-strings (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25398\"\u003e#25398\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eServer\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eReturn code action for \u003ccode\u003ecodeAction/resolve\u003c/code\u003e requests that contain no or no valid URL (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25365\"\u003e#25365\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eExpand semantic syntax errors for invalid walruses (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25415\"\u003e#25415\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eContributors\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/chirizxc\"\u003e\u003ccode\u003e@​chirizxc\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ntBre\"\u003e\u003ccode\u003e@​ntBre\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/adityasingh2400\"\u003e\u003ccode\u003e@​adityasingh2400\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/charliermarsh\"\u003e\u003ccode\u003e@​charliermarsh\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fallintoplace\"\u003e\u003ccode\u003e@​fallintoplace\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/martin-schlossarek\"\u003e\u003ccode\u003e@​martin-schlossarek\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MichaReiser\"\u003e\u003ccode\u003e@​MichaReiser\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md\"\u003eruff's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.15.15\u003c/h2\u003e\n\u003cp\u003eReleased on 2026-05-28.\u003c/p\u003e\n\u003ch3\u003ePreview features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix Markdown closing fence handling (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25310\"\u003e#25310\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003epyflakes\u003c/code\u003e] Report duplicate imports in \u003ccode\u003etyping.TYPE_CHECKING\u003c/code\u003e block (\u003ccode\u003eF811\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/22560\"\u003e#22560\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[\u003ccode\u003epyflakes\u003c/code\u003e] Treat function-scope bare annotations as locals per PEP 526 (\u003ccode\u003eF821\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/21540\"\u003e#21540\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAvoid redundant \u003ccode\u003eTokenValue\u003c/code\u003e drops in the lexer (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25300\"\u003e#25300\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eReduce memory usage by dropping token-excess capacity and improve performance by approximating the initial tokens \u003ccode\u003eVec\u003c/code\u003e size (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25354\"\u003e#25354\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eThinVec\u003c/code\u003e in AST to shrink \u003ccode\u003eStmt\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25361\"\u003e#25361\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003eline-length\u003c/code\u003e example for \u003ccode\u003e--config\u003c/code\u003e option (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25389\"\u003e#25389\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003eflake8-comprehensions\u003c/code\u003e] Document \u003ccode\u003eRecursionError\u003c/code\u003e edge case in \u003ccode\u003e__len__\u003c/code\u003e (\u003ccode\u003eC416\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25286\"\u003e#25286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003emccabe\u003c/code\u003e] Improve example (\u003ccode\u003eC901\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25287\"\u003e#25287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003epyupgrade\u003c/code\u003e] Clarify fix safety docs (\u003ccode\u003eUP007\u003c/code\u003e, \u003ccode\u003eUP045\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25288\"\u003e#25288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003erefurb\u003c/code\u003e] Document \u003ccode\u003eFURB192\u003c/code\u003e exception change for empty sequences (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25317\"\u003e#25317\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003eruff\u003c/code\u003e] Document false negative for user-defined types (\u003ccode\u003eRUF013\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25289\"\u003e#25289\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFormatter\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix formatting of lambdas nested within f-strings (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25398\"\u003e#25398\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eServer\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eReturn code action for \u003ccode\u003ecodeAction/resolve\u003c/code\u003e requests that contain no or no valid URL (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25365\"\u003e#25365\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eExpand semantic syntax errors for invalid walruses (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25415\"\u003e#25415\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eContributors\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/chirizxc\"\u003e\u003ccode\u003e@​chirizxc\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ntBre\"\u003e\u003ccode\u003e@​ntBre\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/adityasingh2400\"\u003e\u003ccode\u003e@​adityasingh2400\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/charliermarsh\"\u003e\u003ccode\u003e@​charliermarsh\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fallintoplace\"\u003e\u003ccode\u003e@​fallintoplace\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/martin-schlossarek\"\u003e\u003ccode\u003e@​martin-schlossarek\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MichaReiser\"\u003e\u003ccode\u003e@​MichaReiser\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Ruchir28\"\u003e\u003ccode\u003e@​Ruchir28\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/db5aa0a5f1b92cb91d910bf0866a967554dd94f5\"\u003e\u003ccode\u003edb5aa0a\u003c/code\u003e\u003c/a\u003e Bump 0.15.15 (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25431\"\u003e#25431\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/366fe21ba369ccdd01eb99c1043c9a969c99230b\"\u003e\u003ccode\u003e366fe21\u003c/code\u003e\u003c/a\u003e [ty] Improve diagnostics for syntax errors in forward annotations (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25158\"\u003e#25158\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/e2e1e647d182b8567845039c9a65fb0608a4dcfc\"\u003e\u003ccode\u003ee2e1e64\u003c/code\u003e\u003c/a\u003e [ty] Remove excess capacity from more Salsa cached collections (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25411\"\u003e#25411\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/1bd77e1646f2213d86b8da215f08279187867d72\"\u003e\u003ccode\u003e1bd77e1\u003c/code\u003e\u003c/a\u003e [ty] Use diagnostic message as tie breaker when sorting (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25424\"\u003e#25424\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/7e1bc1e75f15795f12c846294b13df4535f2abbf\"\u003e\u003ccode\u003e7e1bc1e\u003c/code\u003e\u003c/a\u003e Add agent skills for working on ty (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25422\"\u003e#25422\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/574e10752f8cfa9e0cdbe3b01e96c4380950469b\"\u003e\u003ccode\u003e574e107\u003c/code\u003e\u003c/a\u003e Expand semantic syntax errors for invalid walruses (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25415\"\u003e#25415\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/4a7ca062fccd80443a43aa61e5dc7e5858e88dc1\"\u003e\u003ccode\u003e4a7ca06\u003c/code\u003e\u003c/a\u003e [ty] Display docs for matching parameter when hovering over the name of an ar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/54327092dbfe455040690d63bb1e5e4b5f551239\"\u003e\u003ccode\u003e5432709\u003c/code\u003e\u003c/a\u003e Refine a few agents instructions (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25423\"\u003e#25423\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/3cb09eba689ebb49e799131092121928cc789c18\"\u003e\u003ccode\u003e3cb09eb\u003c/code\u003e\u003c/a\u003e [ty] Support \u003ccode\u003etyping.TypeForm\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25334\"\u003e#25334\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/c8cd59f189f2b6f55d542b29bddb953622add6fc\"\u003e\u003ccode\u003ec8cd59f\u003c/code\u003e\u003c/a\u003e [ty] Infer class attributes assigned by metaclass initialization (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25342\"\u003e#25342\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/astral-sh/ruff/compare/0.15.12...0.15.15\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/MustafaBeratYavas/rl-based-algorithmic-trading-and-portfolio-management/pull/3","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/MustafaBeratYavas%2Frl-based-algorithmic-trading-and-portfolio-management/issues/3","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/3/packages"},{"uuid":"4544368049","node_id":"PR_kwDOQbHgbc7gb0Ms","number":6,"state":"closed","title":"chore(deps): bump the pip group across 9 directories with 18 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-05-28T22:52:52.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-28T22:52:45.000Z","updated_at":"2026-05-28T22:52:54.000Z","time_to_close":7,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"pip","update_count":18,"packages":[{"name":"authlib","old_version":"1.5.2","new_version":"1.6.12","repository_url":"https://github.com/authlib/authlib"},{"name":"dulwich","old_version":"0.22.8","new_version":"1.2.5","repository_url":"https://github.com/dulwich/dulwich"},{"name":"idna","old_version":"3.10","new_version":"3.15","repository_url":"https://github.com/kjd/idna"},{"name":"langchain-core","old_version":"0.3.49","new_version":"1.3.3","repository_url":"https://github.com/langchain-ai/langchain"},{"name":"langchain-openai","old_version":"0.3.11","new_version":"1.1.14","repository_url":"https://github.com/langchain-ai/langchain"},{"name":"langchain-text-splitters","old_version":"0.3.7","new_version":"1.1.2","repository_url":"https://github.com/langchain-ai/langchain"},{"name":"langsmith","old_version":"0.3.19","new_version":"0.8.0","repository_url":"https://github.com/langchain-ai/langsmith-sdk"},{"name":"lxml","old_version":"5.3.0","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"},{"name":"mem0ai","old_version":"0.1.88","new_version":"2.0.0b2","repository_url":"https://github.com/mem0ai/mem0"},{"name":"nltk","old_version":"3.9.2","new_version":"3.9.4","repository_url":"https://github.com/nltk/nltk"},{"name":"pillow","old_version":"12.0.0","new_version":"12.2.0","repository_url":"https://github.com/python-pillow/Pillow"},{"name":"pip","old_version":"24.2","new_version":"26.1","repository_url":"https://github.com/pypa/pip"},{"name":"poetry","old_version":"2.1.3","new_version":"2.3.4","repository_url":"https://github.com/python-poetry/poetry"},{"name":"python-dotenv","old_version":"1.1.1","new_version":"1.2.2","repository_url":"https://github.com/theskumar/python-dotenv"},{"name":"python-multipart","old_version":"0.0.20","new_version":"0.0.27","repository_url":"https://github.com/Kludex/python-multipart"},{"name":"pytorch-lightning","old_version":"2.5.1.post0","new_version":"2.6.1","repository_url":"https://github.com/Lightning-AI/pytorch-lightning"},{"name":"ujson","old_version":"5.10.0","new_version":"5.12.1","repository_url":"https://github.com/ultrajson/ultrajson"},{"name":"urllib3","old_version":"2.3.0","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"}],"path":null,"ecosystem":"pip"},"body":"Bumps the pip group with 18 updates in the /dakota_rl_training/outputs/tinker_qwen30b/wandb/run-20251119_104422-i55d4x26/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 18 updates in the /dakota_rl_training/outputs/tinker_qwen4b/wandb/run-20251120_085502-ntfgah7s/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 18 updates in the /dakota_rl_training/outputs/tinker_qwen4b/wandb/run-20251120_085815-o69alc9b/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 18 updates in the /dakota_rl_training/outputs/tinker_qwen4b/wandb/run-20251120_090142-tbmfb9o0/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 18 updates in the /dakota_rl_training/outputs/tinker_smoke/wandb/run-20251118_182158-ymh8qjl6/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 18 updates in the /dakota_rl_training/outputs/tinker_smoke/wandb/run-20251118_182714-8xv4ah4h/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 17 updates in the /wandb/run-20251105_064731-wq8xuzar/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 17 updates in the /wandb/run-20251105_064758-5jy9n26c/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 18 updates in the /wandb/run-20251118_210438-u82h659i/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\n\nUpdates `authlib` from 1.5.2 to 1.6.12\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/authlib/authlib/releases\"\u003eauthlib's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.6.12\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eInvalidScopeError\u003c/code\u003e  in \u003ccode\u003eOpenIDImplicitGrant\u003c/code\u003e and \u003ccode\u003eOpenIDHybridGrant\u003c/code\u003e.\n\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.11...v1.6.12\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.11...v1.6.12\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.11\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.10...v1.6.11\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.10...v1.6.11\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix CSRF issue with starlette client\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.10\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.9...v1.6.10\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.9...v1.6.10\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eUnsupportedResponseTypeError\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.9\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.8...v1.6.9\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.8...v1.6.9\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eChanges in \u003ccode\u003ejose\u003c/code\u003e module\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eNot using header's \u003ccode\u003ejwk\u003c/code\u003e automatically\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eES256K\u003c/code\u003e into default jwt algorithms\u003c/li\u003e\n\u003cli\u003eRemove deprecated algorithm from default registry\u003c/li\u003e\n\u003cli\u003eGenerate random \u003ccode\u003ecek\u003c/code\u003e when \u003ccode\u003ecek\u003c/code\u003e length doesn't match\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.8\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.7...v1.6.8\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.7...v1.6.8\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eEdDSA\u003c/code\u003e to default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.7\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.6...v1.6.7\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.6...v1.6.7\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eSet supported algorithms for the default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/p\u003e\n\u003ch2\u003ev1.6.6\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix(ClientAuth): fix incorrect signature when Content-Type is x-www-form-urlencoded by \u003ca href=\"https://github.com/shc261392\"\u003e\u003ccode\u003e@​shc261392\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/778\"\u003eauthlib/authlib#778\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix: Use \u003ccode\u003eexpires_in\u003c/code\u003e when \u003ccode\u003eexpires_at\u003c/code\u003e is unparsable by \u003ca href=\"https://github.com/bendavis78\"\u003e\u003ccode\u003e@​bendavis78\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/842\"\u003eauthlib/authlib#842\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eget_jwt_config\u003c/code\u003e takes a \u003ccode\u003eclient\u003c/code\u003e parameter. by \u003ca href=\"https://github.com/azmeuk\"\u003e\u003ccode\u003e@​azmeuk\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/844\"\u003eauthlib/authlib#844\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/shc261392\"\u003e\u003ccode\u003e@​shc261392\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/778\"\u003eauthlib/authlib#778\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/bendavis78\"\u003e\u003ccode\u003e@​bendavis78\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/842\"\u003eauthlib/authlib#842\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.5...v1.6.6\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.5...v1.6.6\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.6.5\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a \u003ccode\u003erequest\u003c/code\u003e param to RFC7591 \u003ccode\u003egenerate_client_info\u003c/code\u003e and \u003ccode\u003egenerate_client_secret\u003c/code\u003e methods by \u003ca href=\"https://github.com/azmeuk\"\u003e\u003ccode\u003e@​azmeuk\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/825\"\u003eauthlib/authlib#825\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: support list params in prepare_grant_uri by \u003ca href=\"https://github.com/lisongmin\"\u003e\u003ccode\u003e@​lisongmin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/827\"\u003eauthlib/authlib#827\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump SonarSource/sonarqube-scan-action from 5 to 6 in /.github/workflows by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/828\"\u003eauthlib/authlib#828\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/authlib/authlib/blob/1.6.12/docs/changelog.rst\"\u003eauthlib's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 1.6.12\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on may 4, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eInvalidScopeError\u003c/code\u003e\nin \u003ccode\u003eOpenIDImplicitGrant\u003c/code\u003e and \u003ccode\u003eOpenIDHybridGrant\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.11\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Apr 16, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix CSRF vulnerability in the Starlette OAuth client when a \u003ccode\u003ecache\u003c/code\u003e is\nconfigured.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.10\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Apr 13, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eUnsupportedResponseTypeError\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.9\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Mar 2, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eNot using header's \u003ccode\u003ejwk\u003c/code\u003e automatically.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eES256K\u003c/code\u003e into default jwt algorithms.\u003c/li\u003e\n\u003cli\u003eRemove deprecated algorithm from default registry.\u003c/li\u003e\n\u003cli\u003eGenerate random \u003ccode\u003ecek\u003c/code\u003e when \u003ccode\u003ecek\u003c/code\u003e length doesn't match.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.8\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Feb 17, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eEdDSA\u003c/code\u003e to default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.7\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Feb 6, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eSet supported algorithms for the default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.6\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/e46e515b3a87ea63ab0606b248d75f69d83a2391\"\u003e\u003ccode\u003ee46e515\u003c/code\u003e\u003c/a\u003e chore: bump to 1.6.12\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/9babc131e13b018a267ae78747cba7caa6dfb7d5\"\u003e\u003ccode\u003e9babc13\u003c/code\u003e\u003c/a\u003e fix: redirecting to unvalidated redirect_uri on InvalidScopeError in OIDC grants\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/0dc0e5b4dc84f155319518a3732113af6fa47525\"\u003e\u003ccode\u003e0dc0e5b\u003c/code\u003e\u003c/a\u003e chore: bump to 1.6.11\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/aa7b8e46e00d0622658666476782042ac00153a5\"\u003e\u003ccode\u003eaa7b8e4\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/401a7709c3fe43bce1b2105d16a475b688faa788\"\u003e\u003ccode\u003e401a770\u003c/code\u003e\u003c/a\u003e fix: CSRF issue with starlette client\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/ef09aebbba4439dedb22bd15777d1b3458b6f0ab\"\u003e\u003ccode\u003eef09aeb\u003c/code\u003e\u003c/a\u003e chore: release 1.6.10\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/3be08468201a7766a93012ce149ea12822cab096\"\u003e\u003ccode\u003e3be0846\u003c/code\u003e\u003c/a\u003e fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/9266eaa2227ad7e21dc731b2a4a01909aabd934b\"\u003e\u003ccode\u003e9266eaa\u003c/code\u003e\u003c/a\u003e chore: release 1.6.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b\"\u003e\u003ccode\u003eb9bb2b2\u003c/code\u003e\u003c/a\u003e fix(oidc): fail close at validating c_hash and at_hash\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/1b0a1d988842bff7347c4ec0a70e45c3ba55504e\"\u003e\u003ccode\u003e1b0a1d9\u003c/code\u003e\u003c/a\u003e fix(jose): generate random cek when cek length doesn't match\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/authlib/authlib/compare/v1.5.2...1.6.12\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `dulwich` from 0.22.8 to 1.2.5\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/dulwich/dulwich/releases\"\u003edulwich's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003edulwich 1.2.5\u003c/h2\u003e\n\u003cp\u003eThis is a security release. All users are encouraged to upgrade.\u003c/p\u003e\n\u003ch2\u003eSecurity fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eGHSA-gfhv-vqv2-4544\u003c/strong\u003e -- Validate submodule paths in \u003ccode\u003eporcelain.submodule_update\u003c/code\u003e (and thus \u003ccode\u003eporcelain.clone(recurse_submodules=True)\u003c/code\u003e). A crafted upstream repository could carry a submodule whose path was \u003ccode\u003e.git/hooks\u003c/code\u003e (or any other path inside \u003ccode\u003e.git\u003c/code\u003e or above the work tree), causing the submodule's tree contents to be written there with their executable bits intact. The dulwich analogue of git's CVE-2024-32002 / CVE-2024-32004. (Reported by tonghuaroot)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eCVE-2026-42305\u003c/strong\u003e -- Harden tree path validation against entry names that are harmless on POSIX but dangerous when checked out on Windows. \u003ccode\u003evalidate_path_element_ntfs\u003c/code\u003e now also rejects Windows path separators, the alternate data stream marker \u003ccode\u003e:\u003c/code\u003e, NTFS 8.3 short-name aliases of \u003ccode\u003e.git\u003c/code\u003e, and reserved Windows device names. \u003ccode\u003ecore.protectNTFS\u003c/code\u003e now defaults to true on every platform, and both \u003ccode\u003ecore.protectNTFS\u003c/code\u003e and \u003ccode\u003ecore.protectHFS\u003c/code\u003e are now read under their correct option names. (Reported by Christopher Toth)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eCVE-2026-42563\u003c/strong\u003e -- Shell-quote values substituted into \u003ccode\u003eProcessMergeDriver\u003c/code\u003e commands. A malicious branch could inject shell commands when a merge driver referencing \u003ccode\u003e%P\u003c/code\u003e was configured. (Reported by Ravishanker Kusuma (hayageek))\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eCVE-2026-47712\u003c/strong\u003e -- Sanitize commit subjects used in \u003ccode\u003eporcelain.format_patch\u003c/code\u003e filenames so a malicious subject (e.g. \u003ccode\u003ex/../../x\u003c/code\u003e) cannot direct the generated patch outside \u003ccode\u003eoutdir\u003c/code\u003e. (Reported by Christopher Toth)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003ereceive.maxInputSize\u003c/strong\u003e -- Honour \u003ccode\u003ereceive.maxInputSize\u003c/code\u003e in \u003ccode\u003eReceivePackHandler\u003c/code\u003e. Previously a remote unauthenticated client could send a tiny crafted pack that declared a huge \u003ccode\u003edest_size\u003c/code\u003e and trigger hundreds of MB of allocation over \u003ccode\u003egit-receive-pack\u003c/code\u003e. (Reported by Liyi, Ziyue, Strick, Maurice and Chenchen @ University of Sydney)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edulwich-1.2.4\u003c/h2\u003e\n\u003cp\u003eTolerate ref names with empty path components (e.g. `refs/tags//v1.0`) for now, emitting a `DeprecationWarning` rather than raising a `RefFormatError`. Such names are constructed by older Poetry releases (fixed in Poetry 2.4.0) and were silently accepted before Dulwich 1.2.3. `local_branch_name`, `local_tag_name` and `local_replace_name` likewise warn about, and strip, a leading slash instead of raising `ValueError`. Both will become errors again in a future release. (Jelmer Vernooij, \u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/2192\"\u003e#2192\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003edulwich-1.2.1\u003c/h2\u003e\n\u003ch2\u003eChanges since 1.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDerive the LFS endpoint as the remote's on-disk LFS store\n(\u003ccode\u003e\u0026lt;remote\u0026gt;/.git/lfs\u003c/code\u003e for worktrees, \u003ccode\u003e\u0026lt;remote\u0026gt;/lfs\u003c/code\u003e for bare repos)\nwhen \u003ccode\u003eremote.origin.url\u003c/code\u003e points at a local filesystem path or\n\u003ccode\u003efile://\u003c/code\u003e URL, matching git-lfs behaviour. Previously the built-in\nsmudge filter constructed an HTTP-style \u003ccode\u003e\u0026lt;remote\u0026gt;.git/info/lfs\u003c/code\u003e path\nthat did not exist on disk, leaving LFS-tracked files as pointers\nwhen cloning from a local repo.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDeduplicate objects when writing a multi-pack-index. Objects present\nin multiple packs (e.g. after \u003ccode\u003egit gc\u003c/code\u003e creates a cruft pack) would\notherwise produce an OIDL chunk with repeated SHAs, causing\n\u003ccode\u003egit multi-pack-index verify\u003c/code\u003e to fail with \u0026quot;oid lookup out of order\u0026quot;.\n(\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/2152\"\u003e#2152\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eExtend ignorecase and precomposeunicode support to index lookups.\n(\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/1807\"\u003e#1807\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.2.0\u003c/h2\u003e\n\u003ch2\u003eNotable changes since 1.1.0\u003c/h2\u003e\n\u003ch3\u003eNew features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eam\u003c/code\u003e command and \u003ccode\u003eporcelain.am()\u003c/code\u003e for applying mailbox-style email patches (\u003ccode\u003egit am\u003c/code\u003e), with state persistence for \u003ccode\u003e--continue\u003c/code\u003e, \u003ccode\u003e--skip\u003c/code\u003e, \u003ccode\u003e--abort\u003c/code\u003e, and \u003ccode\u003e--quit\u003c/code\u003e recovery (\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/1692\"\u003e#1692\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eapply\u003c/code\u003e command and \u003ccode\u003eporcelain.apply_patch()\u003c/code\u003e for applying unified diffs, including rename/copy detection, binary patches with Git's base85 encoding, and \u003ccode\u003e--3way\u003c/code\u003e merge fallback (\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/1784\"\u003e#1784\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eExpand \u003ccode\u003elog\u003c/code\u003e command options: \u003ccode\u003e--oneline\u003c/code\u003e, \u003ccode\u003e--abbrev-commit\u003c/code\u003e, \u003ccode\u003e--author\u003c/code\u003e, \u003ccode\u003e--committer\u003c/code\u003e, \u003ccode\u003e--grep\u003c/code\u003e, \u003ccode\u003e--since\u003c/code\u003e/\u003ccode\u003e--after\u003c/code\u003e, \u003ccode\u003e--until\u003c/code\u003e/\u003ccode\u003e--before\u003c/code\u003e, \u003ccode\u003e-n\u003c/code\u003e/\u003ccode\u003e--max-count\u003c/code\u003e, \u003ccode\u003e--no-merges\u003c/code\u003e, \u003ccode\u003e--merges\u003c/code\u003e, \u003ccode\u003e--stat\u003c/code\u003e, \u003ccode\u003e-p\u003c/code\u003e/\u003ccode\u003e--patch\u003c/code\u003e, \u003ccode\u003e--name-only\u003c/code\u003e, and \u003ccode\u003e--follow\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/1779\"\u003e#1779\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eAdd support for push options (\u003ccode\u003e-o\u003c/code\u003e/\u003ccode\u003e--push-option\u003c/code\u003e) in \u003ccode\u003epush\u003c/code\u003e, enabling AGit flow and other server-side push option workflows.\u003c/li\u003e\n\u003cli\u003eAdd missing push options: \u003ccode\u003e--all\u003c/code\u003e, \u003ccode\u003e--tags\u003c/code\u003e, \u003ccode\u003e--delete\u003c/code\u003e, \u003ccode\u003e--dry-run\u003c/code\u003e, \u003ccode\u003e--prune\u003c/code\u003e, \u003ccode\u003e--set-upstream\u003c/code\u003e, \u003ccode\u003e--follow-tags\u003c/code\u003e, and \u003ccode\u003e--mirror\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/1844\"\u003e#1844\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eAdd support for atomic push operations (\u003ccode\u003e--atomic\u003c/code\u003e): either all ref updates succeed or none are applied (\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/1781\"\u003e#1781\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eAdd support for \u003ccode\u003eextensions.relativeworktrees\u003c/code\u003e repository extension, allowing worktrees to use relative paths (\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/2112\"\u003e#2112\u003c/a\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jelmer/dulwich/blob/main/NEWS\"\u003edulwich's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e1.2.5\t2026-05-28\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSECURITY(GHSA-gfhv-vqv2-4544): Validate submodule paths in\n\u003ccode\u003eporcelain.submodule_update\u003c/code\u003e (and thus\n\u003ccode\u003eporcelain.clone(recurse_submodules=True)\u003c/code\u003e). A crafted upstream\nrepository could carry a submodule whose path was \u003ccode\u003e.git/hooks\u003c/code\u003e (or\nany other path inside \u003ccode\u003e.git\u003c/code\u003e or above the work tree), causing the\nsubmodule's tree contents to be written there with their executable\nbits intact -- dropping a hook that later commands would run. Submodule\npaths are now rejected if they are absolute or carry a component that\nthe configured path validator refuses, and the submodule's own tree is\nmaterialized with the same validator. This is the dulwich analogue of git's\nCVE-2024-32002 / CVE-2024-32004.\n(Jelmer Vernooij; reported by tonghuaroot)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSECURITY(CVE-2026-42305): Harden tree path validation against entry\nnames that are harmless on POSIX but dangerous when checked out on\nWindows. A crafted tree could previously carry such names through to\nthe work tree. \u003ccode\u003evalidate_path_element_ntfs\u003c/code\u003e now also rejects:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eWindows path separators, so an entry named\n\u003ccode\u003e.git\\hooks\\pre-commit.exe\u003c/code\u003e can no longer materialize a file\ninside \u003ccode\u003e.git\u003c/code\u003e that Git for Windows would execute.\u003c/li\u003e\n\u003cli\u003eThe alternate data stream marker \u003ccode\u003e:\u003c/code\u003e (e.g.\n\u003ccode\u003e.git::$INDEX_ALLOCATION\u003c/code\u003e, which writes into \u003ccode\u003e.git\u003c/code\u003e directly).\u003c/li\u003e\n\u003cli\u003eNTFS 8.3 short-name aliases of \u003ccode\u003e.git\u003c/code\u003e (\u003ccode\u003egit~\u0026lt;digits\u0026gt;\u003c/code\u003e); only\n\u003ccode\u003egit~1\u003c/code\u003e was rejected before.\u003c/li\u003e\n\u003cli\u003eReserved Windows device names (\u003ccode\u003eCON\u003c/code\u003e, \u003ccode\u003ePRN\u003c/code\u003e, \u003ccode\u003eAUX\u003c/code\u003e, \u003ccode\u003eNUL\u003c/code\u003e,\n\u003ccode\u003eCOM1\u003c/code\u003e-\u003ccode\u003eCOM9\u003c/code\u003e, \u003ccode\u003eLPT1\u003c/code\u003e-\u003ccode\u003eLPT9\u003c/code\u003e), including with an extension or\ntrailing dots/spaces such as \u003ccode\u003eNUL.txt\u003c/code\u003e or \u003ccode\u003eCOM1 .bar\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eIn addition, \u003ccode\u003ecore.protectNTFS\u003c/code\u003e now defaults to true on every\nplatform (matching git after CVE-2019-1353), so a POSIX clone no longer\naccepts paths that would be unsafe on a later Windows clone, and both\n\u003ccode\u003ecore.protectNTFS\u003c/code\u003e and \u003ccode\u003ecore.protectHFS\u003c/code\u003e are now read under their\ncorrect option names, having previously been silently ignored. POSIX\nusers who need literal NTFS-unsafe filenames can opt out with\n\u003ccode\u003ecore.protectNTFS=false\u003c/code\u003e.\n(Jelmer Vernooij; reported by Christopher Toth)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSECURITY (CVE-2026-42563): Shell-quote values substituted into\n\u003ccode\u003eProcessMergeDriver\u003c/code\u003e commands. \u003ccode\u003e%P\u003c/code\u003e is a path from the git\ntree, so a malicious branch could inject shell commands when the\nuser had a merge driver configured that referenced \u003ccode\u003e%P\u003c/code\u003e.\n(Jelmer Vernooij; reported by Ravishanker Kusuma (hayageek))\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSECURITY(CVE-2026-47712): Sanitize commit subjects used in\n\u003ccode\u003eporcelain.format_patch\u003c/code\u003e filenames so a malicious subject (e.g.\n\u003ccode\u003ex/../../x\u003c/code\u003e) cannot direct the generated patch outside \u003ccode\u003eoutdir\u003c/code\u003e.\n\u003ccode\u003eget_summary\u003c/code\u003e now matches git's \u003ccode\u003eformat_sanitized_subject\u003c/code\u003e.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/073f4dfa9840af2da59887ed828b026b609faa6c\"\u003e\u003ccode\u003e073f4df\u003c/code\u003e\u003c/a\u003e Release 1.2.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/5f85d3e4b0d47dd7fbf37934f9a4b9b6b98bb467\"\u003e\u003ccode\u003e5f85d3e\u003c/code\u003e\u003c/a\u003e tests: fix Windows-only failures in NTFS and merge-driver tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/25313ad7f9d5036b03617dc3dfc284a586966dab\"\u003e\u003ccode\u003e25313ad\u003c/code\u003e\u003c/a\u003e Merge branch 'advisory-5'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/1ca18147a1d03b61c2ae203c46bf0b2a2f5dd421\"\u003e\u003ccode\u003e1ca1814\u003c/code\u003e\u003c/a\u003e submodule: Reject unsafe submodule paths in submodule_update\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/3559ef15c1e2a8d2a56c98f36b53b29c5d60b9fd\"\u003e\u003ccode\u003e3559ef1\u003c/code\u003e\u003c/a\u003e Merge branch 'advisory-4'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/f860ca489d63624ae6d7c7945fbbd19018b8125c\"\u003e\u003ccode\u003ef860ca4\u003c/code\u003e\u003c/a\u003e server: Honour receive.maxInputSize to bound received packs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/0fd6e6bb61f8017b1af4b5fdbf7602ddbcf6d17e\"\u003e\u003ccode\u003e0fd6e6b\u003c/code\u003e\u003c/a\u003e Merge branch 'advisory-3'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/0110b885a1ab5b2128473263a6ff5b7230732e49\"\u003e\u003ccode\u003e0110b88\u003c/code\u003e\u003c/a\u003e Merge branch 'advisory-2'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/49eb56e51aad637fc23d54bf2a08cb42739b8290\"\u003e\u003ccode\u003e49eb56e\u003c/code\u003e\u003c/a\u003e Add NEWS entry for CVE-2026-42305\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/57efc4aa1581e038915a0fd79365be53b150f4a9\"\u003e\u003ccode\u003e57efc4a\u003c/code\u003e\u003c/a\u003e Merge branch 'advisory-1'\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/dulwich/dulwich/compare/dulwich-0.22.8...dulwich-1.2.5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 3.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in \u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining and\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e Release 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e Pre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from kjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e Convert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from kjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from StanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from StanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kjd/idna/compare/v3.10...v3.15\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langchain-core` from 0.3.49 to 1.3.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langchain/releases\"\u003elangchain-core's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elangchain-core==1.3.3\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.2\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37198\"\u003e#37198\u003c/a\u003e)\nfix(core): set deprecation \u003ccode\u003esince\u003c/code\u003e to 1.3.3 to match release (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37200\"\u003e#37200\u003c/a\u003e)\nfix(core, langchain): harden \u003ccode\u003eload()\u003c/code\u003e against untrusted manifests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37197\"\u003e#37197\u003c/a\u003e)\nchore: bump notebook from 7.5.0 to 7.5.6 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37109\"\u003e#37109\u003c/a\u003e)\nchore: bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260408 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37129\"\u003e#37129\u003c/a\u003e)\nfix(core): preserve structured \u003ccode\u003einputs\u003c/code\u003e on tool runs in tracers (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37108\"\u003e#37108\u003c/a\u003e)\nrelease(perplexity): 1.2.0 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37091\"\u003e#37091\u003c/a\u003e)\nchore(docs): update x handle references (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37081\"\u003e#37081\u003c/a\u003e)\nfix(core): make \u003ccode\u003eremoval\u003c/code\u003e optional in \u003ccode\u003ewarn_deprecated\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37056\"\u003e#37056\u003c/a\u003e)\nfix(core): validate batch_size in _batch and _abatch to prevent infinite loop (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36663\"\u003e#36663\u003c/a\u003e)\nchore(core): mark stream_v2/astream_v2 as beta (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36992\"\u003e#36992\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.2\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.1\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36990\"\u003e#36990\u003c/a\u003e)\nfeat(core): add content-block-centric streaming (v2) (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36834\"\u003e#36834\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.1\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.0\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36972\"\u003e#36972\u003c/a\u003e)\nfeat(core): allow _format_output to pass through list of ToolOutputMixin instances (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36963\"\u003e#36963\u003c/a\u003e)\nchore: bump nbconvert from 7.17.0 to 7.17.1 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36923\"\u003e#36923\u003c/a\u003e)\nfeat(core): Update inheritance behavior for tracer metadata for special keys (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36900\"\u003e#36900\u003c/a\u003e)\nchore: bump langsmith from 0.7.13 to 0.7.31 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36813\"\u003e#36813\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.0\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.2.31\u003c/p\u003e\n\u003cp\u003erelease(core): release 1.3.0 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36851\"\u003e#36851\u003c/a\u003e)\nrelease(core): 1.3.0a3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36829\"\u003e#36829\u003c/a\u003e)\nchore(core): keep checkpoint_ns behavior in streaming metadata for backwards compat (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36828\"\u003e#36828\u003c/a\u003e)\nfeat(core): Add chat model and LLM invocation params to traceable metadata (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36771\"\u003e#36771\u003c/a\u003e)\nfix(core): restore cloud metadata IPs and link-local range in SSRF policy (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36816\"\u003e#36816\u003c/a\u003e)\nchore(deps): bump pytest to \u003ccode\u003e9.0.3\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36801\"\u003e#36801\u003c/a\u003e)\nchore(core): harden private SSRF utilities (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36768\"\u003e#36768\u003c/a\u003e)\nfix(openai): handle content blocks without type key in responses api conversion (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36725\"\u003e#36725\u003c/a\u003e)\nchore: bump pytest from 9.0.2 to 9.0.3 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36719\"\u003e#36719\u003c/a\u003e)\nrelease(core): 1.3.0.a2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36698\"\u003e#36698\u003c/a\u003e)\nfix(core): Use reference counting for storing inherited run trees to support garbage collection (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36660\"\u003e#36660\u003c/a\u003e)\ndocs(core): nit (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36685\"\u003e#36685\u003c/a\u003e)\nrelease(core): 1.3.0a1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36656\"\u003e#36656\u003c/a\u003e)\nchore(core): reduce streaming metadata / perf (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36588\"\u003e#36588\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.0a3\u003c/h2\u003e\n\u003cp\u003eInitial release\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/5039dfec1f8e78459540a7f1b52fb0d6d82e3f07\"\u003e\u003ccode\u003e5039dfe\u003c/code\u003e\u003c/a\u003e release(core): 1.3.3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37198\"\u003e#37198\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/55a7707837742c2f7a9b7e4a5dd428bf615f3b82\"\u003e\u003ccode\u003e55a7707\u003c/code\u003e\u003c/a\u003e fix(core): set deprecation \u003ccode\u003esince\u003c/code\u003e to 1.3.3 to match release (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37200\"\u003e#37200\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/c979c6187b6d82f4bef35b10b84b39fa44806b22\"\u003e\u003ccode\u003ec979c61\u003c/code\u003e\u003c/a\u003e fix(core, langchain): harden \u003ccode\u003eload()\u003c/code\u003e against untrusted manifests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37197\"\u003e#37197\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/d7031101da78e3f6b6c5956b48a5170c1a33292b\"\u003e\u003ccode\u003ed703110\u003c/code\u003e\u003c/a\u003e docs: update README.md (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37190\"\u003e#37190\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/4d50a2a68b38e9acc53027ea7e7cc89e2d80b4c7\"\u003e\u003ccode\u003e4d50a2a\u003c/code\u003e\u003c/a\u003e ci(infra): run pre-release checks before TestPyPI publish (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37194\"\u003e#37194\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/9bd730e1991baac4ea80aa07d93110dc1b52ee25\"\u003e\u003ccode\u003e9bd730e\u003c/code\u003e\u003c/a\u003e fix(fireworks): require \u003ccode\u003eapi_key\u003c/code\u003e in \u003ccode\u003eFireworksEmbeddings\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37193\"\u003e#37193\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/f475f4191fc3a8d3cf14063b44d524594c080c04\"\u003e\u003ccode\u003ef475f41\u003c/code\u003e\u003c/a\u003e release(mistralai): 1.1.4 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37191\"\u003e#37191\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/7dbff48aff508b01dc231ea0cbd4e4e09da92c97\"\u003e\u003ccode\u003e7dbff48\u003c/code\u003e\u003c/a\u003e fix(mistralai): strip non-wire keys from \u003ccode\u003eToolMessage\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37188\"\u003e#37188\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/913816c440ea79295370e1af6484e17b86e5d03c\"\u003e\u003ccode\u003e913816c\u003c/code\u003e\u003c/a\u003e release(fireworks): 1.3.1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37189\"\u003e#37189\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/4498d3dc84a85688fa4d15476403a900bc7f9114\"\u003e\u003ccode\u003e4498d3d\u003c/code\u003e\u003c/a\u003e fix(fireworks): strip non-wire keys from \u003ccode\u003eToolMessage\u003c/code\u003e text content blocks (#...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/langchain-ai/langchain/compare/langchain-core==0.3.49...langchain-core==1.3.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langchain-openai` from 0.3.11 to 1.1.14\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langchain/releases\"\u003elangchain-openai's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elangchain-openai==1.1.14\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-openai==1.1.13\u003c/p\u003e\n\u003cp\u003erelease(openai): 1.1.14 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36820\"\u003e#36820\u003c/a\u003e)\nfix(openai): use SSRF-safe transport for image token counting (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36819\"\u003e#36819\u003c/a\u003e)\nchore(deps): bump pytest to \u003ccode\u003e9.0.3\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36801\"\u003e#36801\u003c/a\u003e)\nchore: bump langsmith from 0.6.3 to 0.7.31 in /libs/partners/openai (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36795\"\u003e#36795\u003c/a\u003e)\nchore: bump pillow from 12.1.1 to 12.2.0 in /libs/partners/openai (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36777\"\u003e#36777\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-openai==1.1.13\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-openai==1.1.12\u003c/p\u003e\n\u003cp\u003erelease(openai): 1.1.13 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36729\"\u003e#36729\u003c/a\u003e)\nfix(openai): handle content blocks without type key in responses api conversion (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36725\"\u003e#36725\u003c/a\u003e)\nchore(model-profiles): refresh model profile data (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36539\"\u003e#36539\u003c/a\u003e)\nchore(openai): fix broken vcr cassette playback and add ci guard (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36502\"\u003e#36502\u003c/a\u003e)\nfix(openai,groq,openrouter): use is-not-None checks in usage metadata token extraction (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36500\"\u003e#36500\u003c/a\u003e)\nfix(core): fixed typos in the documentation (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36459\"\u003e#36459\u003c/a\u003e)\nchore(model-profiles): refresh model profile data (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36455\"\u003e#36455\u003c/a\u003e)\nfeat(core): impute placeholder filenames for OpenAI file inputs (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36433\"\u003e#36433\u003c/a\u003e)\nchore: pygments\u0026gt;=2.20.0 across all packages (CVE-2026-4539) (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36385\"\u003e#36385\u003c/a\u003e)\nchore(model-profiles): refresh model profile data (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36368\"\u003e#36368\u003c/a\u003e)\nfix(openai): update computer call test (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36352\"\u003e#36352\u003c/a\u003e)\nfix(openai): let user-provided User-Agent override the Azure default (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35523\"\u003e#35523\u003c/a\u003e)\nchore: bump requests from 2.32.5 to 2.33.0 in /libs/partners/openai (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36248\"\u003e#36248\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-openai==1.1.12\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-openai==1.1.11\u003c/p\u003e\n\u003cp\u003efix(openai): bump min core version (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36180\"\u003e#36180\u003c/a\u003e)\nrelease(openai): 1.1.12 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36178\"\u003e#36178\u003c/a\u003e)\nfix(core,model-profiles): add missing \u003ccode\u003eModelProfile\u003c/code\u003e fields, warn on schema drift (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36129\"\u003e#36129\u003c/a\u003e)\nfix(openai): support phase parameter (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36161\"\u003e#36161\u003c/a\u003e)\nfix(openai): preserve namespace field in streaming function_call chunks (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36108\"\u003e#36108\u003c/a\u003e)\nci: suppress pytest streaming output in CI (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36092\"\u003e#36092\u003c/a\u003e)\nci: avoid unnecessary dep installs in lint targets (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36046\"\u003e#36046\u003c/a\u003e)\nchore(model-profiles): refresh model profile data (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36039\"\u003e#36039\u003c/a\u003e)\nchore: bump orjson from 3.11.5 to 3.11.6 in /libs/partners/openai (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35860\"\u003e#35860\u003c/a\u003e)\nfix(openai): add type: message to Responses API input items (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35693\"\u003e#35693\u003c/a\u003e)\nperf(.github): set a timeout on get min versions HTTP calls (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35851\"\u003e#35851\u003c/a\u003e)\nfeat(model-profiles): new fields + \u003ccode\u003eMakefile\u003c/code\u003e target (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35788\"\u003e#35788\u003c/a\u003e)\nfix(openai): close PIL Image handles in token counting to prevent fd leak (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35742\"\u003e#35742\u003c/a\u003e)\nfix(openai): typo (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35763\"\u003e#35763\u003c/a\u003e)\nchore(model-profiles): refresh model profile data (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35754\"\u003e#35754\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-openai==1.1.11\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-openai==1.1.10\u003c/p\u003e\n\u003cp\u003efix(openai): bump min core version (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35705\"\u003e#35705\u003c/a\u003e)\nrelease(openai): 1.1.11 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35703\"\u003e#35703\u003c/a\u003e)\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/b7447c6969fc928ec3f29c200e2e56c0a46c4c77\"\u003e\u003ccode\u003eb7447c6\u003c/code\u003e\u003c/a\u003e fix(infra): skip serdes tests in min-version release step (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36818\"\u003e#36818\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/41c0cc58b0dac82000d24715f7a4b44dc8b01fd3\"\u003e\u003ccode\u003e41c0cc5\u003c/code\u003e\u003c/a\u003e release(openai): 1.1.14 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36820\"\u003e#36820\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/0516156ef98f5001129f6d47bc8682d6536d58fb\"\u003e\u003ccode\u003e0516156\u003c/code\u003e\u003c/a\u003e fix(openai): use SSRF-safe transport for image token counting (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36819\"\u003e#36819\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/338aa8131a8124e7aa1e042616ccd2366ff9f699\"\u003e\u003ccode\u003e338aa81\u003c/code\u003e\u003c/a\u003e fix(core): restore cloud metadata IPs and link-local range in SSRF policy (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/3\"\u003e#3\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/51e954877efd2d2c3c5bf09364dcfec8794eadb0\"\u003e\u003ccode\u003e51e9548\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36797\"\u003e#36797\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/e85c418cfa559d4a794ddc6db92c6febab44651c\"\u003e\u003ccode\u003ee85c418\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/model-profiles (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36798\"\u003e#36798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/789126e6c78ad74664bea26228dda6e72e135dce\"\u003e\u003ccode\u003e789126e\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/standard-tests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36799\"\u003e#36799\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/937b3eb3827551d17ee4736f9acc4aa57e88c716\"\u003e\u003ccode\u003e937b3eb\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/langchain_v1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36800\"\u003e#36800\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/a06c205738cf5953e28c37287ddb1559d67c01f6\"\u003e\u003ccode\u003ea06c205\u003c/code\u003e\u003c/a\u003e ci(infra): validate issue checkboxes by section (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36811\"\u003e#36811\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/aa33b06deb0d65489ce254b48a8aaf8a86304c18\"\u003e\u003ccode\u003eaa33b06\u003c/code\u003e\u003c/a\u003e fix(langchain-classic): suppress mypy errors in compat code (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36806\"\u003e#36806\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/langchain-ai/langchain/compare/langchain-openai==0.3.11...langchain-openai==1.1.14\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langchain-text-splitters` from 0.3.7 to 1.1.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langchain/releases\"\u003elangchain-text-splitters's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elangchain-text-splitters==1.1.2\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-text-splitters==1.1.1\u003c/p\u003e\n\u003cp\u003erelease(text-splitters): 1.1.2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36822\"\u003e#36822\u003c/a\u003e)\nfix(text-splitters): deprecate and use SSRF-safe transport in split_text_from_url (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36821\"\u003e#36821\u003c/a\u003e)\nchore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36797\"\u003e#36797\u003c/a\u003e)\nchore(deps): bump pytest to \u003ccode\u003e9.0.3\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36801\"\u003e#36801\u003c/a\u003e)\nchore: bump pytest from 9.0.2 to 9.0.3 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36714\"\u003e#36714\u003c/a\u003e)\nchore: add comment explaining \u003ccode\u003epygments\u0026gt;=2.20.0\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36570\"\u003e#36570\u003c/a\u003e)\nrelease(core): 1.2.26 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36511\"\u003e#36511\u003c/a\u003e)\nchore: pygments\u0026gt;=2.20.0 across all packages (CVE-2026-4539) (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36385\"\u003e#36385\u003c/a\u003e)\nfix(text-splitters): prevent silent data loss for empty dict values in RecursiveJsonSplitter (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35079\"\u003e#35079\u003c/a\u003e)\nfeat(text-splitters): support spacy tests with Python 3.14 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36198\"\u003e#36198\u003c/a\u003e)\nfix(infra): correct lint_diff relative paths in package makefiles (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36333\"\u003e#36333\u003c/a\u003e)\nchore: bump requests from 2.32.5 to 2.33.0 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36238\"\u003e#36238\u003c/a\u003e)\nchore: bump nltk from 3.9.3 to 3.9.4 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36237\"\u003e#36237\u003c/a\u003e)\nchore(partners): bump \u003ccode\u003elangchain-core\u003c/code\u003e min to \u003ccode\u003e1.2.21\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36183\"\u003e#36183\u003c/a\u003e)\nchore(text-splitters): bump nltk in lock file (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36112\"\u003e#36112\u003c/a\u003e)\nci: suppress pytest streaming output in CI (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36092\"\u003e#36092\u003c/a\u003e)\nchore(text-splitters): speed up ci (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36050\"\u003e#36050\u003c/a\u003e)\nci: avoid unnecessary dep installs in lint targets (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36046\"\u003e#36046\u003c/a\u003e)\nchore: bump orjson from 3.11.5 to 3.11.6 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35856\"\u003e#35856\u003c/a\u003e)\nchore: bump locks, lint (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35985\"\u003e#35985\u003c/a\u003e)\nperf(.github): set a timeout on get min versions HTTP calls (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35851\"\u003e#35851\u003c/a\u003e)\nchore: bump tornado from 6.5.2 to 6.5.5 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35774\"\u003e#35774\u003c/a\u003e)\nchore: bump the minor-and-patch group across 3 directories with 3 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35589\"\u003e#35589\u003c/a\u003e)\nchore: bump the other-deps group across 3 directories with 2 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35512\"\u003e#35512\u003c/a\u003e)\nchore: bump nltk from 3.9.2 to 3.9.3 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35449\"\u003e#35449\u003c/a\u003e)\nchore: bump the other-deps group across 3 directories with 2 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35407\"\u003e#35407\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-text-splitters==1.1.1\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-text-splitters==1.1.0\u003c/p\u003e\n\u003cp\u003erelease(text-splitters): 1.1.1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35318\"\u003e#35318\u003c/a\u003e)\nfix(text-splitters): prevent JSFrameworkTextSplitter from mutating self._separators on each split_text() call (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35316\"\u003e#35316\u003c/a\u003e)\nchore: bump transformers from 5.1.0 to 5.2.0 in /libs/text-splitters in the other-deps group across 1 directory (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35279\"\u003e#35279\u003c/a\u003e)\nchore: bump the other-deps group across 3 directories with 2 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35255\"\u003e#35255\u003c/a\u003e)\nstyle: bump ruff version to 0.15 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35042\"\u003e#35042\u003c/a\u003e)\nfix: Server-Side Request Forgery (SSRF) in HTMLHeaderTextSplitter.split_text_from_url (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35196\"\u003e#35196\u003c/a\u003e)\nfeat(text-splitters): add model_kwargs to SentenceTransformersTokenTextSplitter (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35113\"\u003e#35113\u003c/a\u003e)\nchore(deps): bump langsmith from 0.4.31 to 0.6.3 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35162\"\u003e#35162\u003c/a\u003e)\nchore(deps): bump the other-deps group across 3 directories with 12 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35127\"\u003e#35127\u003c/a\u003e)\nchore(deps): bump the other-deps group across 3 directories with 8 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35120\"\u003e#35120\u003c/a\u003e)\nchore: add \u003ccode\u003emake type\u003c/code\u003e target (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35015\"\u003e#35015\u003c/a\u003e)\nrevert: \u0026quot;chore: add typing target in \u003ccode\u003eMakefile\u003c/code\u003e\u0026quot; (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35013\"\u003e#35013\u003c/a\u003e)\nchore: add typing target in \u003ccode\u003eMakefile\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35012\"\u003e#35012\u003c/a\u003e)\nfix(text-splitters): reverse preserved elements iterator in \u003ccode\u003eHTMLSemanticPreservingSplitter\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/34080\"\u003e#34080\u003c/a\u003e)\nchore: enrich \u003ccode\u003epyproject.toml\u003c/code\u003e files (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/34980\"\u003e#34980\u003c/a\u003e)\nchore(deps): bump the uv group across 20 directories with 3 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/34941\"\u003e#34941\u003c/a\u003e)\nchore: upgrade urllib3 to 2.6.3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/34940\"\u003e#34940\u003c/a\u003e)\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/58c4e5bbdd9d18d7fe7ec83b5a05477d06fe2a8e\"\u003e\u003ccode\u003e58c4e5b\u003c/code\u003e\u003c/a\u003e release(text-splitters): 1.1.2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36822\"\u003e#36822\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/c289bf10e940e960a132d7403482283114063063\"\u003e\u003ccode\u003ec289bf1\u003c/code\u003e\u003c/a\u003e fix(text-splitters): deprecate and use SSRF-safe transport in split_text_from...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/b7447c6969fc928ec3f29c200e2e56c0a46c4c77\"\u003e\u003ccode\u003eb7447c6\u003c/code\u003e\u003c/a\u003e fix(infra): skip serdes tests in min-version release step (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36818\"\u003e#36818\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/41c0cc58b0dac82000d24715f7a4b44dc8b01fd3\"\u003e\u003ccode\u003e41c0cc5\u003c/code\u003e\u003c/a\u003e release(openai): 1.1.14 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36820\"\u003e#36820\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/0516156ef98f5001129f6d47bc8682d6536d58fb\"\u003e\u003ccode\u003e0516156\u003c/code\u003e\u003c/a\u003e fix(openai): use SSRF-safe transport for image token counting (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36819\"\u003e#36819\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/338aa8131a8124e7aa1e042616ccd2366ff9f699\"\u003e\u003ccode\u003e338aa81\u003c/code\u003e\u003c/a\u003e fix(core): restore cloud metadata IPs and link-local range in SSRF policy (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/3\"\u003e#3\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/51e954877efd2d2c3c5bf09364dcfec8794eadb0\"\u003e\u003ccode\u003e51e9548\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36797\"\u003e#36797\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/e85c418cfa559d4a794ddc6db92c6febab44651c\"\u003e\u003ccode\u003ee85c418\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/model-profiles (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36798\"\u003e#36798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/789126e6c78ad74664bea26228dda6e72e135dce\"\u003e\u003ccode\u003e789126e\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/standard-tests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36799\"\u003e#36799\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/937b3eb3827551d17ee4736f9acc4aa57e88c716\"\u003e\u003ccode\u003e937b3eb\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/langchain_v1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36800\"\u003e#36800\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/langchain-ai/langchain/compare/langchain-text-splitters==0.3.7...langchain-text-splitters==1.1.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langsmith` from 0.3.19 to 0.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langsmith-sdk/releases\"\u003elangsmith's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.8.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat(js,py): JS 0.6.0, Py 0.8.0 by \u003ca href=\"https://github.com/jacoblee93\"\u003e\u003ccode\u003e@​jacoblee93\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2831\"\u003elangchain-ai/langsmith-sdk#2831\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease(js): 0.6.0 by \u003ca href=\"https://github.com/jacoblee93\"\u003e\u003ccode\u003e@​jacoblee93\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2832\"\u003elangchain-ai/langsmith-sdk#2832\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease(py): 0.8.0 by \u003ca href=\"https://github.com/jacoblee93\"\u003e\u003ccode\u003e@​jacoblee93\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2833\"\u003elangchain-ai/langsmith-sdk#2833\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.38...v0.8.0\"\u003ehttps://github.com/langchain-ai/langsmith-sdk/compare/v0.7.38...v0.8...\n\n_Description has been truncated_","html_url":"https://github.com/HarleyCoops/Qwen3-RailroadEngineer1959-RL/pull/6","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/HarleyCoops%2FQwen3-RailroadEngineer1959-RL/issues/6","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/6/packages"},{"uuid":"4543760423","node_id":"PR_kwDOSqs-LM7gZ0sS","number":5,"state":"open","title":"chore(deps): bump lxml from 6.1.0 to 6.1.1","user":"dependabot[bot]","labels":["dependencies","python:uv","dependabot-approved"],"assignees":[],"locked":false,"comments_count":4,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-28T20:56:21.000Z","updated_at":"2026-05-31T04:50:58.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps)","packages":[{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"}],"path":null,"ecosystem":"pip"},"body":"Bumps [lxml](https://github.com/lxml/lxml) from 6.1.0 to 6.1.1.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n","html_url":"https://github.com/TechMatrix-labs/pythinker-code/pull/5","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/TechMatrix-labs%2Fpythinker-code/issues/5","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/5/packages"},{"uuid":"4539525071","node_id":"PR_kwDOSqM5uM7gL4Bz","number":6,"state":"closed","title":"[upd] pypi: Bump the minor group with 5 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-05-30T00:51:29.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-28T10:05:33.000Z","updated_at":"2026-05-30T00:51:31.000Z","time_to_close":139556,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"[upd] pypi: Bump","group_name":"minor","update_count":5,"packages":[{"name":"certifi","old_version":"2026.4.22","new_version":"2026.5.20","repository_url":"https://github.com/certifi/python-certifi"},{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"},{"name":"httpx-socks","old_version":"0.10.0","new_version":"0.11.0","repository_url":"https://github.com/romis2012/httpx-socks"},{"name":"typer","old_version":"0.25.1","new_version":"0.26.2","repository_url":"https://github.com/fastapi/typer"},{"name":"basedpyright","old_version":"1.39.4","new_version":"1.39.6","repository_url":"https://github.com/detachhead/basedpyright"}],"path":null,"ecosystem":"pip"},"body":"Bumps the minor group with 5 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [certifi](https://github.com/certifi/python-certifi) | `2026.4.22` | `2026.5.20` |\n| [lxml](https://github.com/lxml/lxml) | `6.1.0` | `6.1.1` |\n| [httpx-socks](https://github.com/romis2012/httpx-socks) | `0.10.0` | `0.11.0` |\n| [typer](https://github.com/fastapi/typer) | `0.25.1` | `0.26.2` |\n| [basedpyright](https://github.com/detachhead/basedpyright) | `1.39.4` | `1.39.6` |\n\nUpdates `certifi` from 2026.4.22 to 2026.5.20\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/d7ea151afc2ce6bef0555b9349902bd867e928dd\"\u003e\u003ccode\u003ed7ea151\u003c/code\u003e\u003c/a\u003e 2026.05.20 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/413\"\u003e#413\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/certifi/python-certifi/compare/2026.04.22...2026.05.20\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lxml` from 6.1.0 to 6.1.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `httpx-socks` from 0.10.0 to 0.11.0\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/romis2012/httpx-socks/commit/ae0df29274f3b7018ee30b982a878921667c6511\"\u003e\u003ccode\u003eae0df29\u003c/code\u003e\u003c/a\u003e Delete setup.py\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/romis2012/httpx-socks/commit/4e372f0895438f8034dbc9cb2637dc4e121bd69f\"\u003e\u003ccode\u003e4e372f0\u003c/code\u003e\u003c/a\u003e Move project metadata to pyproject.toml, other fixes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/romis2012/httpx-socks/commit/07bac473517a6265e490eb53abcbbe59b5794fd3\"\u003e\u003ccode\u003e07bac47\u003c/code\u003e\u003c/a\u003e Fix http2 issue (\u003ca href=\"https://redirect.github.com/romis2012/httpx-socks/issues/27\"\u003e#27\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/romis2012/httpx-socks/compare/v0.10.0...v0.11.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `typer` from 0.25.1 to 0.26.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/fastapi/typer/releases\"\u003etyper's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.26.2\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e🐛 Ensure that an envvar set for a \u003ccode\u003etyper.Option\u003c/code\u003e list is split on whitespace. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1791\"\u003e#1791\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.26.1\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e🐛 Ensure that an envvar set for \u003ccode\u003etyper.Option\u003c/code\u003e works as expected. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1788\"\u003e#1788\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eInternal\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e⬆ Bump python-dotenv from 1.2.1 to 1.2.2. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1714\"\u003e#1714\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.26.0\u003c/h2\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e➖ Vendor Click and streamline Typer's functionality and code base. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1774\"\u003e#1774\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\n\u003cul\u003e\n\u003cli\u003eTyper no longer depends on Click as a third party dependency, it vendors (includes the source code of) Click.\u003c/li\u003e\n\u003cli\u003eThis simplifies the work done by both Click and Typer teams.\u003c/li\u003e\n\u003cli\u003eIt allows Typer to evolve independently, and enables several new planned features.\u003c/li\u003e\n\u003cli\u003eIt will solve several dependency conflict situations for projects that use some packages that depend on Click and some that depend on Typer.\u003c/li\u003e\n\u003cli\u003eThis also means that Click-specific functionality is no longer supported, like extracting the Click app and adding Click-specific plug-ins, or customizing the field types with Click-specific types.\u003c/li\u003e\n\u003cli\u003eYou can read more about it in the docs for \u003ca href=\"https://typer.tiangolo.com/tutorial/click/\"\u003eVendored Click\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocs\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e📝 Update and simplify docs about help and management. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1778\"\u003e#1778\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update contributing docs, reference central docs. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1777\"\u003e#1777\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update security policy. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1775\"\u003e#1775\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update link syntax to minimal Markdown. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1623\"\u003e#1623\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update and simplify usage of admonitions. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1755\"\u003e#1755\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eInternal\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e📌 Pin max version of Click to \u003ccode\u003e\u0026gt;= 8.2.1, \u0026lt; 8.4\u003c/code\u003e temporarily to prevent incompatibilities. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1753\"\u003e#1753\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\n\u003cul\u003e\n\u003cli\u003eSuperseded by vendoring Click.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e👷 Configure Dependabot to group updates and update weekly. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1768\"\u003e#1768\u003c/a\u003e by \u003ca href=\"https://github.com/YuriiMotov\"\u003e\u003ccode\u003e@​YuriiMotov\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔥 Remove config files now in central GitHub repo. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1780\"\u003e#1780\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump idna from 3.11 to 3.15. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1771\"\u003e#1771\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump pymdown-extensions from 10.21.2 to 10.21.3. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1772\"\u003e#1772\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Fix categorization of PR 1475 in release notes. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1769\"\u003e#1769\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e✅ Add Fish shell completion tests for colon options. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1475\"\u003e#1475\u003c/a\u003e by \u003ca href=\"https://github.com/Mohamed-Elwasila\"\u003e\u003ccode\u003e@​Mohamed-Elwasila\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e✅ Extend completion unit tests for zsh, powershell and pwsh. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1767\"\u003e#1767\u003c/a\u003e by \u003ca href=\"https://github.com/ADiTyaRaj8969\"\u003e\u003ccode\u003e@​ADiTyaRaj8969\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump actions/github-script from 7.1.0 to 9.0.0. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1746\"\u003e#1746\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔧 Fix GitHub link in docs. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1754\"\u003e#1754\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆️ Migrate to Zensical. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1470\"\u003e#1470\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump urllib3 from 2.6.3 to 2.7.0. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1741\"\u003e#1741\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔧 Remove unnecessary Ruff rule. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1752\"\u003e#1752\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔒️ Add zizmor and fix audit findings. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1705\"\u003e#1705\u003c/a\u003e by \u003ca href=\"https://github.com/YuriiMotov\"\u003e\u003ccode\u003e@​YuriiMotov\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/fastapi/typer/blob/master/docs/release-notes.md\"\u003etyper's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.26.2 (2026-05-27)\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e🐛 Ensure that an envvar set for a \u003ccode\u003etyper.Option\u003c/code\u003e list is split on whitespace. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1791\"\u003e#1791\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.26.1 (2026-05-26)\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e🐛 Ensure that an envvar set for \u003ccode\u003etyper.Option\u003c/code\u003e works as expected. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1788\"\u003e#1788\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eInternal\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e⬆ Bump python-dotenv from 1.2.1 to 1.2.2. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1714\"\u003e#1714\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.26.0 (2026-05-26)\u003c/h2\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e➖ Vendor Click and streamline Typer's functionality and code base. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1774\"\u003e#1774\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\n\u003cul\u003e\n\u003cli\u003eTyper no longer depends on Click as a third party dependency, it vendors (includes the source code of) Click.\u003c/li\u003e\n\u003cli\u003eThis simplifies the work done by both Click and Typer teams.\u003c/li\u003e\n\u003cli\u003eIt allows Typer to evolve independently, and enables several new planned features.\u003c/li\u003e\n\u003cli\u003eIt will solve several dependency conflict situations for projects that use some packages that depend on Click and some that depend on Typer.\u003c/li\u003e\n\u003cli\u003eThis also means that Click-specific functionality is no longer supported, like extracting the Click app and adding Click-specific plug-ins, or customizing the field types with Click-specific types.\u003c/li\u003e\n\u003cli\u003eYou can read more about it in the docs for \u003ca href=\"https://typer.tiangolo.com/tutorial/click/\"\u003eVendored Click\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocs\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e📝 Update and simplify docs about help and management. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1778\"\u003e#1778\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update contributing docs, reference central docs. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1777\"\u003e#1777\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update security policy. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1775\"\u003e#1775\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update link syntax to minimal Markdown. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1623\"\u003e#1623\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update and simplify usage of admonitions. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1755\"\u003e#1755\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eInternal\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e📌 Pin max version of Click to \u003ccode\u003e\u0026gt;= 8.2.1, \u0026lt; 8.4\u003c/code\u003e temporarily to prevent incompatibilities. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1753\"\u003e#1753\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\n\u003cul\u003e\n\u003cli\u003eSuperseded by vendoring Click.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e👷 Configure Dependabot to group updates and update weekly. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1768\"\u003e#1768\u003c/a\u003e by \u003ca href=\"https://github.com/YuriiMotov\"\u003e\u003ccode\u003e@​YuriiMotov\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔥 Remove config files now in central GitHub repo. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1780\"\u003e#1780\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump idna from 3.11 to 3.15. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1771\"\u003e#1771\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump pymdown-extensions from 10.21.2 to 10.21.3. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1772\"\u003e#1772\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Fix categorization of PR 1475 in release notes. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1769\"\u003e#1769\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e✅ Add Fish shell completion tests for colon options. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1475\"\u003e#1475\u003c/a\u003e by \u003ca href=\"https://github.com/Mohamed-Elwasila\"\u003e\u003ccode\u003e@​Mohamed-Elwasila\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e✅ Extend completion unit tests for zsh, powershell and pwsh. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1767\"\u003e#1767\u003c/a\u003e by \u003ca href=\"https://github.com/ADiTyaRaj8969\"\u003e\u003ccode\u003e@​ADiTyaRaj8969\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump actions/github-script from 7.1.0 to 9.0.0. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1746\"\u003e#1746\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔧 Fix GitHub link in docs. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1754\"\u003e#1754\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆️ Migrate to Zensical. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1470\"\u003e#1470\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/eef433fcf337734f51ac68a77a82748adfacaa85\"\u003e\u003ccode\u003eeef433f\u003c/code\u003e\u003c/a\u003e 🔖 Release version 0.26.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/23474b03bca44ace3c0f7459653b2433626de74e\"\u003e\u003ccode\u003e23474b0\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/5568bab22f9de34dbcd25e02a566505a11349d35\"\u003e\u003ccode\u003e5568bab\u003c/code\u003e\u003c/a\u003e 🐛 Ensure that an envvar set for a \u003ccode\u003etyper.Option\u003c/code\u003e list is split on whitespace ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/8c70d4987284a37ca6c418297af0210dc01ed5ac\"\u003e\u003ccode\u003e8c70d49\u003c/code\u003e\u003c/a\u003e 🔖 Release version 0.26.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/75ee9272b048a2843cd7acddb8f0cc39b8140e4a\"\u003e\u003ccode\u003e75ee927\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/30288540dde2b68d820c450ea0452747be632a84\"\u003e\u003ccode\u003e3028854\u003c/code\u003e\u003c/a\u003e 🐛 Ensure that an envvar set for \u003ccode\u003etyper.Option\u003c/code\u003e works as expected (\u003ca href=\"https://redirect.github.com/fastapi/typer/issues/1788\"\u003e#1788\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/959a356fec72cedcfd4ee3f84790789f8e961989\"\u003e\u003ccode\u003e959a356\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/a79de202db26ae32d00674ba246b59864e2f89c1\"\u003e\u003ccode\u003ea79de20\u003c/code\u003e\u003c/a\u003e ⬆ Bump python-dotenv from 1.2.1 to 1.2.2 (\u003ca href=\"https://redirect.github.com/fastapi/typer/issues/1714\"\u003e#1714\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/8f44149ca511ebd26fcaf36c4712e7d8a8004a4d\"\u003e\u003ccode\u003e8f44149\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/d88415fc1d20adcb73f44961f6ae8cff156df016\"\u003e\u003ccode\u003ed88415f\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/fastapi/typer/compare/0.25.1...0.26.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `basedpyright` from 1.39.4 to 1.39.6\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/ad82d91ce241116737e65e660c5420dd0366f405\"\u003e\u003ccode\u003ead82d91\u003c/code\u003e\u003c/a\u003e 1.39.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/cf60738b8dbbcc89f02d097a2dfa6e91c540bd86\"\u003e\u003ccode\u003ecf60738\u003c/code\u003e\u003c/a\u003e fix vscode config for formatting markdown files now that we use two formatter...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/29e303a1b0b5f401f21c28fe3ea7da4b9db09e35\"\u003e\u003ccode\u003e29e303a\u003c/code\u003e\u003c/a\u003e print stderr from npm commands when build fails\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/f133f3d6b9a4ef3cf2d53a929a053875e1effbe4\"\u003e\u003ccode\u003ef133f3d\u003c/code\u003e\u003c/a\u003e uncomment some test code which started causing a test to fail. no idea why i ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/f71e96bfe63f0833f3d169cf0df9208a7734929f\"\u003e\u003ccode\u003ef71e96b\u003c/code\u003e\u003c/a\u003e remove python 3.9 check from \u003ccode\u003eTypeAlias4\u003c/code\u003e test because typeshed has dropped s...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/e4c40b76f5cb70a44825aa65da7fdaa3f32b4f85\"\u003e\u003ccode\u003ee4c40b7\u003c/code\u003e\u003c/a\u003e fix tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/d7c522bc2a8b105d206b5efce0d6dd4e2610b917\"\u003e\u003ccode\u003ed7c522b\u003c/code\u003e\u003c/a\u003e ruff ignore new \u003ccode\u003ebenchmarkData\u003c/code\u003e files from upstream\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/a7cf33dce12ce64f8fb2fecf039c4422c232784a\"\u003e\u003ccode\u003ea7cf33d\u003c/code\u003e\u003c/a\u003e fix eslint in vscode\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/14c96beec311ff57bb3ef416ac86f886648b1adb\"\u003e\u003ccode\u003e14c96be\u003c/code\u003e\u003c/a\u003e fix logic for reporting invalid \u003ccode\u003epythonPlatform\u003c/code\u003e detected by the new eslint v...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/280802ce1b2bdbaf78a880b94355ebf702241ca9\"\u003e\u003ccode\u003e280802c\u003c/code\u003e\u003c/a\u003e remove remnants of webpack\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/detachhead/basedpyright/compare/v1.39.4...v1.39.6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/Amanzuu/Search-Engine-Project/pull/6","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Amanzuu%2FSearch-Engine-Project/issues/6","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/6/packages"},{"uuid":"4528571642","node_id":"PR_kwDOC8BTjM7foTQH","number":20949,"state":"open","title":"build(deps): bump lxml from 6.1.0 to 6.1.1","user":"dependabot[bot]","labels":["dependencies","python","Changed"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-27T00:53:06.000Z","updated_at":"2026-05-27T03:14:30.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps)","packages":[{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"}],"path":null,"ecosystem":"pip"},"body":"Bumps [lxml](https://github.com/lxml/lxml) from 6.1.0 to 6.1.1.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lxml\u0026package-manager=pip\u0026previous-version=6.1.0\u0026new-version=6.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\n\u003c!-- CURSOR_SUMMARY --\u003e\n---\n\n\u003e [!NOTE]\n\u003e **Low Risk**\n\u003e Lockfile-only patch bump of an optional dev dependency with no production code changes; verify CI/dev installs still resolve correctly.\n\u003e \n\u003e **Overview**\n\u003e Bumps the optional **dev** dependency **`lxml`** from **6.1.0** to **6.1.1** by raising the floor in `pyproject.toml` (`\u003e=6.1.1`) and refreshing **`poetry.lock`** (package version, wheel artifact hashes, and lock `content-hash`).\n\u003e \n\u003e No application or test source changes—only dependency resolution. **`lxml`** remains tied to the `dev` extra and is used in-repo for JUnit XML parsing (`lxml.etree` in `chia/_tests/process_junit.py`), not runtime node/wallet code.\n\u003e \n\u003e \u003csup\u003eReviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 20feb6eaf2b40e6d6a554e9d40874d215c4b200b. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).\u003c/sup\u003e\n\u003c!-- /CURSOR_SUMMARY --\u003e","html_url":"https://github.com/Chia-Network/chia-blockchain/pull/20949","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chia-Network%2Fchia-blockchain/issues/20949","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/20949/packages"},{"uuid":"4521014144","node_id":"PR_kwDOOCoWus7fPvj8","number":1,"state":"open","title":"Bump the uv group across 1 directory with 4 updates","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-26T03:09:58.000Z","updated_at":"2026-05-26T03:11:19.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","group_name":"uv","update_count":4,"packages":[{"name":"idna","old_version":"3.10","new_version":"3.15","repository_url":"https://github.com/kjd/idna"},{"name":"langchain-core","old_version":"1.3.0","new_version":"1.3.3","repository_url":"https://github.com/langchain-ai/langchain"},{"name":"lxml","old_version":"6.0.0","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"},{"name":"urllib3","old_version":"2.6.3","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"}],"path":null,"ecosystem":"pip"},"body":"Bumps the uv group with 4 updates in the / directory: [idna](https://github.com/kjd/idna), [langchain-core](https://github.com/langchain-ai/langchain), [lxml](https://github.com/lxml/lxml) and [urllib3](https://github.com/urllib3/urllib3).\n\nUpdates `idna` from 3.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in \u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining and\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e Release 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e Pre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from kjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e Convert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from kjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from StanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from StanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kjd/idna/compare/v3.10...v3.15\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langchain-core` from 1.3.0 to 1.3.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langchain/releases\"\u003elangchain-core's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elangchain-core==1.3.3\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.2\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37198\"\u003e#37198\u003c/a\u003e)\nfix(core): set deprecation \u003ccode\u003esince\u003c/code\u003e to 1.3.3 to match release (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37200\"\u003e#37200\u003c/a\u003e)\nfix(core, langchain): harden \u003ccode\u003eload()\u003c/code\u003e against untrusted manifests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37197\"\u003e#37197\u003c/a\u003e)\nchore: bump notebook from 7.5.0 to 7.5.6 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37109\"\u003e#37109\u003c/a\u003e)\nchore: bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260408 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37129\"\u003e#37129\u003c/a\u003e)\nfix(core): preserve structured \u003ccode\u003einputs\u003c/code\u003e on tool runs in tracers (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37108\"\u003e#37108\u003c/a\u003e)\nrelease(perplexity): 1.2.0 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37091\"\u003e#37091\u003c/a\u003e)\nchore(docs): update x handle references (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37081\"\u003e#37081\u003c/a\u003e)\nfix(core): make \u003ccode\u003eremoval\u003c/code\u003e optional in \u003ccode\u003ewarn_deprecated\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37056\"\u003e#37056\u003c/a\u003e)\nfix(core): validate batch_size in _batch and _abatch to prevent infinite loop (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36663\"\u003e#36663\u003c/a\u003e)\nchore(core): mark stream_v2/astream_v2 as beta (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36992\"\u003e#36992\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.2\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.1\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36990\"\u003e#36990\u003c/a\u003e)\nfeat(core): add content-block-centric streaming (v2) (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36834\"\u003e#36834\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.1\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.0\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36972\"\u003e#36972\u003c/a\u003e)\nfeat(core): allow _format_output to pass through list of ToolOutputMixin instances (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36963\"\u003e#36963\u003c/a\u003e)\nchore: bump nbconvert from 7.17.0 to 7.17.1 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36923\"\u003e#36923\u003c/a\u003e)\nfeat(core): Update inheritance behavior for tracer metadata for special keys (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36900\"\u003e#36900\u003c/a\u003e)\nchore: bump langsmith from 0.7.13 to 0.7.31 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36813\"\u003e#36813\u003c/a\u003e)\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/5039dfec1f8e78459540a7f1b52fb0d6d82e3f07\"\u003e\u003ccode\u003e5039dfe\u003c/code\u003e\u003c/a\u003e release(core): 1.3.3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37198\"\u003e#37198\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/55a7707837742c2f7a9b7e4a5dd428bf615f3b82\"\u003e\u003ccode\u003e55a7707\u003c/code\u003e\u003c/a\u003e fix(core): set deprecation \u003ccode\u003esince\u003c/code\u003e to 1.3.3 to match release (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37200\"\u003e#37200\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/c979c6187b6d82f4bef35b10b84b39fa44806b22\"\u003e\u003ccode\u003ec979c61\u003c/code\u003e\u003c/a\u003e fix(core, langchain): harden \u003ccode\u003eload()\u003c/code\u003e against untrusted manifests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37197\"\u003e#37197\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/d7031101da78e3f6b6c5956b48a5170c1a33292b\"\u003e\u003ccode\u003ed703110\u003c/code\u003e\u003c/a\u003e docs: update README.md (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37190\"\u003e#37190\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/4d50a2a68b38e9acc53027ea7e7cc89e2d80b4c7\"\u003e\u003ccode\u003e4d50a2a\u003c/code\u003e\u003c/a\u003e ci(infra): run pre-release checks before TestPyPI publish (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37194\"\u003e#37194\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/9bd730e1991baac4ea80aa07d93110dc1b52ee25\"\u003e\u003ccode\u003e9bd730e\u003c/code\u003e\u003c/a\u003e fix(fireworks): require \u003ccode\u003eapi_key\u003c/code\u003e in \u003ccode\u003eFireworksEmbeddings\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37193\"\u003e#37193\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/f475f4191fc3a8d3cf14063b44d524594c080c04\"\u003e\u003ccode\u003ef475f41\u003c/code\u003e\u003c/a\u003e release(mistralai): 1.1.4 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37191\"\u003e#37191\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/7dbff48aff508b01dc231ea0cbd4e4e09da92c97\"\u003e\u003ccode\u003e7dbff48\u003c/code\u003e\u003c/a\u003e fix(mistralai): strip non-wire keys from \u003ccode\u003eToolMessage\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37188\"\u003e#37188\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/913816c440ea79295370e1af6484e17b86e5d03c\"\u003e\u003ccode\u003e913816c\u003c/code\u003e\u003c/a\u003e release(fireworks): 1.3.1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37189\"\u003e#37189\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/4498d3dc84a85688fa4d15476403a900bc7f9114\"\u003e\u003ccode\u003e4498d3d\u003c/code\u003e\u003c/a\u003e fix(fireworks): strip non-wire keys from \u003ccode\u003eToolMessage\u003c/code\u003e text content blocks (#...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/langchain-ai/langchain/compare/langchain-core==1.3.0...langchain-core==1.3.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lxml` from 6.0.0 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.3 (2026-04-09)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSeveral out of memory error cases now raise \u003ccode\u003eMemoryError\u003c/code\u003e that were not handled before.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSlicing with large step values (outside of \u003ccode\u003e+/- sys.maxsize\u003c/code\u003e) could trigger undefined C behaviour.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2125399: Some failing tests were fixed or disabled in PyPy.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2138421: Memory leak in error cases when setting the \u003ccode\u003epublic_id\u003c/code\u003e or \u003ccode\u003esystem_url\u003c/code\u003e of a document.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c7d76d6cb817c8e1f316e43b16cab5e6ad669ad0\"\u003e\u003ccode\u003ec7d76d6\u003c/code\u003e\u003c/a\u003e Change security policy to point to Github security advisories.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/378ccf82db8160928807c55ed580c0443aa94f42\"\u003e\u003ccode\u003e378ccf8\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/315270b810a9e3276c60daba549299d204ac962b\"\u003e\u003ccode\u003e315270b\u003c/code\u003e\u003c/a\u003e Docs: Reduce TOC depth of package pages and move module contents first.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6dbba7f3c72f655b05b26ef453fdee31af13ccf5\"\u003e\u003ccode\u003e6dbba7f\u003c/code\u003e\u003c/a\u003e Docs: Show current year in copyright line.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/e4385bfa5d79527350d5ef17372fb70ba80b4cce\"\u003e\u003ccode\u003ee4385bf\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5bed1e1a227cd9ba5a879aaeacdf504093a3f6e8\"\u003e\u003ccode\u003e5bed1e1\u003c/code\u003e\u003c/a\u003e Validate file hashes in release download script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c13ee10a429f1144779bb1cbf6ae3bec808ae9c1\"\u003e\u003ccode\u003ec13ee10\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.0.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.0.0...lxml-6.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 2.6.3 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3 is raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects \u003ca href=\"https://opencollective.com/urllib3\"\u003eplease consider contributing financially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been read and decompressed partially. (Reported by \u003ca href=\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or \u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed using the official \u003ca href=\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by \u003ca href=\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca href=\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed data buffered from previous partial reads. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the response after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt=0\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing \u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior of chunked request bodies. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling schemeless URIs were passed to \u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to accept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e, matching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling use with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed\nusing the official \u003ccode\u003eBrotli \u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763) \u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720) \u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979) \u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777) \u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636) \u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the\nresponse after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e Release 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e Fix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e Switch to nightly PyPy3.11 in CI for now (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e Avoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when \u003ccode\u003eamt=0\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e Bump dev dependencies (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e Upgrade mypy to version 1.20.2 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e Drop support for EOL PyPy3.10 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e Upgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix warnings (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/urllib3/urllib3/compare/2.6.3...2.7.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/GlacierEQ/ollama-deep-researcher/network/alerts).\n\n\u003c/details\u003e\n\n---\n\n🔄 This PR updates four Python dependencies (idna, langchain-core, lxml, urllib3) in the uv dependency group to their latest versions. The updates include important security fixes, particularly for lxml and urllib3, along with bug fixes and feature improvements across all packages.\n\n\u003cdetails\u003e\n\u003csummary\u003e🔍 \u003cstrong\u003eDetailed Analysis\u003c/strong\u003e\u003c/summary\u003e\n\n### Key Changes\n- **idna**: Updated from 3.10 to 3.15 with security fixes for CVE-2026-45409 and CVE-2026-45409, addressing quadratic time processing vulnerabilities\n- **langchain-core**: Updated from 1.3.0 to 1.3.3 with security hardening for `load()` function against untrusted manifests and improved tool handling\n- **lxml**: Updated from 6.0.0 to 6.1.0 fixing XXE vulnerability (CVE-2026-41066) in `iterparse()` and `ETCompatXMLParser`\n- **urllib3**: Updated from 2.6.3 to 2.7.0 addressing decompression-bomb bypass vulnerabilities and proxy header stripping issues\n\n### Technical Implementation\n```mermaid\nflowchart TD\n    A[Dependabot Scan] --\u003e B[Identify Updates]\n    B --\u003e C[Security Patches]\n    B --\u003e D[Feature Updates]\n    B --\u003e E[Bug Fixes]\n    C --\u003e F[idna: CVE fixes]\n    C --\u003e G[lxml: XXE protection]\n    C --\u003e H[urllib3: Decompression safeguards]\n    D --\u003e I[langchain-core: Tool improvements]\n    E --\u003e J[Various stability fixes]\n    F --\u003e K[Updated Dependencies]\n    G --\u003e K\n    H --\u003e K\n    I --\u003e K\n    J --\u003e K\n```\n\n### Impact\n- **Security Enhancement**: Critical vulnerabilities patched in idna, lxml, and urllib3 protecting against XXE attacks, quadratic time processing, and decompression bombs\n- **Stability Improvement**: Bug fixes across all packages improve reliability, particularly in HTTP response handling and XML parsing\n- **Feature Addition**: New capabilities like configurable chunk sizes in lxml and improved tool handling in langchain-core enhance functionality\n\n\u003c/details\u003e\n\n_Created with [Palmier](https://www.palmier.io)_","html_url":"https://github.com/GlacierEQ/ollama-deep-researcher/pull/1","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/GlacierEQ%2Follama-deep-researcher/issues/1","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/1/packages"},{"uuid":"4520522281","node_id":"PR_kwDOQkYl-s7fOJBz","number":290,"state":"closed","title":"chore(deps): Bump the python-minor group across 1 directory with 21 updates","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-06-03T05:24:22.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-26T01:14:57.000Z","updated_at":"2026-06-03T05:24:24.000Z","time_to_close":706165,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): Bump","group_name":"python-minor","update_count":21,"packages":[{"name":"fastapi","old_version":"0.136.1","new_version":"0.136.3","repository_url":"https://github.com/fastapi/fastapi"},{"name":"uvicorn","old_version":"0.46.0","new_version":"0.48.0","repository_url":"https://github.com/Kludex/uvicorn"},{"name":"python-multipart","old_version":"0.0.27","new_version":"0.0.29","repository_url":"https://github.com/Kludex/python-multipart"},{"name":"starlette","old_version":"1.0.0","new_version":"1.1.0","repository_url":"https://github.com/Kludex/starlette"},{"name":"sse-starlette","old_version":"3.4.1","new_version":"3.4.4","repository_url":"https://github.com/sysid/sse-starlette"},{"name":"sqlalchemy","old_version":"2.0.49","new_version":"2.0.50","repository_url":"https://github.com/sqlalchemy/sqlalchemy"},{"name":"greenlet","old_version":"3.5.0","new_version":"3.5.1","repository_url":"https://github.com/python-greenlet/greenlet"},{"name":"pyjwt","old_version":"2.12.1","new_version":"2.13.0","repository_url":"https://github.com/jpadilla/pyjwt"},{"name":"pydantic","old_version":"2.13.3","new_version":"2.13.4","repository_url":"https://github.com/pydantic/pydantic"},{"name":"pydantic-settings","old_version":"2.14.0","new_version":"2.14.1","repository_url":"https://github.com/pydantic/pydantic-settings"},{"name":"pandas","old_version":"3.0.2","new_version":"3.0.3","repository_url":"https://github.com/pandas-dev/pandas"},{"name":"google-cloud-aiplatform","old_version":"1.150.0","new_version":"1.153.1","repository_url":"https://github.com/googleapis/python-aiplatform"},{"name":"google-auth","old_version":"2.50.0","new_version":"2.53.0","repository_url":"https://github.com/googleapis/google-auth-library-python"},{"name":"anthropic","old_version":"0.45.2","new_version":"0.104.1","repository_url":"https://github.com/anthropics/anthropic-sdk-python"},{"name":"pgvector","old_version":"0.3.6","new_version":"0.4.2","repository_url":"https://github.com/pgvector/pgvector-python"},{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"},{"name":"orjson","old_version":"3.11.8","new_version":"3.11.9","repository_url":"https://github.com/ijl/orjson"},{"name":"sentry-sdk","old_version":"2.59.0","new_version":"2.60.0","repository_url":"https://github.com/getsentry/sentry-python"},{"name":"faker","old_version":"40.15.0","new_version":"40.19.1","repository_url":"https://github.com/joke2k/faker"},{"name":"black","old_version":"26.3.1","new_version":"26.5.1","repository_url":"https://github.com/psf/black"},{"name":"ruff","old_version":"0.15.12","new_version":"0.15.14","repository_url":"https://github.com/astral-sh/ruff"}],"path":null,"ecosystem":"pip"},"body":"Bumps the python-minor group with 21 updates in the /backend directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [fastapi](https://github.com/fastapi/fastapi) | `0.136.1` | `0.136.3` |\n| [uvicorn](https://github.com/Kludex/uvicorn) | `0.46.0` | `0.48.0` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.27` | `0.0.29` |\n| [starlette](https://github.com/Kludex/starlette) | `1.0.0` | `1.1.0` |\n| [sse-starlette](https://github.com/sysid/sse-starlette) | `3.4.1` | `3.4.4` |\n| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.49` | `2.0.50` |\n| [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.0` | `3.5.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.12.1` | `2.13.0` |\n| [pydantic](https://github.com/pydantic/pydantic) | `2.13.3` | `2.13.4` |\n| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.0` | `2.14.1` |\n| [pandas](https://github.com/pandas-dev/pandas) | `3.0.2` | `3.0.3` |\n| [google-cloud-aiplatform](https://github.com/googleapis/python-aiplatform) | `1.150.0` | `1.153.1` |\n| [google-auth](https://github.com/googleapis/google-auth-library-python) | `2.50.0` | `2.53.0` |\n| [anthropic](https://github.com/anthropics/anthropic-sdk-python) | `0.45.2` | `0.104.1` |\n| [pgvector](https://github.com/pgvector/pgvector-python) | `0.3.6` | `0.4.2` |\n| [lxml](https://github.com/lxml/lxml) | `6.1.0` | `6.1.1` |\n| [orjson](https://github.com/ijl/orjson) | `3.11.8` | `3.11.9` |\n| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.59.0` | `2.60.0` |\n| [faker](https://github.com/joke2k/faker) | `40.15.0` | `40.19.1` |\n| [black](https://github.com/psf/black) | `26.3.1` | `26.5.1` |\n| [ruff](https://github.com/astral-sh/ruff) | `0.15.12` | `0.15.14` |\n\n\nUpdates `fastapi` from 0.136.1 to 0.136.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/fastapi/fastapi/releases\"\u003efastapi's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.136.3\u003c/h2\u003e\n\u003ch3\u003eRefactors\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e♻️ Do not accept underscore headers when using \u003ccode\u003econvert_underscores=True\u003c/code\u003e (the default). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15589\"\u003e#15589\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.136.2\u003c/h2\u003e\n\u003ch3\u003eRefactors\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e♻️ Validate Server Sent Event fields to avoid applications from sending broken data. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15588\"\u003e#15588\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocs\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e📝 Document \u003ccode\u003e--entrypoint\u003c/code\u003e CLI option. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15464\"\u003e#15464\u003c/a\u003e by \u003ca href=\"https://github.com/YuriiMotov\"\u003e\u003ccode\u003e@​YuriiMotov\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update and simplify docs about help and management. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15583\"\u003e#15583\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Add docs references to central contributing docs. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15580\"\u003e#15580\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update security policy. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15577\"\u003e#15577\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🍱 Update sponsors: TalorData image. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15562\"\u003e#15562\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update docs, simplify usage of admonitions, only default ones. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15553\"\u003e#15553\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Fix image URLs in \u003ccode\u003eindex.md\u003c/code\u003e. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15534\"\u003e#15534\u003c/a\u003e by \u003ca href=\"https://github.com/YuriiMotov\"\u003e\u003ccode\u003e@​YuriiMotov\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e✏️ Fix Azkaban spelling typo in \u003ccode\u003evirtual-environments.md‎\u003c/code\u003e. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15463\"\u003e#15463\u003c/a\u003e by \u003ca href=\"https://github.com/isaacbernat\"\u003e\u003ccode\u003e@​isaacbernat\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e💄 Improve layout and styling. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15462\"\u003e#15462\u003c/a\u003e by \u003ca href=\"https://github.com/alejsdev\"\u003e\u003ccode\u003e@​alejsdev\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e💄 Refactor opinions section with interactive tabs and new logos. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15458\"\u003e#15458\u003c/a\u003e by \u003ca href=\"https://github.com/alejsdev\"\u003e\u003ccode\u003e@​alejsdev\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Add FastAPI Conf '26 announcement to docs. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15457\"\u003e#15457\u003c/a\u003e by \u003ca href=\"https://github.com/alejsdev\"\u003e\u003ccode\u003e@​alejsdev\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eTranslations\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e🌐 Improve translation consistency in \u003ccode\u003e‎docs/pt/docs/advanced/generate-clients.md‎\u003c/code\u003e. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15456\"\u003e#15456\u003c/a\u003e by \u003ca href=\"https://github.com/Will-thom\"\u003e\u003ccode\u003e@​Will-thom\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for ja (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15530\"\u003e#15530\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for uk (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15529\"\u003e#15529\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for pt (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15528\"\u003e#15528\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for de (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15527\"\u003e#15527\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for tr (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15526\"\u003e#15526\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for ko (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15525\"\u003e#15525\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for zh-hant (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15524\"\u003e#15524\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for fr (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15522\"\u003e#15522\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for es (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15523\"\u003e#15523\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for zh (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15520\"\u003e#15520\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for ru (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15521\"\u003e#15521\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Fix typos in Spanish LLM-prompt. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15472\"\u003e#15472\u003c/a\u003e by \u003ca href=\"https://github.com/crr004\"\u003e\u003ccode\u003e@​crr004\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eInternal\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e✅ Update tests, don't double dispose the engine. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15587\"\u003e#15587\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⚡️ Speed up test suite via caching and fixture scopes to make it ~24% faster. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/13583\"\u003e#13583\u003c/a\u003e by \u003ca href=\"https://github.com/dikos1337\"\u003e\u003ccode\u003e@​dikos1337\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔥 Remove config files now in central GitHub repo. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15585\"\u003e#15585\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump urllib3 from 2.6.3 to 2.7.0. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15502\"\u003e#15502\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump idna from 3.11 to 3.15. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15565\"\u003e#15565\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump cloudflare/wrangler-action from 3.15.0 to 4.0.0. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15571\"\u003e#15571\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔧 Migrate docs from MkDocs to Zensical. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15563\"\u003e#15563\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔒️ Only allow team members to modify dependencies. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15548\"\u003e#15548\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/82064857539e6286522c347b4b11331b48dd2378\"\u003e\u003ccode\u003e8206485\u003c/code\u003e\u003c/a\u003e 🔖 Release version 0.136.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/c910e0139f983d0e04e2d1d235cd71803afeae34\"\u003e\u003ccode\u003ec910e01\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/063b5bf582d31fb155cc6bc6f88cf512329d0fd5\"\u003e\u003ccode\u003e063b5bf\u003c/code\u003e\u003c/a\u003e ♻️ Do not accept underscore headers when using \u003ccode\u003econvert_underscores=True\u003c/code\u003e (th...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/22b02e26f9e8c7e32bd8266e2b0ebe8bb3a0db2b\"\u003e\u003ccode\u003e22b02e2\u003c/code\u003e\u003c/a\u003e 🔖 Release version 0.136.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/3b252a2a22ba27a8ab83d6bde7d9cddbc5bf738e\"\u003e\u003ccode\u003e3b252a2\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/c7fb7851b3389f24c51701d705458989be53ccbb\"\u003e\u003ccode\u003ec7fb785\u003c/code\u003e\u003c/a\u003e ♻️ Validate Server Sent Event fields to avoid applications from sending broke...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/cb83b83dcf78eab4ea17d504db5abcda705fbdc4\"\u003e\u003ccode\u003ecb83b83\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/00f805cec94c0bf48c1f9a563535a3ab2e6f90ab\"\u003e\u003ccode\u003e00f805c\u003c/code\u003e\u003c/a\u003e ✅ Update tests, don't double dispose the engine (\u003ca href=\"https://redirect.github.com/fastapi/fastapi/issues/15587\"\u003e#15587\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/3675137523dc167981aa3a3c44599b4f3079ccd8\"\u003e\u003ccode\u003e3675137\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/7b57e42986bb4d40c9eb6580537d13fb8e76097e\"\u003e\u003ccode\u003e7b57e42\u003c/code\u003e\u003c/a\u003e 📝 Document \u003ccode\u003e--entrypoint\u003c/code\u003e CLI option (\u003ca href=\"https://redirect.github.com/fastapi/fastapi/issues/15464\"\u003e#15464\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/fastapi/fastapi/compare/0.136.1...0.136.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `uvicorn` from 0.46.0 to 0.48.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/uvicorn/releases\"\u003euvicorn's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 0.48.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDefault \u003ccode\u003essl_ciphers\u003c/code\u003e to \u003ccode\u003eNone\u003c/code\u003e and use OpenSSL defaults by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/uvicorn/pull/2940\"\u003eKludex/uvicorn#2940\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIgnore duplicate forwarding headers in \u003ccode\u003eProxyHeadersMiddleware\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/uvicorn/pull/2944\"\u003eKludex/uvicorn#2944\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/uvicorn/compare/0.47.0...0.48.0\"\u003ehttps://github.com/Kludex/uvicorn/compare/0.47.0...0.48.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 0.47.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEagerly import the ASGI app in the parent process by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/uvicorn/pull/2919\"\u003eKludex/uvicorn#2919\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003essl_context_factory\u003c/code\u003e for custom \u003ccode\u003eSSLContext\u003c/code\u003e configuration by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/uvicorn/pull/2920\"\u003eKludex/uvicorn#2920\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eTreat \u003ccode\u003efd=0\u003c/code\u003e as a valid file descriptor with reload/workers by \u003ca href=\"https://github.com/eltoder\"\u003e\u003ccode\u003e@​eltoder\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/uvicorn/pull/2927\"\u003eKludex/uvicorn#2927\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/uvicorn/compare/0.46.0...0.47.0\"\u003ehttps://github.com/Kludex/uvicorn/compare/0.46.0...0.47.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md\"\u003euvicorn's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.48.0 (May 24, 2026)\u003c/h2\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDefault \u003ccode\u003essl_ciphers\u003c/code\u003e to \u003ccode\u003eNone\u003c/code\u003e and use OpenSSL defaults (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2940\"\u003e#2940\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore duplicate forwarding headers in \u003ccode\u003eProxyHeadersMiddleware\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.47.0 (May 14, 2026)\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003essl_context_factory\u003c/code\u003e for custom \u003ccode\u003eSSLContext\u003c/code\u003e configuration (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2920\"\u003e#2920\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEagerly import the ASGI app in the parent process (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2919\"\u003e#2919\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eTreat \u003ccode\u003efd=0\u003c/code\u003e as a valid file descriptor with reload/workers (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2927\"\u003e#2927\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/73e84e58d7f6b8b3dfd8a9e3e42d716862250f33\"\u003e\u003ccode\u003e73e84e5\u003c/code\u003e\u003c/a\u003e Version 0.48.0 (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2951\"\u003e#2951\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/45ea11690b4a62fa6df339d2b6ee3b8545a418e0\"\u003e\u003ccode\u003e45ea116\u003c/code\u003e\u003c/a\u003e Ignore duplicate forwarding headers in \u003ccode\u003eProxyHeadersMiddleware\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/dd4394c3cbfd9f27a696a7b08047149690058158\"\u003e\u003ccode\u003edd4394c\u003c/code\u003e\u003c/a\u003e chore(deps): bump idna from 3.11 to 3.15 (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2941\"\u003e#2941\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/abe07818a191cd036dc3824d802d052207e01c7e\"\u003e\u003ccode\u003eabe0781\u003c/code\u003e\u003c/a\u003e Default \u003ccode\u003essl_ciphers\u003c/code\u003e to \u003ccode\u003eNone\u003c/code\u003e and use OpenSSL defaults (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2940\"\u003e#2940\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/479a2c0c89186714f1aac52aecdebebf271395ac\"\u003e\u003ccode\u003e479a2c0\u003c/code\u003e\u003c/a\u003e Version 0.47.0 (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2937\"\u003e#2937\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/89347fd166ebedf98fb3f806ce8ea44e93b1c2b5\"\u003e\u003ccode\u003e89347fd\u003c/code\u003e\u003c/a\u003e Add 7-day cooldown for dependency resolution via uv exclude-newer (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2936\"\u003e#2936\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/767315b38ae509cee9fe8ee9d09f6da920536096\"\u003e\u003ccode\u003e767315b\u003c/code\u003e\u003c/a\u003e Drop unused contents/actions permissions from zizmor workflow (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2935\"\u003e#2935\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/f25ee43e68a9678453cbca99ad96f1a447ff34af\"\u003e\u003ccode\u003ef25ee43\u003c/code\u003e\u003c/a\u003e chore(deps): bump urllib3 from 2.6.3 to 2.7.0 (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2933\"\u003e#2933\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/8782666189a3d36c978de5698620db705659bf44\"\u003e\u003ccode\u003e8782666\u003c/code\u003e\u003c/a\u003e Fix typo in \u003ccode\u003edocs/deployment/index.md\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2932\"\u003e#2932\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/ad5ff87c869e8a34e9b04fcd5ca38d65c526893c\"\u003e\u003ccode\u003ead5ff87\u003c/code\u003e\u003c/a\u003e Treat \u003ccode\u003efd=0\u003c/code\u003e as a valid file descriptor with reload/workers (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2927\"\u003e#2927\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/Kludex/uvicorn/compare/0.46.0...0.48.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `python-multipart` from 0.0.27 to 0.0.29\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/python-multipart/releases\"\u003epython-multipart's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 0.0.29\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eHandle malformed RFC 2231 continuations in \u003ccode\u003eparse_options_header\u003c/code\u003e by \u003ca href=\"https://github.com/manunio\"\u003e\u003ccode\u003e@​manunio\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/python-multipart/pull/270\"\u003eKludex/python-multipart#270\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/python-multipart/compare/0.0.28...0.0.29\"\u003ehttps://github.com/Kludex/python-multipart/compare/0.0.28...0.0.29\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 0.0.28\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSpeed up partial-boundary tail scan via \u003ccode\u003ebytes.find\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/python-multipart/pull/281\"\u003eKludex/python-multipart#281\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCap multipart boundary length at 256 bytes by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/python-multipart/pull/282\"\u003eKludex/python-multipart#282\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.28\"\u003ehttps://github.com/Kludex/python-multipart/compare/0.0.27...0.0.28\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md\"\u003epython-multipart's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.0.29 (2026-05-17)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eHandle malformed RFC 2231 continuations in \u003ccode\u003eparse_options_header\u003c/code\u003e \u003ca href=\"https://redirect.github.com/Kludex/python-multipart/pull/270\"\u003e#270\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.0.28 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSpeed up partial-boundary tail scan via \u003ccode\u003ebytes.find\u003c/code\u003e \u003ca href=\"https://redirect.github.com/Kludex/python-multipart/pull/281\"\u003e#281\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eCap multipart boundary length at 256 bytes \u003ca href=\"https://redirect.github.com/Kludex/python-multipart/pull/282\"\u003e#282\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/e3d6853978b91b77e9739d47389124d633894c39\"\u003e\u003ccode\u003ee3d6853\u003c/code\u003e\u003c/a\u003e Version 0.0.29 (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/288\"\u003e#288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/a60dcdcb34d55b396ced6f5bdb1d1e6df84832ae\"\u003e\u003ccode\u003ea60dcdc\u003c/code\u003e\u003c/a\u003e Handle malformed RFC 2231 continuations in \u003ccode\u003eparse_options_header\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/270\"\u003e#270\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/75c33b24d91f1e3c65b597832984d6c46d1a38df\"\u003e\u003ccode\u003e75c33b2\u003c/code\u003e\u003c/a\u003e Add 7-day cooldown for dependency resolution via uv exclude-newer (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/286\"\u003e#286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/a078b8ef00474c3f3a6cf750cd092cf880354a11\"\u003e\u003ccode\u003ea078b8e\u003c/code\u003e\u003c/a\u003e Bump urllib3 from 2.6.3 to 2.7.0 (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/285\"\u003e#285\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/7d8d28b210ac6cb055399562b0dc0e5cf9aef14a\"\u003e\u003ccode\u003e7d8d28b\u003c/code\u003e\u003c/a\u003e Version 0.0.28 (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/284\"\u003e#284\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/b0dd125457d0f98de23bf2f894aedb1a54639d4e\"\u003e\u003ccode\u003eb0dd125\u003c/code\u003e\u003c/a\u003e Cap multipart boundary length at 256 bytes (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/282\"\u003e#282\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/d1b57392cf7d0c19235ba454eb5686fd27dc2384\"\u003e\u003ccode\u003ed1b5739\u003c/code\u003e\u003c/a\u003e Speed up partial-boundary tail scan via \u003ccode\u003ebytes.find\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/281\"\u003e#281\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/09cb8c3da7638d45ecdf7c154832303214bba829\"\u003e\u003ccode\u003e09cb8c3\u003c/code\u003e\u003c/a\u003e Make the long_boundary benchmark dominated by the patched code path (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/280\"\u003e#280\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/a6467c93c14aa4b09ef65450ead8011c45e5c7a0\"\u003e\u003ccode\u003ea6467c9\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;Switch CodSpeed benchmarks to walltime mode\u0026quot; (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/279\"\u003e#279\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/9a9690035a956fbdcca06f98461244cf790375a7\"\u003e\u003ccode\u003e9a96900\u003c/code\u003e\u003c/a\u003e Switch CodSpeed benchmarks to walltime mode (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/278\"\u003e#278\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.29\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `starlette` from 1.0.0 to 1.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/starlette/releases\"\u003estarlette's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 1.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUse \u003ccode\u003e\u0026quot;application/octet-stream\u0026quot;\u003c/code\u003e as the \u003ccode\u003eFileResponse\u003c/code\u003e media type fallback by \u003ca href=\"https://github.com/ATOM00blue\"\u003e\u003ccode\u003e@​ATOM00blue\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3283\"\u003eKludex/starlette#3283\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOnly dispatch standard HTTP verbs in \u003ccode\u003eHTTPEndpoint\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3286\"\u003eKludex/starlette#3286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReject absolute paths in \u003ccode\u003eStaticFiles.lookup_path\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3287\"\u003eKludex/starlette#3287\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ATOM00blue\"\u003e\u003ccode\u003e@​ATOM00blue\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3283\"\u003eKludex/starlette#3283\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/1.0.1...1.1.0\"\u003ehttps://github.com/Kludex/starlette/compare/1.0.1...1.1.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 1.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore malformed \u003ccode\u003eHost\u003c/code\u003e header when constructing \u003ccode\u003erequest.url\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3279\"\u003eKludex/starlette#3279\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/1.0.0...1.0.1\"\u003ehttps://github.com/Kludex/starlette/compare/1.0.0...1.0.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/starlette/blob/main/docs/release-notes.md\"\u003estarlette's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.1.0 (May 23, 2026)\u003c/h2\u003e\n\u003ch4\u003eAdded\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eUse \u003ccode\u003e\u0026quot;application/octet-stream\u0026quot;\u003c/code\u003e as the \u003ccode\u003eFileResponse\u003c/code\u003e media type fallback \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3283\"\u003e#3283\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eOnly dispatch standard HTTP verbs in \u003ccode\u003eHTTPEndpoint\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3286\"\u003e#3286\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eReject absolute paths in \u003ccode\u003eStaticFiles.lookup_path\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3287\"\u003e#3287\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.0.1 (May 21, 2026)\u003c/h2\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore malformed \u003ccode\u003eHost\u003c/code\u003e header when constructing \u003ccode\u003erequest.url\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3279\"\u003e#3279\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/a4ff83b1aacaf8955e241dd00444c27823be163a\"\u003e\u003ccode\u003ea4ff83b\u003c/code\u003e\u003c/a\u003e Version 1.1.0 (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3289\"\u003e#3289\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5\"\u003e\u003ccode\u003efd53168\u003c/code\u003e\u003c/a\u003e Reject absolute paths in \u003ccode\u003eStaticFiles.lookup_path\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3287\"\u003e#3287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/e3f972225adb1d84b80dba132f520cc24cb84229\"\u003e\u003ccode\u003ee3f9722\u003c/code\u003e\u003c/a\u003e Only dispatch standard HTTP verbs in \u003ccode\u003eHTTPEndpoint\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3286\"\u003e#3286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/348f86dc92fed6e3c0314154e38deec90a6bcabd\"\u003e\u003ccode\u003e348f86d\u003c/code\u003e\u003c/a\u003e Use \u003ccode\u003e\u0026quot;application/octet-stream\u0026quot;\u003c/code\u003e as the \u003ccode\u003eFileResponse\u003c/code\u003e media type fallback (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/48f8e331b23ca692f4713ac1f370bff1b5cd034c\"\u003e\u003ccode\u003e48f8e33\u003c/code\u003e\u003c/a\u003e Version 1.0.1 (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3281\"\u003e#3281\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/f078832be1aa27ab0e7ec3153479a347749e967a\"\u003e\u003ccode\u003ef078832\u003c/code\u003e\u003c/a\u003e Remove Hugging Face sponsor block from docs (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3280\"\u003e#3280\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/472951eba8f6e35be845fd1b91625a1b5488294b\"\u003e\u003ccode\u003e472951e\u003c/code\u003e\u003c/a\u003e chore(deps): bump the github-actions group with 2 updates (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3277\"\u003e#3277\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6\"\u003e\u003ccode\u003e764dab0\u003c/code\u003e\u003c/a\u003e Ignore malformed \u003ccode\u003eHost\u003c/code\u003e header when constructing \u003ccode\u003erequest.url\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3279\"\u003e#3279\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/19d08115ce56da8d4da2838ecdd9c5882cb2b365\"\u003e\u003ccode\u003e19d0811\u003c/code\u003e\u003c/a\u003e Harden GitHub Actions workflows and Dependabot config (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3276\"\u003e#3276\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/01f46378120fe2c6312074ed7e997e3b5f7d8c20\"\u003e\u003ccode\u003e01f4637\u003c/code\u003e\u003c/a\u003e chore(deps): bump idna from 3.10 to 3.15 (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3274\"\u003e#3274\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/Kludex/starlette/compare/1.0.0...1.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `sse-starlette` from 3.4.1 to 3.4.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/sysid/sse-starlette/releases\"\u003esse-starlette's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.4.4\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/sysid/sse-starlette/compare/v3.4.3...v3.4.4\"\u003ehttps://github.com/sysid/sse-starlette/compare/v3.4.3...v3.4.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.4.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): bump granian from 2.6.0 to 2.7.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/sysid/sse-starlette/pull/185\"\u003esysid/sse-starlette#185\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump urllib3 from 2.6.3 to 2.7.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/sysid/sse-starlette/pull/186\"\u003esysid/sse-starlette#186\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/sysid/sse-starlette/compare/v3.4.2...v3.4.3\"\u003ehttps://github.com/sysid/sse-starlette/compare/v3.4.2...v3.4.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.4.2\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/sysid/sse-starlette/compare/v3.4.1...v3.4.2\"\u003ehttps://github.com/sysid/sse-starlette/compare/v3.4.1...v3.4.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/e0933950b83ab99575b34b3641cd7f88b62e11c2\"\u003e\u003ccode\u003ee093395\u003c/code\u003e\u003c/a\u003e Bump version to 3.4.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/a6799e1063bd2c102336b8963a288736b0588972\"\u003e\u003ccode\u003ea6799e1\u003c/code\u003e\u003c/a\u003e new release workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/d033a9755865b1521baf5d7f4b9ce6c5b4b2c843\"\u003e\u003ccode\u003ed033a97\u003c/code\u003e\u003c/a\u003e Bump version to 3.4.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/6a34c6aa05037b4b63864384bc61f7e855d18008\"\u003e\u003ccode\u003e6a34c6a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/sysid/sse-starlette/issues/186\"\u003e#186\u003c/a\u003e from sysid/dependabot/uv/urllib3-2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/e0be426235833f4d5084669bbba947193a2720e0\"\u003e\u003ccode\u003ee0be426\u003c/code\u003e\u003c/a\u003e chore(deps): bump urllib3 from 2.6.3 to 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/d8d43ab64b1090644ae42c4c2a4d361947296a26\"\u003e\u003ccode\u003ed8d43ab\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/sysid/sse-starlette/issues/185\"\u003e#185\u003c/a\u003e from sysid/dependabot/uv/granian-2.7.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/5854ac05f8f0170d7e4ccfd9b28a681f96038913\"\u003e\u003ccode\u003e5854ac0\u003c/code\u003e\u003c/a\u003e chore(deps): bump granian from 2.6.0 to 2.7.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/1d56ff3c33cd2544908890ecb3ff4ca2d55c2ee3\"\u003e\u003ccode\u003e1d56ff3\u003c/code\u003e\u003c/a\u003e Bump version to 3.4.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/8387e1155ae38552dc8064d85cf1d75c8700827f\"\u003e\u003ccode\u003e8387e11\u003c/code\u003e\u003c/a\u003e update pyproject.toml\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/sysid/sse-starlette/compare/v3.4.1...v3.4.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `sqlalchemy` from 2.0.49 to 2.0.50\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/sqlalchemy/sqlalchemy/releases\"\u003esqlalchemy's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.0.50\u003c/h1\u003e\n\u003cp\u003eReleased: May 24, 2026\u003c/p\u003e\n\u003ch2\u003eorm\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e[orm] [bug]\u003c/strong\u003e Fixed issue where using \u003ccode\u003e_orm.joinedload()\u003c/code\u003e with\n\u003ccode\u003ePropComparator.of_type()\u003c/code\u003e targeting a joined-table subclass combined\nwith \u003ccode\u003ePropComparator.and_()\u003c/code\u003e referencing a column on that subclass\nwould generate invalid SQL, where the subclass column was not adapted to\nthe subquery alias.  Pull request courtesy Joaquin Hui Gomez.\u003c/p\u003e\n\u003cp\u003eReferences: \u003ca href=\"https://www.sqlalchemy.org/trac/ticket/13203\"\u003e#13203\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e[orm] [bug]\u003c/strong\u003e Fixed issue where the presence of a \u003ccode\u003eSessionEvents.do_orm_execute()\u003c/code\u003e\nevent hook would cause internal execution options such as \u003ccode\u003eyield_per\u003c/code\u003e and\nloader-specific state from the first \u003ccode\u003eorm_pre_session_exec\u003c/code\u003e pass to leak\ninto the second pass, leading to errors when using relationship loaders\nsuch as \u003ccode\u003eselectinload()\u003c/code\u003e and \u003ccode\u003eimmediateload()\u003c/code\u003e.  The execution\noptions passed to the second compilation pass are now based on the original\noptions plus only the explicit updates made via\n\u003ccode\u003eORMExecuteState.update_execution_options()\u003c/code\u003e within the event hook.\u003c/p\u003e\n\u003cp\u003eReferences: \u003ca href=\"https://www.sqlalchemy.org/trac/ticket/13301\"\u003e#13301\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e[orm] [bug]\u003c/strong\u003e Fixed issue where using \u003ccode\u003e_orm.with_polymorphic()\u003c/code\u003e on a leaf class (a\nsubclass with no further descendants) or a non-inherited class would fail\nwith an \u003ccode\u003eAttributeError\u003c/code\u003e when used in an ORM statement, due to\n\u003ccode\u003e_orm.configure_mappers()\u003c/code\u003e not being triggered implicitly. The fix\nensures that \u003ccode\u003eAliasedInsp\u003c/code\u003e participates in the \u003ccode\u003e_post_inspect\u003c/code\u003e\nhook, triggering mapper configuration during ORM statement compilation.\u003c/p\u003e\n\u003cp\u003eReferences: \u003ca href=\"https://www.sqlalchemy.org/trac/ticket/13319\"\u003e#13319\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003esql\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e[sql] [bug]\u003c/strong\u003e Fixed issue where floor division (\u003ccode\u003e//\u003c/code\u003e) between a \u003ccode\u003eFloat\u003c/code\u003e or\n\u003ccode\u003eNumeric\u003c/code\u003e numerator and an \u003ccode\u003eInteger\u003c/code\u003e denominator would omit\nthe \u003ccode\u003eFLOOR()\u003c/code\u003e SQL wrapper on dialects where\n\u003ccode\u003eDialect.div_is_floordiv\u003c/code\u003e is \u003ccode\u003eTrue\u003c/code\u003e (the default, including\nPostgreSQL and SQLite).  \u003ccode\u003eFLOOR()\u003c/code\u003e is now applied if either the\ndenominator or the numerator is a non-integer, so that expressions such as\n\u003ccode\u003efloat_col // int_col\u003c/code\u003e render as \u003ccode\u003eFLOOR(float_col / int_col)\u003c/code\u003e instead\nof the incorrect \u003ccode\u003efloat_col / int_col\u003c/code\u003e.  Pull request courtesy r266-tech.\u003c/p\u003e\n\u003cp\u003eReferences: \u003ca href=\"https://www.sqlalchemy.org/trac/ticket/10528\"\u003e#10528\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003epostgresql\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/sqlalchemy/sqlalchemy/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `greenlet` from 3.5.0 to 3.5.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst\"\u003egreenlet's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e3.5.1 (2026-05-20)\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eAdd preliminary support for Python 3.15b1. This has not been\nreviewed by CPython core developers, but all tests pass. Binary\nwheels of this version won't work on earlier Python 3.15 builds and\nmay not work on later 3.15 builds.\u003c/li\u003e\n\u003cli\u003eFix the discrepancy in the way the two \u003ccode\u003egetcurrent\u003c/code\u003e APIs behave\nduring greenlet teardown. One API (the C API used by, e.g.,  gevent) raised a\n\u003ccode\u003eRuntimeError\u003c/code\u003e; the other (the Python \u003ccode\u003egreenlet.getcurrent\u003c/code\u003e API)\nreturned \u003ccode\u003eNone\u003c/code\u003e. This second way is incompatible with greenlet's type\nannotations, so \u003ccode\u003egreenlet.getcurrent\u003c/code\u003e now raises a\n\u003ccode\u003eRuntimeError\u003c/code\u003e as well.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-greenlet/greenlet/commit/b5e5fc43a51c27ecffa1b1c7107c91464a6b26e2\"\u003e\u003ccode\u003eb5e5fc4\u003c/code\u003e\u003c/a\u003e Preparing release 3.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-greenlet/greenlet/commit/c8e177413d34bc36ed56d2c185c232ab0538be90\"\u003e\u003ccode\u003ec8e1774\u003c/code\u003e\u003c/a\u003e Tweak wording in CHANGES about greenlet.getcurrent.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-greenlet/greenlet/commit/7fb10c570f37b3eb4c8909c6164fdfac3269ddb6\"\u003e\u003ccode\u003e7fb10c5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/python-greenlet/greenlet/issues/510\"\u003e#510\u003c/a\u003e from python-greenlet/315\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-greenlet/greenlet/commit/9718ce5a23ea3360232b78a806a837d6c3d6183d\"\u003e\u003ccode\u003e9718ce5\u003c/code\u003e\u003c/a\u003e Add Py 3.15; make both API versions of getcurrent() consistent in raising Run...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-greenlet/greenlet/commit/276e08afc4ddba87e4366390e3eeaecd61ccb3b8\"\u003e\u003ccode\u003e276e08a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/python-greenlet/greenlet/issues/509\"\u003e#509\u003c/a\u003e from python-greenlet/dependabot/github_actions/github...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-greenlet/greenlet/commit/32b0ad69828eb69d879c70dbee948e685268901b\"\u003e\u003ccode\u003e32b0ad6\u003c/code\u003e\u003c/a\u003e Bump pypa/gh-action-pypi-publish in the github-actions group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-greenlet/greenlet/commit/173b692dc84288ef41572612ac744754f98eaa90\"\u003e\u003ccode\u003e173b692\u003c/code\u003e\u003c/a\u003e Back to development: 3.5.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/python-greenlet/greenlet/compare/3.5.0...3.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pyjwt` from 2.12.1 to 2.13.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/releases\"\u003epyjwt's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.13.0\u003c/h2\u003e\n\u003ch1\u003ePyJWT 2.13.0 — Security Release\u003c/h1\u003e\n\u003cp\u003eThis release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\"\u003e\u003ccode\u003eGHSA-xgmm-8j9v-c9wx\u003c/code\u003e\u003c/a\u003e — JWK JSON accepted as HMAC secret (algorithm confusion).\u003c/strong\u003e \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in \u003ccode\u003ealgorithms=[…]\u003c/code\u003e and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. \u003cem\u003eReported by \u003ca href=\"https://github.com/aradona91\"\u003e\u003ccode\u003e@​aradona91\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\"\u003e\u003ccode\u003eGHSA-jq35-7prp-9v3f\u003c/code\u003e\u003c/a\u003e — Algorithm allow-list bypass with \u003ccode\u003ePyJWK\u003c/code\u003e / \u003ccode\u003ePyJWKClient\u003c/code\u003e.\u003c/strong\u003e When verifying with a \u003ccode\u003ePyJWK\u003c/code\u003e, the caller's \u003ccode\u003ealgorithms=[…]\u003c/code\u003e allow-list was checked against the token header \u003ccode\u003ealg\u003c/code\u003e as a string only; actual verification used the algorithm bound to the \u003ccode\u003ePyJWK\u003c/code\u003e. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header \u003ccode\u003ealg\u003c/code\u003e to match the \u003ccode\u003ePyJWK\u003c/code\u003e's algorithm before verification. \u003cem\u003eReported by \u003ca href=\"https://github.com/sushi-gif\"\u003e\u003ccode\u003e@​sushi-gif\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\"\u003e\u003ccode\u003eGHSA-w7vc-732c-9m39\u003c/code\u003e\u003c/a\u003e — DoS via base64 decode of unused payload segment when \u003ccode\u003eb64=false\u003c/code\u003e.\u003c/strong\u003e For detached-payload JWS (\u003ccode\u003eb64=false\u003c/code\u003e), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied \u003ccode\u003edetached_payload\u003c/code\u003e. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. \u003cem\u003eReported by \u003ca href=\"https://github.com/thesmartshadow\"\u003e\u003ccode\u003e@​thesmartshadow\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\"\u003e\u003ccode\u003eGHSA-993g-76c3-p5m4\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e accepts non-HTTP(S) URIs.\u003c/strong\u003e \u003ccode\u003ePyJWKClient.fetch_data\u003c/code\u003e passed its URI to \u003ccode\u003eurllib.request.urlopen\u003c/code\u003e, which by default also handles \u003ccode\u003efile://\u003c/code\u003e, \u003ccode\u003eftp://\u003c/code\u003e, and \u003ccode\u003edata:\u003c/code\u003e schemes. An application that fed an attacker-influenced URI into \u003ccode\u003ePyJWKClient\u003c/code\u003e could be coerced into reading local files or reaching other unintended schemes. \u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects any URI whose scheme isn't \u003ccode\u003ehttp\u003c/code\u003e or \u003ccode\u003ehttps\u003c/code\u003e. \u003cem\u003eReported by \u003ca href=\"https://github.com/KEIJOT\"\u003e\u003ccode\u003e@​KEIJOT\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\"\u003e\u003ccode\u003eGHSA-fhv5-28vv-h8m8\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e cache wiped on fetch error.\u003c/strong\u003e A \u003ccode\u003efinally\u003c/code\u003e-block \u003ccode\u003eput(jwk_set=None)\u003c/code\u003e cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. \u003cem\u003eReported by \u003ca href=\"https://github.com/eddieran\"\u003e\u003ccode\u003e@​eddieran\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReject empty HMAC keys outright in \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e with \u003ccode\u003eInvalidKeyError\u003c/code\u003e instead of accepting them with only a warning. Defends against the \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e footgun. \u003cem\u003eThanks to \u003ca href=\"https://github.com/SnailSploit\"\u003e\u003ccode\u003e@​SnailSploit\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"https://github.com/spartan8806\"\u003e\u003ccode\u003e@​spartan8806\u003c/code\u003e\u003c/a\u003e for the reports.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003eForward per-call \u003ccode\u003eoptions\u003c/code\u003e (including \u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e) from \u003ccode\u003ePyJWT.decode\u003c/code\u003e through to \u003ccode\u003ePyJWS._verify_signature\u003c/code\u003e. The option was previously silently dropped between the two layers, so it only took effect when set on the \u003ccode\u003ePyJWT\u003c/code\u003e instance. \u003cem\u003eThanks to \u003ca href=\"https://github.com/WLUB\"\u003e\u003ccode\u003e@​WLUB\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRFC 7797 §3 compliance for \u003ccode\u003eb64=false\u003c/code\u003e:\u003c/strong\u003e the encoder now auto-adds \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e to \u003ccode\u003ecrit\u003c/code\u003e, and the decoder rejects tokens that set \u003ccode\u003eb64=false\u003c/code\u003e without listing it in \u003ccode\u003ecrit\u003c/code\u003e. \u003cem\u003eThanks to \u003ca href=\"https://github.com/MachineLearning-Nerd\"\u003e\u003ccode\u003e@​MachineLearning-Nerd\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eChanged\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups, by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/pull/1152\"\u003e#1152\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eUpgrade notes\u003c/h2\u003e\n\u003cp\u003eMost fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eEmpty HMAC keys now raise.\u003c/strong\u003e If your app passed \u003ccode\u003e\u0026quot;\u0026quot;\u003c/code\u003e or \u003ccode\u003eb\u0026quot;\u0026quot;\u003c/code\u003e as a secret (often via a missing env var, e.g. \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e), \u003ccode\u003eencode\u003c/code\u003e/\u003ccode\u003edecode\u003c/code\u003e will now raise \u003ccode\u003eInvalidKeyError\u003c/code\u003e. This is the intended behavior — fix the configuration.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWK\u003c/code\u003e decoding now requires the token's \u003ccode\u003ealg\u003c/code\u003e to match the JWK's algorithm.\u003c/strong\u003e Previously a mismatch was silently honored if the header \u003ccode\u003ealg\u003c/code\u003e appeared in the allow-list. Tokens that relied on this mismatch will now fail with \u003ccode\u003eInvalidAlgorithmError\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects non-HTTP(S) URIs at construction time.\u003c/strong\u003e Tests or dev environments that fetched JWKS from \u003ccode\u003efile://\u003c/code\u003e URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct \u003ccode\u003ePyJWKSet.from_dict(...)\u003c/code\u003e directly).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eb64=false\u003c/code\u003e tokens are now strictly RFC 7515 / 7797 compliant.\u003c/strong\u003e Tokens with a non-empty compact-form payload segment, or that omit \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e from \u003ccode\u003ecrit\u003c/code\u003e, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e set per-call now takes effect.\u003c/strong\u003e Callers who passed \u003ccode\u003eoptions={\u0026quot;enforce_minimum_key_length\u0026quot;: True}\u003c/code\u003e to \u003ccode\u003ejwt.decode()\u003c/code\u003e previously got no enforcement; they will now get \u003ccode\u003eInvalidKeyError\u003c/code\u003e on undersized keys, as documented.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull changelog:\u003c/strong\u003e \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\"\u003ehttps://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst\"\u003epyjwt's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ccode\u003ev2.13.0 \u0026lt;https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u0026gt;\u003c/code\u003e__\u003c/h2\u003e\n\u003cp\u003eSecurity\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject JWK JSON documents passed as raw HMAC secrets in\n  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that\n  the existing PEM/SSH guard did not cover. Reported by @aradona91 in\n  `GHSA-xgmm-8j9v-c9wx \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\u0026gt;`__.\n- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during\n  verification so the caller's ``algorithms=[...]`` allow-list cannot be\n  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported\n  by @sushi-gif in `GHSA-jq35-7prp-9v3f \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\u0026gt;`__.\n- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-\n  influenced URIs cannot read local files or reach unintended schemes via\n  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported\n  by @KEIJOT in `GHSA-993g-76c3-p5m4 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\u0026gt;`__.\n- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.\n  The previous ``finally``-block ``put(None)`` pattern cleared the cache\n  on any transient outage, turning one bad JWKS request into application-\n  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\u0026gt;`__.\n- Skip the unconditional base64 decode of the compact-form payload segment\n  when ``b64=false`` is set in the protected header, and require that\n  segment to be empty (RFC 7515 Appendix F detached form). Closes an\n  unauthenticated DoS amplifier. Reported by @thesmartshadow in\n  `GHSA-w7vc-732c-9m39 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\u0026gt;`__.\n\u003cp\u003eFixed\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with\n  ``InvalidKeyError`` instead of accepting them with only a warning.\n  Thanks to @SnailSploit and @spartan8806 for independently flagging the\n  footgun.\n- Forward per-call ``options`` (including ``enforce_minimum_key_length``)\n  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the\n  option actually takes effect when set at the call site rather than only\n  on the ``PyJWT`` instance. Thanks to @WLUB for the report.\n- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds\n  ``\u0026amp;quot;b64\u0026amp;quot;`` to the ``crit`` header parameter, and the decoder rejects\n  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to\n  @MachineLearning-Nerd for the report.\n\nChanged\n\u003c/code\u003e\u003c/pre\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ccode\u003e[#1152](https://github.com/jpadilla/pyjwt/issues/1152) \u0026amp;lt;https://github.com/jpadilla/pyjwt/pull/1152\u0026amp;gt;\u003c/code\u003e__\n\u003c/code\u003e\u003c/pre\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff\"\u003e\u003ccode\u003e7144e45\u003c/code\u003e\u003c/a\u003e Apply ruff format\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab\"\u003e\u003ccode\u003ed2f4bec\u003c/code\u003e\u003c/a\u003e Restore \u003ccode\u003ecast()\u003c/code\u003e calls with cross-version \u003ccode\u003etype: ignore\u003c/code\u003e for \u003ccode\u003eprepare_key\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774\"\u003e\u003ccode\u003e22f478c\u003c/code\u003e\u003c/a\u003e Remove redundant casts in \u003ccode\u003eRSAAlgorithm.prepare_key\u003c/code\u003e and `ECAlgorithm.prepare...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81\"\u003e\u003ccode\u003e95791b1\u003c/code\u003e\u003c/a\u003e Bundle security fixes and hardening into 2.13.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508\"\u003e\u003ccode\u003edcc27a9\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1155\"\u003e#1155\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a\"\u003e\u003ccode\u003e9d08a9a\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1146\"\u003e#1146\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64\"\u003e\u003ccode\u003eb87c100\u003c/code\u003e\u003c/a\u003e Bump codecov/codecov-action from 5 to 6 (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1154\"\u003e#1154\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812\"\u003e\u003ccode\u003e40e3147\u003c/code\u003e\u003c/a\u003e Migrate development extras to dependency groups (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1152\"\u003e#1152\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pydantic` from 2.13.3 to 2.13.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pydantic/pydantic/releases\"\u003epydantic's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.13.4 2026-05-06\u003c/h2\u003e\n\u003ch2\u003ev2.13.4 (2026-05-06)\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003ch4\u003ePackaging\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eBump libc from 0.2.155 to 0.2.185 by \u003ca href=\"https://github.com/Viicos\"\u003e\u003ccode\u003e@​Viicos\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic/pull/13109\"\u003e#13109\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdapt \u003ccode\u003epydantic-core\u003c/code\u003e linker flags on macOS by \u003ca href=\"https://github.com/washingtoneg\"\u003e\u003ccode\u003e@​washingtoneg\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"https://github.com/Viicos\"\u003e\u003ccode\u003e@​Viicos\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic/pull/13147\"\u003e#13147\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eFixes\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve \u003ccode\u003eRootModel\u003c/code\u003e core metadata by \u003ca href=\"https://github.com/Viicos\"\u003e\u003ccode\u003e@​Viicos\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic/pull/13129\"\u003e#13129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/pydantic/pydantic/compare/v2.13.3...v2.13.4\"\u003ehttps://github.com/pydantic/pydantic/compare/v2.13.3...v2.13.4\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pydantic/pydantic/blob/main/HISTORY.md\"\u003epydantic's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.13.4 (2026-05-06)\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/pydantic/pydantic/releases/tag/v2.13.4\"\u003eGitHub release\u003c/a\u003e\u003c/p\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003ch4\u003ePackaging\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eBump libc from 0.2.155 to 0.2.185 by \u003ca href=\"https://github.com/Viicos\"\u003e\u003ccode\u003e@​Viicos\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic/pull/13109\"\u003e#13109\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdapt \u003ccode\u003epydantic-core\u003c/code\u003e linker flags on macOS by \u003ca href=\"https://github.com/washingtoneg\"\u003e\u003ccode\u003e@​washingtoneg\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"https://github.com/Viicos\"\u003e\u003ccode\u003e@​Viicos\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic/pull/13147\"\u003e#13147\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eFixes\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve \u003ccode\u003eRootModel\u003c/code\u003e core metadata by \u003ca href=\"https://github.com/Viicos\"\u003e\u003ccode\u003e@​Viicos\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic/pull/13129\"\u003e#13129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/cf67d4b3193c3fe43ede18612ed62785eee11382\"\u003e\u003ccode\u003ecf67d4b\u003c/code\u003e\u003c/a\u003e Fix linting\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/f0d8a214a5803036db46a56b1f62f1e56b81d662\"\u003e\u003ccode\u003ef0d8a21\u003c/code\u003e\u003c/a\u003e Prepare release v2.13.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/5e3fe1d41a00f441204241c66078003ae0391f9a\"\u003e\u003ccode\u003e5e3fe1d\u003c/code\u003e\u003c/a\u003e Check for pydantic tag pattern in CI\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/7f9edcc2a191d2eaa9751220eb910914e716a686\"\u003e\u003ccode\u003e7f9edcc\u003c/code\u003e\u003c/a\u003e Document tagging conventions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/b46a0c9b8a4dd967fda8ec1a92f6437076bf262c\"\u003e\u003ccode\u003eb46a0c9\u003c/code\u003e\u003c/a\u003e Adapt \u003ccode\u003epydantic-core\u003c/code\u003e linker flags on macOS\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/50629c851e61d887d5420452c311ec6203f1f400\"\u003e\u003ccode\u003e50629c8\u003c/code\u003e\u003c/a\u003e Update to PyPy 7.3.22\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/8522ebb71e5e9a6f7188af5f009f01785b8cf725\"\u003e\u003ccode\u003e8522ebb\u003c/code\u003e\u003c/a\u003e Preserve \u003ccode\u003eRootModel\u003c/code\u003e core metadata\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/a37f3aff090ca342dc5f48304889963530b993f8\"\u003e\u003ccode\u003ea37f3af\u003c/code\u003e\u003c/a\u003e Adapt \u003ccode\u003eMISSING\u003c/code\u003e sentinel test to work with unreleased \u003ccode\u003etyping_extensions\u003c/code\u003e ver...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/909259a9df660518033aa686b689f045a6eaf9d2\"\u003e\u003ccode\u003e909259a\u003c/code\u003e\u003c/a\u003e Remove Logfire example in documentation\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/2c4174c366606fc2dc46cb806833a080aefa77df\"\u003e\u003ccode\u003e2c4174c\u003c/code\u003e\u003c/a\u003e Bump libc from 0.2.155 to 0.2.185\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/pydantic/pydantic/compare/v2.13.3...v2.13.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pydantic-settings` from 2.14.0 to 2.14.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pydantic/pydantic-settings/releases\"\u003epydantic-settings's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.14.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump the python-packages group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/pull/850\"\u003epydantic/pydantic-settings#850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the python-packages group with 5 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/pull/854\"\u003epydantic/pydantic-settings#854\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the github-actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/pull/853\"\u003epydantic/pydantic-settings#853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the python-packages group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/pull/856\"\u003epydantic/pydantic-settings#856\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix field named \u003ccode\u003ecls\u003c/code\u003e conflicting with classmethod parameter by \u003ca href=\"https://github.com/hramezani\"\u003e\u003ccode\u003e@​hramezani\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/pull/858\"\u003epydantic/pydantic-settings#858\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare release 2.14.1 by \u003ca href=\"https://github.com/hramezani\"\u003e\u003ccode\u003e@​hramezani\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/pull/859\"\u003epydantic/pydantic-settings#859\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1\"\u003ehttps://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic-settings/commit/e95c30bec8cfaee88ee275138c064aea97a25bdf\"\u003e\u003ccode\u003ee95c30b\u003c/code\u003e\u003c/a\u003e Prepare release 2.14.1 (\u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/issues/859\"\u003e#859\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic-settings/commit/0c8734581b6cf70a995afad603ac456631d00621\"\u003e\u003ccode\u003e0c87345\u003c/code\u003e\u003c/a\u003e Fix field named \u003ccode\u003ecls\u003c/code\u003e conflicting with classmethod parameter (\u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/issues/858\"\u003e#858\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic-settings/commit/7bd0072795a800065b42210b6dca90fc9b83daf7\"\u003e\u003ccode\u003e7bd0072\u003c/code\u003e\u003c/a\u003e Bump the python-packages group with 2 updates (\u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/issues/856\"\u003e#856\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic-settings/commit/b03e573d017ed48e1c2774a5e0b715db9766c76b\"\u003e\u003ccode\u003eb03e573\u003c/code\u003e\u003c/a\u003e Bump the github-actions group with 3 updates (\u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/issues/853\"\u003e#853\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic-settings/commit/eaa3b434938411ec8a3717ea646614561e713f51\"\u003e\u003ccode\u003eeaa3b43\u003c/code\u003e\u003c/a\u003e Bump the python-packages group with 5 updates (\u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/issues/854\"\u003e#854\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic-settings/commit/9f95615c24c6813c1d7d203576581a79cb6d9e8e\"\u003e\u003ccode\u003e9f95615\u003c/code\u003e\u003c/a\u003e Bump the python-packages group with 4 updates (\u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/issues/850\"\u003e#850\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pandas` from 3.0.2 to 3.0.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pandas-dev/pandas/releases\"\u003epandas's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003epandas 3.0.3\u003c/h2\u003e\n\u003cp\u003eWe are pleased to announce the release of pandas 3.0.3.\nThis is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.\u003c/p\u003e\n\u003cp\u003eSee the \u003ca href=\"https://pandas.pydata.org/docs/whatsnew/v3.0.3.html\"\u003efull whatsnew\u003c/a\u003e for a list of all the changes.\u003c/p\u003e\n\u003cp\u003ePandas 3.0 supports Python 3.11 and higher.\nThe release can be installed from PyPI:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003epython -m pip install --upgrade pandas==3.0.*\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eOr from conda-forge\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003econda install -c conda-forge pandas=3.0\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003ePlease report any issues with the release on the \u003ca href=\"https://github.com/pandas-dev/pandas/issues\"\u003epandas issue tracker\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eThanks to all the contributors who made this release possible.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/72f2fea91530b5abb3cf2100cb22d84e504695c0\"\u003e\u003ccode\u003e72f2fea\u003c/code\u003e\u003c/a\u003e RLS: 3.0.3 (\u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/65590\"\u003e#65590\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/2897590094c2b6e3962d01a82665936f30be563d\"\u003e\u003ccode\u003e2897590\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/65436\"\u003e#65436\u003c/a\u003e on branch 3.0.x (Account for privatization of matplotlib `...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/49894b5b6037c50f6444504070d9b1e8e514001a\"\u003e\u003ccode\u003e49894b5\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/65499\"\u003e#65499\u003c/a\u003e on branch 3.0.x (BUG: fix check if pyarrow is installed in...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/1c6d1e30cc4b80bedb769a8b3731b0788f69c9dc\"\u003e\u003ccode\u003e1c6d1e3\u003c/code\u003e\u003c/a\u003e [backport 3.0.x] PERF: remove special casing for zoneinfo in tz_localize_to_u...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/2a547116afc46d88d4e6584670fd793949222a1e\"\u003e\u003ccode\u003e2a54711\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/64379\"\u003e#64379\u003c/a\u003e on branch 3.0.x (PERF: improve performance with ZoneInfo t...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/036bb7c0e7160b9d5a7f6bd26a9fc00921fa6977\"\u003e\u003ccode\u003e036bb7c\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/65482\"\u003e#65482\u003c/a\u003e on branch 3.0.x (PERF: don't call unique on dtypes for che...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/bf4c182b09251f5b469e8e246ae3ea3e1ae07164\"\u003e\u003ccode\u003ebf4c182\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/65410\"\u003e#65410\u003c/a\u003e on branch 3.0.x (TST: also convert str index to object in ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/dd02d75ce219135f9f3f65c13644d4be35585d42\"\u003e\u003ccode\u003edd02d75\u003c/code\u003e\u003c/a\u003e [backport 3.0.x] BUG: keep fsspec OpenFile alive for chained URL reads (\u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/6547\"\u003e#6547\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/aef3d0f6698667262c6d6ffc69180b280b0fa86a\"\u003e\u003ccode\u003eaef3d0f\u003c/code\u003e\u003c/a\u003e [backport 3.0.x] CI: lowercase types-pymysql/types-pyyaml to fix mamba 2.6.0 ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/bb8e24876273a14322047f4b89e648f6a4abebae\"\u003e\u003ccode\u003ebb8e248\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/65399\"\u003e#65399\u003c/a\u003e on branch 3.0.x (DOC: fix source link for classes in the r...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pandas-dev/pandas/compare/v3.0.2...v3.0.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google-cloud-aiplatform` from 1.150.0 to 1.153.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/googleapis/python-aiplatform/releases\"\u003egoogle-cloud-aiplatform's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.153.1\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/googleapis/python-aiplatform/compare/v1.153.0...v1.153.1\"\u003e1.153.1\u003c/a\u003e (2026-05-15)\u003c/h2\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRemove google-genai version contraints (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/cf4f183c085421e255267787214018de209430d1\"\u003ecf4f183\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemove SDK workaround for async_retrieve_contexts. (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/5aabd30b88de06f1c4d73cfd3e6d02bf4f73c943\"\u003e5aabd30\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRelax google-genai dep to \u0026gt;= 2.0 (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/6a17fdc1ed5b95839836ba0f9a29782b5af6b279\"\u003e6a17fdc\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMiscellaneous Chores\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRelease 1.153.1 (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/addbff629c38c172267aa5caa3f4a79c8c444837\"\u003eaddbff6\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.153.0\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/googleapis/python-aiplatform/compare/v1.152.0...v1.153.0\"\u003e1.153.0\u003c/a\u003e (2026-05-14)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eGenAI Client(evals) - Add red_teaming_config support for create_evaluation_run (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/657f379dc516a1db75eca1686731b7a4944a3b41\"\u003e657f379\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eMigrate Agent Engines, Evaluation, Prompt Management, and Skill features to agentplatform (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/74ec5e1e8234713d16024c9bea06778366c4dd64\"\u003e74ec5e1\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eInject agents map from agent_info into agent_data for create_evaluation_run (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/a4ffb673911fb4e0e25174c1b92054eb4a443d34\"\u003ea4ffb67\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Skill Registry Python SDK section in README (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/9f8e24c04f577bba7bb17a730a2264a94502cf4c\"\u003e9f8e24c\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.152.0\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/googleapis/python-aiplatform/compare/v1.151.0...v1.152.0\"\u003e1.152.0\u003c/a\u003e (2026-05-11)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd GetSkillRevision and ListSkillRevisions methods in Vertex AI Skill Registry SDK (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/e4fdb7a5d9129cb46aa060f4c69f276b14b6864a\"\u003ee4fdb7a\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd ListSkills and DeleteSkill methods in Vertex AI Skill Registry SDK (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/8578bfd09b78990051b2839e8b0cf1f9e0cca4ef\"\u003e8578bfd\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd mTLS support for telemetry endpoint in adk.py. (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/7b0c9956c9f73e76a2ca3a2c8ad00f79d06f1e13\"\u003e7b0c995\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd Update Skill method for Vertex AI Skill Registry SDK (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/48f792b07cda215cc62d16fac0df84eb3f60cba5\"\u003e48f792b\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eGenAI Client(evals) - Add allow_cross_region_model support for create_evaluation_run (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/3ce4b0264174463372b7e980c71231b651b7d411\"\u003e3ce4b02\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix name collision on SandboxEnvironment.state by renaming enum to SandboxState (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/1f9c8e014b46a77ce64843434b1cad253bc4ce05\"\u003e1f9c8e0\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/googleapis/python-aiplatform/blob/main/CHANGELOG.md\"\u003egoogle-cloud-aiplatform's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/googleapis/python-aiplatform/compare/v1.153.0...v1.153.1\"\u003e1.153.1\u003c/a\u003e (2...\n\n_Description has been truncated_","html_url":"https://github.com/Ibrahim-newaeon/Stratum-AI-Final-Updates-Dec-2025/pull/290","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Ibrahim-newaeon%2FStratum-AI-Final-Updates-Dec-2025/issues/290","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/290/packages"},{"uuid":"4520297200","node_id":"PR_kwDOSnyNFs7fNaBQ","number":1,"state":"open","title":"deps(deps): update lxml requirement from \u003c7.0.0,\u003e=6.0.2 to \u003e=6.1.1,\u003c7.0.0","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-26T00:19:40.000Z","updated_at":"2026-05-26T00:19:40.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"deps(deps): update","packages":[{"name":"lxml","old_version":"\u003c7.0.0,\u003e=6.0.2","new_version":"\u003e=6.1.1,\u003c7.0.0","repository_url":"https://github.com/lxml/lxml"}],"path":null,"ecosystem":"pip"},"body":"Updates the requirements on [lxml](https://github.com/lxml/lxml) to permit the latest version.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.0.2...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/graham-a11y/Claude-seo/pull/1","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/graham-a11y%2FClaude-seo/issues/1","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/1/packages"},{"uuid":"4520006161","node_id":"PR_kwDOO9zzg87fMc_W","number":116,"state":"open","title":"chore(deps): bump lxml from 6.1.0 to 6.1.1","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-25T23:06:33.000Z","updated_at":"2026-05-25T23:06:34.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps)","packages":[{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"}],"path":null,"ecosystem":"pip"},"body":"Bumps [lxml](https://github.com/lxml/lxml) from 6.1.0 to 6.1.1.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lxml\u0026package-manager=uv\u0026previous-version=6.1.0\u0026new-version=6.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/Brain-Modulation-Lab/DBSAnnotator/pull/116","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Brain-Modulation-Lab%2FDBSAnnotator/issues/116","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/116/packages"}],"issue_packages":[{"old_version":"6.1.0","new_version":"6.1.1","update_type":"patch","path":null,"pr_created_at":"2026-07-24T01:50:20.000Z","version_change":"6.1.0 → 6.1.1","issue":{"uuid":"4964417245","node_id":"PR_kwDOSuNyS871pZua","number":26,"state":"open","title":"build(deps): Bump the dependencies group across 3 directories with 73 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-07-24T01:50:20.000Z","updated_at":"2026-07-24T01:50:21.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps): Bump","group_name":"dependencies","update_count":73,"packages":[{"name":"asgiref","old_version":"3.11.1","new_version":"3.12.1","repository_url":"https://github.com/django/asgiref"},{"name":"bleach","old_version":"4.1.0","new_version":"6.4.0","repository_url":"https://github.com/mozilla/bleach"},{"name":"blessed","old_version":"1.39.0","new_version":"1.47.0","repository_url":"https://github.com/jquast/blessed"},{"name":"boto3","old_version":"1.43.8","new_version":"1.43.50","repository_url":"https://github.com/boto/boto3"},{"name":"botocore","old_version":"1.43.8","new_version":"1.43.50","repository_url":"https://github.com/boto/botocore"},{"name":"certifi","old_version":"2026.4.22","new_version":"2026.6.17","repository_url":"https://github.com/certifi/python-certifi"},{"name":"cffi","old_version":"2.0.0","new_version":"2.1.0","repository_url":"https://github.com/python-cffi/cffi"},{"name":"charset-normalizer","old_version":"3.4.7","new_version":"3.4.9","repository_url":"https://github.com/jawah/charset_normalizer"},{"name":"django","old_version":"5.2.14","new_version":"6.0.7","repository_url":"https://github.com/django/django"},{"name":"django-allauth","old_version":"65.14.3","new_version":"65.18.0","repository_url":"https://github.com/sponsors/pennersr"},{"name":"django-filter","old_version":"25.2","new_version":"26.1","repository_url":"https://github.com/carltongibson/django-filter"},{"name":"django-js-asset","old_version":"3.1.2","new_version":"4.0.1","repository_url":"https://github.com/feincms/django-js-asset"},{"name":"django-maintenance-mode","old_version":"0.22.0","new_version":"0.23.0","repository_url":"https://github.com/fabiocaccamo/django-maintenance-mode"},{"name":"django-markdownify","old_version":"0.9.1","new_version":"0.9.7","repository_url":"https://github.com/erwinmatijsen/django-markdownify"},{"name":"django-money","old_version":"3.6.0","new_version":"3.6.1","repository_url":"https://github.com/django-money/django-money"},{"name":"django-oauth-toolkit","old_version":"3.2.0","new_version":"3.3.0","repository_url":"https://github.com/django-oauth/django-oauth-toolkit"},{"name":"django-otp","old_version":"1.3.0","new_version":"1.7.0","repository_url":"https://github.com/django-otp/django-otp"},{"name":"django-redis","old_version":"6.0.0","new_version":"7.0.0","repository_url":"https://github.com/jazzband/django-redis"},{"name":"django-structlog","old_version":"10.0.0","new_version":"10.1.0","repository_url":"https://github.com/jrobichaud/django-structlog"},{"name":"docutils","old_version":"0.22.4","new_version":"0.23","repository_url":"https://github.com/rtfd/recommonmark"},{"name":"drf-spectacular","old_version":"0.29.0","new_version":"0.30.0","repository_url":"https://github.com/tfranzel/drf-spectacular"},{"name":"dulwich","old_version":"1.2.1","new_version":"1.2.11","repository_url":"https://github.com/dulwich/dulwich"},{"name":"fido2","old_version":"2.2.0","new_version":"2.2.1","repository_url":"https://github.com/Yubico/python-fido2"},{"name":"grpcio","old_version":"1.80.0","new_version":"1.82.1","repository_url":"https://github.com/grpc/grpc"},{"name":"icalendar","old_version":"7.1.0","new_version":"7.2.0","repository_url":"https://github.com/collective/icalendar"},{"name":"idna","old_version":"3.15","new_version":"3.18","repository_url":"https://github.com/kjd/idna"},{"name":"importlib-metadata","old_version":"8.7.1","new_version":"9.0.0","repository_url":"https://github.com/python/importlib_metadata"},{"name":"jwcrypto","old_version":"1.5.7","new_version":"1.5.8","repository_url":"https://github.com/latchset/jwcrypto"},{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"},{"name":"nh3","old_version":"0.3.5","new_version":"0.3.6","repository_url":"https://github.com/messense/nh3"},{"name":"opentelemetry-exporter-otlp-proto-common","old_version":"1.41.1","new_version":"1.44.0","repository_url":"https://github.com/open-telemetry/opentelemetry-python"},{"name":"opentelemetry-exporter-otlp-proto-grpc","old_version":"1.41.1","new_version":"1.44.0","repository_url":"https://github.com/open-telemetry/opentelemetry-python"},{"name":"opentelemetry-exporter-otlp-proto-http","old_version":"1.41.1","new_version":"1.44.0","repository_url":"https://github.com/open-telemetry/opentelemetry-python"},{"name":"opentelemetry-instrumentation","old_version":"0.62b1","new_version":"0.65b0","repository_url":"https://github.com/open-telemetry/opentelemetry-python-contrib"},{"name":"opentelemetry-instrumentation-dbapi","old_version":"0.62b1","new_version":"0.65b0","repository_url":"https://github.com/open-telemetry/opentelemetry-python-contrib"},{"name":"opentelemetry-proto","old_version":"1.41.1","new_version":"1.44.0","repository_url":"https://github.com/open-telemetry/opentelemetry-python"},{"name":"opentelemetry-semantic-conventions","old_version":"0.62b1","new_version":"0.65b0","repository_url":"https://github.com/open-telemetry/opentelemetry-python"},{"name":"opentelemetry-util-http","old_version":"0.62b1","new_version":"0.65b0","repository_url":"https://github.com/open-telemetry/opentelemetry-python-contrib"},{"name":"pillow","old_version":"12.2.0","new_version":"12.3.0","repository_url":"https://github.com/python-pillow/Pillow"},{"name":"platformdirs","old_version":"4.9.6","new_version":"4.10.0","repository_url":"https://github.com/tox-dev/platformdirs"},{"name":"prettytable","old_version":"3.17.0","new_version":"3.18.0","repository_url":"https://github.com/prettytable/prettytable"},{"name":"protobuf","old_version":"6.33.6","new_version":"7.35.1","repository_url":"https://github.com/protocolbuffers/protobuf"},{"name":"pyjwt","old_version":"2.12.1","new_version":"2.13.0","repository_url":"https://github.com/jpadilla/pyjwt"},{"name":"pypdf","old_version":"6.11.0","new_version":"6.14.2","repository_url":"https://github.com/py-pdf/pypdf"},{"name":"python-fsutil","old_version":"0.16.1","new_version":"0.17.0","repository_url":"https://github.com/fabiocaccamo/python-fsutil"},{"name":"redis","old_version":"7.4.0","new_version":"8.0.1","repository_url":"https://github.com/redis/redis-py"},{"name":"rpds-py","old_version":"0.30.0","new_version":"2026.6.3","repository_url":"https://github.com/crate-py/rpds"},{"name":"s3transfer","old_version":"0.17.0","new_version":"0.19.1","repository_url":"https://github.com/boto/s3transfer"},{"name":"sentry-sdk","old_version":"2.60.0","new_version":"2.66.0","repository_url":"https://github.com/getsentry/sentry-python"},{"name":"setuptools","old_version":"82.0.1","new_version":"83.0.0","repository_url":"https://github.com/pypa/setuptools"},{"name":"structlog","old_version":"25.5.0","new_version":"26.1.0","repository_url":"https://github.com/hynek/structlog"},{"name":"tqdm","old_version":"4.67.3","new_version":"4.68.4","repository_url":"https://github.com/tqdm/tqdm"},{"name":"typing-extensions","old_version":"4.15.0","new_version":"4.16.0","repository_url":"https://github.com/python/typing_extensions"},{"name":"tzdata","old_version":"2026.2","new_version":"2026.3","repository_url":"https://github.com/python/tzdata"},{"name":"wcwidth","old_version":"0.7.0","new_version":"0.8.2","repository_url":"https://github.com/jquast/wcwidth"},{"name":"weasyprint","old_version":"68.1","new_version":"69.0","repository_url":"https://github.com/Kozea/WeasyPrint"},{"name":"wrapt","old_version":"1.17.3","new_version":"2.2.2","repository_url":"https://github.com/GrahamDumpleton/wrapt"},{"name":"zipp","old_version":"3.23.1","new_version":"4.1.0","repository_url":"https://github.com/jaraco/zipp"},{"name":"zopfli","old_version":"0.4.1","new_version":"0.4.3","repository_url":"https://github.com/fonttools/py-zopfli"},{"name":"click","old_version":"8.3.3","new_version":"8.4.2","repository_url":"https://github.com/pallets/click"},{"name":"coverage","old_version":"7.14.0","new_version":"7.15.2","repository_url":"https://github.com/coveragepy/coveragepy"},{"name":"django-stubs","old_version":"6.0.4","new_version":"6.0.7","repository_url":"https://github.com/typeddjango/django-stubs"},{"name":"django-stubs-ext","old_version":"6.0.4","new_version":"6.0.7","repository_url":"https://github.com/typeddjango/django-stubs"},{"name":"pip","old_version":"26.1.1","new_version":"26.1.2","repository_url":"https://github.com/pypa/pip"},{"name":"prek","old_version":"0.4.0","new_version":"0.4.10","repository_url":"https://github.com/j178/prek"},{"name":"pytest","old_version":"9.0.3","new_version":"9.1.1","repository_url":"https://github.com/pytest-dev/pytest"},{"name":"pytest-codspeed","old_version":"5.0.2","new_version":"5.0.3","repository_url":"https://github.com/CodSpeedHQ/pytest-codspeed"},{"name":"ty","old_version":"0.0.1a21","new_version":"0.0.60","repository_url":"https://github.com/astral-sh/ty"},{"name":"types-psycopg2","old_version":"2.9.21.20260509","new_version":"2.9.21.20260712","repository_url":"https://github.com/python/typeshed"},{"name":"types-pyyaml","old_version":"6.0.12.20260510","new_version":"6.0.12.20260518","repository_url":"https://github.com/python/typeshed"}],"path":null,"ecosystem":"pip"},"body":"Bumps the dependencies group with 1 update in the /contrib/dev_reqs directory: [jc](https://github.com/kellyjonbrazil/jc).\nBumps the dependencies group with 2 updates in the /docs directory: [mkdocs-git-revision-date-localized-plugin](https://github.com/timvink/mkdocs-git-revision-date-localized-plugin) and [mkdocstrings](https://github.com/mkdocstrings/mkdocstrings).\nBumps the dependencies group with 70 updates in the /src/backend directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [asgiref](https://github.com/django/asgiref) | `3.11.1` | `3.12.1` |\n| [bleach](https://github.com/mozilla/bleach) | `4.1.0` | `6.4.0` |\n| [blessed](https://github.com/jquast/blessed) | `1.39.0` | `1.47.0` |\n| [boto3](https://github.com/boto/boto3) | `1.43.8` | `1.43.50` |\n| [botocore](https://github.com/boto/botocore) | `1.43.8` | `1.43.50` |\n| [certifi](https://github.com/certifi/python-certifi) | `2026.4.22` | `2026.6.17` |\n| [cffi](https://github.com/python-cffi/cffi) | `2.0.0` | `2.1.0` |\n| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.7` | `3.4.9` |\n| [django](https://github.com/django/django) | `5.2.14` | `6.0.7` |\n| [django-allauth](https://github.com/sponsors/pennersr) | `65.14.3` | `65.18.0` |\n| [django-filter](https://github.com/carltongibson/django-filter) | `25.2` | `26.1` |\n| [django-js-asset](https://github.com/feincms/django-js-asset) | `3.1.2` | `4.0.1` |\n| [django-maintenance-mode](https://github.com/fabiocaccamo/django-maintenance-mode) | `0.22.0` | `0.23.0` |\n| [django-markdownify](https://github.com/erwinmatijsen/django-markdownify) | `0.9.1` | `0.9.7` |\n| [django-money](https://github.com/django-money/django-money) | `3.6.0` | `3.6.1` |\n| [django-oauth-toolkit](https://github.com/django-oauth/django-oauth-toolkit) | `3.2.0` | `3.3.0` |\n| [django-otp](https://github.com/django-otp/django-otp) | `1.3.0` | `1.7.0` |\n| [django-redis](https://github.com/jazzband/django-redis) | `6.0.0` | `7.0.0` |\n| [django-structlog](https://github.com/jrobichaud/django-structlog) | `10.0.0` | `10.1.0` |\n| [docutils](https://github.com/rtfd/recommonmark) | `0.22.4` | `0.23` |\n| [drf-spectacular](https://github.com/tfranzel/drf-spectacular) | `0.29.0` | `0.30.0` |\n| [dulwich](https://github.com/dulwich/dulwich) | `1.2.1` | `1.2.11` |\n| [fido2](https://github.com/Yubico/python-fido2) | `2.2.0` | `2.2.1` |\n| [grpcio](https://github.com/grpc/grpc) | `1.80.0` | `1.82.1` |\n| [icalendar](https://github.com/collective/icalendar) | `7.1.0` | `7.2.0` |\n| [idna](https://github.com/kjd/idna) | `3.15` | `3.18` |\n| [importlib-metadata](https://github.com/python/importlib_metadata) | `8.7.1` | `9.0.0` |\n| [jwcrypto](https://github.com/latchset/jwcrypto) | `1.5.7` | `1.5.8` |\n| [lxml](https://github.com/lxml/lxml) | `6.1.0` | `6.1.1` |\n| [nh3](https://github.com/messense/nh3) | `0.3.5` | `0.3.6` |\n| [opentelemetry-exporter-otlp-proto-common](https://github.com/open-telemetry/opentelemetry-python) | `1.41.1` | `1.44.0` |\n| [opentelemetry-exporter-otlp-proto-grpc](https://github.com/open-telemetry/opentelemetry-python) | `1.41.1` | `1.44.0` |\n| [opentelemetry-exporter-otlp-proto-http](https://github.com/open-telemetry/opentelemetry-python) | `1.41.1` | `1.44.0` |\n| [opentelemetry-instrumentation](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.62b1` | `0.65b0` |\n| [opentelemetry-instrumentation-dbapi](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.62b1` | `0.65b0` |\n| [opentelemetry-proto](https://github.com/open-telemetry/opentelemetry-python) | `1.41.1` | `1.44.0` |\n| [opentelemetry-semantic-conventions](https://github.com/open-telemetry/opentelemetry-python) | `0.62b1` | `0.65b0` |\n| [opentelemetry-util-http](https://github.com/open-telemetry/opentelemetry-python-contrib) | `0.62b1` | `0.65b0` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` |\n| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.9.6` | `4.10.0` |\n| [prettytable](https://github.com/prettytable/prettytable) | `3.17.0` | `3.18.0` |\n| [protobuf](https://github.com/protocolbuffers/protobuf) | `6.33.6` | `7.35.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.12.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.11.0` | `6.14.2` |\n| [python-fsutil](https://github.com/fabiocaccamo/python-fsutil) | `0.16.1` | `0.17.0` |\n| [redis](https://github.com/redis/redis-py) | `7.4.0` | `8.0.1` |\n| [rpds-py](https://github.com/crate-py/rpds) | `0.30.0` | `2026.6.3` |\n| [s3transfer](https://github.com/boto/s3transfer) | `0.17.0` | `0.19.1` |\n| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.60.0` | `2.66.0` |\n| [setuptools](https://github.com/pypa/setuptools) | `82.0.1` | `83.0.0` |\n| [structlog](https://github.com/hynek/structlog) | `25.5.0` | `26.1.0` |\n| [tqdm](https://github.com/tqdm/tqdm) | `4.67.3` | `4.68.4` |\n| [typing-extensions](https://github.com/python/typing_extensions) | `4.15.0` | `4.16.0` |\n| [tzdata](https://github.com/python/tzdata) | `2026.2` | `2026.3` |\n| [wcwidth](https://github.com/jquast/wcwidth) | `0.7.0` | `0.8.2` |\n| [weasyprint](https://github.com/Kozea/WeasyPrint) | `68.1` | `69.0` |\n| [wrapt](https://github.com/GrahamDumpleton/wrapt) | `1.17.3` | `2.2.2` |\n| [zipp](https://github.com/jaraco/zipp) | `3.23.1` | `4.1.0` |\n| [zopfli](https://github.com/fonttools/py-zopfli) | `0.4.1` | `0.4.3` |\n| [click](https://github.com/pallets/click) | `8.3.3` | `8.4.2` |\n| [coverage](https://github.com/coveragepy/coveragepy) | `7.14.0` | `7.15.2` |\n| [django-stubs](https://github.com/typeddjango/django-stubs) | `6.0.4` | `6.0.7` |\n| [django-stubs-ext](https://github.com/typeddjango/django-stubs) | `6.0.4` | `6.0.7` |\n| [pip](https://github.com/pypa/pip) | `26.1.1` | `26.1.2` |\n| [prek](https://github.com/j178/prek) | `0.4.0` | `0.4.10` |\n| [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.1.1` |\n| [pytest-codspeed](https://github.com/CodSpeedHQ/pytest-codspeed) | `5.0.2` | `5.0.3` |\n| [ty](https://github.com/astral-sh/ty) | `0.0.1a21` | `0.0.60` |\n| [types-psycopg2](https://github.com/python/typeshed) | `2.9.21.20260509` | `2.9.21.20260712` |\n| [types-pyyaml](https://github.com/python/typeshed) | `6.0.12.20260510` | `6.0.12.20260518` |\n\n\nUpdates `jc` from 1.25.6 to 1.25.7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kellyjonbrazil/jc/releases\"\u003ejc's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eJC version 1.25.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003ecsv-ih\u003c/code\u003e, \u003ccode\u003etsv\u003c/code\u003e, and \u003ccode\u003etsv-ih\u003c/code\u003e file parsers for CSV files without headers,\nTSV files, and TSV files without headers. Note that these are standard and\nnot streaming parsers so the entire CSV/TSV will be loaded into memory. For\nlazy loading equivalents, see below.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ecsv-ih-s\u003c/code\u003e, \u003ccode\u003etsv-s\u003c/code\u003e, and \u003ccode\u003etsv-ih-s\u003c/code\u003e streaming file parsers for CSV files\nwithout headers, TSV files, and TSV files without headers. These streaming\nparsers will lazily load the data into memory and may be more suitable for\nextremely large files.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003etypeset\u003c/code\u003e and \u003ccode\u003edeclare\u003c/code\u003e Bash internal command parser to convert variables\nsimple arrays, and associative arrays along with object metadata\u003c/li\u003e\n\u003cli\u003eEnhance \u003ccode\u003epip-show\u003c/code\u003e command parser to add \u003ccode\u003e-f\u003c/code\u003e show files support\u003c/li\u003e\n\u003cli\u003eEnhance \u003ccode\u003ersync\u003c/code\u003e and \u003ccode\u003ersync-s\u003c/code\u003e parsers to add \u003ccode\u003e--stats\u003c/code\u003e or \u003ccode\u003e--info=stats[1-3]\u003c/code\u003e fields\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ecertbot\u003c/code\u003e command parser to allow parsing of named certs\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003edir\u003c/code\u003e command parser for incorrect stripping of the \u003ccode\u003eD:\u003c/code\u003e drive letter\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ehashsum\u003c/code\u003e command parser to correctly parse the \u003ccode\u003emode\u003c/code\u003e indicator\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eifconfig\u003c/code\u003e command parser for incorrect stripping of leading zeros in some hex numbers\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eiptables\u003c/code\u003e command parser when Target is blank and verbose output is used\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003elsattr\u003c/code\u003e command parser for filenames with spaces (newlines in filenames are\nstill not supported)\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eproc-pid-smaps\u003c/code\u003e proc parser when unknown VmFlags are output\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ejc.utils.timestamp\u003c/code\u003e function and tests for behavior change in python 3.15\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eufw\u003c/code\u003e command parser to support rule logging. A new boolean \u003ccode\u003elog\u003c/code\u003e field is introduced\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kellyjonbrazil/jc/blob/master/CHANGELOG\"\u003ejc's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003ejc changelog\u003c/p\u003e\n\u003cp\u003e20260617 v1.25.7\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003ecsv-ih\u003c/code\u003e, \u003ccode\u003etsv\u003c/code\u003e, and \u003ccode\u003etsv-ih\u003c/code\u003e file parsers for CSV files without headers,\nTSV files, and TSV files without headers. Note that these are standard and\nnot streaming parsers so the entire CSV/TSV will be loaded into memory. For\nlazy loading equivalents, see below.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ecsv-ih-s\u003c/code\u003e, \u003ccode\u003etsv-s\u003c/code\u003e, and \u003ccode\u003etsv-ih-s\u003c/code\u003e streaming file parsers for CSV files\nwithout headers, TSV files, and TSV files without headers. These streaming\nparsers will lazily load the data into memory and may be more suitable for\nextremely large files.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003etypeset\u003c/code\u003e and \u003ccode\u003edeclare\u003c/code\u003e Bash internal command parser to convert variables\nsimple arrays, and associative arrays along with object metadata\u003c/li\u003e\n\u003cli\u003eEnhance \u003ccode\u003epip-show\u003c/code\u003e command parser to add \u003ccode\u003e-f\u003c/code\u003e show files support\u003c/li\u003e\n\u003cli\u003eEnhance \u003ccode\u003ersync\u003c/code\u003e and \u003ccode\u003ersync-s\u003c/code\u003e parsers to add \u003ccode\u003e--stats\u003c/code\u003e or \u003ccode\u003e--info=stats[1-3]\u003c/code\u003e fields\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ecertbot\u003c/code\u003e command parser to allow parsing of named certs\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003edir\u003c/code\u003e command parser for incorrect stripping of the \u003ccode\u003eD:\u003c/code\u003e drive letter\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ehashsum\u003c/code\u003e command parser to correctly parse the \u003ccode\u003emode\u003c/code\u003e indicator\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eifconfig\u003c/code\u003e command parser for incorrect stripping of leading zeros in some hex numbers\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eiptables\u003c/code\u003e command parser when Target is blank and verbose output is used\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003elsattr\u003c/code\u003e command parser for filenames with spaces (newlines in filenames are\nstill not supported)\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eproc-pid-smaps\u003c/code\u003e proc parser when unknown VmFlags are output\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ejc.utils.timestamp\u003c/code\u003e function and tests for behavior change in python 3.15\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eufw\u003c/code\u003e command parser to support rule logging. A new boolean \u003ccode\u003elog\u003c/code\u003e field is introduced\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e20251012 v1.25.6\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003enet-localgroup\u003c/code\u003e Windows command parser\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003enet-user\u003c/code\u003e Windows command parser\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eroute-print\u003c/code\u003e Windows command parser\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003etraceroute-s\u003c/code\u003e streaming command parser\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003emax_hops\u003c/code\u003e and \u003ccode\u003edata_bytes\u003c/code\u003e fields to \u003ccode\u003etraceroute\u003c/code\u003e command parser\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ex509-crl\u003c/code\u003e file parser to support Certificate Revocation List PEM and DER files\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eyay\u003c/code\u003e as a magic command for the \u003ccode\u003epacman\u003c/code\u003e command parser\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ebluetoothctl\u003c/code\u003e command parser to support output with the \u003ccode\u003ecable_pairing\u003c/code\u003e attribute\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003enmcli\u003c/code\u003e command parser to support blank \u003ccode\u003eteam.config\u003c/code\u003e JSON value and \u003ccode\u003eteam-port.config\u003c/code\u003e JSON value\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003etop\u003c/code\u003e command parsers to correct memory size field parsing. Several new unit\nand byte conversion fields have been added\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ewho\u003c/code\u003e command parser to support the \u003ccode\u003eprocess\u003c/code\u003e field on Debian13\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e20250503 v1.25.5\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eamixer\u003c/code\u003e command parser\u003c/li\u003e\n\u003cli\u003eEnhance \u003ccode\u003eiptables\u003c/code\u003e command parser to add default policy statistics fields\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ebluetoothctl\u003c/code\u003e parser failing to parse controllers with power state prop\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003elsblk\u003c/code\u003e command parser to support multiple mountpoints. Also, added\nbyte conversions for size fields.\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003enmcli\u003c/code\u003e command parser to support \u003ccode\u003eteam.config\u003c/code\u003e JSON field\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003etime\u003c/code\u003e command parser for output that does not contain centiseconds\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003ex509-cert\u003c/code\u003e parser to handle IDNA2008 encoded email addresses with a warning\u003c/li\u003e\n\u003cli\u003eFix typing for upcoming python v3.14\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/8290734a87a30e5f0af7e1fba5ecbda2e1c145a8\"\u003e\u003ccode\u003e8290734\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kellyjonbrazil/jc/issues/712\"\u003e#712\u003c/a\u003e from kellyjonbrazil/dev\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/9d11e1fe5bbdfb9f68b001940a7ae235b68db637\"\u003e\u003ccode\u003e9d11e1f\u003c/code\u003e\u003c/a\u003e doc update\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/3a2946b6584f2128917ffe908f749498b8c5ea5c\"\u003e\u003ccode\u003e3a2946b\u003c/code\u003e\u003c/a\u003e add streaming csv-ih, tsv, and tsv-ih parsers with doc fixes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/22ff0e33c3957c929d45864cc9790b8f7b6fe9c8\"\u003e\u003ccode\u003e22ff0e3\u003c/code\u003e\u003c/a\u003e fix for python 3.15 behavior changes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/fab550e3b8fef49abe297c5ac4f0b2f9b330d3a9\"\u003e\u003ccode\u003efab550e\u003c/code\u003e\u003c/a\u003e docs: fix typos (\u003ca href=\"https://redirect.github.com/kellyjonbrazil/jc/issues/711\"\u003e#711\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/6e79f08c9083836467711e6965f5ca18b1505674\"\u003e\u003ccode\u003e6e79f08\u003c/code\u003e\u003c/a\u003e Add TSV alias and CSV/TSV \u0026quot;No Header\u0026quot; alias (\u003ca href=\"https://redirect.github.com/kellyjonbrazil/jc/issues/709\"\u003e#709\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/900aed5d880f2c1150739976bfbfb1f87e64cbc9\"\u003e\u003ccode\u003e900aed5\u003c/code\u003e\u003c/a\u003e fix tests and update docs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/676695eacf75aa01920b89bb1809ee96e47d20bb\"\u003e\u003ccode\u003e676695e\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kellyjonbrazil/jc/issues/701\"\u003e#701\u003c/a\u003e from jeffdyke/feature/certs-with-cert-name\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/30c75073044dd364174b080709e9fb6c870ce82e\"\u003e\u003ccode\u003e30c7507\u003c/code\u003e\u003c/a\u003e doc update\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kellyjonbrazil/jc/commit/7d801f30bb9b35b60938c193d76227f5a3473b50\"\u003e\u003ccode\u003e7d801f3\u003c/code\u003e\u003c/a\u003e doc update\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kellyjonbrazil/jc/compare/v1.25.6...v1.25.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `mkdocs-git-revision-date-localized-plugin` from 1.5.2 to 1.5.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/releases\"\u003emkdocs-git-revision-date-localized-plugin's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.5.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix paths in MANIFEST.in by \u003ca href=\"https://github.com/mitya57\"\u003e\u003ccode\u003e@​mitya57\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/timvink/mkdocs-git-revision-date-localized-plugin/pull/211\"\u003etimvink/mkdocs-git-revision-date-localized-plugin#211\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mitya57\"\u003e\u003ccode\u003e@​mitya57\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/timvink/mkdocs-git-revision-date-localized-plugin/pull/211\"\u003etimvink/mkdocs-git-revision-date-localized-plugin#211\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/compare/v1.5.2...v1.5.3\"\u003ehttps://github.com/timvink/mkdocs-git-revision-date-localized-plugin/compare/v1.5.2...v1.5.3\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/commit/30e58767a16cd9ec1dd2669f0bdc1af8630af18c\"\u003e\u003ccode\u003e30e5876\u003c/code\u003e\u003c/a\u003e Bump version to 1.5.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/commit/d58c5becb14bcd4a6143768fb3b7478954c09133\"\u003e\u003ccode\u003ed58c5be\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/timvink/mkdocs-git-revision-date-localized-plugin/issues/211\"\u003e#211\u003c/a\u003e from mitya57/fix-manifest\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/commit/6da0b4ea1b8c379164a4f1db8e005e98a0b4557d\"\u003e\u003ccode\u003e6da0b4e\u003c/code\u003e\u003c/a\u003e Fix paths in MANIFEST.in\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/commit/aa0d4a3b93f6c4cc36afbf2d8def4af5566d0834\"\u003e\u003ccode\u003eaa0d4a3\u003c/code\u003e\u003c/a\u003e Constrain mkdocs to \u0026lt;2\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/timvink/mkdocs-git-revision-date-localized-plugin/compare/v1.5.2...v1.5.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `mkdocstrings` from 1.0.4 to 1.0.6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/releases\"\u003emkdocstrings's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.0.6\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/releases/tag/1.0.6\"\u003e1.0.6\u003c/a\u003e - 2026-07-11\u003c/h2\u003e\n\u003cp\u003e\u003c!-- raw HTML omitted --\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/compare/1.0.5...1.0.6\"\u003eCompare with 1.0.5\u003c/a\u003e\u003c!-- raw HTML omitted --\u003e\u003c/p\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eStop propagating Zensical's \u003ccode\u003ezrelpath\u003c/code\u003e treeprocessor and its \u003ccode\u003epreview\u003c/code\u003e extension (\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/473279816aff4cc8ee3215fdf8b2d186517fc63d\"\u003e4732798\u003c/a\u003e by Timothée Mazzucotelli). \u003ca href=\"https://redirect.github.com/zensical/zensical/issues/818\"\u003eIssue-zensical-818\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.0.5\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/releases/tag/1.0.5\"\u003e1.0.5\u003c/a\u003e - 2026-07-10\u003c/h2\u003e\n\u003cp\u003e\u003c!-- raw HTML omitted --\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/compare/1.0.4...1.0.5\"\u003eCompare with 1.0.4\u003c/a\u003e\u003c!-- raw HTML omitted --\u003e\u003c/p\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eParse inventory project and version (\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/acc0da32d11428ea9c60f8e50f90df329f2e6460\"\u003eacc0da3\u003c/a\u003e by Timothée Mazzucotelli).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/blob/main/CHANGELOG.md\"\u003emkdocstrings's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/releases/tag/1.0.6\"\u003e1.0.6\u003c/a\u003e - 2026-07-11\u003c/h2\u003e\n\u003cp\u003e\u003c!-- raw HTML omitted --\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/compare/1.0.5...1.0.6\"\u003eCompare with 1.0.5\u003c/a\u003e\u003c!-- raw HTML omitted --\u003e\u003c/p\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eStop propagating Zensical's \u003ccode\u003ezrelpath\u003c/code\u003e treeprocessor and its \u003ccode\u003epreview\u003c/code\u003e extension (\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/473279816aff4cc8ee3215fdf8b2d186517fc63d\"\u003e4732798\u003c/a\u003e by Timothée Mazzucotelli). \u003ca href=\"https://redirect.github.com/zensical/zensical/issues/818\"\u003eIssue-zensical-818\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/releases/tag/1.0.5\"\u003e1.0.5\u003c/a\u003e - 2026-07-10\u003c/h2\u003e\n\u003cp\u003e\u003c!-- raw HTML omitted --\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/compare/1.0.4...1.0.5\"\u003eCompare with 1.0.4\u003c/a\u003e\u003c!-- raw HTML omitted --\u003e\u003c/p\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eParse inventory project and version (\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/acc0da32d11428ea9c60f8e50f90df329f2e6460\"\u003eacc0da3\u003c/a\u003e by Timothée Mazzucotelli).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/9a11dcb8e9b39ff6e1a22abdd362350de4e68e9f\"\u003e\u003ccode\u003e9a11dcb\u003c/code\u003e\u003c/a\u003e chore: Prepare release 1.0.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/473279816aff4cc8ee3215fdf8b2d186517fc63d\"\u003e\u003ccode\u003e4732798\u003c/code\u003e\u003c/a\u003e fix: Stop propagating Zensical's \u003ccode\u003ezrelpath\u003c/code\u003e treeprocessor and its \u003ccode\u003epreview\u003c/code\u003e e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/ecbaa9a05dde5bdc83accf8814fa1c9a1ffe1473\"\u003e\u003ccode\u003eecbaa9a\u003c/code\u003e\u003c/a\u003e Merge branch 'main' of github.com:mkdocstrings/mkdocstrings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/64260f748f3db8b301a9d6fa05b2609ab6f6876c\"\u003e\u003ccode\u003e64260f7\u003c/code\u003e\u003c/a\u003e chore: Prepare release 1.0.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/acc0da32d11428ea9c60f8e50f90df329f2e6460\"\u003e\u003ccode\u003eacc0da3\u003c/code\u003e\u003c/a\u003e fix: Parse inventory project and version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/ec45a9b7a1301a4c70e02e6c92e1b9caff6df61f\"\u003e\u003ccode\u003eec45a9b\u003c/code\u003e\u003c/a\u003e ci: Fix warnings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/commit/ce2199c5195535f8c3b4907dd3ac7de2181925cc\"\u003e\u003ccode\u003ece2199c\u003c/code\u003e\u003c/a\u003e chore: Update sponsors section in README (\u003ca href=\"https://redirect.github.com/mkdocstrings/mkdocstrings/issues/823\"\u003e#823\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/mkdocstrings/mkdocstrings/compare/1.0.4...1.0.6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `asgiref` from 3.11.1 to 3.12.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/django/asgiref/blob/main/CHANGELOG.txt\"\u003easgiref's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.12.1 (2026-07-14)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eRestored the previous SyncToAsync.\u003cstrong\u003ecall\u003c/strong\u003e internal code shape, which was\nrelied on by some APM services. (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/572\"\u003e#572\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003eNote, this change was available whilst maintaining the underlying fix (from\n\u003ca href=\"https://redirect.github.com/django/asgiref/issues/564\"\u003e#564\u003c/a\u003e). It does not constitute an API stability promise. Ideally APMs are\n\u003cem\u003enot\u003c/em\u003e monkey patching internal APIs, and future changes will be made here if\nneeded.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12.0 (2026-07-14)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003eAsyncToSync\u003c/code\u003e no longer captures the running event loop on\ninstantiation. (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/562\"\u003e#562\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003eThis resolves a series of deadlocks that users experienced after asgiref 3.9.0,\nparticularly with pytest-asyncio. pytest-asyncio stops the event loop between\ntests, and long-running unawaited futures could find themselves trying to\nschedule work onto a stopped loop, and so would never complete. Ideally, code\nshould be structured to await long-running futures before returning, but this\nchange should help users experiencing issues here.\u003c/p\u003e\n\u003cp\u003eThe loop is now resolved when the callable is invoked rather than when it is\ncreated. If \u003ccode\u003easync_to_sync\u003c/code\u003e is called from within \u003ccode\u003esync_to_async\u003c/code\u003e, the\nparent event loop is still used, as before.\u003c/p\u003e\n\u003cp\u003eThe possibility of deadlock therefore remains in some nested patterns. For\nexample, an async function may call a long-running \u003ccode\u003esync_to_async\u003c/code\u003e function\nthat itself uses \u003ccode\u003easync_to_sync\u003c/code\u003e; if the outer function returns before the\nsync future completes, the parent event loop may already be stopped, and the\nnested calls cannot be driven to completion.\u003c/p\u003e\n\u003cp\u003eThis is not a bug in asgiref — the same patterns deadlock in plain asyncio. As\nabove, restructure your code to await the \u003ccode\u003esync_to_async\u003c/code\u003e future before\nexiting the driving coroutine.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed an event loop deadlock when exiting \u003ccode\u003eThreadSensitiveContext\u003c/code\u003e\nwhile its executor thread was still blocked waiting on the event loop.\n(\u003ca href=\"https://redirect.github.com/django/asgiref/issues/535\"\u003e#535\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDropped support for EOL Python 3.9.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eStatelessServer.run()\u003c/code\u003e failing on Python 3.14, where\n\u003ccode\u003easyncio.get_event_loop()\u003c/code\u003e no longer creates an event loop if none\nexists. It now uses \u003ccode\u003easyncio.run()\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/559\"\u003e#559\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFixed \u003ccode\u003eLocal\u003c/code\u003e leaking data between unrelated sync threads when\n\u003ccode\u003esys.flags.thread_inherit_context\u003c/code\u003e is enabled (Python 3.14+), so a newly\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/ef9d4b8b371cf8a7bb63dea3d0fdc60923e9e081\"\u003e\u003ccode\u003eef9d4b8\u003c/code\u003e\u003c/a\u003e Releasing 3.12.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/34fba6328f67a753d814c280811fd34094bd1f6c\"\u003e\u003ccode\u003e34fba63\u003c/code\u003e\u003c/a\u003e Restore previous SyncToAsync.\u003cstrong\u003ecall\u003c/strong\u003e internal code shape.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/a43900c131874be571c6afdca642d4054eed0acf\"\u003e\u003ccode\u003ea43900c\u003c/code\u003e\u003c/a\u003e Separate mypy from tests extra.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/1b7c338591054c04ff6c140d899ced28b803b4e0\"\u003e\u003ccode\u003e1b7c338\u003c/code\u003e\u003c/a\u003e Releasing 3.12.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/157d9d4168434d73b1bb5a619f947b74ccbf1fc8\"\u003e\u003ccode\u003e157d9d4\u003c/code\u003e\u003c/a\u003e Renovate precommit (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/552\"\u003e#552\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/deda0d4fd8d3997dddd9646dd9ef7e0b6d3e59a5\"\u003e\u003ccode\u003ededa0d4\u003c/code\u003e\u003c/a\u003e Test free-threading builds and fix Local data leak for thread_inherit_context...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/a54250a24ad770616d3afcc37af3186558562041\"\u003e\u003ccode\u003ea54250a\u003c/code\u003e\u003c/a\u003e Don’t capture the event loop in \u003ccode\u003eAsyncToSync.__init__\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/562\"\u003e#562\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/836356a2802247a0963177197b50cbd7476d7950\"\u003e\u003ccode\u003e836356a\u003c/code\u003e\u003c/a\u003e Use asyncio.run in StatelessServer.run (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/561\"\u003e#561\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/e04afd54ba29bb277ba6177dc898c73c129446f3\"\u003e\u003ccode\u003ee04afd5\u003c/code\u003e\u003c/a\u003e Dropped support for Python 3.9. (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/543\"\u003e#543\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/asgiref/commit/95d2430a346be7f40652d2eabff84fe54fbc725d\"\u003e\u003ccode\u003e95d2430\u003c/code\u003e\u003c/a\u003e Fixed \u003ca href=\"https://redirect.github.com/django/asgiref/issues/535\"\u003e#535\u003c/a\u003e: ThreadSensitiveContext.\u003cstrong\u003eaexit\u003c/strong\u003e blocking the event loop. (\u003ca href=\"https://redirect.github.com/django/asgiref/issues/563\"\u003e#563\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/django/asgiref/compare/3.11.1...3.12.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `bleach` from 4.1.0 to 6.4.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/mozilla/bleach/blob/main/CHANGES\"\u003ebleach's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.4.0 (June 5th, 2026)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eNOTE: 2026-06-05: Bleach is no longer maintained. There will be no future\nreleases including for security issues.\u003c/strong\u003e\nSee issue: \u003ccode\u003e\u0026lt;https://github.com/mozilla/bleach/issues/698\u0026gt;\u003c/code\u003e__\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eBackwards incompatible changes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for pypy 3.10. (\u003ca href=\"https://redirect.github.com/mozilla/bleach/issues/764\"\u003e#764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity fixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eFix bug 2023812 / GHSA-8rfp-98v4-mmr6.\u003c/p\u003e\n\u003cp\u003eFix XSS issue with sanitize_uri_value where disallowed schemes with\nUnicode invisible characters wouldn't be rejected.\u003c/p\u003e\n\u003cp\u003eFor example::\u003c/p\u003e\n\u003cp\u003eimport bleach\npayload1 = '\u003c!-- raw HTML omitted --\u003eClick\u003c!-- raw HTML omitted --\u003e'\nresult1 = bleach.clean(payload1)\nprint(repr(result1))\u003c/p\u003e\n\u003cp\u003eoutputs::\u003c/p\u003e\n\u003cp\u003e'\u003c!-- raw HTML omitted --\u003eClick\u003c!-- raw HTML omitted --\u003e'\u003c/p\u003e\n\u003cp\u003eSee the advisory for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eFix GHSA-gj48-438w-jh9v.\u003c/p\u003e\n\u003cp\u003eFix issue where URI sanitization wasn't happening in formaction attributes.\u003c/p\u003e\n\u003cp\u003eSee the advisory for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBug fixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eAdd support for pypy 3.11. (\u003ca href=\"https://redirect.github.com/mozilla/bleach/issues/764\"\u003e#764\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDrop version max in tinycss2 pin. (\u003ca href=\"https://redirect.github.com/mozilla/bleach/issues/772\"\u003e#772\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003eThis removes one of the things we had to keep checking and updating. Users\nnow own the responsibility for correctness with the version of tinycss2\nthey're using.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 6.3.0 (October 27th, 2025)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/f0355a7af00500482c5292c6c83290c6a178068d\"\u003e\u003ccode\u003ef0355a7\u003c/code\u003e\u003c/a\u003e fix: fix last release date in CHANGES\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/ae4e8a26706516ad01b92e66321b480208a440da\"\u003e\u003ccode\u003eae4e8a2\u003c/code\u003e\u003c/a\u003e chore: bleach 6.4.0 and final release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/970df58e9f0c55cc52244f3f0106e473a40d886d\"\u003e\u003ccode\u003e970df58\u003c/code\u003e\u003c/a\u003e fix: uri-sanitization in formaction attributes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/7c4867c32344d1c961107fae62240a6f0dc680dc\"\u003e\u003ccode\u003e7c4867c\u003c/code\u003e\u003c/a\u003e fix: xss bypass in allowed protocol test using unicode invisible characters\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/913ab75992b845e2c9c060c41f24d46921db4693\"\u003e\u003ccode\u003e913ab75\u003c/code\u003e\u003c/a\u003e fix: reduce redundancy in workflow jobs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/218c15af455c8dec14f98fcb2e235f8680e93930\"\u003e\u003ccode\u003e218c15a\u003c/code\u003e\u003c/a\u003e fix: rework pip caching\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/4f0b097bf80548a022050e2f71f024d755a9f154\"\u003e\u003ccode\u003e4f0b097\u003c/code\u003e\u003c/a\u003e fix: fix tox platform restrictions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/e95a79d07bb5d792425c2bc0ef5dd03f6614f3bb\"\u003e\u003ccode\u003ee95a79d\u003c/code\u003e\u003c/a\u003e chore: update pytest\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/91539d4e80d4685b8f2bedc79076ff0ff6c1b911\"\u003e\u003ccode\u003e91539d4\u003c/code\u003e\u003c/a\u003e Bump actions/cache from 5.0.3 to 5.0.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mozilla/bleach/commit/cd47b4ce495859065da23c2116f651e591e1e90d\"\u003e\u003ccode\u003ecd47b4c\u003c/code\u003e\u003c/a\u003e fix: handle left-angle-bracket that's not a tag (\u003ca href=\"https://redirect.github.com/mozilla/bleach/issues/733\"\u003e#733\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/mozilla/bleach/compare/v4.1.0...v6.4.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `blessed` from 1.39.0 to 1.47.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jquast/blessed/releases\"\u003eblessed's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.46\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix DA1 response for some terminals (kitty) by \u003ca href=\"https://github.com/jquast\"\u003e\u003ccode\u003e@​jquast\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jquast/blessed/pull/392\"\u003ejquast/blessed#392\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved remote truecolor detection by unique TERM by \u003ca href=\"https://github.com/jquast\"\u003e\u003ccode\u003e@​jquast\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jquast/blessed/pull/394\"\u003ejquast/blessed#394\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd sugar for some extended capabilities by \u003ca href=\"https://github.com/jquast\"\u003e\u003ccode\u003e@​jquast\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jquast/blessed/pull/393\"\u003ejquast/blessed#393\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jquast/blessed/compare/1.45...1.46\"\u003ehttps://github.com/jquast/blessed/compare/1.45...1.46\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e1.43: bugfix leaked XTGETTCAP responses into inkey()\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix leaked XTGETTCAP responses into inkey() by \u003ca href=\"https://github.com/jquast\"\u003e\u003ccode\u003e@​jquast\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jquast/blessed/pull/383\"\u003ejquast/blessed#383\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jquast/blessed/compare/1.42...1.43\"\u003ehttps://github.com/jquast/blessed/compare/1.42...1.43\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e1.42: bugfix regression: cbreak and raw() were not thread-safe\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: regression in \u003ccode\u003eTerminal.cbreak()\u003c/code\u003e and \u003ccode\u003eraw\u003c/code\u003e were not thread-safe broken in versions 1.40 and 1.41, remove signal ignore of SIGTTOU \u003ca href=\"https://redirect.github.com/jquast/blessed/issues/380\"\u003e#380\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jquast/blessed/compare/1.41...1.42\"\u003ehttps://github.com/jquast/blessed/compare/1.41...1.42\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e1.41: bugfix get_location() regression\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix get_location() return type in 1.40 release by \u003ca href=\"https://github.com/jquast\"\u003e\u003ccode\u003e@​jquast\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jquast/blessed/pull/379\"\u003ejquast/blessed#379\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jquast/blessed/compare/1.40...1.41\"\u003ehttps://github.com/jquast/blessed/compare/1.40...1.41\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e1.40: XTGETTCAP support\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ecurses-free jinxed 2.0 integration by \u003ca href=\"https://github.com/jquast\"\u003e\u003ccode\u003e@​jquast\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jquast/blessed/pull/374\"\u003ejquast/blessed#374\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eQuery XTGETTCAP on Terminal init by \u003ca href=\"https://github.com/jquast\"\u003e\u003ccode\u003e@​jquast\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jquast/blessed/pull/375\"\u003ejquast/blessed#375\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jquast/blessed/compare/1.39...1.40\"\u003ehttps://github.com/jquast/blessed/compare/1.39...1.40\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e1.17.9: Initial support for Python 3.10\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: Now imports on 3.10+\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.15.0: Disable various integration tests, support python 3.7\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003e1.14.0: bugfix term.wrap for text containing newlines\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: term.wrap misbehaved for text containing newlines, \u003ca href=\"https://redirect.github.com/jquast/blessed/issues/74\"\u003e#74\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.13.0: new Terminal.split_seqs() function, speed enhancement\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eenhancement: method \u003ccode\u003eTerminal.split_seqs\u003c/code\u003e introduced, and 4x cost reduction in related sequence-aware functions, \u003ca href=\"https://redirect.github.com/jquast/blessed/issues/29\"\u003e#29\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003edeprecated: function \u003ccode\u003eblessed.sequences.measure_length\u003c/code\u003e superseded by \u003ccode\u003eblessed.sequences.iter_parse\u003c/code\u003e if necessary.\u003c/li\u003e\n\u003cli\u003edeprecated: warnings about \u0026quot;binary-packed capabilities\u0026quot; are no longer emitted on strange terminal types, making best effort.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.12.0: add Terminal.get_location() method\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eenhancement: method Terminal.get_location\u003ccode\u003ereturns the\u003c/code\u003e(row, col)`` position of the cursor at the time of call for attached terminal.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jquast/blessed/blob/master/docs/history.rst\"\u003eblessed's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e.. py:currentmodule:: blessed.terminal\u003c/p\u003e\n\u003ch1\u003eVersion History\u003c/h1\u003e\n\u003cp\u003e1.47\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: :meth:\u003ccode\u003e~Terminal.does_sixel\u003c/code\u003e now returns \u003ccode\u003eTrue\u003c/code\u003e for SyncTERM using special-case\nmatching of its illegal DA1 response.\u003c/li\u003e\n\u003cli\u003ebugfix: legacy SGR mouse decoder reported no-button motion event (mode 1003) as \u003ccode\u003eLEFT_MOTION\u003c/code\u003e\ninstead of \u003ccode\u003eMOTION\u003c/code\u003e, :ghpull:\u003ccode\u003e398\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003ebugfix: match keyboard input \u003ccode\u003e\\x1b\\n\u003c/code\u003e as \u003ccode\u003eKEY_ALT_ENTER\u003c/code\u003e instead of \u003ccode\u003eKEY_CTRL_ALT_J\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e1.46\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: :meth:\u003ccode\u003e~Terminal.does_sixel\u003c/code\u003e failed to detect DA1 and caused the response to \u0026quot;leak\u0026quot; into\nnext call to :meth:\u003ccode\u003e~Terminal.inkey\u003c/code\u003e for some terminals of unmatched patterns (e.g., kitty).\u003c/li\u003e\n\u003cli\u003eimprove: add new sugar for extended cap-defined styles, like 'clear_scrollback' (common),\n'strikethrough', and 'overline' (not common).\u003c/li\u003e\n\u003cli\u003eimprove: Truecolor support by unique TERM, improves remote sessions like SSH that do not forward\n\u003ccode\u003eCOLORTERM\u003c/code\u003e, and, for the few terminals that do not respond to XTGETTCAP request for \u003ccode\u003eRGB\u003c/code\u003e:\n(kitty).\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e1.45\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: name consistency of kitty keyboard modifiers :ghpull:\u003ccode\u003e390\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e1.44\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eimprove: reduce errant XTGETTCAP output for Terminal.app and ConEmu.exe :ghpull:\u003ccode\u003e385\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e1.43\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: regression of XTGETTCAP responses leaking into first call for empty/non-response\nterminals (libvte/Gnome Terminal), in versions 1.40 to 1.42 :ghpull:\u003ccode\u003e383\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e1.42\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: regression in :meth:\u003ccode\u003e~.Terminal.cbreak\u003c/code\u003e and :meth:\u003ccode\u003e~.Terminal.raw\u003c/code\u003e were not thread-safe\nbroken in versions 1.40 and 1.41, remove signal ignore of SIGTTOU :ghissue:\u003ccode\u003e380\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e1.41\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ebugfix: :meth:\u003ccode\u003e~.Terminal.get_location\u003c/code\u003e broken in 1.40, returned a generator instead of a tuple.\n:ghissue:\u003ccode\u003e378\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e1.40\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eimproved: jinxed_ is \u003cstrong\u003enow required on all platforms\u003c/strong\u003e, providing a curses-free and\n\u003ccode\u003esingleton-free \u0026lt;https://jinxed.readthedocs.io/en/stable/capabilities.html#singleton-free\u0026gt;\u003c/code\u003e_\nimplementation of the subset of curses_ used by blessed.  The jinxed_ 1.5.0 release provides a\nterminal \u003ccode\u003ecapability database \u0026lt;https://jinxed.readthedocs.io/en/stable/capabilities.html#database\u0026gt;\u003c/code\u003e of 45 terminals and their\ncommon aliases.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eimproved: Class initialization of :class:\u003ccode\u003e~.Terminal()\u003c/code\u003e now uses \u003ccode\u003eXTGETTCAP\u003c/code\u003e_ to determine\npreferred terminal name \u003ccode\u003eTN\u003c/code\u003e, 24-bit color support \u003ccode\u003eRGB\u003c/code\u003e, number of colors \u003ccode\u003eCo\u003c/code\u003e, \u003ccode\u003eitalic\u003c/code\u003e,\nand \u003ccode\u003eblink\u003c/code\u003e capabilities.\u003c/p\u003e\n\u003cp\u003eThis improves detection of Terminal \u003ccode\u003ekind\u003c/code\u003e and \u003ccode\u003enumber_of_colors\u003c/code\u003e over protocols like serial\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/jquast/blessed/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `boto3` from 1.43.8 to 1.43.50\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/a8ae7f0619b16600dfb006b07c55c3e276cbf21a\"\u003e\u003ccode\u003ea8ae7f0\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.50'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/b8c36a990c84df2cdec68b0af03194c619e3e8f1\"\u003e\u003ccode\u003eb8c36a9\u003c/code\u003e\u003c/a\u003e Bumping version to 1.43.50\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/fa19980a5c4eee55479fb56b444dc785a6e6b988\"\u003e\u003ccode\u003efa19980\u003c/code\u003e\u003c/a\u003e Add changelog entries from botocore\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/2ce2fd5ac8a6e5069465b4eface2938a940bc8b2\"\u003e\u003ccode\u003e2ce2fd5\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.49'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/d2937da5351e7da82f983c2c572ba35615746b62\"\u003e\u003ccode\u003ed2937da\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.49' into develop\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/159cb6abdba69c6a433ad2b83920e850643a85cc\"\u003e\u003ccode\u003e159cb6a\u003c/code\u003e\u003c/a\u003e Bumping version to 1.43.49\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/2b8f4d84ae0fb264813e0997f3e510d517b4a1ab\"\u003e\u003ccode\u003e2b8f4d8\u003c/code\u003e\u003c/a\u003e Add changelog entries from botocore\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/aa40f37ebe773ef7e8aadbeffee37aeaec8a29c2\"\u003e\u003ccode\u003eaa40f37\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.48'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/652b573c3d4853497e60f983ff2938d2c4efbb4e\"\u003e\u003ccode\u003e652b573\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.48' into develop\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/boto3/commit/13cce5d163edd8e436f51d61c9fde9619c48993b\"\u003e\u003ccode\u003e13cce5d\u003c/code\u003e\u003c/a\u003e Bumping version to 1.43.48\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/boto/boto3/compare/1.43.8...1.43.50\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `botocore` from 1.43.8 to 1.43.50\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/42b0340e335b1f633be78fa7e59832bb37951a68\"\u003e\u003ccode\u003e42b0340\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.50'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/febd30f4a24b77afe9ef211aad0675453d621618\"\u003e\u003ccode\u003efebd30f\u003c/code\u003e\u003c/a\u003e Bumping version to 1.43.50\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/31af253ee49bea34214380b92e7d0152d5f69fa4\"\u003e\u003ccode\u003e31af253\u003c/code\u003e\u003c/a\u003e Update endpoints model\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/e179889d6e2bc604b77b9785735d336612e7108a\"\u003e\u003ccode\u003ee179889\u003c/code\u003e\u003c/a\u003e Update to latest models\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/eceb63d43b437b7e5cc67251c07bdb583ee845bd\"\u003e\u003ccode\u003eeceb63d\u003c/code\u003e\u003c/a\u003e Bump the github-actions group with 3 updates (\u003ca href=\"https://redirect.github.com/boto/botocore/issues/3749\"\u003e#3749\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/eecee80c7891c35f2f60ec00d7c4fa81b5fce388\"\u003e\u003ccode\u003eeecee80\u003c/code\u003e\u003c/a\u003e Bump \u003ca href=\"https://github.com/astral-sh/ruff-pre-commit\"\u003ehttps://github.com/astral-sh/ruff-pre-commit\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/boto/botocore/issues/3745\"\u003e#3745\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/7d6402f9d49dfa0a873f07b57b888b8d5158738c\"\u003e\u003ccode\u003e7d6402f\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.49'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/10f305e588ce4ebe24dd0c8d8ff0e825782bbd85\"\u003e\u003ccode\u003e10f305e\u003c/code\u003e\u003c/a\u003e Merge branch 'release-1.43.49' into develop\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/2b632ee6822a4f254a02aae6e37b479ae77b688f\"\u003e\u003ccode\u003e2b632ee\u003c/code\u003e\u003c/a\u003e Bumping version to 1.43.49\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/boto/botocore/commit/7ef2356e4892dfb360bddfb0fba8632ac8a59797\"\u003e\u003ccode\u003e7ef2356\u003c/code\u003e\u003c/a\u003e Update to latest models\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/boto/botocore/compare/1.43.8...1.43.50\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `certifi` from 2026.4.22 to 2026.6.17\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/d0ac52f3d93a514224197c7efb66c41b1beae5d1\"\u003e\u003ccode\u003ed0ac52f\u003c/code\u003e\u003c/a\u003e 2026.06.17 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/418\"\u003e#418\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/d46de621787c609158579929f44b91ce731d01b8\"\u003e\u003ccode\u003ed46de62\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6.0.2 to 6.0.3 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/417\"\u003e#417\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/6c183ec39d81135350dd44abd0e5daefc8e35b9d\"\u003e\u003ccode\u003e6c183ec\u003c/code\u003e\u003c/a\u003e fix: update Requests docs link to canonical URL (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/415\"\u003e#415\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/36e35680e0dc42c70cd60bfe440e92e7137f5a1c\"\u003e\u003ccode\u003e36e3568\u003c/code\u003e\u003c/a\u003e Bump dessant/lock-threads from 6.0.0 to 6.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/d7ea151afc2ce6bef0555b9349902bd867e928dd\"\u003e\u003ccode\u003ed7ea151\u003c/code\u003e\u003c/a\u003e 2026.05.20 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/413\"\u003e#413\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/certifi/python-certifi/compare/2026.04.22...2026.06.17\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `cffi` from 2.0.0 to 2.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/python-cffi/cffi/releases\"\u003ecffi's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.1.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.15 and support for C extensions generated by CFFI\nto target the new \u003ccode\u003eabi3t\u003c/code\u003e free-threaded ABI.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.9.\u003c/li\u003e\n\u003cli\u003eAdded \u003ccode\u003ecffi-gen-src\u003c/code\u003e CLI to generate CFFI C extension source for alternate build backend support.\u003c/li\u003e\n\u003cli\u003eFixed crashes inside \u003ccode\u003e__delitem__\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eFixed \u0026quot;string too big\u0026quot; error under MSVC.\u003c/li\u003e\n\u003cli\u003eFixed mingw builds.\u003c/li\u003e\n\u003cli\u003eAdded support for arm64 iOS wheels.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/d9f6f70adac5ca9f260abf5405cf4d0373767b65\"\u003e\u003ccode\u003ed9f6f70\u003c/code\u003e\u003c/a\u003e New release 2.1.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/02a7b0e32db93964b9756537110119d74aa23425\"\u003e\u003ccode\u003e02a7b0e\u003c/code\u003e\u003c/a\u003e Misc pre-2.1 release/packaging cleanup (\u003ca href=\"https://redirect.github.com/python-cffi/cffi/issues/253\"\u003e#253\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/1362e5ddc5417f1350200d4d6183c3eb3da9cc8d\"\u003e\u003ccode\u003e1362e5d\u003c/code\u003e\u003c/a\u003e Move cffi-gen-src release note to 2.1.0 notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/a797055125e049fd79483d0dcdf8cff59c64c6e4\"\u003e\u003ccode\u003ea797055\u003c/code\u003e\u003c/a\u003e Make error message when embedding version test fails more friendly\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/f1f40a8e1667b9ef6cf8fe3c451829408feab018\"\u003e\u003ccode\u003ef1f40a8\u003c/code\u003e\u003c/a\u003e Update changelog\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/dc62c93af7be7c535dc17f621de2bfc99490d3bd\"\u003e\u003ccode\u003edc62c93\u003c/code\u003e\u003c/a\u003e Delete missed cp39 Windows builds\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/a34118009e64a7fed8ea49bdbad4d6a07494bb4f\"\u003e\u003ccode\u003ea341180\u003c/code\u003e\u003c/a\u003e Update version numbers to prepare for v2.1 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/9f04d8506a6c7186dc3be7316f21aab042e075cb\"\u003e\u003ccode\u003e9f04d85\u003c/code\u003e\u003c/a\u003e Mark test using inet_ntoa as thread-unsafe\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/5f127028caeb7750c4763f7381dd1b12c4747d95\"\u003e\u003ccode\u003e5f12702\u003c/code\u003e\u003c/a\u003e Fix flaky pytest-run-parallel CI crash\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-cffi/cffi/commit/26b3d3ae756138d4f9e8f42f063f73c26aa40c24\"\u003e\u003ccode\u003e26b3d3a\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into integrate-buildtool\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/python-cffi/cffi/compare/v2.0.0...v2.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `charset-normalizer` from 3.4.7 to 3.4.9\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jawah/charset_normalizer/releases\"\u003echarset-normalizer's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 3.4.9\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.8...3.4.9\"\u003e3.4.9\u003c/a\u003e (2026-07-07)\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRegression in our fallback path leading to a decode error. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/771\"\u003e#771\u003c/a\u003e)\nWe've yanked 3.4.8 as a result of that bug.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 3.4.8\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.7...3.4.8\"\u003e3.4.8\u003c/a\u003e (2026-07-06)\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/742\"\u003e#742\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUnnecessary json import at runtime (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/753\"\u003e#753\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eInverse capitalization not seen by noise detector (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/731\"\u003e#731\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eNo longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.\u003c/li\u003e\n\u003cli\u003eMicro-optimizations in our noise / coherence measurements.\u003c/li\u003e\n\u003cli\u003eNo longer using regex search by default for our preemptive charset mark algorithm.\u003c/li\u003e\n\u003cli\u003eRaised upperbound of setuptools to v83.\u003c/li\u003e\n\u003cli\u003eRaised upperbound of mypy(c) to v2.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRemoved\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRedundant UTF7 BOM marker (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/730\"\u003e#730\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md\"\u003echarset-normalizer's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.8...3.4.9\"\u003e3.4.9\u003c/a\u003e (2026-07-07)\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRegression in our fallback path leading to a decode error. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/771\"\u003e#771\u003c/a\u003e)\nWe've yanked 3.4.8 as a result of that bug.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.7...3.4.8\"\u003e3.4.8\u003c/a\u003e (2026-07-06)\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eWall import time due to cascade codec imports for our multibyte first sort of iana supported codecs (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/742\"\u003e#742\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUnnecessary json import at runtime (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/753\"\u003e#753\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eInverse capitalization not seen by noise detector (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/731\"\u003e#731\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eNo longer holding a global cache for our noise / coherence measurements. Relax RSS memory usage.\u003c/li\u003e\n\u003cli\u003eMicro-optimizations in our noise / coherence measurements.\u003c/li\u003e\n\u003cli\u003eNo longer using regex search by default for our preemptive charset mark algorithm.\u003c/li\u003e\n\u003cli\u003eRaised upperbound of setuptools to v83.\u003c/li\u003e\n\u003cli\u003eRaised upperbound of mypy(c) to v2.1.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRemoved\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRedundant UTF7 BOM marker (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/730\"\u003e#730\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/cc6840753f17f00dea4e339ce37507747217e916\"\u003e\u003ccode\u003ecc68407\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/772\"\u003e#772\u003c/a\u003e from jawah/fix-regression-fallback-path\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/152b923c87e212e11c9591ff0a29ff35df719c91\"\u003e\u003ccode\u003e152b923\u003c/code\u003e\u003c/a\u003e chore: release 3.4.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/2bc26076a86704fc19bc2ae811615b169373dea6\"\u003e\u003ccode\u003e2bc2607\u003c/code\u003e\u003c/a\u003e fix: unicodedecodeerror in fallback path\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/be252d70c9f45846f0e851cc4d1829328540c825\"\u003e\u003ccode\u003ebe252d7\u003c/code\u003e\u003c/a\u003e chore(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/767\"\u003e#767\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/71c7bdd25514e5631c17be397abb6a2974b26e5b\"\u003e\u003ccode\u003e71c7bdd\u003c/code\u003e\u003c/a\u003e chore(deps): bump actions/setup-python from 6.2.0 to 6.3.0 (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/768\"\u003e#768\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/aeea391cc95761f1353b3914afcdee7a6e7589da\"\u003e\u003ccode\u003eaeea391\u003c/code\u003e\u003c/a\u003e chore(deps): bump pypa/cibuildwheel from 3.4.1 to 4.1.0 (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/758\"\u003e#758\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/a6f8febd210c129ea741e6562fc06ee1ac437487\"\u003e\u003ccode\u003ea6f8feb\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/770\"\u003e#770\u003c/a\u003e from jawah/unblock-ci\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/528e16ce9105d10ea6cc66d41f237ba3c64c4392\"\u003e\u003ccode\u003e528e16c\u003c/code\u003e\u003c/a\u003e chore: add osv-scanner.toml\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/5993498b06d0bcb0cc1aaab1255742fef39a5aca\"\u003e\u003ccode\u003e5993498\u003c/code\u003e\u003c/a\u003e chore: ast_serialize musl missing prebuilt riscv,s390x,ppc64le\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/aa2ddd8fb788b98a815f25c37609e919105d1dbb\"\u003e\u003ccode\u003eaa2ddd8\u003c/code\u003e\u003c/a\u003e Release 3.4.8 (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/766\"\u003e#766\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jawah/charset_normalizer/compare/3.4.7...3.4.9\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `django` from 5.2.14 to 6.0.7\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/e2a424605ac2e7e6e799496542fb2997207e2f23\"\u003e\u003ccode\u003ee2a4246\u003c/code\u003e\u003c/a\u003e [6.0.x] Bumped version for 6.0.7 release.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/a5de13f1491f1dbf2bb0ad9b91570524ebbc8acd\"\u003e\u003ccode\u003ea5de13f\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed CVE-2026-53878 -- Prevented newlines from being accepted in Dom...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/38dfbd27d7d4f4e6eaa087d7a90f2613fbf55b3a\"\u003e\u003ccode\u003e38dfbd2\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed CVE-2026-53877 -- Prevented heap buffer over-read when creating...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/64f9a2b2283fde3ec69fb0dfe441cf0f6f411ba3\"\u003e\u003ccode\u003e64f9a2b\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed CVE-2026-48588 -- Prevented caching of responses that set cooki...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/c26957a58241037f5849171f35177b95c7ec6660\"\u003e\u003ccode\u003ec26957a\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed flatpages synopsis in docs.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/0b60f44b77510c00ca79403560987cfbaf5a0037\"\u003e\u003ccode\u003e0b60f44\u003c/code\u003e\u003c/a\u003e [6.0.x] Added FILE_UPLOAD_DIRECTORY_PERMISSIONS to docs settings index.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/d928e3060b258fcd002c80d80bb40390efc988db\"\u003e\u003ccode\u003ed928e30\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed \u003ca href=\"https://redirect.github.com/django/django/issues/37172\"\u003e#37172\u003c/a\u003e -- Linked to upload handlers section in FILE_UPLOAD_* se...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/e18935cc265aa30079b9c2d280e53cfb91679bba\"\u003e\u003ccode\u003ee18935c\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed \u003ca href=\"https://redirect.github.com/django/django/issues/37158\"\u003e#37158\u003c/a\u003e -- Reordered the contribution checklist sections.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/490eb9cfb68848b88c91f2b6c75d57e2620c7304\"\u003e\u003ccode\u003e490eb9c\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed document referenced in multiple toctrees warning in docs/intern...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/django/django/commit/748a9b53c5864f87f4501378d2748199ff0063bb\"\u003e\u003ccode\u003e748a9b5\u003c/code\u003e\u003c/a\u003e [6.0.x] Fixed duplicate target name in docs/internals/howto-release-django.txt.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/django/django/compare/5.2.14...6.0.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `django-allauth` from 65.14.3 to 65.18.0\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/sponsors/pennersr/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `django-filter` from 25.2 to 26.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/carltongibson/django-filter/blob/main/CHANGES.rst\"\u003edjango-filter's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 26.1 (2026-07-11)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eAdded testing for Django 6.1.\u003c/p\u003e\n\u003cp\u003eDRF integration will require the upcoming DRF v3.18.\nSee \u003ca href=\"https://redirect.github.com/encode/django-rest-framework/pull/9978\"\u003eencode/django-rest-framework#9978\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded testing against Python 3.14.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/carltongibson/django-filter/commit/52c3c0f21ef8fe281982ec0e95a3675cd8402214\"\u003e\u003ccode\u003e52c3c0f\u003c/code\u003e\u003c/a\u003e Set date and bump version for 26.1 release.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/carltongibson/django-filter/commit/6a3222aaf83170df0f967423444d5312b99a3d69\"\u003e\u003ccode\u003e6a3222a\u003c/code\u003e\u003c/a\u003e Add testing for Python 3.14.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/carltongibson/django-filter/commit/aa3bd8e87136d4730f4eb44b3386e52c218bcf66\"\u003e\u003ccode\u003eaa3bd8e\u003c/code\u003e\u003c/a\u003e Added testing against Django 6.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/carltongibson/django-filter/commit/ec717ea11378a4dc003cbe2f77b5211d8815a0b6\"\u003e\u003ccode\u003eec717ea\u003c/code\u003e\u003c/a\u003e Correct Language header in Greek locale file (el) (\u003ca href=\"https://redirect.github.com/carltongibson/django-filter/issues/1751\"\u003e#1751\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/carltongibson/django-filter/commit/31b297ca2414218052476ba458c4d1eedc0a0f99\"\u003e\u003ccode\u003e31b297c\u003c/code\u003e\u003c/a\u003e Bump the github-actions group with 2 updates (\u003ca href=\"https://redirect.github.com/carltongibson/django-filter/issues/1733\"\u003e#1733\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/carltongibson/django-filter/commit/590c0a3e7d73fafa4fb25df45b53fcc79258d09f\"\u003e\u003ccode\u003e590c0a3\u003c/code\u003e\u003c/a\u003e Fix version range for Django 6.0 (\u003ca href=\"https://redirect.github.com/carltongibson/django-filter/issues/1731\"\u003e#1731\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/carltongibson/django-filter/commit/6204bc4eb75edf7ba766fc256d72a68fa80c3029\"\u003e\u003ccode\u003e6204bc4\u003c/code\u003e\u003c/a\u003e Added release date for v25.2.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/carltongibson/django-filter/compare/25.2...26.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `django-js-asset` from 3.1.2 to 4.0.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/feincms/django-js-asset/blob/main/CHANGELOG.rst\"\u003edjango-js-asset's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e.. _changelog:\u003c/p\u003e\n\u003ch1\u003eChange log\u003c/h1\u003e\n\u003cp\u003eNext version\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Fixed ``js_asset.Media`` crashing with an ``AttributeError`` when rendering an\n  asset that only implements Django's plain ``__html__`` contract (neither a\n  ``MediaAsset`` nor one of our ``ImportMap``/``JSON`` types). Such assets now\n  fall back to ``__html__()`` exactly like ``django.forms.Media`` does; the\n  nonce cannot be threaded into an opaque ``__html__`` asset, same as with stock\n  Django.\n- Corrected the docs around Django 6.1 support. Thanks James Bligh!\n- Finally set up a documentation site at Read the Docs for django-js-asset.\n\u003cp\u003e4.0 (2026-06-11)\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cp\u003eThis is a major release. Most code keeps working unchanged and the rendered\nHTML is the same, but \u003cstrong\u003eif you use import maps the upgrade is not automatic\u003c/strong\u003e --\nsee the import-map note at the end.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003ejs_asset.Media\u003c/code\u003e, a \u003ccode\u003edjango.forms.Media\u003c/code\u003e subclass with two extra\nabilities. First, it merges every embedded \u003ccode\u003eImportMap\u003c/code\u003e into a single\n\u003ccode\u003e\u0026lt;script type=\u0026quot;importmap\u0026quot;\u0026gt;\u003c/code\u003e rendered before any other script -- this\nreplaces the old global \u003ccode\u003eimportmap\u003c/code\u003e object and works no matter how many\nmedia objects Django combines. Second, it applies a request-scoped CSP nonce\nto the tags it renders. It implements \u003ccode\u003e__add__\u003c/code\u003e \u003cstrong\u003eand\u003c/strong\u003e \u003ccode\u003e__radd__\u003c/code\u003e, so it\nkeeps its type -- and its nonce -- when combined with a plain \u003ccode\u003eforms.Media\u003c/code\u003e\nfrom either side (e.g. while Django collects form and widget media). The nonce\ncan be passed to the constructor (\u003ccode\u003enonce=\u003c/code\u003e), copied onto a clone with\n\u003ccode\u003ewith_nonce()\u003c/code\u003e, or passed to \u003ccode\u003erender(nonce=...)\u003c/code\u003e; \u003ccode\u003erender()\u003c/code\u003e also accepts\n\u003ccode\u003eattrs={\u0026quot;nonce\u0026quot;: ...}\u003c/code\u003e so it plugs straight into Django 6.2's\n\u003ccode\u003e{% csp_nonce_attr %}\u003c/code\u003e tag. \u003ccode\u003eMedia.from_media()\u003c/code\u003e wraps an existing\n\u003ccode\u003eforms.Media\u003c/code\u003e instance (e.g. \u003ccode\u003eform.media\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eJS\u003c/code\u003e and \u003ccode\u003eCSS\u003c/code\u003e now \u003cem\u003eproduce\u003c/em\u003e Django's own \u003ccode\u003eScript\u003c/code\u003e and \u003ccode\u003eStylesheet\u003c/code\u003e\nobjects (backported via \u003ccode\u003ejs_asset._compat\u003c/code\u003e on Django versions that lack\nthem) instead of being standalone dataclasses. They therefore share merge\nbuckets with native Django assets and with bare path strings, so the same\nfile is no longer rendered more than once when \u003ccode\u003ejs_asset\u003c/code\u003e assets, plain\nstrings and Django's auto-wrapped assets meet in \u003ccode\u003eforms.Media.merge()\u003c/code\u003e.\n\u003ccode\u003eisinstance(x, JS)\u003c/code\u003e / \u003ccode\u003eisinstance(x, CSS)\u003c/code\u003e keep working (via a metaclass).\nInline CSS (\u003ccode\u003eCSS(src, inline=True)\u003c/code\u003e) is rendered by a small dedicated\n\u003ccode\u003eInlineStyle\u003c/code\u003e asset. Rendered output is unchanged.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eScript\u003c/code\u003e, \u003ccode\u003eStylesheet\u003c/code\u003e, \u003ccode\u003eMediaAsset\u003c/code\u003e and \u003ccode\u003eInlineStyle\u003c/code\u003e can now be\nimported from \u003ccode\u003ejs_asset\u003c/code\u003e -- prefer these in \u003ccode\u003eisinstance\u003c/code\u003e checks over\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/7c024a3ef83a1c2951f2ab3925e85b81ebbc8bc0\"\u003e\u003ccode\u003e7c024a3\u003c/code\u003e\u003c/a\u003e django-js-asset 4.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/59aa7e529ef7052c3c1710e8a673c14c852334f6\"\u003e\u003ccode\u003e59aa7e5\u003c/code\u003e\u003c/a\u003e Fix \u003cstrong\u003ehtml\u003c/strong\u003e objects in Media\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/b3c515c793185d96d43124a8239267a535bdd18f\"\u003e\u003ccode\u003eb3c515c\u003c/code\u003e\u003c/a\u003e django-js-asset 4.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/8a343389d9500999bd3397a1d1c44cb5ee709a00\"\u003e\u003ccode\u003e8a34338\u003c/code\u003e\u003c/a\u003e Address review comments\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/b7d05eb0f4d7548219b06eb4057fe908c2e85a23\"\u003e\u003ccode\u003eb7d05eb\u003c/code\u003e\u003c/a\u003e Remove the global importmap and update the guidance accordingly\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/3213b9bd209527e989c0fb8f552e7941407460cc\"\u003e\u003ccode\u003e3213b9b\u003c/code\u003e\u003c/a\u003e Increase interoperability with Django's own object-based media assets\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/cfe3b529f22bd8dcd1abf193aa4af0f1e96681be\"\u003e\u003ccode\u003ecfe3b52\u003c/code\u003e\u003c/a\u003e Add a Media subclass with import-map merging and CSP nonce support\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/6708307bd5e1d5cc18cb58da63e2c6ace07e653c\"\u003e\u003ccode\u003e6708307\u003c/code\u003e\u003c/a\u003e dj62 does not exist yet as a release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/9961d4871605432a9923d2a844d51d9efca47c73\"\u003e\u003ccode\u003e9961d48\u003c/code\u003e\u003c/a\u003e Run tests with newer Django and Python versions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/feincms/django-js-asset/commit/f77abf57e6754612793c9976305f704f61dfceff\"\u003e\u003ccode\u003ef77abf5\u003c/code\u003e\u003c/a\u003e Bump the github-actions group with 2 updates (\u003ca href=\"https://redirect.github.com/feincms/django-js-asset/issues/20\"\u003e#20\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/feincms/django-js-asset/compare/3.1.2...4.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `django-maintenance-mode` from 0.22.0 to 0.23.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/fabiocaccamo/django-maintenance-mode/releases\"\u003edjango-maintenance-mode's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.23.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003ePython 3.14\u003c/code\u003e and \u003ccode\u003eDjango 6.0\u003c/code\u003e support.\u003c/li\u003e\n\u003cli\u003eAdd scheduled maintenance mode support: \u003ccode\u003eset_maintenance_mode(True, start=..., end=...)\u003c/code\u003e and \u003ccode\u003emanage.py maintenance_mode on --start ... --end ...\u003c/code\u003e (maintenance mode automatically activates/deactivates itself based on the scheduled datetimes). \u003ca href=\"https://redirect.github.com/fabiocaccamo/django-maintenance-mode/issues/64\"\u003e#64\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003eNote for custom state backends consumers: \u003ccode\u003eget_value()\u003c/code\u003e now returns \u003ccode\u003ebool\u003c/code\u003e or \u003ccode\u003edict\u003c/code\u003e (scheduled state), and the state file format is extended accordingly (running \u003ccode\u003emaintenance_mode off\u003c/code\u003e restores the plain bool format).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eMAINTENANCE_MODE_LOGOUT_STAFF_USER\u003c/code\u003e and \u003ccode\u003eMAINTENANCE_MODE_LOGOUT_SUPERUSER\u003c/code\u003e settings to override the \u003ccode\u003eMAINTENANCE_MODE_LOGOUT_AUTHENTICATED_USER\u003c/code\u003e behavior for staff users and superusers (if \u003ccode\u003eNone\u003c/code\u003e, default, they inherit the \u003ccode\u003eMAINTENANCE_MODE_LOGOUT_AUTHENTICATED_USER\u003c/code\u003e behavior). \u003ca href=\"https://redirect.github.com/fabiocaccamo/django-maintenance-mode/issues/191\"\u003e#191\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eMAINTENANCE_MODE_RESPONSE_TYPE\u003c/code\u003e to be the path of a function that receives the request and returns the response type (\u003ccode\u003e\u0026quot;html\u0026quot;\u003c/code\u003e or \u003ccode\u003e\u0026quot;json\u0026quot;\u003c/code\u003e). \u003ca href=\"https://redirect.github.com/fabiocaccamo/django-maintenance-mode/issues/204\"\u003e#204\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eMAINTENANCE_MODE_GET_AUTHENTICATED_USER\u003c/code\u003e setting to support non-session authentication (eg. \u003ccode\u003eJWT\u003c/code\u003e / token authentication with \u003ccode\u003edjango-rest-framework\u003c/code\u003e). \u003ca href=\"https://redirect.github.com/fabiocaccamo/django-maintenance-mode/issues/233\"\u003e#233\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove middleware position docs. \u003ca href=\"https://redirect.github.com/fabiocaccamo/django-maintenance-mode/issues/251\"\u003e#251\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/fabiocaccamo/django-maintenance-mode/blob/main/CHANGELOG.md\"\u003edjango-maintenance-mode's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/fabiocaccamo/django-maintenance-mode/releases/tag/0.23.0\"\u003e0.23.0\u003c/a\u003e - 2026-07-13\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003ePython 3.14\u003c/code\u003e and \u003ccode\u003eDjango 6.0\u003c/code\u003e support.\u003c/li\u003e\n\u003cli\u003eAdd scheduled maintenance mode support: \u003ccode\u003eset_maintenance_mode(True, start=..., end=...)\u003c/code\u003e and \u003ccode\u003emanage.py maintenance_mode on --start ... --end ...\u003c/code\u003e (maintenance mode automatically activates/deactivates itself based on the scheduled datetimes). \u003ca href=\"https://redirect.github.com/fabiocaccamo/django-maintenance-mode/issues/64\"\u003e#64\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003eNote for custom state backends consumers: \u003ccode\u003eget_value()\u003c/code\u003e now returns \u003ccode\u003ebool\u003c/code\u003e or \u003ccode\u003edict\u003c/code\u003e (scheduled state), and the state file format is extended accordingly (running \u003ccode\u003emaintenance_mode off\u003c/code\u003e restores the plain bool format).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eMAINTE...\n\n_Description has been truncated_","html_url":"https://github.com/artursampaio-gc/goproduct/pull/26","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/artursampaio-gc%2Fgoproduct/issues/26","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/26/packages"}},{"old_version":"6.0.0","new_version":"6.1.0","update_type":"minor","path":null,"pr_created_at":"2026-07-01T18:51:27.000Z","version_change":"6.0.0 → 6.1.0","issue":{"uuid":"4788376467","node_id":"PR_kwDOPJsOlc7s0ZDN","number":3,"state":"open","title":"chore(deps): bump the uv group across 2 directories with 20 updates","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-07-01T18:51:27.000Z","updated_at":"2026-07-01T18:55:01.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"uv","update_count":20,"packages":[{"name":"nltk","old_version":"3.9.1","new_version":"3.9.4","repository_url":"https://github.com/nltk/nltk"},{"name":"authlib","old_version":"1.6.0","new_version":"1.6.12","repository_url":"https://github.com/authlib/authlib"},{"name":"cryptography","old_version":"45.0.5","new_version":"48.0.1","repository_url":"https://github.com/pyca/cryptography"},{"name":"fastmcp","old_version":"2.10.5","new_version":"3.2.0","repository_url":"https://github.com/PrefectHQ/fastmcp"},{"name":"idna","old_version":"3.10","new_version":"3.15","repository_url":"https://github.com/kjd/idna"},{"name":"joserfc","old_version":"1.6.4","new_version":"1.6.7","repository_url":"https://github.com/authlib/joserfc"},{"name":"langchain-core","old_version":"1.1.0","new_version":"1.3.3","repository_url":"https://github.com/langchain-ai/langchain"},{"name":"langchain-text-splitters","old_version":"1.0.0","new_version":"1.1.2","repository_url":"https://github.com/langchain-ai/langchain"},{"name":"langsmith","old_version":"0.4.7","new_version":"0.8.18","repository_url":"https://github.com/langchain-ai/langsmith-sdk"},{"name":"lxml","old_version":"6.0.0","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"},{"name":"pillow","old_version":"11.3.0","new_version":"12.2.0","repository_url":"https://github.com/python-pillow/Pillow"},{"name":"pyjwt","old_version":"2.10.1","new_version":"2.13.0","repository_url":"https://github.com/jpadilla/pyjwt"},{"name":"python-multipart","old_version":"0.0.20","new_version":"0.0.31","repository_url":"https://github.com/Kludex/python-multipart"},{"name":"requests","old_version":"2.32.4","new_version":"2.33.0","repository_url":"https://github.com/psf/requests"},{"name":"starlette","old_version":"0.46.2","new_version":"1.3.1","repository_url":"https://github.com/Kludex/starlette"},{"name":"transformers","old_version":"4.53.2","new_version":"5.3.0","repository_url":"https://github.com/huggingface/transformers"},{"name":"ujson","old_version":"5.10.0","new_version":"5.13.0","repository_url":"https://github.com/ultrajson/ultrajson"},{"name":"urllib3","old_version":"2.5.0","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"}],"path":null,"ecosystem":"pip"},"body":"Bumps the uv group with 18 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [nltk](https://github.com/nltk/nltk) | `3.9.1` | `3.9.4` |\n| [authlib](https://github.com/authlib/authlib) | `1.6.0` | `1.6.12` |\n| [cryptography](https://github.com/pyca/cryptography) | `45.0.5` | `48.0.1` |\n| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `2.10.5` | `3.2.0` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [joserfc](https://github.com/authlib/joserfc) | `1.6.4` | `1.6.7` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `1.1.0` | `1.3.3` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `1.0.0` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.4.7` | `0.8.18` |\n| [lxml](https://github.com/lxml/lxml) | `6.0.0` | `6.1.0` |\n| [pillow](https://github.com/python-pillow/Pillow) | `11.3.0` | `12.2.0` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.31` |\n| [requests](https://github.com/psf/requests) | `2.32.4` | `2.33.0` |\n| [starlette](https://github.com/Kludex/starlette) | `0.46.2` | `1.3.1` |\n| [transformers](https://github.com/huggingface/transformers) | `4.53.2` | `5.3.0` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.13.0` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.5.0` | `2.7.0` |\n\nBumps the uv group with 19 updates in the /docker directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pytest](https://github.com/pytest-dev/pytest) | `9.0.2` | `9.0.3` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.1` | `3.9.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [authlib](https://github.com/authlib/authlib) | `1.6.0` | `1.6.12` |\n| [cryptography](https://github.com/pyca/cryptography) | `45.0.5` | `48.0.1` |\n| [fastmcp](https://github.com/PrefectHQ/fastmcp) | `2.10.5` | `3.2.0` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `1.1.0` | `1.3.3` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `1.0.0` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.4.7` | `0.8.18` |\n| [lxml](https://github.com/lxml/lxml) | `6.0.0` | `6.1.0` |\n| [pillow](https://github.com/python-pillow/Pillow) | `11.3.0` | `12.2.0` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.31` |\n| [requests](https://github.com/psf/requests) | `2.32.4` | `2.33.0` |\n| [starlette](https://github.com/Kludex/starlette) | `0.46.2` | `1.3.1` |\n| [transformers](https://github.com/huggingface/transformers) | `4.53.2` | `5.3.0` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.13.0` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.5.0` | `2.7.0` |\n\n\nUpdates `nltk` from 3.9.1 to 3.9.4\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/nltk/nltk/blob/develop/ChangeLog\"\u003enltk's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eVersion 3.10.0 2026-06-11\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce the stricter \u003ccode\u003enltk.pathsec\u003c/code\u003e security policy by default\u003c/li\u003e\n\u003cli\u003eDocument the new security model and migration guidance\u003c/li\u003e\n\u003cli\u003eHarden resource loading against path traversal and SSRF/DNS-rebinding\u003c/li\u003e\n\u003cli\u003eHarden downloader path handling and block XML entity expansion\u003c/li\u003e\n\u003cli\u003eClose remaining corpus-reader security edge cases\u003c/li\u003e\n\u003cli\u003eReplace unsafe \u003ccode\u003eexec()\u003c/code\u003e usage in the utility CLI\u003c/li\u003e\n\u003cli\u003eWarn on unpickling user-provided pickles\u003c/li\u003e\n\u003cli\u003eAdd HuggingFace datasets integration (\u003ccode\u003enltk.huggingface\u003c/code\u003e)\u003c/li\u003e\n\u003cli\u003eAlign TnT with Brants (2000) specifications\u003c/li\u003e\n\u003cli\u003eFix PorterStemmer irregular-form lowercasing in NLTK mode\u003c/li\u003e\n\u003cli\u003eFix TransitionParser sparse index dtype for scikit-learn 1.9\u003c/li\u003e\n\u003cli\u003eFix TextCat tie handling\u003c/li\u003e\n\u003cli\u003eFix WordNet object comparisons for incompatible types\u003c/li\u003e\n\u003cli\u003eCache WordNet max depth lazily for \u003ccode\u003elch_similarity()\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFix CCG variable direction, substitution, and type-raising bugs\u003c/li\u003e\n\u003cli\u003eFix Jaro similarity for single-character and empty-string cases\u003c/li\u003e\n\u003cli\u003eImprove CI and release-maintenance workflows\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to the following contributors to 3.10.0:\n13rac1, alvations, bowiechen, devesh-2002, ekaf, elias-ba,\nhaosenwang1018, HyperPS, ihitamandal, jancallewaert, jhnwnstd,\nJuanIMartinezB, Lemm1, LinZiyuu, Mr-Neutr0n, PastelStorm,\nscruge1, Syzygy2048, ylwango613, yzhaoinuw\u003c/p\u003e\n\u003cp\u003eVersion 3.9.4 2026-03-24\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eSupport Python 3.14\u003c/li\u003e\n\u003cli\u003eFix bug in Levenshtein distance when substitution_cost \u0026gt; 2\u003c/li\u003e\n\u003cli\u003eFix bug in Treebank detokeniser re quote ordering\u003c/li\u003e\n\u003cli\u003eFix bug in Jaro similarity for empty strings\u003c/li\u003e\n\u003cli\u003eSeveral security enhancements\u003c/li\u003e\n\u003cli\u003eFix GHSA-rf74-v2fm-23pw: unbounded recursion in JSONTaggedDecoder\u003c/li\u003e\n\u003cli\u003eImplement TextTiling vocabulary introduction method (Hearst 1997)\u003c/li\u003e\n\u003cli\u003eFix ALINE feature matrix errors and add comprehensive tests\u003c/li\u003e\n\u003cli\u003eSupport multiple VerbNet versions, fix longid/shortid regex for VerbNet ids\u003c/li\u003e\n\u003cli\u003eLet downloader fallback to md5 when sha256 is unavailable\u003c/li\u003e\n\u003cli\u003eSeveral other minor bugfixes and code cleanups\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to the following contributors to 3.9.4:\nMin-Yen Kan, Eric Kafe, Emily Voss, bowiechen, Hrudhai01,\njancallewaert, Mr-Neutr0n, pollak.peter89, ylwango613,\u003c/p\u003e\n\u003cp\u003eVersion 3.9.3 2026-02-21\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix CVE-2025-14009: secure ZIP extraction in nltk.downloader (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3468\"\u003e#3468\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBlock path traversal/arbitrary reads in nltk.data for protocol-less refs (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3467\"\u003e#3467\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBlock path traversal/abs paths in corpus readers and FS pointers (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3479\"\u003e#3479\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3480\"\u003e#3480\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eValidate external StanfordSegmenter JARs using SHA256 (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3477\"\u003e#3477\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/ad9c96ba00a16923ffe917eacf63f1707bfa2d08\"\u003e\u003ccode\u003ead9c96b\u003c/code\u003e\u003c/a\u003e Update copyright year\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/7edcddfda566627b897397397cc4d10ae91cb86d\"\u003e\u003ccode\u003e7edcddf\u003c/code\u003e\u003c/a\u003e Updates for 3.9.4 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/67a2736f89b286b028db08bd247134f17a11fc6b\"\u003e\u003ccode\u003e67a2736\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3180\"\u003e#3180\u003c/a\u003e from yzhaoinuw/bug-on-edit_distance_align\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/2b17ac5358a1c8d4b97455766efde0b786e6cdb2\"\u003e\u003ccode\u003e2b17ac5\u003c/code\u003e\u003c/a\u003e Fix edit_distance_align backtrace for high substitution costs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/4b72976a6ff3d180ed4012f11843e611a8f89516\"\u003e\u003ccode\u003e4b72976\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3018\"\u003e#3018\u003c/a\u003e from JuanIMartinezB/bug/shortid-longid\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/8a5619f53a281149e5342b1a00fe05fe2fc6517f\"\u003e\u003ccode\u003e8a5619f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3222\"\u003e#3222\u003c/a\u003e from Syzygy2048/feature/texttiling-vocabulary-introd...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/c6574d755e02b6163d9cd1d0b407076940e08864\"\u003e\u003ccode\u003ec6574d7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3289\"\u003e#3289\u003c/a\u003e from ihitamandal/codeflash/optimize-windowdiff-2024-...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/98ff5d9eaa1a81511873b9aef857944519c28dc4\"\u003e\u003ccode\u003e98ff5d9\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3435\"\u003e#3435\u003c/a\u003e from Hrudhai01/fix-3260-detokenize-quotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/aec4fce1b84ad725b8975f7365b23a4f626572a9\"\u003e\u003ccode\u003eaec4fce\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3522\"\u003e#3522\u003c/a\u003e from ekaf/pathsec\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/eec4ee3591cb9cb8b8c2989f08012608c841d532\"\u003e\u003ccode\u003eeec4ee3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3526\"\u003e#3526\u003c/a\u003e from nltk/update-contributing\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/nltk/nltk/compare/3.9.1...3.9.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `authlib` from 1.6.0 to 1.6.12\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/authlib/authlib/releases\"\u003eauthlib's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.6.12\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eInvalidScopeError\u003c/code\u003e  in \u003ccode\u003eOpenIDImplicitGrant\u003c/code\u003e and \u003ccode\u003eOpenIDHybridGrant\u003c/code\u003e.\n\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.11...v1.6.12\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.11...v1.6.12\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.11\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.10...v1.6.11\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.10...v1.6.11\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix CSRF issue with starlette client\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.10\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.9...v1.6.10\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.9...v1.6.10\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eUnsupportedResponseTypeError\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.9\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.8...v1.6.9\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.8...v1.6.9\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eChanges in \u003ccode\u003ejose\u003c/code\u003e module\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eNot using header's \u003ccode\u003ejwk\u003c/code\u003e automatically\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eES256K\u003c/code\u003e into default jwt algorithms\u003c/li\u003e\n\u003cli\u003eRemove deprecated algorithm from default registry\u003c/li\u003e\n\u003cli\u003eGenerate random \u003ccode\u003ecek\u003c/code\u003e when \u003ccode\u003ecek\u003c/code\u003e length doesn't match\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.8\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.7...v1.6.8\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.7...v1.6.8\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eEdDSA\u003c/code\u003e to default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.7\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.6...v1.6.7\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.6...v1.6.7\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eSet supported algorithms for the default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/p\u003e\n\u003ch2\u003ev1.6.6\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix(ClientAuth): fix incorrect signature when Content-Type is x-www-form-urlencoded by \u003ca href=\"https://github.com/shc261392\"\u003e\u003ccode\u003e@​shc261392\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/778\"\u003eauthlib/authlib#778\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix: Use \u003ccode\u003eexpires_in\u003c/code\u003e when \u003ccode\u003eexpires_at\u003c/code\u003e is unparsable by \u003ca href=\"https://github.com/bendavis78\"\u003e\u003ccode\u003e@​bendavis78\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/842\"\u003eauthlib/authlib#842\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eget_jwt_config\u003c/code\u003e takes a \u003ccode\u003eclient\u003c/code\u003e parameter. by \u003ca href=\"https://github.com/azmeuk\"\u003e\u003ccode\u003e@​azmeuk\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/844\"\u003eauthlib/authlib#844\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/shc261392\"\u003e\u003ccode\u003e@​shc261392\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/778\"\u003eauthlib/authlib#778\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/bendavis78\"\u003e\u003ccode\u003e@​bendavis78\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/842\"\u003eauthlib/authlib#842\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.5...v1.6.6\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.5...v1.6.6\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.6.5\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a \u003ccode\u003erequest\u003c/code\u003e param to RFC7591 \u003ccode\u003egenerate_client_info\u003c/code\u003e and \u003ccode\u003egenerate_client_secret\u003c/code\u003e methods by \u003ca href=\"https://github.com/azmeuk\"\u003e\u003ccode\u003e@​azmeuk\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/825\"\u003eauthlib/authlib#825\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: support list params in prepare_grant_uri by \u003ca href=\"https://github.com/lisongmin\"\u003e\u003ccode\u003e@​lisongmin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/827\"\u003eauthlib/authlib#827\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump SonarSource/sonarqube-scan-action from 5 to 6 in /.github/workflows by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/828\"\u003eauthlib/authlib#828\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/authlib/authlib/blob/1.6.12/docs/changelog.rst\"\u003eauthlib's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 1.6.12\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on may 4, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eInvalidScopeError\u003c/code\u003e\nin \u003ccode\u003eOpenIDImplicitGrant\u003c/code\u003e and \u003ccode\u003eOpenIDHybridGrant\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.11\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Apr 16, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix CSRF vulnerability in the Starlette OAuth client when a \u003ccode\u003ecache\u003c/code\u003e is\nconfigured.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.10\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Apr 13, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eUnsupportedResponseTypeError\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.9\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Mar 2, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eNot using header's \u003ccode\u003ejwk\u003c/code\u003e automatically.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eES256K\u003c/code\u003e into default jwt algorithms.\u003c/li\u003e\n\u003cli\u003eRemove deprecated algorithm from default registry.\u003c/li\u003e\n\u003cli\u003eGenerate random \u003ccode\u003ecek\u003c/code\u003e when \u003ccode\u003ecek\u003c/code\u003e length doesn't match.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.8\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Feb 17, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eEdDSA\u003c/code\u003e to default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.7\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Feb 6, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eSet supported algorithms for the default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.6\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/e46e515b3a87ea63ab0606b248d75f69d83a2391\"\u003e\u003ccode\u003ee46e515\u003c/code\u003e\u003c/a\u003e chore: bump to 1.6.12\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/9babc131e13b018a267ae78747cba7caa6dfb7d5\"\u003e\u003ccode\u003e9babc13\u003c/code\u003e\u003c/a\u003e fix: redirecting to unvalidated redirect_uri on InvalidScopeError in OIDC grants\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/0dc0e5b4dc84f155319518a3732113af6fa47525\"\u003e\u003ccode\u003e0dc0e5b\u003c/code\u003e\u003c/a\u003e chore: bump to 1.6.11\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/aa7b8e46e00d0622658666476782042ac00153a5\"\u003e\u003ccode\u003eaa7b8e4\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/401a7709c3fe43bce1b2105d16a475b688faa788\"\u003e\u003ccode\u003e401a770\u003c/code\u003e\u003c/a\u003e fix: CSRF issue with starlette client\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/ef09aebbba4439dedb22bd15777d1b3458b6f0ab\"\u003e\u003ccode\u003eef09aeb\u003c/code\u003e\u003c/a\u003e chore: release 1.6.10\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/3be08468201a7766a93012ce149ea12822cab096\"\u003e\u003ccode\u003e3be0846\u003c/code\u003e\u003c/a\u003e fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/9266eaa2227ad7e21dc731b2a4a01909aabd934b\"\u003e\u003ccode\u003e9266eaa\u003c/code\u003e\u003c/a\u003e chore: release 1.6.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b\"\u003e\u003ccode\u003eb9bb2b2\u003c/code\u003e\u003c/a\u003e fix(oidc): fail close at validating c_hash and at_hash\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/1b0a1d988842bff7347c4ec0a70e45c3ba55504e\"\u003e\u003ccode\u003e1b0a1d9\u003c/code\u003e\u003c/a\u003e fix(jose): generate random cek when cek length doesn't match\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.0...1.6.12\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `cryptography` from 45.0.5 to 48.0.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst\"\u003ecryptography's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e48.0.1 - 2026-06-09\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.\n\u003cp\u003e.. _v48-0-0:\u003c/p\u003e\n\u003cp\u003e48.0.0 - 2026-05-04\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Support for Python 3.8 has been removed.\n\u003ccode\u003ecryptography\u003c/code\u003e now requires Python 3.9 or later.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Loading an X.509 CRL whose inner\n\u003ccode\u003eTBSCertList.signature\u003c/code\u003e algorithm does not match the outer\n\u003ccode\u003esignatureAlgorithm\u003c/code\u003e now raises \u003ccode\u003eValueError\u003c/code\u003e. Previously, such CRLs\nwere parsed successfully and only rejected during signature validation.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded support for :doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mlkem\u003c/code\u003e and\n:doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mldsa\u003c/code\u003e when using OpenSSL 3.5.0 or\nlater, in addition to the existing AWS-LC and BoringSSL support. This means\npost-quantum algorithms are now available to users of our wheels.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eNote:\u003c/strong\u003e Going forward, we do not guarantee that all functionality\nin \u003ccode\u003ecryptography\u003c/code\u003e will be available when building against\nOpenSSL. See :doc:\u003ccode\u003e/statements/state-of-openssl\u003c/code\u003e for more information.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. _v47-0-0:\u003c/p\u003e\n\u003cp\u003e47.0.0 - 2026-04-24\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Support for Python 3.8 is deprecated and will be removed in the next\n  ``cryptography`` release.\n* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves\n  (``SECT*`` classes) has been removed. These curves are rarely used and\n  have additional security considerations that make them undesirable.\n* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.\n  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC\n  continue to be supported.\n* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL \u0026lt; 4.1.\n* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or\n  keys with unsupported explicit curve encodings now raises\n  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of\n  ``ValueError``. This change affects\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,\n  and :meth:`~cryptography.x509.Certificate.public_key` when called on\n  certificates with unsupported public key algorithms.\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt; \n\u003c/code\u003e\u003c/pre\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/de987ce48ccfeb1abca41efa23b2bf73ec704f74\"\u003e\u003ccode\u003ede987ce\u003c/code\u003e\u003c/a\u003e 48.0.1 version bump and changelog (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14996\"\u003e#14996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/8e03e30e3aae01632a697e903e3593c924f0139d\"\u003e\u003ccode\u003e8e03e30\u003c/code\u003e\u003c/a\u003e bump for 48.0.0 release (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14796\"\u003e#14796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/295e0d254ef31ab864730aa41312ec355416ee71\"\u003e\u003ccode\u003e295e0d2\u003c/code\u003e\u003c/a\u003e Add AGENTS.md with CLAUDE.md symlink (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14794\"\u003e#14794\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/104a2de19e268a433e6da92be9cb872dcf0003c8\"\u003e\u003ccode\u003e104a2de\u003c/code\u003e\u003c/a\u003e Bump BoringSSL, OpenSSL, AWS-LC in CI (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14793\"\u003e#14793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/67ec1e51988195e17993d2edef5258b27509b926\"\u003e\u003ccode\u003e67ec1e5\u003c/code\u003e\u003c/a\u003e call check_length early on AesSiv::encrypt (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14792\"\u003e#14792\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/b2da57a0d9e4bfd2b95364299091a18f74127b26\"\u003e\u003ccode\u003eb2da57a\u003c/code\u003e\u003c/a\u003e changelog for mldsa/mlkem for openssl (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14791\"\u003e#14791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/3cf44adee25c368d4a136e072fa9f80465d91eb0\"\u003e\u003ccode\u003e3cf44ad\u003c/code\u003e\u003c/a\u003e ML-KEM OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14781\"\u003e#14781\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e31639666766f846fbab2c605879db0fa64fe83\"\u003e\u003ccode\u003e2e31639\u003c/code\u003e\u003c/a\u003e ML-DSA OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14773\"\u003e#14773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/5affe5a286a986fdf512c4a5cb280d28a96c10e3\"\u003e\u003ccode\u003e5affe5a\u003c/code\u003e\u003c/a\u003e fix rust nightly clippy (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14790\"\u003e#14790\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e73ca448eaf64b6f0d4ffbb794cf96170cef5ec\"\u003e\u003ccode\u003e2e73ca4\u003c/code\u003e\u003c/a\u003e bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pyca/cryptography/compare/45.0.5...48.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `fastmcp` from 2.10.5 to 3.2.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/PrefectHQ/fastmcp/releases\"\u003efastmcp's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.2.0: Show Don't Tool\u003c/h2\u003e\n\u003cp\u003eFastMCP 3.2 is the Apps release. The 3.0 architecture gave you providers and transforms; 3.1 shipped Code Mode for tool discovery. 3.2 puts a face on it: your tools can now return interactive UIs — charts, dashboards, forms, maps — rendered right inside the conversation.\u003c/p\u003e\n\u003ch2\u003eFastMCPApp\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003eFastMCPApp\u003c/code\u003e is a new provider class for building interactive applications inside MCP. It separates the tools the LLM sees (\u003ccode\u003e@app.ui()\u003c/code\u003e) from the backend tools the UI calls (\u003ccode\u003e@app.tool()\u003c/code\u003e), manages visibility automatically, and gives tool references stable identifiers that survive namespace transforms and server composition — without requiring host cooperation.\u003c/p\u003e\n\u003cpre lang=\"python\"\u003e\u003ccode\u003efrom fastmcp import FastMCP, FastMCPApp\nfrom prefab_ui.actions.mcp import CallTool\nfrom prefab_ui.components import Column, Form, Input, Button, ForEach, Text\n\u003cp\u003eapp = FastMCPApp(\u0026quot;Contacts\u0026quot;)\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/app\"\u003e\u003ccode\u003e@​app\u003c/code\u003e\u003c/a\u003e.tool()\ndef save_contact(name: str, email: str) -\u0026gt; list[dict]:\ndb.append({\u0026quot;name\u0026quot;: name, \u0026quot;email\u0026quot;: email})\nreturn list(db)\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/app\"\u003e\u003ccode\u003e@​app\u003c/code\u003e\u003c/a\u003e.ui()\ndef contact_manager() -\u0026gt; PrefabApp:\nwith PrefabApp(state={\u0026quot;contacts\u0026quot;: list(db)}) as view:\nwith Column(gap=4):\nForEach(\u0026quot;contacts\u0026quot;, lambda c: Text(c.name))\nwith Form(on_submit=CallTool(\u0026quot;save_contact\u0026quot;)):\nInput(name=\u0026quot;name\u0026quot;, required=True)\nInput(name=\u0026quot;email\u0026quot;, required=True)\nButton(\u0026quot;Save\u0026quot;)\nreturn view\u003c/p\u003e\n\u003cp\u003emcp = FastMCP(\u0026quot;Server\u0026quot;, providers=[app])\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cp\u003eThe UI is built with \u003ca href=\"https://prefab.prefect.io\"\u003ePrefab\u003c/a\u003e, a Python component library that compiles to interactive UIs. You write Python; the user sees charts, tables, forms, and dashboards. FastMCP handles the MCP Apps protocol machinery — renderer resources, CSP configuration, structured content serialization — so you don't have to.\u003c/p\u003e\n\u003cp\u003eFor simpler cases where you just want to visualize data without server interaction, set \u003ccode\u003eapp=True\u003c/code\u003e on any tool and return Prefab components directly:\u003c/p\u003e\n\u003cpre lang=\"python\"\u003e\u003ccode\u003e@mcp.tool(app=True)\ndef revenue_chart(year: int) -\u0026gt; PrefabApp:\n    with PrefabApp() as app:\n        BarChart(data=revenue_data, series=[ChartSeries(data_key=\u0026quot;revenue\u0026quot;)])\n    return app\n\u003c/code\u003e\u003c/pre\u003e\n\u003ch2\u003eBuilt-in Providers\u003c/h2\u003e\n\u003cp\u003eFive ready-made providers you add with a single \u003ccode\u003eadd_provider()\u003c/code\u003e call:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eFileUpload\u003c/strong\u003e — drag-and-drop file upload with session-scoped storage\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/PrefectHQ/fastmcp/blob/main/docs/changelog.mdx\"\u003efastmcp's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003chr /\u003e\n\u003ch2\u003etitle: \u0026quot;Changelog\u0026quot;\nicon: \u0026quot;list-check\u0026quot;\nrss: true\ntag: NEW\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.1\"\u003ev3.4.1: Floor It\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eFastMCP 3.4.1 floors Starlette at \u003ccode\u003e\u0026gt;=1.0.1\u003c/code\u003e so installs can no longer resolve to a version affected by CVE-2026-48710, which was previously only constrained transitively through \u003ccode\u003emcp\u003c/code\u003e. It also makes OAuthProxy log refresh-token cache misses instead of failing silently.\u003c/p\u003e\n\u003ch3\u003eEnhancements ✨\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eLog refresh-token misses in OAuthProxy instead of failing silently by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4276\"\u003e#4276\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eSecurity 🔒\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd explicit starlette\u0026gt;=1.0.1 floor (CVE-2026-48710) by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4286\"\u003e#4286\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocs 📚\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDocument --notes-start-tag in release instructions by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4275\"\u003e#4275\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/PrefectHQ/fastmcp/compare/v3.4.0...v3.4.1\"\u003ev3.4.0...v3.4.1\u003c/a\u003e\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/releases/tag/v3.4.0\"\u003ev3.4.0: Remote Control\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eFastMCP 3.4 is about reaching servers that live somewhere else. The headline is \u003ccode\u003efastmcp-remote\u003c/code\u003e, a standalone bridge that connects stdio-only MCP hosts to servers hosted over HTTP. Around it, the proxy layer those connections depend on is hardened: a proxy now forwards \u003ccode\u003einitialize\u003c/code\u003e upstream and fails loudly when the backend is missing or misconfigured, instead of reporting a connected-but-empty proxy. And FastMCP-issued access tokens can now outlive short-lived upstream tokens, so authenticated sessions survive the long idle periods remote clients are prone to.\u003c/p\u003e\n\u003ch3\u003eNew Features 🎉\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd fastmcp-remote bridge package by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4208\"\u003e#4208\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes ⚠️\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eForward proxy initialize as bridge behavior by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4228\"\u003e#4228\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eEnhancements ✨\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eci: require external PRs to link a tracked issue by \u003ca href=\"https://github.com/strawgate\"\u003e\u003ccode\u003e@​strawgate\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4173\"\u003e#4173\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: new options --host and --no-log-panel | --log-panel  to cli dev apps by \u003ca href=\"https://github.com/itaru2622\"\u003e\u003ccode\u003e@​itaru2622\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4123\"\u003e#4123\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd valid_scopes and extra_authorize_params to WorkOSProvider by \u003ca href=\"https://github.com/tiagoskaneta\"\u003e\u003ccode\u003e@​tiagoskaneta\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4135\"\u003e#4135\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd token_expiry_threshold_seconds for proactive token refresh by \u003ca href=\"https://github.com/mohankumarelec\"\u003e\u003ccode\u003e@​mohankumarelec\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4142\"\u003e#4142\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd review-issue skill for triaging gated external contributions by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4212\"\u003e#4212\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd contract gate to review-issue skill by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4214\"\u003e#4214\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eLet ToolResult return an error result via is_error by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4217\"\u003e#4217\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate published docs after PyPI release by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4211\"\u003e#4211\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAllow pre-bound HTTP sockets by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4222\"\u003e#4222\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd targeted coverage tests by \u003ca href=\"https://github.com/strawgate\"\u003e\u003ccode\u003e@​strawgate\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4230\"\u003e#4230\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpgrade ty to 0.0.39 by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4225\"\u003e#4225\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDecouple FastMCP access token lifetime from upstream expires_in by \u003ca href=\"https://github.com/jlowin\"\u003e\u003ccode\u003e@​jlowin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4254\"\u003e#4254\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eSecurity 🔒\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003efeat(code-mode): default sandbox limits and per-execution tool-call cap by \u003ca href=\"https://github.com/strawgate\"\u003e\u003ccode\u003e@​strawgate\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4170\"\u003e#4170\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSecurity: Fix 3 findings in GitHub Actions workflows by \u003ca href=\"https://github.com/jpr5\"\u003e\u003ccode\u003e@​jpr5\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/pull/4183\"\u003e#4183\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/665514e19a78543709be85b4261153bbe98e882f\"\u003e\u003ccode\u003e665514e\u003c/code\u003e\u003c/a\u003e Add forward_resource flag to OAuthProxy (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3711\"\u003e#3711\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/f189d1f7fbfd55c9f68c750a3a293e31c7586e8b\"\u003e\u003ccode\u003ef189d1f\u003c/code\u003e\u003c/a\u003e Bump pydantic-monty to 0.0.9 (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3707\"\u003e#3707\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/6faa2d61f82eab670694965606fd7b14bedddc7f\"\u003e\u003ccode\u003e6faa2d6\u003c/code\u003e\u003c/a\u003e Remove hardcoded prefab-ui version from pinning warnings (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3708\"\u003e#3708\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/dd8816c6ccc733048fe6208bfc8f80ded505f993\"\u003e\u003ccode\u003edd8816c\u003c/code\u003e\u003c/a\u003e chore: Update SDK documentation (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3701\"\u003e#3701\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/d27495960af23969f11d6e1e44e2018529c1c37e\"\u003e\u003ccode\u003ed274959\u003c/code\u003e\u003c/a\u003e docs: note that custom routes are unauthenticated (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3706\"\u003e#3706\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/4a54be2d5f1ac8925a461e67cf993e0278729d4d\"\u003e\u003ccode\u003e4a54be2\u003c/code\u003e\u003c/a\u003e Add examples gallery page (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3705\"\u003e#3705\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/961dd5045611e9c1bd6b7c4f5ac3aa14f0a30ce7\"\u003e\u003ccode\u003e961dd50\u003c/code\u003e\u003c/a\u003e Add interactive map example with geocoding (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3702\"\u003e#3702\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/f01d0c581c7a821a9701d6dde4d9beb95e32d479\"\u003e\u003ccode\u003ef01d0c5\u003c/code\u003e\u003c/a\u003e Add quiz example app, fix dev server empty string args (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3700\"\u003e#3700\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/85b7efd74601a72c74ac68e23599de6c032bb9c4\"\u003e\u003ccode\u003e85b7efd\u003c/code\u003e\u003c/a\u003e chore: Update SDK documentation (\u003ca href=\"https://redirect.github.com/PrefectHQ/fastmcp/issues/3694\"\u003e#3694\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/PrefectHQ/fastmcp/commit/27abe3c3f0cc2ce1925cc3cbc7968d5637ebc82b\"\u003e\u003ccode\u003e27abe3c\u003c/code\u003e\u003c/a\u003e Add sales dashboard and live system monitor examples, bump prefab-ui to 0.17 ...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/PrefectHQ/fastmcp/compare/v2.10.5...v3.2.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 3.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in \u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining and\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e Release 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e Pre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from kjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e Convert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from kjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from StanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from StanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kjd/idna/compare/v3.10...v3.15\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `joserfc` from 1.6.4 to 1.6.7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/authlib/joserfc/releases\"\u003ejoserfc's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.6.7\u003c/h2\u003e\n\u003ch3\u003e   🐞 Bug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ejws\u003c/strong\u003e: Validate payload size for b64=false  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/authlib/joserfc/commit/4d4ea2e\"\u003e\u003c!-- raw HTML omitted --\u003e(4d4ea)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003etyping\u003c/strong\u003e: Accept any Collection for algorithms, not just list  -  by \u003ca href=\"https://github.com/jonathangreen\"\u003e\u003ccode\u003e@​jonathangreen\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/authlib/joserfc/commit/102a7a7\"\u003e\u003c!-- raw HTML omitted --\u003e(102a7)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003etyping\u003c/strong\u003e: Use cast for type hints  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/authlib/joserfc/commit/75d9f95\"\u003e\u003c!-- raw HTML omitted --\u003e(75d9f)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch5\u003e    \u003ca href=\"https://github.com/authlib/joserfc/compare/1.6.5...1.6.7\"\u003eView changes on GitHub\u003c/a\u003e\u003c/h5\u003e\n\u003ch2\u003e1.6.5\u003c/h2\u003e\n\u003cp\u003e\u003cem\u003eNo significant changes\u003c/em\u003e\u003c/p\u003e\n\u003ch5\u003e    \u003ca href=\"https://github.com/authlib/joserfc/compare/1.6.4...1.6.5\"\u003eView changes on GitHub\u003c/a\u003e\u003c/h5\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/authlib/joserfc/blob/main/docs/changelog.rst\"\u003ejoserfc's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.6.7\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on May 23, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate for type hints.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.6.6\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on May 18, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eJWS\u003c/strong\u003e: validate payload size when \u003ccode\u003eb64=false\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.6.5\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on May 3, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eJWS\u003c/strong\u003e: increase registry's payload max size.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/1e5b94da589c695f54abd9f1a0ad822dcffe0305\"\u003e\u003ccode\u003e1e5b94d\u003c/code\u003e\u003c/a\u003e chore: release 1.6.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/75d9f95815f522ccb50515fb36efbcc6601b2e34\"\u003e\u003ccode\u003e75d9f95\u003c/code\u003e\u003c/a\u003e fix(typing): use cast for type hints\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/6d240377ce8ddfb15793822d9d82cf66e66a9980\"\u003e\u003ccode\u003e6d24037\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/authlib/joserfc/issues/98\"\u003e#98\u003c/a\u003e from jonathangreen/algorithms-accept-collection\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/102a7a7610eb50cd53cd46d917146b7af295613f\"\u003e\u003ccode\u003e102a7a7\u003c/code\u003e\u003c/a\u003e fix(typing): accept any Collection for algorithms, not just list\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/8b869e8754b5022c3a2a9e1071fe15f65d3749c6\"\u003e\u003ccode\u003e8b869e8\u003c/code\u003e\u003c/a\u003e chore: release 1.6.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/00d599bfc1282cf887bb6a8bc82598dc10532fa5\"\u003e\u003ccode\u003e00d599b\u003c/code\u003e\u003c/a\u003e chore: update actions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/9186561fc40de112e3b3f01934b11d7ca54da142\"\u003e\u003ccode\u003e9186561\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/authlib/joserfc/issues/97\"\u003e#97\u003c/a\u003e from authlib/fix-b64\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/4d4ea2e787ed36a2190158d86d8470e3acbb349b\"\u003e\u003ccode\u003e4d4ea2e\u003c/code\u003e\u003c/a\u003e fix(jws): validate payload size for b64=false\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/b6554cca2f0ae4f246411aa569b2980381eb35a3\"\u003e\u003ccode\u003eb6554cc\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/authlib/joserfc/issues/96\"\u003e#96\u003c/a\u003e from sebasxsala/fix-p512-fixture\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/joserfc/commit/b89eadff61ef9d8cf4302d18987f27dc1b281647\"\u003e\u003ccode\u003eb89eadf\u003c/code\u003e\u003c/a\u003e test: normalize P-521 private key fixture\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/authlib/joserfc/compare/1.6.4...1.6.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langchain-core` from 1.1.0 to 1.3.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langchain/releases\"\u003elangchain-core's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elangchain-core==1.3.3\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.2\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37198\"\u003e#37198\u003c/a\u003e)\nfix(core): set deprecation \u003ccode\u003esince\u003c/code\u003e to 1.3.3 to match release (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37200\"\u003e#37200\u003c/a\u003e)\nfix(core, langchain): harden \u003ccode\u003eload()\u003c/code\u003e against untrusted manifests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37197\"\u003e#37197\u003c/a\u003e)\nchore: bump notebook from 7.5.0 to 7.5.6 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37109\"\u003e#37109\u003c/a\u003e)\nchore: bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260408 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37129\"\u003e#37129\u003c/a\u003e)\nfix(core): preserve structured \u003ccode\u003einputs\u003c/code\u003e on tool runs in tracers (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37108\"\u003e#37108\u003c/a\u003e)\nrelease(perplexity): 1.2.0 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37091\"\u003e#37091\u003c/a\u003e)\nchore(docs): update x handle references (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37081\"\u003e#37081\u003c/a\u003e)\nfix(core): make \u003ccode\u003eremoval\u003c/code\u003e optional in \u003ccode\u003ewarn_deprecated\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37056\"\u003e#37056\u003c/a\u003e)\nfix(core): validate batch_size in _batch and _abatch to prevent infinite loop (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36663\"\u003e#36663\u003c/a\u003e)\nchore(core): mark stream_v2/astream_v2 as beta (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36992\"\u003e#36992\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.2\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.1\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36990\"\u003e#36990\u003c/a\u003e)\nfeat(core): add content-block-centric streaming (v2) (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36834\"\u003e#36834\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.1\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.0\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36972\"\u003e#36972\u003c/a\u003e)\nfeat(core): allow _format_output to pass through list of ToolOutputMixin instances (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36963\"\u003e#36963\u003c/a\u003e)\nchore: bump nbconvert from 7.17.0 to 7.17.1 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36923\"\u003e#36923\u003c/a\u003e)\nfeat(core): Update inheritance behavior for tracer metadata for special keys (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36900\"\u003e#36900\u003c/a\u003e)\nchore: bump langsmith from 0.7.13 to 0.7.31 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36813\"\u003e#36813\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.0\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.2.31\u003c/p\u003e\n\u003cp\u003erelease(core): release 1.3.0 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36851\"\u003e#36851\u003c/a\u003e)\nrelease(core): 1.3.0a3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36829\"\u003e#36829\u003c/a\u003e)\nchore(core): keep checkpoint_ns behavior in streaming metadata for backwards compat (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36828\"\u003e#36828\u003c/a\u003e)\nfeat(core): Add chat model and LLM invocation params to traceable metadata (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36771\"\u003e#36771\u003c/a\u003e)\nfix(core): restore cloud metadata IPs and link-local range in SSRF policy (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36816\"\u003e#36816\u003c/a\u003e)\nchore(deps): bump pytest to \u003ccode\u003e9.0.3\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36801\"\u003e#36801\u003c/a\u003e)\nchore(core): harden private SSRF utilities (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36768\"\u003e#36768\u003c/a\u003e)\nfix(openai): handle content blocks without type key in responses api conversion (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36725\"\u003e#36725\u003c/a\u003e)\nchore: bump pytest from 9.0.2 to 9.0.3 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36719\"\u003e#36719\u003c/a\u003e)\nrelease(core): 1.3.0.a2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36698\"\u003e#36698\u003c/a\u003e)\nfix(core): Use reference counting for storing inherited run trees to support garbage collection (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36660\"\u003e#36660\u003c/a\u003e)\ndocs(core): nit (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36685\"\u003e#36685\u003c/a\u003e)\nrelease(core): 1.3.0a1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36656\"\u003e#36656\u003c/a\u003e)\nchore(core): reduce streaming metadata / perf (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36588\"\u003e#36588\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.0a3\u003c/h2\u003e\n\u003cp\u003eInitial release\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/5039dfec1f8e78459540a7f1b52fb0d6d82e3f07\"\u003e\u003ccode\u003e5039dfe\u003c/code\u003e\u003c/a\u003e release(core): 1.3.3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37198\"\u003e#37198\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/55a7707837742c2f7a9b7e4a5dd428bf615f3b82\"\u003e\u003ccode\u003e55a7707\u003c/code\u003e\u003c/a\u003e fix(core): set deprecation \u003ccode\u003esince\u003c/code\u003e to 1.3.3 to match release (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37200\"\u003e#37200\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/c979c6187b6d82f4bef35b10b84b39fa44806b22\"\u003e\u003ccode\u003ec979c61\u003c/code\u003e\u003c/a\u003e fix(core, langchain): harden \u003ccode\u003eload()\u003c/code\u003e against untrusted manifests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37197\"\u003e#37197\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/d7031101da78e3f6b6c5956b48a5170c1a33292b\"\u003e\u003ccode\u003ed703110\u003c/code\u003e\u003c/a\u003e docs: update README.md (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37190\"\u003e#37190\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/4d50a2a68b38e9acc53027ea7e7cc89e2d80b4c7\"\u003e\u003ccode\u003e4d50a2a\u003c/code\u003e\u003c/a\u003e ci(infra): run pre-release checks before TestPyPI publish (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37194\"\u003e#37194\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/9bd730e1991baac4ea80aa07d93110dc1b52ee25\"\u003e\u003ccode\u003e9bd730e\u003c/code\u003e\u003c/a\u003e fix(fireworks): require \u003ccode\u003eapi_key\u003c/code\u003e in \u003ccode\u003eFireworksEmbeddings\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37193\"\u003e#37193\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/f475f4191fc3a8d3cf14063b44d524594c080c04\"\u003e\u003ccode\u003ef475f41\u003c/code\u003e\u003c/a\u003e release(mistralai): 1.1.4 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37191\"\u003e#37191\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/7dbff48aff508b01dc231ea0cbd4e4e09da92c97\"\u003e\u003ccode\u003e7dbff48\u003c/code\u003e\u003c/a\u003e fix(mistralai): strip non-wire keys from \u003ccode\u003eToolMessage\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37188\"\u003e#37188\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/913816c440ea79295370e1af6484e17b86e5d03c\"\u003e\u003ccode\u003e913816c\u003c/code\u003e\u003c/a\u003e release(fireworks): 1.3.1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37189\"\u003e#37189\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/4498d3dc84a85688fa4d15476403a900bc7f9114\"\u003e\u003ccode\u003e4498d3d\u003c/code\u003e\u003c/a\u003e fix(fireworks): strip non-wire keys from \u003ccode\u003eToolMessage\u003c/code\u003e text content blocks (#...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/langchain-ai/langchain/compare/langchain-core==1.1.0...langchain-core==1.3.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langchain-text-splitters` from 1.0.0 to 1.1.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langchain/releases\"\u003elangchain-text-splitters's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elangchain-text-splitters==1.1.2\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-text-splitters==1.1.1\u003c/p\u003e\n\u003cp\u003erelease(text-splitters): 1.1.2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36822\"\u003e#36822\u003c/a\u003e)\nfix(text-splitters): deprecate and use SSRF-safe transport in split_text_from_url (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36821\"\u003e#36821\u003c/a\u003e)\nchore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36797\"\u003e#36797\u003c/a\u003e)\nchore(deps): bump pytest to \u003ccode\u003e9.0.3\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36801\"\u003e#36801\u003c/a\u003e)\nchore: bump pytest from 9.0.2 to 9.0.3 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36714\"\u003e#36714\u003c/a\u003e)\nchore: add comment explaining \u003ccode\u003epygments\u0026gt;=2.20.0\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36570\"\u003e#36570\u003c/a\u003e)\nrelease(core): 1.2.26 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36511\"\u003e#36511\u003c/a\u003e)\nchore: pygments\u0026gt;=2.20.0 across all packages (CVE-2026-4539) (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36385\"\u003e#36385\u003c/a\u003e)\nfix(text-splitters): prevent silent data loss for empty dict values in RecursiveJsonSplitter (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35079\"\u003e#35079\u003c/a\u003e)\nfeat(text-splitters): support spacy tests with Python 3.14 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36198\"\u003e#36198\u003c/a\u003e)\nfix(infra): correct lint_diff relative paths in package makefiles (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36333\"\u003e#36333\u003c/a\u003e)\nchore: bump requests from 2.32.5 to 2.33.0 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36238\"\u003e#36238\u003c/a\u003e)\nchore: bump nltk from 3.9.3 to 3.9.4 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36237\"\u003e#36237\u003c/a\u003e)\nchore(partners): bump \u003ccode\u003elangchain-core\u003c/code\u003e min to \u003ccode\u003e1.2.21\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36183\"\u003e#36183\u003c/a\u003e)\nchore(text-splitters): bump nltk in lock file (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36112\"\u003e#36112\u003c/a\u003e)\nci: suppress pytest streaming output in CI (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36092\"\u003e#36092\u003c/a\u003e)\nchore(text-splitters): speed up ci (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36050\"\u003e#36050\u003c/a\u003e)\nci: avoid unnecessary dep installs in lint targets (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36046\"\u003e#36046\u003c/a\u003e)\nchore: bump orjson from 3.11.5 to 3.11.6 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35856\"\u003e#35856\u003c/a\u003e)\nchore: bump locks, lint (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35985\"\u003e#35985\u003c/a\u003e)\nperf(.github): set a timeout on get min versions HTTP calls (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35851\"\u003e#35851\u003c/a\u003e)\nchore: bump tornado from 6.5.2 to 6.5.5 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35774\"\u003e#35774\u003c/a\u003e)\nchore: bump the minor-and-patch group across 3 directories with 3 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35589\"\u003e#35589\u003c/a\u003e)\nchore: bump the other-deps group across 3 directories with 2 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35512\"\u003e#35512\u003c/a\u003e)\nchore: bump nltk from 3.9.2 to 3.9.3 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35449\"\u003e#35449\u003c/a\u003e)\nchore: bump the other-deps group across 3 directories with 2 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35407\"\u003e#35407\u003c/a\u003e)\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/58c4e5bbdd9d18d7fe7ec83b5a05477d06fe2a8e\"\u003e\u003ccode\u003e58c4e5b\u003c/code\u003e\u003c/a\u003e release(text-splitters): 1.1.2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36822\"\u003e#36822\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/c289bf10e940e960a132d7403482283114063063\"\u003e\u003ccode\u003ec289bf1\u003c/code\u003e\u003c/a\u003e fix(text-splitters): deprecate and use SSRF-safe transport in split_text_from...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/b7447c6969fc928ec3f29c200e2e56c0a46c4c77\"\u003e\u003ccode\u003eb7447c6\u003c/code\u003e\u003c/a\u003e fix(infra): skip serdes tests in min-version release step (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36818\"\u003e#36818\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/41c0cc58b0dac82000d24715f7a4b44dc8b01fd3\"\u003e\u003ccode\u003e41c0cc5\u003c/code\u003e\u003c/a\u003e release(openai): 1.1.14 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36820\"\u003e#36820\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/0516156ef98f5001129f6d47bc8682d6536d58fb\"\u003e\u003ccode\u003e0516156\u003c/code\u003e\u003c/a\u003e fix(openai): use SSRF-safe transport for image token counting (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36819\"\u003e#36819\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/338aa8131a8124e7aa1e042616ccd2366ff9f699\"\u003e\u003ccode\u003e338aa81\u003c/code\u003e\u003c/a\u003e fix(core): restore cloud metadata IPs and link-local range in SSRF policy (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/3\"\u003e#3\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/51e954877efd2d2c3c5bf09364dcfec8794eadb0\"\u003e\u003ccode\u003e51e9548\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36797\"\u003e#36797\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/e85c418cfa559d4a794ddc6db92c6febab44651c\"\u003e\u003ccode\u003ee85c418\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/model-profiles (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36798\"\u003e#36798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/789126e6c78ad74664bea26228dda6e72e135dce\"\u003e\u003ccode\u003e789126e\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/standard-tests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36799\"\u003e#36799\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/937b3eb3827551d17ee4736f9acc4aa57e88c716\"\u003e\u003ccode\u003e937b3eb\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/langchain_v1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36800\"\u003e#36800\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/langchain-ai/langchain/compare/langchain-text-splitters==1.0.0...langchain-text-splitters==1.1.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langsmith` from 0.4.7 to 0.8.18\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langsmith-sdk/releases\"\u003elangsmith's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.8.18\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps-dev): bump vitest from 3.2.4 to 3.2.6 in /js by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3002\"\u003elangchain-ai/langsmith-sdk#3002\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump pyjwt from 2.12.1 to 2.13.0 in /python by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3030\"\u003elangchain-ai/langsmith-sdk#3030\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump python-multipart from 0.0.27 to 0.0.31 in /python by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3036\"\u003elangchain-ai/langsmith-sdk#3036\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump aiohttp from 3.14.0 to 3.14.1 in /python by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3037\"\u003elangchain-ai/langsmith-sdk#3037\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump cryptography from 46.0.7 to 48.0.1 in /python by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3038\"\u003elangchain-ai/langsmith-sdk#3038\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump starlette from 1.0.1 to 1.3.1 in /python by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3039\"\u003elangchain-ai/langsmith-sdk#3039\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump langchain-anthropic from 1.4.4 to 1.4.6 in /python by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3044\"\u003elangchain-ai/langsmith-sdk#3044\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm_and_yarn group across 4 directories with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3046\"\u003elangchain-ai/langsmith-sdk#3046\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the npm_and_yarn group across 2 directories with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3060\"\u003elangchain-ai/langsmith-sdk#3060\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etest(python): fix integration assertions for updated attachment error message by \u003ca href=\"https://github.com/QuentinBrosse\"\u003e\u003ccode\u003e@​QuentinBrosse\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3061\"\u003elangchain-ai/langsmith-sdk#3061\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: reconcile bumpversion config and mandate release process for agents by \u003ca href=\"https://github.com/QuentinBrosse\"\u003e\u003ccode\u003e@​QuentinBrosse\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3062\"\u003elangchain-ai/langsmith-sdk#3062\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease(py): 0.8.18 by \u003ca href=\"https://github.com/QuentinBrosse\"\u003e\u003ccode\u003e@​QuentinBrosse\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3063\"\u003elangchain-ai/langsmith-sdk#3063\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.17...v0.8.18\"\u003ehttps://github.com/langchain-ai/langsmith-sdk/compare/v0.8.17...v0.8.18\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev0.8.17\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: expose the resources from the generated openapi client in the langsmith client by \u003ca href=\"https://github.com/sineha-mani\"\u003e\u003ccode\u003e@​sineha-mani\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3018\"\u003elangchain-ai/langsmith-sdk#3018\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat(js): port \u003ccode\u003eisTracingEnabled\u003c/code\u003e utility from Python by \u003ca href=\"https://github.com/dqbd\"\u003e\u003ccode\u003e@​dqbd\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3032\"\u003elangchain-ai/langsmith-sdk#3032\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd sandbox mount support to JS SDK by \u003ca href=\"https://github.com/DanielKneipp\"\u003e\u003ccode\u003e@​DanielKneipp\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3010\"\u003elangchain-ai/langsmith-sdk#3010\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease(js): bump to 0.7.9 by \u003ca href=\"https://github.com/dqbd\"\u003e\u003ccode\u003e@​dqbd\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3035\"\u003elangchain-ai/langsmith-sdk#3035\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd sandbox mount support to Python SDK by \u003ca href=\"https://github.com/DanielKneipp\"\u003e\u003ccode\u003e@​DanielKneipp\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3009\"\u003elangchain-ai/langsmith-sdk#3009\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: note that _openapi_client directories are auto-generated by \u003ca href=\"https://github.com/KiewanVillatel\"\u003e\u003ccode\u003e@​KiewanVillatel\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3034\"\u003elangchain-ai/langsmith-sdk#3034\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: update JS SDK type declarations with skipLibCheck disabled by \u003ca href=\"https://github.com/sineha-mani\"\u003e\u003ccode\u003e@​sineha-mani\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3043\"\u003elangchain-ai/langsmith-sdk#3043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease(js): 0.7.10 by \u003ca href=\"https://github.com/dqbd\"\u003e\u003ccode\u003e@​dqbd\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3045\"\u003elangchain-ai/langsmith-sdk#3045\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: adding python async for online evals by \u003ca href=\"https://github.com/sineha-mani\"\u003e\u003ccode\u003e@​sineha-mani\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3048\"\u003elangchain-ai/langsmith-sdk#3048\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd sandbox Git mount SDK helpers by \u003ca href=\"https://github.com/DanielKneipp\"\u003e\u003ccode\u003e@​DanielKneipp\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3040\"\u003elangchain-ai/langsmith-sdk#3040\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: use insights tab in sdk report links [closes LSO-2936] by \u003ca href=\"https://github.com/eric-langchain\"\u003e\u003ccode\u003e@​eric-langchain\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3050\"\u003elangchain-ai/langsmith-sdk#3050\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat(client): warn when backend version is below minimum required by \u003ca href=\"https://github.com/KiewanVillatel\"\u003e\u003ccode\u003e@​KiewanVillatel\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3041\"\u003elangchain-ai/langsmith-sdk#3041\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: bump _MIN_BACKEND_VERSION to 0.16.5rc1 by \u003ca href=\"https://github.com/langtions-bot\"\u003e\u003ccode\u003e@​langtions-bot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3053\"\u003elangchain-ai/langsmith-sdk#3053\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(sandbox): use built-in gcp auth host matching by \u003ca href=\"https://github.com/DanielKneipp\"\u003e\u003ccode\u003e@​DanielKneipp\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3055\"\u003elangchain-ai/langsmith-sdk#3055\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(python): py to 0.8.17 by \u003ca href=\"https://github.com/sineha-mani\"\u003e\u003ccode\u003e@​sineha-mani\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3056\"\u003elangchain-ai/langsmith-sdk#3056\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sineha-mani\"\u003e\u003ccode\u003e@​sineha-mani\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3018\"\u003elangchain-ai/langsmith-sdk#3018\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/eric-langchain\"\u003e\u003ccode\u003e@​eric-langchain\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/3050\"\u003elangchain-ai/langsmith-sdk#3050\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/langchain-ai/langsmith-sdk/compare/v0.8.16...v0.8.17\"\u003ehttps://github.com/langchain-ai/langsmith-sdk/compare/v0.8.16...v0.8.17\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev0.8.16\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/...\n\n_Description has been truncated_","html_url":"https://github.com/CaffeeLake/MemOS/pull/3","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/CaffeeLake%2FMemOS/issues/3","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/3/packages"}},{"old_version":"4.9.2","new_version":"6.1.0","update_type":"major","path":null,"pr_created_at":"2026-07-01T03:16:54.000Z","version_change":"4.9.2 → 6.1.0","issue":{"uuid":"4782104700","node_id":"PR_kwDOEq4Je87sfsdB","number":1165,"state":"open","title":"Bump the pip group across 1 directory with 10 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-07-01T03:16:54.000Z","updated_at":"2026-07-01T03:18:53.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","group_name":"pip","update_count":10,"packages":[{"name":"pyarrow","old_version":"17.0.0","new_version":"23.0.1","repository_url":"https://github.com/apache/arrow"},{"name":"pytest","old_version":"9.0.2","new_version":"9.0.3","repository_url":"https://github.com/pytest-dev/pytest"},{"name":"flask","old_version":"2.2.5","new_version":"3.1.3","repository_url":"https://github.com/pallets/flask"},{"name":"lxml","old_version":"4.9.2","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"},{"name":"pillow","old_version":"12.1.1","new_version":"12.2.0","repository_url":"https://github.com/python-pillow/Pillow"},{"name":"pyjwt","old_version":"2.6.0","new_version":"2.13.0","repository_url":"https://github.com/jpadilla/pyjwt"},{"name":"pypdf","old_version":"6.7.1","new_version":"6.13.3","repository_url":"https://github.com/py-pdf/pypdf"},{"name":"python-dotenv","old_version":"1.2.1","new_version":"1.2.2","repository_url":"https://github.com/theskumar/python-dotenv"},{"name":"requests","old_version":"2.32.4","new_version":"2.33.0","repository_url":"https://github.com/psf/requests"},{"name":"werkzeug","old_version":"3.0.6","new_version":"3.1.6","repository_url":"https://github.com/pallets/werkzeug"}],"path":null,"ecosystem":"pip"},"body":"Bumps the pip group with 10 updates in the /etl-pipeline directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `17.0.0` | `23.0.1` |\n| [pytest](https://github.com/pytest-dev/pytest) | `9.0.2` | `9.0.3` |\n| [flask](https://github.com/pallets/flask) | `2.2.5` | `3.1.3` |\n| [lxml](https://github.com/lxml/lxml) | `4.9.2` | `6.1.0` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.1.1` | `12.2.0` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.6.0` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.7.1` | `6.13.3` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.1` | `1.2.2` |\n| [requests](https://github.com/psf/requests) | `2.32.4` | `2.33.0` |\n| [werkzeug](https://github.com/pallets/werkzeug) | `3.0.6` | `3.1.6` |\n\n\nUpdates `pyarrow` from 17.0.0 to 23.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/apache/arrow/releases\"\u003epyarrow's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Arrow 23.0.1\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/23.0.1.html\"\u003ehttps://arrow.apache.org/release/23.0.1.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.1 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 23.0.1 RC0\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/23.0.0.html\"\u003ehttps://arrow.apache.org/release/23.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 23.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/22.0.0.html\"\u003ehttps://arrow.apache.org/release/22.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0 RC1\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 22.0.0 RC1\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 22.0.0 RC0\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/21.0.0.html\"\u003ehttps://arrow.apache.org/release/21.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC6\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC6\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC5\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC5\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC4\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC4\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC3\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC3\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/20.0.0.html\"\u003ehttps://arrow.apache.org/release/20.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC1\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC1\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC0\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/82a374e5f3de5b744f26591e6cd96de6349c76d9\"\u003e\u003ccode\u003e82a374e\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update versions for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/c1ae37c4a597f466b1806e65a9e011be1060dfc5\"\u003e\u003ccode\u003ec1ae37c\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update .deb/.rpm changelogs for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/8f6e55736f60f1f95aee1e8765c6b75ad9589111\"\u003e\u003ccode\u003e8f6e557\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update CHANGELOG.md for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/4e16a1aeed83a65e6b49556c2fed8e9061cdf980\"\u003e\u003ccode\u003e4e16a1a\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49159\"\u003eGH-49159\u003c/a\u003e: [C++][Gandiva] Detect overflow in repeat() (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49160\"\u003e#49160\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/985621dbfcf3fd2061889e43c50b59825df84f3f\"\u003e\u003ccode\u003e985621d\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/48817\"\u003eGH-48817\u003c/a\u003e [R][C++] Bump C++20 in R build infrastructure (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/48819\"\u003e#48819\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/1bea06ad4e14d75dd97a78a0148cd9cf6f4df0bc\"\u003e\u003ccode\u003e1bea06a\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49024\"\u003eGH-49024\u003c/a\u003e: [CI] Update Debian version in \u003ccode\u003e.env\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49032\"\u003e#49032\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/147bcd6d8f3fef05dd06968d3b60c17721c60334\"\u003e\u003ccode\u003e147bcd6\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49156\"\u003eGH-49156\u003c/a\u003e: [Python] Require GIL for string comparison (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49161\"\u003e#49161\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/e4f922b1621b6c833f583cf26500f115ab5bc483\"\u003e\u003ccode\u003ee4f922b\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49138\"\u003eGH-49138\u003c/a\u003e: [Packaging][Python] Remove nightly cython install from manylinux wh...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/f9376e4721b81bad9fe3fe840926a3283f95ee30\"\u003e\u003ccode\u003ef9376e4\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49003\"\u003eGH-49003\u003c/a\u003e: [C++] Don't consider \u003ccode\u003eout_of_range\u003c/code\u003e an error in float parsing (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49095\"\u003e#49095\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/ab2c0ad6b23d05d5f77fc8a34d5a1c4baaacb0a4\"\u003e\u003ccode\u003eab2c0ad\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49044\"\u003eGH-49044\u003c/a\u003e: [CI][Python] Fix test_download_tzdata_on_windows by adding required...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/apache/arrow/compare/go/v17.0.0...apache-arrow-23.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pytest` from 9.0.2 to 9.0.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytest-dev/pytest/releases\"\u003epytest's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e9.0.3\u003c/h2\u003e\n\u003ch1\u003epytest 9.0.3 (2026-04-07)\u003c/h1\u003e\n\u003ch2\u003eBug fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/12444\"\u003e#12444\u003c/a\u003e: Fixed \u003ccode\u003epytest.approx\u003c/code\u003e which now correctly takes into account \u003ccode\u003e~collections.abc.Mapping\u003c/code\u003e keys order to compare them.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/13634\"\u003e#13634\u003c/a\u003e: Blocking a \u003ccode\u003econftest.py\u003c/code\u003e file using the \u003ccode\u003e-p no:\u003c/code\u003e option is now explicitly disallowed.\u003c/p\u003e\n\u003cp\u003ePreviously this resulted in an internal assertion failure during plugin loading.\u003c/p\u003e\n\u003cp\u003ePytest now raises a clear \u003ccode\u003eUsageError\u003c/code\u003e explaining that conftest files are not plugins and cannot be disabled via \u003ccode\u003e-p\u003c/code\u003e.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/13734\"\u003e#13734\u003c/a\u003e: Fixed crash when a test raises an exceptiongroup with \u003ccode\u003e__tracebackhide__ = True\u003c/code\u003e.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14195\"\u003e#14195\u003c/a\u003e: Fixed an issue where non-string messages passed to \u003c!-- raw HTML omitted --\u003eunittest.TestCase.subTest()\u003c!-- raw HTML omitted --\u003e were not printed.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14343\"\u003e#14343\u003c/a\u003e: Fixed use of insecure temporary directory (CVE-2025-71176).\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eImproved documentation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/13388\"\u003e#13388\u003c/a\u003e: Clarified documentation for \u003ccode\u003e-p\u003c/code\u003e vs \u003ccode\u003ePYTEST_PLUGINS\u003c/code\u003e plugin loading and fixed an incorrect \u003ccode\u003e-p\u003c/code\u003e example.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/13731\"\u003e#13731\u003c/a\u003e: Clarified that capture fixtures (e.g. \u003ccode\u003ecapsys\u003c/code\u003e and \u003ccode\u003ecapfd\u003c/code\u003e) take precedence over the \u003ccode\u003e-s\u003c/code\u003e / \u003ccode\u003e--capture=no\u003c/code\u003e command-line options in \u003ccode\u003eAccessing captured output from a test function \u0026lt;accessing-captured-output\u0026gt;\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14088\"\u003e#14088\u003c/a\u003e: Clarified that the default \u003ccode\u003epytest_collection\u003c/code\u003e hook sets \u003ccode\u003esession.items\u003c/code\u003e before it calls \u003ccode\u003epytest_collection_finish\u003c/code\u003e, not after.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14255\"\u003e#14255\u003c/a\u003e: TOML integer log levels must be quoted: Updating reference documentation.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eContributor-facing changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/12689\"\u003e#12689\u003c/a\u003e: The test reports are now published to Codecov from GitHub Actions.\nThe test statistics is visible \u003ca href=\"https://app.codecov.io/gh/pytest-dev/pytest/tests\"\u003eon the web interface\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e-- by \u003ccode\u003ealeguy02\u003c/code\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/a7d58d7a21b78581e636bbbdea13c66ad1657c1e\"\u003e\u003ccode\u003ea7d58d7\u003c/code\u003e\u003c/a\u003e Prepare release version 9.0.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/089d98199c253d8f89a040243bc4f2aa6cd5ab22\"\u003e\u003ccode\u003e089d981\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14366\"\u003e#14366\u003c/a\u003e from bluetech/revert-14193-backport\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/8127eaf4ab7f6b2fdd0dc1b38343ec97aeef05ac\"\u003e\u003ccode\u003e8127eaf\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;Fix: assertrepr_compare respects dict insertion order (\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14050\"\u003e#14050\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14193\"\u003e#14193\u003c/a\u003e)\u0026quot;\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/99a7e6029e7a6e8d53e5df114b1346e035370241\"\u003e\u003ccode\u003e99a7e60\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14363\"\u003e#14363\u003c/a\u003e from pytest-dev/patchback/backports/9.0.x/95d8423bd...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/ddee02a578da30dd43aedc39c1c1f1aaadfcee95\"\u003e\u003ccode\u003eddee02a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14343\"\u003e#14343\u003c/a\u003e from bluetech/cve-2025-71176-simple\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/74eac6916fee34726cb194f16c516e96fbd29619\"\u003e\u003ccode\u003e74eac69\u003c/code\u003e\u003c/a\u003e doc: Update training info (\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14298\"\u003e#14298\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14301\"\u003e#14301\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/f92dee777cfdb77d1c43633d02766ddf1f07c869\"\u003e\u003ccode\u003ef92dee7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14267\"\u003e#14267\u003c/a\u003e from pytest-dev/patchback/backports/9.0.x/d6fa26c62...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/7ee58acc8777c31ac6cf388d01addf5a414a7439\"\u003e\u003ccode\u003e7ee58ac\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/12378\"\u003e#12378\u003c/a\u003e from Pierre-Sassoulas/fix-implicit-str-concat-and-d...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/37da870d37e3a2f5177cae075c7b9ae279432bf8\"\u003e\u003ccode\u003e37da870\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14259\"\u003e#14259\u003c/a\u003e from mitre88/patch-4 (\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14268\"\u003e#14268\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytest-dev/pytest/commit/c34bfa3b7acb65b594707c714f1d8461b0304eed\"\u003e\u003ccode\u003ec34bfa3\u003c/code\u003e\u003c/a\u003e Add explanation for string context diffs (\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14257\"\u003e#14257\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/pytest-dev/pytest/issues/14266\"\u003e#14266\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pytest-dev/pytest/compare/9.0.2...9.0.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `flask` from 2.2.5 to 3.1.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pallets/flask/releases\"\u003eflask's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.1.3\u003c/h2\u003e\n\u003cp\u003eThis is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.\u003c/p\u003e\n\u003cp\u003ePyPI: \u003ca href=\"https://pypi.org/project/Flask/3.1.3/\"\u003ehttps://pypi.org/project/Flask/3.1.3/\u003c/a\u003e\nChanges: \u003ca href=\"https://flask.palletsprojects.com/page/changes/#version-3-1-3\"\u003ehttps://flask.palletsprojects.com/page/changes/#version-3-1-3\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe session is marked as accessed for operations that only access the keys but not the values, such as \u003ccode\u003ein\u003c/code\u003e and \u003ccode\u003elen\u003c/code\u003e. \u003ca href=\"https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726\"\u003eGHSA-68rp-wp8r-4726\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.1.2\u003c/h2\u003e\n\u003cp\u003eThis is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.\u003c/p\u003e\n\u003cp\u003ePyPI: \u003ca href=\"https://pypi.org/project/Flask/3.1.2/\"\u003ehttps://pypi.org/project/Flask/3.1.2/\u003c/a\u003e\nChanges: \u003ca href=\"https://flask.palletsprojects.com/page/changes/#version-3-1-2\"\u003ehttps://flask.palletsprojects.com/page/changes/#version-3-1-2\u003c/a\u003e\nMilestone: \u003ca href=\"https://github.com/pallets/flask/milestone/38?closed=1\"\u003ehttps://github.com/pallets/flask/milestone/38?closed=1\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003estream_with_context\u003c/code\u003e does not fail inside async views. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5774\"\u003e#5774\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eWhen using \u003ccode\u003efollow_redirects\u003c/code\u003e in the test client, the final state of \u003ccode\u003esession\u003c/code\u003e is correct. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5786\"\u003e#5786\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRelax type hint for passing bytes IO to \u003ccode\u003esend_file\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5776\"\u003e#5776\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.1.1\u003c/h2\u003e\n\u003cp\u003eThis is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.\u003c/p\u003e\n\u003cp\u003ePyPI: \u003ca href=\"https://pypi.org/project/Flask/3.1.1/\"\u003ehttps://pypi.org/project/Flask/3.1.1/\u003c/a\u003e\nChanges: \u003ca href=\"https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1\"\u003ehttps://flask.palletsprojects.com/en/stable/changes/#version-3-1-1\u003c/a\u003e\nMilestone \u003ca href=\"https://github.com/pallets/flask/milestone/36?closed=1\"\u003ehttps://github.com/pallets/flask/milestone/36?closed=1\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix signing key selection order when key rotation is enabled via \u003ccode\u003eSECRET_KEY_FALLBACKS\u003c/code\u003e. GHSA-4grg-w6v8-c28g\u003c/li\u003e\n\u003cli\u003eFix type hint for \u003ccode\u003ecli_runner.invoke\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5645\"\u003e#5645\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eflask --help\u003c/code\u003e loads the app and plugins first to make sure all commands are shown. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5673\"\u003e#5673\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eMark sans-io base class as being able to handle views that return \u003ccode\u003eAsyncIterable\u003c/code\u003e. This is not accurate for Flask, but makes typing easier for Quart. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5659\"\u003e#5659\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.1.0\u003c/h2\u003e\n\u003cp\u003eThis is the Flask 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such as \u003ca href=\"https://pypi.org/project/pip-tools/\"\u003epip-tools\u003c/a\u003e to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.\u003c/p\u003e\n\u003cp\u003ePyPI: \u003ca href=\"https://pypi.org/project/Flask/3.1.0/\"\u003ehttps://pypi.org/project/Flask/3.1.0/\u003c/a\u003e\nChanges: \u003ca href=\"https://flask.palletsprojects.com/en/stable/changes/#version-3-1-0\"\u003ehttps://flask.palletsprojects.com/en/stable/changes/#version-3-1-0\u003c/a\u003e\nMilestone: \u003ca href=\"https://github.com/pallets/flask/milestone/33?closed=1\"\u003ehttps://github.com/pallets/flask/milestone/33?closed=1\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDrop support for Python 3.8. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5623\"\u003e#5623\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate minimum dependency versions to latest feature releases. Werkzeug \u0026gt;= 3.1, ItsDangerous \u0026gt;= 2.2, Blinker \u0026gt;= 1.9. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5624\"\u003e#5624\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5633\"\u003e#5633\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eProvide a configuration option to control automatic option responses. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5496\"\u003e#5496\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eFlask.open_resource\u003c/code\u003e/\u003ccode\u003eopen_instance_resource\u003c/code\u003e and \u003ccode\u003eBlueprint.open_resource\u003c/code\u003e take an \u003ccode\u003eencoding\u003c/code\u003e parameter to use when opening in text mode. It defaults to \u003ccode\u003eutf-8\u003c/code\u003e. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5504\"\u003e#5504\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eRequest.max_content_length\u003c/code\u003e can be customized per-request instead of only through the \u003ccode\u003eMAX_CONTENT_LENGTH\u003c/code\u003e config. Added \u003ccode\u003eMAX_FORM_MEMORY_SIZE\u003c/code\u003e and \u003ccode\u003eMAX_FORM_PARTS\u003c/code\u003e config. Added documentation about resource limits to the security page. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5625\"\u003e#5625\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for the \u003ccode\u003ePartitioned\u003c/code\u003e cookie attribute (CHIPS), with the \u003ccode\u003eSESSION_COOKIE_PARTITIONED\u003c/code\u003e config. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5472\"\u003e#5472\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003e-e path\u003c/code\u003e takes precedence over default \u003ccode\u003e.env\u003c/code\u003e and \u003ccode\u003e.flaskenv\u003c/code\u003e files. \u003ccode\u003eload_dotenv\u003c/code\u003e loads default files in addition to a path unless \u003ccode\u003eload_defaults=False\u003c/code\u003e is passed. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5628\"\u003e#5628\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport key rotation with the \u003ccode\u003eSECRET_KEY_FALLBACKS\u003c/code\u003e config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5621\"\u003e#5621\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix how setting \u003ccode\u003ehost_matching=True\u003c/code\u003e or \u003ccode\u003esubdomain_matching=False\u003c/code\u003e interacts with \u003ccode\u003eSERVER_NAME\u003c/code\u003e. Setting \u003ccode\u003eSERVER_NAME\u003c/code\u003e no longer restricts requests to only that domain. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5553\"\u003e#5553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eRequest.trusted_hosts\u003c/code\u003e is checked during routing, and can be set through the \u003ccode\u003eTRUSTED_HOSTS\u003c/code\u003e config. \u003ca href=\"https://redirect.github.com/pallets/flask/issues/5636\"\u003e#5636\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.0.3\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pallets/flask/blob/main/CHANGES.rst\"\u003eflask's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 3.1.3\u003c/h2\u003e\n\u003cp\u003eReleased 2026-02-18\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe session is marked as accessed for operations that only access the keys\nbut not the values, such as \u003ccode\u003ein\u003c/code\u003e and \u003ccode\u003elen\u003c/code\u003e. :ghsa:\u003ccode\u003e68rp-wp8r-4726\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 3.1.2\u003c/h2\u003e\n\u003cp\u003eReleased 2025-08-19\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003estream_with_context\u003c/code\u003e does not fail inside async views. :issue:\u003ccode\u003e5774\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eWhen using \u003ccode\u003efollow_redirects\u003c/code\u003e in the test client, the final state\nof \u003ccode\u003esession\u003c/code\u003e is correct. :issue:\u003ccode\u003e5786\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eRelax type hint for passing bytes IO to \u003ccode\u003esend_file\u003c/code\u003e. :issue:\u003ccode\u003e5776\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 3.1.1\u003c/h2\u003e\n\u003cp\u003eReleased 2025-05-13\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix signing key selection order when key rotation is enabled via\n\u003ccode\u003eSECRET_KEY_FALLBACKS\u003c/code\u003e. :ghsa:\u003ccode\u003e4grg-w6v8-c28g\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFix type hint for \u003ccode\u003ecli_runner.invoke\u003c/code\u003e. :issue:\u003ccode\u003e5645\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eflask --help\u003c/code\u003e loads the app and plugins first to make sure all commands\nare shown. :issue:\u003ccode\u003e5673\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eMark sans-io base class as being able to handle views that return\n\u003ccode\u003eAsyncIterable\u003c/code\u003e. This is not accurate for Flask, but makes typing easier\nfor Quart. :pr:\u003ccode\u003e5659\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 3.1.0\u003c/h2\u003e\n\u003cp\u003eReleased 2024-11-13\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDrop support for Python 3.8. :pr:\u003ccode\u003e5623\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eUpdate minimum dependency versions to latest feature releases.\nWerkzeug \u0026gt;= 3.1, ItsDangerous \u0026gt;= 2.2, Blinker \u0026gt;= 1.9. :pr:\u003ccode\u003e5624,5633\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eProvide a configuration option to control automatic option\nresponses. :pr:\u003ccode\u003e5496\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eFlask.open_resource\u003c/code\u003e/\u003ccode\u003eopen_instance_resource\u003c/code\u003e and\n\u003ccode\u003eBlueprint.open_resource\u003c/code\u003e take an \u003ccode\u003eencoding\u003c/code\u003e parameter to use when\nopening in text mode. It defaults to \u003ccode\u003eutf-8\u003c/code\u003e. :issue:\u003ccode\u003e5504\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eRequest.max_content_length\u003c/code\u003e can be customized per-request instead of only\nthrough the \u003ccode\u003eMAX_CONTENT_LENGTH\u003c/code\u003e config. Added\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/22d924701a6ae2e4cd01e9a15bbaf3946094af65\"\u003e\u003ccode\u003e22d9247\u003c/code\u003e\u003c/a\u003e release version 3.1.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4\"\u003e\u003ccode\u003e089cb86\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/c17f379390731543eea33a570a47bd4ef76a54fa\"\u003e\u003ccode\u003ec17f379\u003c/code\u003e\u003c/a\u003e request context tracks session access\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/27be9338405382445a7cb01151e084559b98d602\"\u003e\u003ccode\u003e27be933\u003c/code\u003e\u003c/a\u003e start version 3.1.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/4e652d3f68b90d50aa2301d3b7e68c3fafd9251d\"\u003e\u003ccode\u003e4e652d3\u003c/code\u003e\u003c/a\u003e Abort if the instance folder cannot be created (\u003ca href=\"https://redirect.github.com/pallets/flask/issues/5903\"\u003e#5903\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/3d03098a97ddc6a908aa4a50c2ef7381f8297d0a\"\u003e\u003ccode\u003e3d03098\u003c/code\u003e\u003c/a\u003e Abort if the instance folder cannot be created\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/407eb76b27884848383a37c7274654f0271e4bc4\"\u003e\u003ccode\u003e407eb76\u003c/code\u003e\u003c/a\u003e document using gevent for async (\u003ca href=\"https://redirect.github.com/pallets/flask/issues/5900\"\u003e#5900\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/ac5664d2281533eacafd64f5cc7d5edcdaccab60\"\u003e\u003ccode\u003eac5664d\u003c/code\u003e\u003c/a\u003e document using gevent for async\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/4f79d5b59a56bc4356a97f2e81a35f98cb18d7b3\"\u003e\u003ccode\u003e4f79d5b\u003c/code\u003e\u003c/a\u003e Increase required flit_core version to 3.11 (\u003ca href=\"https://redirect.github.com/pallets/flask/issues/5865\"\u003e#5865\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/fe3b215d3ade4db68262dae1a3cdc464a1fc524f\"\u003e\u003ccode\u003efe3b215\u003c/code\u003e\u003c/a\u003e Increase required flit_core version to 3.11\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pallets/flask/compare/2.2.5...3.1.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lxml` from 4.9.2 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/releases\"\u003elxml's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elxml-6.1.0\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.4\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.3\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.2\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.1\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.0\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-5.4.0\u003c/h2\u003e\n\u003ch1\u003e5.4.0 (2025-04-22)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2107279: Binary wheels use libxml2 2.13.8 and libxslt 1.1.43 to resolve several CVEs.\n(Binary wheels for Windows continue to use a patched libxml2 2.11.9 and libxslt 1.1.39.)\nIssue found by Anatoly Katyushin, see \u003ca href=\"https://bugs.launchpad.net/lxml/+bug/2107279\"\u003ehttps://bugs.launchpad.net/lxml/+bug/2107279\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003elxml-5.3.2\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-5.3.1\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-5.3.0\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-5.2.2\u003c/h2\u003e\n\u003ch1\u003e5.2.2 (2024-05-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#417: The \u003ccode\u003etest_feed_parser\u003c/code\u003e test could fail if \u003ccode\u003elxml_html_clean\u003c/code\u003e was not installed.\nIt is now skipped in that case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2059910: The minimum CPU architecture for the Linux x86 binary wheels was set back to\n\u0026quot;core2\u0026quot;, without SSE 4.2.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.3 (2026-04-09)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSeveral out of memory error cases now raise \u003ccode\u003eMemoryError\u003c/code\u003e that were not handled before.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSlicing with large step values (outside of \u003ccode\u003e+/- sys.maxsize\u003c/code\u003e) could trigger undefined C behaviour.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2125399: Some failing tests were fixed or disabled in PyPy.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2138421: Memory leak in error cases when setting the \u003ccode\u003epublic_id\u003c/code\u003e or \u003ccode\u003esystem_url\u003c/code\u003e of a document.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c7d76d6cb817c8e1f316e43b16cab5e6ad669ad0\"\u003e\u003ccode\u003ec7d76d6\u003c/code\u003e\u003c/a\u003e Change security policy to point to Github security advisories.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/378ccf82db8160928807c55ed580c0443aa94f42\"\u003e\u003ccode\u003e378ccf8\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/315270b810a9e3276c60daba549299d204ac962b\"\u003e\u003ccode\u003e315270b\u003c/code\u003e\u003c/a\u003e Docs: Reduce TOC depth of package pages and move module contents first.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6dbba7f3c72f655b05b26ef453fdee31af13ccf5\"\u003e\u003ccode\u003e6dbba7f\u003c/code\u003e\u003c/a\u003e Docs: Show current year in copyright line.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/e4385bfa5d79527350d5ef17372fb70ba80b4cce\"\u003e\u003ccode\u003ee4385bf\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5bed1e1a227cd9ba5a879aaeacdf504093a3f6e8\"\u003e\u003ccode\u003e5bed1e1\u003c/code\u003e\u003c/a\u003e Validate file hashes in release download script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c13ee10a429f1144779bb1cbf6ae3bec808ae9c1\"\u003e\u003ccode\u003ec13ee10\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.0.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-4.9.2...lxml-6.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pillow` from 12.1.1 to 12.2.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/python-pillow/Pillow/releases\"\u003epillow's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e12.2.0\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html\"\u003ehttps://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eDocumentation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate 12.2.0 release notes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9522\"\u003e#9522\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd loader plugins: AMOS abk, Atari Degas, 40+ more obscure formats via Netpbm \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9482\"\u003e#9482\u003c/a\u003e [\u003ca href=\"https://github.com/bitplane\"\u003e\u003ccode\u003e@​bitplane\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate Python versions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9515\"\u003e#9515\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eJeffrey A. Clark -\u0026gt; Jeffrey 'Alex' Clark \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9513\"\u003e#9513\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd release notes for \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9394\"\u003e#9394\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9419\"\u003e#9419\u003c/a\u003e and \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9456\"\u003e#9456\u003c/a\u003e \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9467\"\u003e#9467\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd Amiga Workbench .info loader to 3rd party plugins list \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9459\"\u003e#9459\u003c/a\u003e [\u003ca href=\"https://github.com/bitplane\"\u003e\u003ccode\u003e@​bitplane\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eMerge PFM documentation into PPM \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9434\"\u003e#9434\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate macOS tested Pillow versions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9431\"\u003e#9431\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eFix CVE number \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9430\"\u003e#9430\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependencies\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate xz to 5.8.3 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9523\"\u003e#9523\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate libjpeg-turbo to 3.1.4.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9507\"\u003e#9507\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate libpng to 1.6.56 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9499\"\u003e#9499\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate freetype to 2.14.3 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9485\"\u003e#9485\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdated libavif to 1.4.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9479\"\u003e#9479\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdated harfbuzz to 13.2.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9461\"\u003e#9461\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate Ghostscript to 10.7.0 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9469\"\u003e#9469\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate harfbuzz to 13.0.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9453\"\u003e#9453\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate libavif to 1.4.0 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9460\"\u003e#9460\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate freetype to 2.14.2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9449\"\u003e#9449\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate actions/download-artifact action to v8 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9451\"\u003e#9451\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdated libpng to 1.6.55 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9425\"\u003e#9425\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eTesting\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCleanup .spider extension in the same test where it is added \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9517\"\u003e#9517\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eRun tests in parallel via tox for 3.5x speedup \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9516\"\u003e#9516\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eEnable colour in CI logs \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9486\"\u003e#9486\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate Ghostscript to 10.7.0 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9469\"\u003e#9469\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eSimplify TGA test code \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9477\"\u003e#9477\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate tests to check for ValueError when encoding an empty image \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9464\"\u003e#9464\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpgrade CI from \u003ccode\u003emacos-15-intel\u003c/code\u003e to \u003ccode\u003emacos-26-intel\u003c/code\u003e \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9454\"\u003e#9454\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd check-case-conflict hook \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9446\"\u003e#9446\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eSpecify platform when pulling docker image \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9440\"\u003e#9440\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eGHA: Cache libavif and webp builds for Ubuntu \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9437\"\u003e#9437\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate macOS tested Pillow versions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9431\"\u003e#9431\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eOther changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCheck calloc return value \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9527\"\u003e#9527\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eCheck all allocs in the Arrow tree \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9488\"\u003e#9488\u003c/a\u003e [\u003ca href=\"https://github.com/wiredfool\"\u003e\u003ccode\u003e@​wiredfool\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eReject non-numeric elements inside list coords \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9526\"\u003e#9526\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eMove variable declaration inside define \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9525\"\u003e#9525\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/3c41c095064200a02672d89cc5ff629eaf4b0d4f\"\u003e\u003ccode\u003e3c41c09\u003c/code\u003e\u003c/a\u003e 12.2.0 version bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/cdaa29eb520291c4f1fb50fb71ae46502d41e460\"\u003e\u003ccode\u003ecdaa29e\u003c/code\u003e\u003c/a\u003e Check calloc return value (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9527\"\u003e#9527\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/585b2f5a780722c8a5bfffb3a40f7f42e8a205be\"\u003e\u003ccode\u003e585b2f5\u003c/code\u003e\u003c/a\u003e Check calloc return value\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/ecf011ea15991d4cebacd946e58270cc30b0f2c1\"\u003e\u003ccode\u003eecf011e\u003c/code\u003e\u003c/a\u003e Check all allocs in the Arrow tree (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9488\"\u003e#9488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/cf6de8ca9b23e714aa5310e1c791eda66fc0b670\"\u003e\u003ccode\u003ecf6de8c\u003c/code\u003e\u003c/a\u003e Reject non-numeric elements inside list coords (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9526\"\u003e#9526\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/ffdcede6516b28d9667c92929854023d17048b64\"\u003e\u003ccode\u003effdcede\u003c/code\u003e\u003c/a\u003e Update 12.2.0 release notes (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9522\"\u003e#9522\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/7929d7760fe5a307ba5ae6eabdf70ae4486b147c\"\u003e\u003ccode\u003e7929d77\u003c/code\u003e\u003c/a\u003e Added security release notes (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/149\"\u003e#149\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/c4f7aa5dfb4dbd1242978ac235e01b9934ec6d3c\"\u003e\u003ccode\u003ec4f7aa5\u003c/code\u003e\u003c/a\u003e Added security release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/22cdb5f2e4b15250c06563b1124ac1667342712f\"\u003e\u003ccode\u003e22cdb5f\u003c/code\u003e\u003c/a\u003e Move variable declaration inside define (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9525\"\u003e#9525\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/fc15b3b01899408ec989d7804c5283e13802d057\"\u003e\u003ccode\u003efc15b3b\u003c/code\u003e\u003c/a\u003e Resize tall images vertically first (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9524\"\u003e#9524\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/python-pillow/Pillow/compare/12.1.1...12.2.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pyjwt` from 2.6.0 to 2.13.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/releases\"\u003epyjwt's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.13.0\u003c/h2\u003e\n\u003ch1\u003ePyJWT 2.13.0 — Security Release\u003c/h1\u003e\n\u003cp\u003eThis release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\"\u003e\u003ccode\u003eGHSA-xgmm-8j9v-c9wx\u003c/code\u003e\u003c/a\u003e — JWK JSON accepted as HMAC secret (algorithm confusion).\u003c/strong\u003e \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in \u003ccode\u003ealgorithms=[…]\u003c/code\u003e and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. \u003cem\u003eReported by \u003ca href=\"https://github.com/aradona91\"\u003e\u003ccode\u003e@​aradona91\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\"\u003e\u003ccode\u003eGHSA-jq35-7prp-9v3f\u003c/code\u003e\u003c/a\u003e — Algorithm allow-list bypass with \u003ccode\u003ePyJWK\u003c/code\u003e / \u003ccode\u003ePyJWKClient\u003c/code\u003e.\u003c/strong\u003e When verifying with a \u003ccode\u003ePyJWK\u003c/code\u003e, the caller's \u003ccode\u003ealgorithms=[…]\u003c/code\u003e allow-list was checked against the token header \u003ccode\u003ealg\u003c/code\u003e as a string only; actual verification used the algorithm bound to the \u003ccode\u003ePyJWK\u003c/code\u003e. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header \u003ccode\u003ealg\u003c/code\u003e to match the \u003ccode\u003ePyJWK\u003c/code\u003e's algorithm before verification. \u003cem\u003eReported by \u003ca href=\"https://github.com/sushi-gif\"\u003e\u003ccode\u003e@​sushi-gif\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\"\u003e\u003ccode\u003eGHSA-w7vc-732c-9m39\u003c/code\u003e\u003c/a\u003e — DoS via base64 decode of unused payload segment when \u003ccode\u003eb64=false\u003c/code\u003e.\u003c/strong\u003e For detached-payload JWS (\u003ccode\u003eb64=false\u003c/code\u003e), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied \u003ccode\u003edetached_payload\u003c/code\u003e. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. \u003cem\u003eReported by \u003ca href=\"https://github.com/thesmartshadow\"\u003e\u003ccode\u003e@​thesmartshadow\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\"\u003e\u003ccode\u003eGHSA-993g-76c3-p5m4\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e accepts non-HTTP(S) URIs.\u003c/strong\u003e \u003ccode\u003ePyJWKClient.fetch_data\u003c/code\u003e passed its URI to \u003ccode\u003eurllib.request.urlopen\u003c/code\u003e, which by default also handles \u003ccode\u003efile://\u003c/code\u003e, \u003ccode\u003eftp://\u003c/code\u003e, and \u003ccode\u003edata:\u003c/code\u003e schemes. An application that fed an attacker-influenced URI into \u003ccode\u003ePyJWKClient\u003c/code\u003e could be coerced into reading local files or reaching other unintended schemes. \u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects any URI whose scheme isn't \u003ccode\u003ehttp\u003c/code\u003e or \u003ccode\u003ehttps\u003c/code\u003e. \u003cem\u003eReported by \u003ca href=\"https://github.com/KEIJOT\"\u003e\u003ccode\u003e@​KEIJOT\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\"\u003e\u003ccode\u003eGHSA-fhv5-28vv-h8m8\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e cache wiped on fetch error.\u003c/strong\u003e A \u003ccode\u003efinally\u003c/code\u003e-block \u003ccode\u003eput(jwk_set=None)\u003c/code\u003e cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. \u003cem\u003eReported by \u003ca href=\"https://github.com/eddieran\"\u003e\u003ccode\u003e@​eddieran\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReject empty HMAC keys outright in \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e with \u003ccode\u003eInvalidKeyError\u003c/code\u003e instead of accepting them with only a warning. Defends against the \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e footgun. \u003cem\u003eThanks to \u003ca href=\"https://github.com/SnailSploit\"\u003e\u003ccode\u003e@​SnailSploit\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"https://github.com/spartan8806\"\u003e\u003ccode\u003e@​spartan8806\u003c/code\u003e\u003c/a\u003e for the reports.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003eForward per-call \u003ccode\u003eoptions\u003c/code\u003e (including \u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e) from \u003ccode\u003ePyJWT.decode\u003c/code\u003e through to \u003ccode\u003ePyJWS._verify_signature\u003c/code\u003e. The option was previously silently dropped between the two layers, so it only took effect when set on the \u003ccode\u003ePyJWT\u003c/code\u003e instance. \u003cem\u003eThanks to \u003ca href=\"https://github.com/WLUB\"\u003e\u003ccode\u003e@​WLUB\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRFC 7797 §3 compliance for \u003ccode\u003eb64=false\u003c/code\u003e:\u003c/strong\u003e the encoder now auto-adds \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e to \u003ccode\u003ecrit\u003c/code\u003e, and the decoder rejects tokens that set \u003ccode\u003eb64=false\u003c/code\u003e without listing it in \u003ccode\u003ecrit\u003c/code\u003e. \u003cem\u003eThanks to \u003ca href=\"https://github.com/MachineLearning-Nerd\"\u003e\u003ccode\u003e@​MachineLearning-Nerd\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eChanged\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups, by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/pull/1152\"\u003e#1152\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eUpgrade notes\u003c/h2\u003e\n\u003cp\u003eMost fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eEmpty HMAC keys now raise.\u003c/strong\u003e If your app passed \u003ccode\u003e\u0026quot;\u0026quot;\u003c/code\u003e or \u003ccode\u003eb\u0026quot;\u0026quot;\u003c/code\u003e as a secret (often via a missing env var, e.g. \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e), \u003ccode\u003eencode\u003c/code\u003e/\u003ccode\u003edecode\u003c/code\u003e will now raise \u003ccode\u003eInvalidKeyError\u003c/code\u003e. This is the intended behavior — fix the configuration.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWK\u003c/code\u003e decoding now requires the token's \u003ccode\u003ealg\u003c/code\u003e to match the JWK's algorithm.\u003c/strong\u003e Previously a mismatch was silently honored if the header \u003ccode\u003ealg\u003c/code\u003e appeared in the allow-list. Tokens that relied on this mismatch will now fail with \u003ccode\u003eInvalidAlgorithmError\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects non-HTTP(S) URIs at construction time.\u003c/strong\u003e Tests or dev environments that fetched JWKS from \u003ccode\u003efile://\u003c/code\u003e URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct \u003ccode\u003ePyJWKSet.from_dict(...)\u003c/code\u003e directly).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eb64=false\u003c/code\u003e tokens are now strictly RFC 7515 / 7797 compliant.\u003c/strong\u003e Tokens with a non-empty compact-form payload segment, or that omit \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e from \u003ccode\u003ecrit\u003c/code\u003e, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e set per-call now takes effect.\u003c/strong\u003e Callers who passed \u003ccode\u003eoptions={\u0026quot;enforce_minimum_key_length\u0026quot;: True}\u003c/code\u003e to \u003ccode\u003ejwt.decode()\u003c/code\u003e previously got no enforcement; they will now get \u003ccode\u003eInvalidKeyError\u003c/code\u003e on undersized keys, as documented.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull changelog:\u003c/strong\u003e \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\"\u003ehttps://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e2.12.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd typing_extensions dependency for Python \u0026lt; 3.11 by \u003ca href=\"https://github.com/jpadilla\"\u003e\u003ccode\u003e@​jpadilla\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/pull/1151\"\u003ejpadilla/pyjwt#1151\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\"\u003ehttps://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e2.12.0\u003c/h2\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eValidate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by \u003ca href=\"https://github.com/dmbs335\"\u003e\u003ccode\u003e@​dmbs335\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f\"\u003eGHSA-752w-5fwx-jx9f\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst\"\u003epyjwt's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ccode\u003ev2.13.0 \u0026lt;https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u0026gt;\u003c/code\u003e__\u003c/h2\u003e\n\u003cp\u003eSecurity\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject JWK JSON documents passed as raw HMAC secrets in\n  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that\n  the existing PEM/SSH guard did not cover. Reported by @aradona91 in\n  `GHSA-xgmm-8j9v-c9wx \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\u0026gt;`__.\n- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during\n  verification so the caller's ``algorithms=[...]`` allow-list cannot be\n  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported\n  by @sushi-gif in `GHSA-jq35-7prp-9v3f \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\u0026gt;`__.\n- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-\n  influenced URIs cannot read local files or reach unintended schemes via\n  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported\n  by @KEIJOT in `GHSA-993g-76c3-p5m4 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\u0026gt;`__.\n- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.\n  The previous ``finally``-block ``put(None)`` pattern cleared the cache\n  on any transient outage, turning one bad JWKS request into application-\n  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\u0026gt;`__.\n- Skip the unconditional base64 decode of the compact-form payload segment\n  when ``b64=false`` is set in the protected header, and require that\n  segment to be empty (RFC 7515 Appendix F detached form). Closes an\n  unauthenticated DoS amplifier. Reported by @thesmartshadow in\n  `GHSA-w7vc-732c-9m39 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\u0026gt;`__.\n\u003cp\u003eFixed\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with\n  ``InvalidKeyError`` instead of accepting them with only a warning.\n  Thanks to @SnailSploit and @spartan8806 for independently flagging the\n  footgun.\n- Forward per-call ``options`` (including ``enforce_minimum_key_length``)\n  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the\n  option actually takes effect when set at the call site rather than only\n  on the ``PyJWT`` instance. Thanks to @WLUB for the report.\n- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds\n  ``\u0026amp;quot;b64\u0026amp;quot;`` to the ``crit`` header parameter, and the decoder rejects\n  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to\n  @MachineLearning-Nerd for the report.\n\nChanged\n\u003c/code\u003e\u003c/pre\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ccode\u003e[#1152](https://github.com/jpadilla/pyjwt/issues/1152) \u0026amp;lt;https://github.com/jpadilla/pyjwt/pull/1152\u0026amp;gt;\u003c/code\u003e__\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ccode\u003ev2.12.1 \u0026amp;lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\u0026amp;gt;\u003c/code\u003e__\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt;\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff\"\u003e\u003ccode\u003e7144e45\u003c/code\u003e\u003c/a\u003e Apply ruff format\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab\"\u003e\u003ccode\u003ed2f4bec\u003c/code\u003e\u003c/a\u003e Restore \u003ccode\u003ecast()\u003c/code\u003e calls with cross-version \u003ccode\u003etype: ignore\u003c/code\u003e for \u003ccode\u003eprepare_key\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774\"\u003e\u003ccode\u003e22f478c\u003c/code\u003e\u003c/a\u003e Remove redundant casts in \u003ccode\u003eRSAAlgorithm.prepare_key\u003c/code\u003e and `ECAlgorithm.prepare...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81\"\u003e\u003ccode\u003e95791b1\u003c/code\u003e\u003c/a\u003e Bundle security fixes and hardening into 2.13.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508\"\u003e\u003ccode\u003edcc27a9\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1155\"\u003e#1155\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a\"\u003e\u003ccode\u003e9d08a9a\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1146\"\u003e#1146\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64\"\u003e\u003ccode\u003eb87c100\u003c/code\u003e\u003c/a\u003e Bump codecov/codecov-action from 5 to 6 (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1154\"\u003e#1154\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812\"\u003e\u003ccode\u003e40e3147\u003c/code\u003e\u003c/a\u003e Migrate development extras to dependency groups (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1152\"\u003e#1152\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/a4e1a3d1218b01c5806420b8f16d9308ac4adc30\"\u003e\u003ccode\u003ea4e1a3d\u003c/code\u003e\u003c/a\u003e Add typing_extensions dependency for Python \u0026lt; 3.11 (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1151\"\u003e#1151\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/bd9700cca7f9258fadcc429c1034e508025931f2\"\u003e\u003ccode\u003ebd9700c\u003c/code\u003e\u003c/a\u003e Use PyJWK algorithm when encoding without explicit algorithm (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1148\"\u003e#1148\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.6.0...2.13.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pypdf` from 6.7.1 to 6.13.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/py-pdf/pypdf/releases\"\u003epypdf's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.13.3, 2026-06-17\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eApply MAX_DECLARED_STREAM_LENGTH to streams without length as well (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3871\"\u003e#3871\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance Improvements (PI)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAvoid per-pixel getpixel loop for 1-bit indexed images (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3854\"\u003e#3854\u003c/a\u003e) by \u003ca href=\"https://github.com/Samuel-Harris\"\u003e\u003ccode\u003e@​Samuel-Harris\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSeveral fixes by \u003ca href=\"https://github.com/metsw24-max\"\u003e\u003ccode\u003e@​metsw24-max\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaintenance (MAINT)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMake mypy assert messages consistent (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3849\"\u003e#3849\u003c/a\u003e) by \u003ca href=\"https://github.com/j-t-1\"\u003e\u003ccode\u003e@​j-t-1\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.13.2...6.13.3\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.13.2, 2026-06-10\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDetect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3847\"\u003e#3847\u003c/a\u003e) by \u003ca href=\"https://github.com/fredericoschardong\"\u003e\u003ccode\u003e@​fredericoschardong\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix UnboundLocalError in _read_standard_xref_table on a malformed entry (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3841\"\u003e#3841\u003c/a\u003e) by \u003ca href=\"https://github.com/joszamama\"\u003e\u003ccode\u003e@​joszamama\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRaise PdfStreamError on non-hexadecimal bytes in hex readers (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3832\"\u003e#3832\u003c/a\u003e) by \u003ca href=\"https://github.com/metsw24-max\"\u003e\u003ccode\u003e@​metsw24-max\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.13.1...6.13.2\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.13.1, 2026-06-08\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePrevent infinite loops when processing threads/articles (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3839\"\u003e#3839\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.13.0...6.13.1\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.13.0, 2026-06-05\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAvoid infinite loops for outlines and text extraction (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3830\"\u003e#3830\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Japanese predefined CMaps (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3800\"\u003e#3800\u003c/a\u003e) by \u003ca href=\"https://github.com/yasuhiroiwaki\"\u003e\u003ccode\u003e@​yasuhiroiwaki\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFont: Collect all character widths, not only those that can be unicode mapped (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3798\"\u003e#3798\u003c/a\u003e) by \u003ca href=\"https://github.com/PJBrs\"\u003e\u003ccode\u003e@​PJBrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRecover a corrupt trailing startxref pointer (closes \u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3238\"\u003e#3238\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3826\"\u003e#3826\u003c/a\u003e) by \u003ca href=\"https://github.com/gaoflow\"\u003e\u003ccode\u003e@​gaoflow\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eHandle /Pages node without /Kids during flattening (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3825\"\u003e#3825\u003c/a\u003e) by \u003ca href=\"https://github.com/gaoflow\"\u003e\u003ccode\u003e@​gaoflow\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md\"\u003epypdf's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.13.3, 2026-06-17\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eApply MAX_DECLARED_STREAM_LENGTH to streams without length as well (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3871\"\u003e#3871\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance Improvements (PI)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAvoid per-pixel getpixel loop for 1-bit indexed images (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3854\"\u003e#3854\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSeveral fixes\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaintenance (MAINT)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMake mypy assert messages consistent (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3849\"\u003e#3849\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.13.2...6.13.3\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.13.2, 2026-06-10\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDetect multi-hop cyclic /Pages trees in _flatten to prevent SIGSEGV (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3847\"\u003e#3847\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix UnboundLocalError in _read_standard_xref_table on a malformed entry (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3841\"\u003e#3841\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRaise PdfStreamError on non-hexadecimal bytes in hex readers (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3832\"\u003e#3832\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.13.1...6.13.2\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.13.1, 2026-06-08\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePrevent infinite loops when processing threads/articles (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3839\"\u003e#3839\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.13.0...6.13.1\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.13.0, 2026-06-05\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAvoid infinite loops for outlines and text extraction (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3830\"\u003e#3830\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Japanese predefined CMaps (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3800\"\u003e#3800\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFont: Collect all character widths, not only those that can be unicode mapped (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3798\"\u003e#3798\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRecover a corrupt trailing startxref pointer (closes \u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3238\"\u003e#3238\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3826\"\u003e#3826\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eHandle /Pages node without /Kids during flattening (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3825\"\u003e#3825\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAccept inline image EI marker at the end of a content stream (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3827\"\u003e#3827\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaintenance (MAINT)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eType the always-raising deprecation helpers as \u003ccode\u003eNoReturn\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3819\"\u003e#3819\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/9aa05e7bde29a55e3ddb938347082e0d6e333e17\"\u003e\u003ccode\u003e9aa05e7\u003c/code\u003e\u003c/a\u003e REL: 6.13.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/bbd083d1196d276d9c542418f77ac49e06de3ff1\"\u003e\u003ccode\u003ebbd083d\u003c/code\u003e\u003c/a\u003e SEC: Apply MAX_DECLARED_STREAM_LENGTH to streams without length as well (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3871\"\u003e#3871\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/d5cd26622a871635cb8bc6ae0552c843681b5a6e\"\u003e\u003ccode\u003ed5cd266\u003c/code\u003e\u003c/a\u003e ROB: Guard text operators against missing operands in extract_text (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3861\"\u003e#3861\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/82f1f902a466a42c0e586afdfb35227825572df4\"\u003e\u003ccode\u003e82f1f90\u003c/code\u003e\u003c/a\u003e ROB: Tolerate malformed /Limits in index2label (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3858\"\u003e#3858\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/0276a6fa03a1304a87dfc610ae0335b563cb8788\"\u003e\u003ccode\u003e0276a6f\u003c/code\u003e\u003c/a\u003e PI: Avoid per-pixel getpixel loop for 1-bit indexed images (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3854\"\u003e#3854\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/41a9c3c54f2de0fcb0151e796178c2ed5acb5f79\"\u003e\u003ccode\u003e41a9c3c\u003c/code\u003e\u003c/a\u003e MAINT: Make mypy assert messages consistent (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3849\"\u003e#3849\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/d1bba60c8e22e6fe23d23998dbaea6ea713868e2\"\u003e\u003ccode\u003ed1bba60\u003c/code\u003e\u003c/a\u003e MAINT: Increase readability of PdfDocCommon (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3834\"\u003e#3834\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/53b6fbc71d8596d52002026b821c3436e62060fe\"\u003e\u003ccode\u003e53b6fbc\u003c/code\u003e\u003c/a\u003e DEV: Bump codecov/codecov-action from 6.0.1 to 7.0.0 (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3859\"\u003e#3859\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/e07c223a67fcbaf3fb29b511b65cb5de650edd17\"\u003e\u003ccode\u003ee07c223\u003c/code\u003e\u003c/a\u003e MAINT: Enforce G004 (no f-strings in logging) (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3845\"\u003e#3845\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/5270f76027c5a41be3247b661b58f435e8be479b\"\u003e\u003ccode\u003e5270f76\u003c/code\u003e\u003c/a\u003e ROB: Guard zero unitsPerEm in from_truetype_font_file (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3846\"\u003e#3846\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.7.1...6.13.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `python-dotenv` from 1.2.1 to 1.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/theskumar/python-dotenv/releases\"\u003epython-dotenv's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.2.2\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for Python 3.14, including the free-threaded (3.14t) build. (#)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003edotenv run\u003c/code\u003e command now forwards flags directly to the specified command by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/607\"\u003etheskumar/python-dotenv#607\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved documentation clarity regarding override behavior and the reference page.\u003c/li\u003e\n\u003cli\u003eUpdated PyPy support to version 3.11.\u003c/li\u003e\n\u003cli\u003eDocumentation for FIFO file support.\u003c/li\u003e\n\u003cli\u003eSupport for Python 3.9.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved \u003ccode\u003eset_key\u003c/code\u003e and \u003ccode\u003eunset_key\u003c/code\u003e behavior when interacting with symlinks by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311\"\u003e#790c5\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCorrected the license specifier and added missing Python 3.14 classifiers in package metadata by \u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/590\"\u003etheskumar/python-dotenv#590\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e and \u003ccode\u003edotenv.unset_key\u003c/code\u003e used to follow symlinks in some\nsituations. This is no longer the case. For that behavior to be restored in\nall cases, \u003ccode\u003efollow_symlinks=True\u003c/code\u003e should be used.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the CLI, \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e used to follow symlinks in some situations. This\nis no longer the case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e, \u003ccode\u003edotenv.unset_key\u003c/code\u003e and the CLI commands \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e\nused to reset the file mode of the modified .env file to \u003ccode\u003e0o600\u003c/code\u003e in some\nsituations. This is no longer the case: The original mode of the file is now\npreserved. Is the file needed to be created or wasn't a regular file, mode\n\u003ccode\u003e0o600\u003c/code\u003e is used.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eskip 000 permission tests for root user by \u003ca href=\"https://github.com/burnout-projects\"\u003e\u003ccode\u003e@​burnout-projects\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/561\"\u003etheskumar/python-dotenv#561\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 5 to 6 in the github-actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/593\"\u003etheskumar/python-dotenv#593\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Windows testing to CI by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/604\"\u003etheskumar/python-dotenv#604\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove workflow efficiency with best practices by \u003ca href=\"https://github.com/theskumar\"\u003e...\n\n_Description has been truncated_","html_url":"https://github.com/NYPL/digital-research-books/pull/1165","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/NYPL%2Fdigital-research-books/issues/1165","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/1165/packages"}},{"old_version":"6.1.0","new_version":"6.1.1","update_type":"patch","path":null,"pr_created_at":"2026-06-29T02:15:18.000Z","version_change":"6.1.0 → 6.1.1","issue":{"uuid":"4764504409","node_id":"PR_kwDOAHyNm87rl4Y-","number":19376,"state":"open","title":"build(deps): bump lxml from 6.1.0 to 6.1.1","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-29T02:15:18.000Z","updated_at":"2026-06-29T02:16:20.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps)","packages":[{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"}],"path":null,"ecosystem":"pip"},"body":"Bumps [lxml](https://github.com/lxml/lxml) from 6.1.0 to 6.1.1.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lxml\u0026package-manager=uv\u0026previous-version=6.1.0\u0026new-version=6.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/saleor/saleor/pull/19376","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/saleor%2Fsaleor/issues/19376","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/19376/packages"}},{"old_version":"6.1.0","new_version":"6.1.1","update_type":"patch","path":null,"pr_created_at":"2026-06-25T00:49:57.000Z","version_change":"6.1.0 → 6.1.1","issue":{"uuid":"4739606925","node_id":"PR_kwDORQ8Eq87qWao8","number":130,"state":"open","title":"build(deps): bump the python-minor-patch group across 1 directory with 11 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-25T00:49:57.000Z","updated_at":"2026-06-25T01:11:06.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps): bump","group_name":"python-minor-patch","update_count":11,"packages":[{"name":"certifi","old_version":"2026.2.25","new_version":"2026.6.17","repository_url":"https://github.com/certifi/python-certifi"},{"name":"charset-normalizer","old_version":"3.4.5","new_version":"3.4.7","repository_url":"https://github.com/jawah/charset_normalizer"},{"name":"docutils","old_version":"0.22.4","new_version":"0.23","repository_url":"https://github.com/rtfd/recommonmark"},{"name":"huggingface-hub","old_version":"1.18.0","new_version":"1.20.1","repository_url":"https://github.com/huggingface/huggingface_hub"},{"name":"idna","old_version":"3.15","new_version":"3.18","repository_url":"https://github.com/kjd/idna"},{"name":"jaraco-context","old_version":"6.1.1","new_version":"6.1.2","repository_url":"https://github.com/jaraco/jaraco.context"},{"name":"jaraco-functools","old_version":"4.4.0","new_version":"4.5.0","repository_url":"https://github.com/jaraco/jaraco.functools"},{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"},{"name":"markdown-it-py","old_version":"4.0.0","new_version":"4.2.0","repository_url":"https://github.com/executablebooks/markdown-it-py"},{"name":"nh3","old_version":"0.3.3","new_version":"0.3.6","repository_url":"https://github.com/messense/nh3"},{"name":"semgrep","old_version":"1.166.0","new_version":"1.168.0","repository_url":"https://github.com/semgrep/semgrep"}],"path":null,"ecosystem":"pip"},"body":"Bumps the python-minor-patch group with 11 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [certifi](https://github.com/certifi/python-certifi) | `2026.2.25` | `2026.6.17` |\n| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.5` | `3.4.7` |\n| [docutils](https://github.com/rtfd/recommonmark) | `0.22.4` | `0.23` |\n| [huggingface-hub](https://github.com/huggingface/huggingface_hub) | `1.18.0` | `1.20.1` |\n| [idna](https://github.com/kjd/idna) | `3.15` | `3.18` |\n| [jaraco-context](https://github.com/jaraco/jaraco.context) | `6.1.1` | `6.1.2` |\n| [jaraco-functools](https://github.com/jaraco/jaraco.functools) | `4.4.0` | `4.5.0` |\n| [lxml](https://github.com/lxml/lxml) | `6.1.0` | `6.1.1` |\n| [markdown-it-py](https://github.com/executablebooks/markdown-it-py) | `4.0.0` | `4.2.0` |\n| [nh3](https://github.com/messense/nh3) | `0.3.3` | `0.3.6` |\n| [semgrep](https://github.com/semgrep/semgrep) | `1.166.0` | `1.168.0` |\n\n\nUpdates `certifi` from 2026.2.25 to 2026.6.17\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/d0ac52f3d93a514224197c7efb66c41b1beae5d1\"\u003e\u003ccode\u003ed0ac52f\u003c/code\u003e\u003c/a\u003e 2026.06.17 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/418\"\u003e#418\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/d46de621787c609158579929f44b91ce731d01b8\"\u003e\u003ccode\u003ed46de62\u003c/code\u003e\u003c/a\u003e Bump actions/checkout from 6.0.2 to 6.0.3 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/417\"\u003e#417\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/6c183ec39d81135350dd44abd0e5daefc8e35b9d\"\u003e\u003ccode\u003e6c183ec\u003c/code\u003e\u003c/a\u003e fix: update Requests docs link to canonical URL (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/415\"\u003e#415\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/36e35680e0dc42c70cd60bfe440e92e7137f5a1c\"\u003e\u003ccode\u003e36e3568\u003c/code\u003e\u003c/a\u003e Bump dessant/lock-threads from 6.0.0 to 6.0.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/d7ea151afc2ce6bef0555b9349902bd867e928dd\"\u003e\u003ccode\u003ed7ea151\u003c/code\u003e\u003c/a\u003e 2026.05.20 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/413\"\u003e#413\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/5dddfb072243da27adde885b73ba9b809c3224ca\"\u003e\u003ccode\u003e5dddfb0\u003c/code\u003e\u003c/a\u003e 2026.04.22 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/410\"\u003e#410\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/f99eccdaf87f7c10e521a58a700ca3eb94a0787e\"\u003e\u003ccode\u003ef99eccd\u003c/code\u003e\u003c/a\u003e Bump peter-evans/create-pull-request from 8.1.0 to 8.1.1 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/404\"\u003e#404\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/918bed055f7291719512af186c1c24710f845660\"\u003e\u003ccode\u003e918bed0\u003c/code\u003e\u003c/a\u003e Bump actions/upload-artifact from 7.0.0 to 7.0.1 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/405\"\u003e#405\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/0a49067eb434e53e1f8df5f7707d5dc05ef9def4\"\u003e\u003ccode\u003e0a49067\u003c/code\u003e\u003c/a\u003e Bump pypa/gh-action-pypi-publish from 1.13.0 to 1.14.0 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/403\"\u003e#403\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/acf6ce8e39e3b125f4349e11904295e4fe4c1bed\"\u003e\u003ccode\u003eacf6ce8\u003c/code\u003e\u003c/a\u003e Bump actions/download-artifact from 8.0.0 to 8.0.1 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/398\"\u003e#398\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/certifi/python-certifi/compare/2026.02.25...2026.06.17\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `charset-normalizer` from 3.4.5 to 3.4.7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jawah/charset_normalizer/releases\"\u003echarset-normalizer's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 3.4.7\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.6...3.4.7\"\u003e3.4.7\u003c/a\u003e (2026-04-02)\u003c/h2\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePre-built optimized version using mypy[c] v1.20.\u003c/li\u003e\n\u003cli\u003eRelax \u003ccode\u003esetuptools\u003c/code\u003e constraint to \u003ccode\u003esetuptools\u0026gt;=68,\u0026lt;82.1\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eCorrectly remove SIG remnant in utf-7 decoded string. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/718\"\u003e#718\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/716\"\u003e#716\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 3.4.6\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.5...3.4.6\"\u003e3.4.6\u003c/a\u003e (2026-03-15)\u003c/h2\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFlattened the logic in \u003ccode\u003echarset_normalizer.md\u003c/code\u003e for higher performance. Removed \u003ccode\u003eeligible(..)\u003c/code\u003e and \u003ccode\u003efeed(...)\u003c/code\u003e\nin favor of \u003ccode\u003efeed_info(...)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRaised upper bound for mypy[c] to 1.20, for our optimized version.\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003eUNICODE_RANGES_COMBINED\u003c/code\u003e using Unicode blocks v17.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEdge case where noise difference between two candidates can be almost insignificant. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/672\"\u003e#672\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eCLI \u003ccode\u003e--normalize\u003c/code\u003e writing to wrong path when passing multiple files in. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/702\"\u003e#702\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFreethreaded pre-built wheels now shipped in PyPI starting with 3.14t. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/616\"\u003e#616\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md\"\u003echarset-normalizer's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.6...3.4.7\"\u003e3.4.7\u003c/a\u003e (2026-04-02)\u003c/h2\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePre-built optimized version using mypy[c] v1.20.\u003c/li\u003e\n\u003cli\u003eRelax \u003ccode\u003esetuptools\u003c/code\u003e constraint to \u003ccode\u003esetuptools\u0026gt;=68,\u0026lt;82.1\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eCorrectly remove SIG remnant in utf-7 decoded string. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/718\"\u003e#718\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/716\"\u003e#716\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/Ousret/charset_normalizer/compare/3.4.5...3.4.6\"\u003e3.4.6\u003c/a\u003e (2026-03-15)\u003c/h2\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFlattened the logic in \u003ccode\u003echarset_normalizer.md\u003c/code\u003e for higher performance. Removed \u003ccode\u003eeligible(..)\u003c/code\u003e and \u003ccode\u003efeed(...)\u003c/code\u003e\nin favor of \u003ccode\u003efeed_info(...)\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eRaised upper bound for mypy[c] to 1.20, for our optimized version.\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003eUNICODE_RANGES_COMBINED\u003c/code\u003e using Unicode blocks v17.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEdge case where noise difference between two candidates can be almost insignificant. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/672\"\u003e#672\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eCLI \u003ccode\u003e--normalize\u003c/code\u003e writing to wrong path when passing multiple files in. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/702\"\u003e#702\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFreethreaded pre-built wheels now shipped in PyPI starting with 3.14t. (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/616\"\u003e#616\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/0f07891bf516b5d5231f1bd4dd2d8da7d4d09a9a\"\u003e\u003ccode\u003e0f07891\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/729\"\u003e#729\u003c/a\u003e from jawah/release-3.4.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/fdbeb299479e8f4d737e4d227cd0b2bd5d273dc0\"\u003e\u003ccode\u003efdbeb29\u003c/code\u003e\u003c/a\u003e chore: update dev, and ci requirements\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/b66f922bfbdbdd9dd46af18a8964d4fb888756d4\"\u003e\u003ccode\u003eb66f922\u003c/code\u003e\u003c/a\u003e chore: add ft classifier\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/f94249d0a2c712f2d03124f4de6b77f5e03aaa96\"\u003e\u003ccode\u003ef94249d\u003c/code\u003e\u003c/a\u003e chore: add test cases for utf_7 recent fix\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/95c866f6c984bbd043e7e3ed0628aa4f3f8d5a26\"\u003e\u003ccode\u003e95c866f\u003c/code\u003e\u003c/a\u003e chore: bump version to 3.4.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/4f429bb764c7e893f99bb4bceb60856da1baacfb\"\u003e\u003ccode\u003e4f429bb\u003c/code\u003e\u003c/a\u003e chore: bump mypy pre-commit to v1.20\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/b579cd6cab9bd83aa3fc0ca169d4df022bf4888c\"\u003e\u003ccode\u003eb579cd6\u003c/code\u003e\u003c/a\u003e fix: correctly remove SIG remnant in utf-7 decoded string\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/58bf944a77cc0883fc46a6ee8edac3549fea5d59\"\u003e\u003ccode\u003e58bf944\u003c/code\u003e\u003c/a\u003e :arrow_up: Bump github/codeql-action from 4.32.4 to 4.35.1 (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/728\"\u003e#728\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/44cf8a1b676a2532a8f1694e62e4f4f98f9132e1\"\u003e\u003ccode\u003e44cf8a1\u003c/code\u003e\u003c/a\u003e :arrow_up: Bump actions/download-artifact from 8.0.0 to 8.0.1 (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/726\"\u003e#726\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jawah/charset_normalizer/commit/362bc20073f737b1ba4ca2f68cffb0c4cc024d20\"\u003e\u003ccode\u003e362bc20\u003c/code\u003e\u003c/a\u003e :arrow_up: Bump docker/setup-qemu-action from 3.7.0 to 4.0.0 (\u003ca href=\"https://redirect.github.com/jawah/charset_normalizer/issues/725\"\u003e#725\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jawah/charset_normalizer/compare/3.4.5...3.4.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `docutils` from 0.22.4 to 0.23\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/rtfd/recommonmark/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `huggingface-hub` from 1.18.0 to 1.20.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/huggingface/huggingface_hub/releases\"\u003ehuggingface-hub's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e[v1.20.0] Browser-based OAuth login, multi-commit folder uploads, and more\u003c/h2\u003e\n\u003ch2\u003e🔒 Browser-based OAuth login\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003ehf auth login\u003c/code\u003e now defaults to a browser-based OAuth Device Code flow instead of asking you to copy-paste a token. The command prints a URL and a short code, you authorize in the browser, and the CLI retrieves and saves the token for you. The same applies to \u003ccode\u003elogin()\u003c/code\u003e in Python. In an interactive terminal you still get a \u003ccode\u003egh\u003c/code\u003e-style arrow-key menu to pick between browser login and pasting a token, and \u003ccode\u003e--token\u003c/code\u003e works exactly as before.\u003c/p\u003e\n\u003cp\u003eOAuth tokens expire after 30 days, but they come with a refresh token: \u003ccode\u003eget_token()\u003c/code\u003e transparently refreshes them when less than a day of validity remains, so long-running setups keep working without re-authenticating. \u003ccode\u003ehf auth list\u003c/code\u003e now shows the expiry date for OAuth tokens.\u003c/p\u003e\n\u003cpre lang=\"bash\"\u003e\u003ccode\u003e\u0026gt; hf auth login\r\n? How would you like to log in? Log in with your browser\r\n\u003cpre\u003e\u003ccode\u003eOpen this URL in your browser:\r\n    https://hf.co/oauth/device\r\n\r\nAnd enter the code: 52AT-FLYZ\r\n\r\nWaiting for authorization.\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003e\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cp\u003eWhen the command is run by an AI agent, it never prompts. Instead it streams structured events so the agent can surface the URL and code to its user, then blocks until a terminal \u003ccode\u003eauth_success\u003c/code\u003e / \u003ccode\u003eauth_error\u003c/code\u003e event:\u003c/p\u003e\n\u003cpre lang=\"console\"\u003e\u003ccode\u003e$ hf auth login --format json\r\n{\u0026quot;event\u0026quot;: \u0026quot;device_code\u0026quot;, \u0026quot;verification_uri\u0026quot;: \u0026quot;https://hf.co/oauth/device\u0026quot;, \u0026quot;user_code\u0026quot;: \u0026quot;52AT-FLYZ\u0026quot;, \u0026quot;verification_uri_complete\u0026quot;: \u0026quot;https://hf.co/oauth/device\u0026quot;, \u0026quot;expires_in\u0026quot;: 300, \u0026quot;interval\u0026quot;: 5}\r\n{\u0026quot;event\u0026quot;: \u0026quot;auth_success\u0026quot;, \u0026quot;user\u0026quot;: \u0026quot;celinah\u0026quot;, \u0026quot;token_name\u0026quot;: \u0026quot;oauth-celinah\u0026quot;}\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003e\u003ccode\u003ehf auth list\u003c/code\u003e surfaces the new expiry column:\u003c/p\u003e\n\u003cpre lang=\"console\"\u003e\u003ccode\u003e$ hf auth list\r\n  name          token       expires\r\n- ------------- ----------- -------------------\r\n  my-token      hf_****5678\r\n* oauth-user    hf_****1234 2026-07-09\r\n  oauth-old     hf_****9999 2026-06-09 (expired)\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eFinally, \u003ccode\u003enotebook_login()\u003c/code\u003e now renders the link and code with plain \u003ccode\u003eIPython.display.HTML\u003c/code\u003e, dropping the \u003ccode\u003eipywidgets\u003c/code\u003e dependency.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e[Auth] Browser-based OAuth login by \u003ca href=\"https://github.com/hanouticelina\"\u003e\u003ccode\u003e@​hanouticelina\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4354\"\u003e#4354\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e⚡ Faster, more reliable \u003ccode\u003ehf upload\u003c/code\u003e for large folders\u003c/h2\u003e\n\u003cp\u003e\u003ccode\u003ehf upload\u003c/code\u003e and the underlying \u003ccode\u003eupload_folder\u003c/code\u003e have been revamped to be faster and far more robust on large folders. When \u003ccode\u003ehf_xet\u003c/code\u003e is installed (the default), uploads now run through a streamed, multi-commit pipeline built on the \u003ccode\u003eXetSession\u003c/code\u003e API: the folder is scanned and fed into a background Xet upload while previous batches are committed in parallel, and files are hashed in a single read pass while they are chunked (the old flow read every large file twice). Nothing changes in how you call it:\u003c/p\u003e\n\u003cpre lang=\"bash\"\u003e\u003ccode\u003ehf upload \u0026lt;repo-id\u0026gt; \u0026lt;path/to/folder\u0026gt;\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/5efdca0b066740c911e59feba2f14e145ff3dbfb\"\u003e\u003ccode\u003e5efdca0\u003c/code\u003e\u003c/a\u003e Release: v1.20.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/0c3a0622f413923853faced000b97446194a6fae\"\u003e\u003ccode\u003e0c3a062\u003c/code\u003e\u003c/a\u003e [Auth] Fix circular import on \u003ccode\u003efrom huggingface_hub import login\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4384\"\u003e#4384\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4\"\u003e#4\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/8d52526f5d44cf835b9c2a9fb2e4ac03d545c8ed\"\u003e\u003ccode\u003e8d52526\u003c/code\u003e\u003c/a\u003e Release: v1.20.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/9379ae35ee840fdf889147c7f21fadb32c44db03\"\u003e\u003ccode\u003e9379ae3\u003c/code\u003e\u003c/a\u003e Release: v1.20.0.rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/3b3abe38b7ae761eb1bebfb0676b5bd2b9f2a2c1\"\u003e\u003ccode\u003e3b3abe3\u003c/code\u003e\u003c/a\u003e [Spaces] Add \u003ccode\u003ewait_for_space\u003c/code\u003e API and \u003ccode\u003ehf spaces wait\u003c/code\u003e CLI (\u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4380\"\u003e#4380\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/e52fdef6100a9f3a5d08a146fe99910f297807e0\"\u003e\u003ccode\u003ee52fdef\u003c/code\u003e\u003c/a\u003e [CLI] Make \u003ccode\u003ehf jobs ssh\u003c/code\u003e wait for job to be running (\u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4379\"\u003e#4379\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/a0c1dfeeb1ef7468e616012149b62fd3566915b2\"\u003e\u003ccode\u003ea0c1dfe\u003c/code\u003e\u003c/a\u003e [Jobs] Add \u003ccode\u003ehf jobs wait\u003c/code\u003e and \u003ccode\u003eHfApi.wait_for_job\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4345\"\u003e#4345\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/558987464c237d84cd1f6e3062feff420a39b7c5\"\u003e\u003ccode\u003e5589874\u003c/code\u003e\u003c/a\u003e [Inference Endpoints] Custom-container deploy CLI + deprecate protected endpo...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/462d09366e5d215b72b710769326c4c7baf26f9c\"\u003e\u003ccode\u003e462d093\u003c/code\u003e\u003c/a\u003e [CLI] Suggest creating repo/bucket on NotFound errors (\u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4372\"\u003e#4372\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/huggingface/huggingface_hub/commit/ebe5315b56c53ad0a912d21ce9558ddc9e9f9be5\"\u003e\u003ccode\u003eebe5315\u003c/code\u003e\u003c/a\u003e Add new JobNotFound error (\u003ca href=\"https://redirect.github.com/huggingface/huggingface_hub/issues/4367\"\u003e#4367\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/huggingface/huggingface_hub/compare/v1.18.0...v1.20.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 3.15 to 3.18\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.18 (2026-06-02)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eWhen decoding a domain, add a \u003ccode\u003edisplay\u003c/code\u003e argument that will pass\nthrough invalid labels rather than raising an exception.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.17 (2026-05-28)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSubstantial 75% reduction in memory usage through new data\nstructures and some optimization in processing speed.\u003c/li\u003e\n\u003cli\u003eAdded a general 1024-character input length cap to the public\nvalidation, conversion, and codec entry points. This is well above\nany legitimate domain or label and guards against pathological\ninputs.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.16 (2026-05-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a command-line interface (\u003ccode\u003epython -m idna\u003c/code\u003e, also available as\nthe \u003ccode\u003eidna\u003c/code\u003e script). Encodes or decodes one or more domains supplied\nas arguments or on standard input, with options to select A-label\nor U-label output and control error handling.\u003c/li\u003e\n\u003cli\u003eRaise the minimum supported Python version to 3.9\u003c/li\u003e\n\u003cli\u003eVarious code quality improvements\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f39ea903ba49eb5a0b2c6723c9a929b41ed4a0f1\"\u003e\u003ccode\u003ef39ea90\u003c/code\u003e\u003c/a\u003e Release 3.18\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/40f4e407bc7452da37c24b0c112dcda9a5b299ba\"\u003e\u003ccode\u003e40f4e40\u003c/code\u003e\u003c/a\u003e Pre-release 3.18rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/1a5bf80f2fa40454589e6144efe5f72015ef9d24\"\u003e\u003ccode\u003e1a5bf80\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/253\"\u003e#253\u003c/a\u003e from kjd/lenient-decode\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/5bbb26fc86e28c4ee1434ae8ae8db76de4c2a5ac\"\u003e\u003ccode\u003e5bbb26f\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into lenient-decode\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/c532bae5270489cef8faf9f6b1eb70cbcb454c6d\"\u003e\u003ccode\u003ec532bae\u003c/code\u003e\u003c/a\u003e Rename decode() lenient= option to display= (issue \u003ca href=\"https://redirect.github.com/kjd/idna/issues/248\"\u003e#248\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/0b1758ba11952a2e88fd6141ffa620409bff0580\"\u003e\u003ccode\u003e0b1758b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/252\"\u003e#252\u003c/a\u003e from kjd/release-3.17\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f48619c4cea6859b938d560fdd9feb898e678567\"\u003e\u003ccode\u003ef48619c\u003c/code\u003e\u003c/a\u003e Release 3.17\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/7421ba8003227f816142ab40178e3a7d204e6847\"\u003e\u003ccode\u003e7421ba8\u003c/code\u003e\u003c/a\u003e Pre-release 3.17rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/22ebb73b164081f209449b50162eb7ce086e96a4\"\u003e\u003ccode\u003e22ebb73\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/251\"\u003e#251\u003c/a\u003e from kjd/structure-optimizations\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/2a7ac0a58c788d50112a5003af545a83807fb108\"\u003e\u003ccode\u003e2a7ac0a\u003c/code\u003e\u003c/a\u003e Drop redundant parallel-arrays comment from uts46data\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kjd/idna/compare/v3.15...v3.18\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `jaraco-context` from 6.1.1 to 6.1.2\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jaraco/jaraco.context/blob/main/NEWS.rst\"\u003ejaraco-context's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ev6.1.2\u003c/h1\u003e\n\u003cp\u003eNo significant changes.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/098f39c911d4504b2c718f2ff483ae24f1c4d378\"\u003e\u003ccode\u003e098f39c\u003c/code\u003e\u003c/a\u003e Finalize\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/926a20e42307a2b5d87b058f2df42345fba61ad4\"\u003e\u003ccode\u003e926a20e\u003c/code\u003e\u003c/a\u003e Fix condition for skipping safety test on Python 3.12 (\u003ca href=\"https://redirect.github.com/jaraco/jaraco.context/issues/20\"\u003e#20\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/19f1cbbcf4811fec84c2fee47e51c1a823b7d368\"\u003e\u003ccode\u003e19f1cbb\u003c/code\u003e\u003c/a\u003e Strict type checking and re-enable mypy (\u003ca href=\"https://redirect.github.com/jaraco/jaraco.context/issues/16\"\u003e#16\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/256995fa4d2bcaf5513d7d14204045de94b4957d\"\u003e\u003ccode\u003e256995f\u003c/code\u003e\u003c/a\u003e Suppress coverage errors.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/0190667b24bd7b7f5f199ec36dc6e974fa31aab2\"\u003e\u003ccode\u003e0190667\u003c/code\u003e\u003c/a\u003e Suppress type errors in test_safety.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/bc0dc8a641a0ef9539bd7b193c961f8de05344e0\"\u003e\u003ccode\u003ebc0dc8a\u003c/code\u003e\u003c/a\u003e Suppress type errors with new property.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/8eee4d0bbf99ee75163865b150e638378e5a0b46\"\u003e\u003ccode\u003e8eee4d0\u003c/code\u003e\u003c/a\u003e Modernize with ruff\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/825171649ef9d312b6f9740d235d206c0e927c3e\"\u003e\u003ccode\u003e8251716\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into Strict-type-checking-and-re-enable-mypy\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/7df1443e0d81d0f7a781231ab05e00fc4173672e\"\u003e\u003ccode\u003e7df1443\u003c/code\u003e\u003c/a\u003e Restore expression algebra.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.context/commit/616e2d6153eea558d0acf971adefc4d2c9dd6fc9\"\u003e\u003ccode\u003e616e2d6\u003c/code\u003e\u003c/a\u003e Merge \u003ca href=\"https://github.com/jaraco/skeleton\"\u003ehttps://github.com/jaraco/skeleton\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jaraco/jaraco.context/compare/v6.1.1...v6.1.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `jaraco-functools` from 4.4.0 to 4.5.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jaraco/jaraco.functools/blob/main/NEWS.rst\"\u003ejaraco-functools's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ev4.5.0\u003c/h1\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003ebypass_when\u003c/code\u003e and \u003ccode\u003ebypass_unless\u003c/code\u003e now accept callable checks and evaluate\nthem on each invocation instead of binding only at decoration time. (\u003ca href=\"https://redirect.github.com/jaraco/jaraco.functools/issues/36\"\u003e#36\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/0e89d963ab0a2d6d0755df2424e5e3d5b983cf98\"\u003e\u003ccode\u003e0e89d96\u003c/code\u003e\u003c/a\u003e Finalize\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/4df0abd88dc7c36897b4f40abebda9ae7b24d33e\"\u003e\u003ccode\u003e4df0abd\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/jaraco/jaraco.functools/issues/36\"\u003e#36\u003c/a\u003e from jaraco/copilot/enhance-bypass-decorators-callables\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/e3ad23e72c049950d79d4c1c702a9b7e286d6983\"\u003e\u003ccode\u003ee3ad23e\u003c/code\u003e\u003c/a\u003e 👹 Feed the hobgoblins (delint).\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/9ed118eb092ba639e925578576192d0da823d93f\"\u003e\u003ccode\u003e9ed118e\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into copilot/enhance-bypass-decorators-callables\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/d3cdfdf173d8f073d3c51f7d452e3860d783e283\"\u003e\u003ccode\u003ed3cdfdf\u003c/code\u003e\u003c/a\u003e 👹 Feed the hobgoblins (delint).\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/dfc27da53d5b17d1d3b9b04459933f9054a1e3a2\"\u003e\u003ccode\u003edfc27da\u003c/code\u003e\u003c/a\u003e Merge \u003ca href=\"https://github.com/jaraco/skeleton\"\u003ehttps://github.com/jaraco/skeleton\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/dc2a6a50c7b45d357e608b6beafd1339719d2f7c\"\u003e\u003ccode\u003edc2a6a5\u003c/code\u003e\u003c/a\u003e Rename towncrier fragment to PR number\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/a99352800c88bcac801dc3385cb9952f7729e946\"\u003e\u003ccode\u003ea993528\u003c/code\u003e\u003c/a\u003e Add feature news fragment for callable bypass checks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/2257f0ecead9b3b4bdc57615edb47485572b1669\"\u003e\u003ccode\u003e2257f0e\u003c/code\u003e\u003c/a\u003e Inline bypass check normalization call\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jaraco/jaraco.functools/commit/4d5cf8b5ba250ee46ef59fa7cd9760806ee06440\"\u003e\u003ccode\u003e4d5cf8b\u003c/code\u003e\u003c/a\u003e Drop redundant bypass unit tests\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jaraco/jaraco.functools/compare/v4.4.0...v4.5.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lxml` from 6.1.0 to 6.1.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `markdown-it-py` from 4.0.0 to 4.2.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/executablebooks/markdown-it-py/releases\"\u003emarkdown-it-py's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev4.2.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e✨ Add \u003ccode\u003emake_fence_rule()\u003c/code\u003e factory for configurable fence markers by \u003ca href=\"https://github.com/chrisjsewell\"\u003e\u003ccode\u003e@​chrisjsewell\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/394\"\u003eexecutablebooks/markdown-it-py#394\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e🚀 RELEASE v4.2.0 by \u003ca href=\"https://github.com/chrisjsewell\"\u003e\u003ccode\u003e@​chrisjsewell\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/395\"\u003eexecutablebooks/markdown-it-py#395\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/executablebooks/markdown-it-py/compare/v4.1.0...v4.2.0\"\u003ehttps://github.com/executablebooks/markdown-it-py/compare/v4.1.0...v4.2.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev4.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e✨ Add \u003ccode\u003e--stdin\u003c/code\u003e option to CLI by \u003ca href=\"https://github.com/mcepl\"\u003e\u003ccode\u003e@​mcepl\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/379\"\u003eexecutablebooks/markdown-it-py#379\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd AGENTS.md and copilot-setup-steps workflow by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/380\"\u003eexecutablebooks/markdown-it-py#380\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e🔧 Add typing to Scanner by \u003ca href=\"https://github.com/Alunderin\"\u003e\u003ccode\u003e@​Alunderin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/382\"\u003eexecutablebooks/markdown-it-py#382\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e👌 Fix quadratic complexity in \u003ccode\u003efragments_join\u003c/code\u003e / \u003ccode\u003etext_join\u003c/code\u003e by \u003ca href=\"https://github.com/petricevich\"\u003e\u003ccode\u003e@​petricevich\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/389\"\u003eexecutablebooks/markdown-it-py#389\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e✨Allow plugins to register inline terminator characters by \u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/391\"\u003eexecutablebooks/markdown-it-py#391\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e✨ Add \u003ccode\u003egfm-like2\u003c/code\u003e preset with task lists, alerts, and single-tilde strikethrough by \u003ca href=\"https://github.com/chrisjsewell\"\u003e\u003ccode\u003e@​chrisjsewell\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/388\"\u003eexecutablebooks/markdown-it-py#388\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e🔧 Update pre-commit hooks by \u003ca href=\"https://github.com/chrisjsewell\"\u003e\u003ccode\u003e@​chrisjsewell\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/392\"\u003eexecutablebooks/markdown-it-py#392\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e🚀 RELEASE v4.1.0 by \u003ca href=\"https://github.com/chrisjsewell\"\u003e\u003ccode\u003e@​chrisjsewell\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/393\"\u003eexecutablebooks/markdown-it-py#393\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mcepl\"\u003e\u003ccode\u003e@​mcepl\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/379\"\u003eexecutablebooks/markdown-it-py#379\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Copilot\"\u003e\u003ccode\u003e@​Copilot\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/380\"\u003eexecutablebooks/markdown-it-py#380\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Alunderin\"\u003e\u003ccode\u003e@​Alunderin\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/382\"\u003eexecutablebooks/markdown-it-py#382\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/petricevich\"\u003e\u003ccode\u003e@​petricevich\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/389\"\u003eexecutablebooks/markdown-it-py#389\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/executablebooks/markdown-it-py/compare/v4.0.0...v4.1.0\"\u003ehttps://github.com/executablebooks/markdown-it-py/compare/v4.0.0...v4.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/executablebooks/markdown-it-py/blob/master/CHANGELOG.md\"\u003emarkdown-it-py's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e4.2.0 - 2026-05-07\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e✨ Add \u003ccode\u003emake_fence_rule()\u003c/code\u003e factory for configurable fence markers in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/394\"\u003e#394\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e4.1.0 - 2025-05-06\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e✨ Add \u003ccode\u003egfm-like2\u003c/code\u003e preset with task lists, alerts, and single-tilde strikethrough core plugins in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/388\"\u003e#388\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e✨ Allow plugins to register inline terminator characters in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/391\"\u003e#391\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e👌 Fix quadratic complexity in \u003ccode\u003efragments_join\u003c/code\u003e / \u003ccode\u003etext_join\u003c/code\u003e in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/389\"\u003e#389\u003c/a\u003e, thanks to \u003ca href=\"https://github.com/petricevich\"\u003e\u003ccode\u003e@​petricevich\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e👌 Add \u003ccode\u003e--stdin\u003c/code\u003e option to CLI for reading Markdown from standard input in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/379\"\u003e#379\u003c/a\u003e, thanks to \u003ca href=\"https://github.com/mcepl\"\u003e\u003ccode\u003e@​mcepl\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e🔧 Add typing to Scanner in \u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/pull/382\"\u003e#382\u003c/a\u003e, thanks to \u003ca href=\"https://github.com/Alunderin\"\u003e\u003ccode\u003e@​Alunderin\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/executablebooks/markdown-it-py/compare/v4.0.0...v4.1.0\"\u003ehttps://github.com/executablebooks/markdown-it-py/compare/v4.0.0...v4.1.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/36c5f547144df2d01970a5792d68c71a3380b227\"\u003e\u003ccode\u003e36c5f54\u003c/code\u003e\u003c/a\u003e 🚀 RELEASE v4.2.0 (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/395\"\u003e#395\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/96cf077ba5a6b3b4b2f862db7e0fc532694a72e9\"\u003e\u003ccode\u003e96cf077\u003c/code\u003e\u003c/a\u003e ✨ Add \u003ccode\u003emake_fence_rule()\u003c/code\u003e factory for configurable fence markers (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/394\"\u003e#394\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/3b4ff6ddd368b679643d12debf09e10ef602d4db\"\u003e\u003ccode\u003e3b4ff6d\u003c/code\u003e\u003c/a\u003e 🚀 RELEASE v4.1.0 (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/393\"\u003e#393\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/8951f267370b03a26ae88600a6dfc707ea290067\"\u003e\u003ccode\u003e8951f26\u003c/code\u003e\u003c/a\u003e 🔧 Update pre-commit hooks (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/392\"\u003e#392\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/693bb24063b6c658d60c7c14203ac6470387e3c6\"\u003e\u003ccode\u003e693bb24\u003c/code\u003e\u003c/a\u003e ✨ Add \u003ccode\u003egfm-like2\u003c/code\u003e preset with task lists, alerts, and single-tilde strikethro...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/df6fd361099cab7fe0259467c3aaa3f284ec8259\"\u003e\u003ccode\u003edf6fd36\u003c/code\u003e\u003c/a\u003e ✨Allow plugins to register inline terminator characters (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/391\"\u003e#391\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/d4ea0ca7f44e3ca86c18a87356502c59e5e49ec3\"\u003e\u003ccode\u003ed4ea0ca\u003c/code\u003e\u003c/a\u003e 👌 Fix quadratic complexity in \u003ccode\u003efragments_join\u003c/code\u003e / \u003ccode\u003etext_join\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/389\"\u003e#389\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/89331476e44c150bc32e2597a5fae4cd15391167\"\u003e\u003ccode\u003e8933147\u003c/code\u003e\u003c/a\u003e 🔧 Add typing to Scanner (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/382\"\u003e#382\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/2f6ae107ba32e9a7bd2d00134d09a78ec805a6a0\"\u003e\u003ccode\u003e2f6ae10\u003c/code\u003e\u003c/a\u003e 🔧 Add AGENTS.md and copilot-setup-steps workflow (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/380\"\u003e#380\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/executablebooks/markdown-it-py/commit/49043e4445d233598fb893bed6949f7b25ae4e27\"\u003e\u003ccode\u003e49043e4\u003c/code\u003e\u003c/a\u003e Add --stdin option to CLI for reading Markdown from standard input (\u003ca href=\"https://redirect.github.com/executablebooks/markdown-it-py/issues/379\"\u003e#379\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/executablebooks/markdown-it-py/compare/v4.0.0...v4.2.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `nh3` from 0.3.3 to 0.3.6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/messense/nh3/releases\"\u003enh3's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.3.6\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eValidate clean_content_tags conflict with tags by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/125\"\u003emessense/nh3#125\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument tag_attribute_values as alternate to attributes by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/126\"\u003emessense/nh3#126\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd nh3.escape alias for clean_text by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/127\"\u003emessense/nh3#127\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump pyo3 from 0.28.3 to 0.29.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/130\"\u003emessense/nh3#130\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpose ammonia's url_relative policy via url_relative kwarg by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/131\"\u003emessense/nh3#131\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/messense/nh3/compare/v0.3.5...v0.3.6\"\u003ehttps://github.com/messense/nh3/compare/v0.3.5...v0.3.6\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev0.3.5\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd usage examples for clean() and Cleaner arguments by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/120\"\u003emessense/nh3#120\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd doctest coverage for module docstrings and RST files by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/121\"\u003emessense/nh3#121\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump pyo3 from 0.28.2 to 0.28.3 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/123\"\u003emessense/nh3#123\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd tags parameter to clean_text by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/122\"\u003emessense/nh3#122\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/messense/nh3/compare/v0.3.4...v0.3.5\"\u003ehttps://github.com/messense/nh3/compare/v0.3.4...v0.3.5\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev0.3.4\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump pyo3 from 0.28.1 to 0.28.2 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/114\"\u003emessense/nh3#114\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eValidate rel attribute conflict with link_rel by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/117\"\u003emessense/nh3#117\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eExpose default clean_content_tags as module constant by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/118\"\u003emessense/nh3#118\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAccept frozenset and Mapping in type stubs by \u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/119\"\u003emessense/nh3#119\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gghez\"\u003e\u003ccode\u003e@​gghez\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/messense/nh3/pull/117\"\u003emessense/nh3#117\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/messense/nh3/compare/v0.3.3...v0.3.4\"\u003ehttps://github.com/messense/nh3/compare/v0.3.3...v0.3.4\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/bea70dfcdd0b9e246f884416dec9c73f9e8923cf\"\u003e\u003ccode\u003ebea70df\u003c/code\u003e\u003c/a\u003e Bump version to 0.3.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/788cee289054b95930034eeaedb3424548302456\"\u003e\u003ccode\u003e788cee2\u003c/code\u003e\u003c/a\u003e Expose ammonia's url_relative policy via url_relative kwarg (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/131\"\u003e#131\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/e76a81acc58a98a55992ece96740a1e5a448e222\"\u003e\u003ccode\u003ee76a81a\u003c/code\u003e\u003c/a\u003e Bump pyo3 from 0.28.3 to 0.29.0 (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/130\"\u003e#130\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/8ec45a31335b0df9664d22749067fe41a3e369bc\"\u003e\u003ccode\u003e8ec45a3\u003c/code\u003e\u003c/a\u003e Add nh3.escape alias for clean_text (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/127\"\u003e#127\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/a1e022621e862cf27b929b645cb264d2bf8376df\"\u003e\u003ccode\u003ea1e0226\u003c/code\u003e\u003c/a\u003e Document tag_attribute_values as alternate to attributes (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/126\"\u003e#126\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/389fb797d5203dab4d0691863bd56ff18136a433\"\u003e\u003ccode\u003e389fb79\u003c/code\u003e\u003c/a\u003e Validate clean_content_tags conflict with tags (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/125\"\u003e#125\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/61aad5aaf6c719299b3319e2632c7e96500b0fe6\"\u003e\u003ccode\u003e61aad5a\u003c/code\u003e\u003c/a\u003e Bump uraimo/run-on-arch-action in the github-actions group (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/124\"\u003e#124\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/9e78e6af74267c6789c62e98512460990415fb91\"\u003e\u003ccode\u003e9e78e6a\u003c/code\u003e\u003c/a\u003e Bump version to 0.3.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/5225ec29f6ba74349d158676461fa6081cf804d8\"\u003e\u003ccode\u003e5225ec2\u003c/code\u003e\u003c/a\u003e Add tags parameter to clean_text (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/122\"\u003e#122\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/messense/nh3/commit/129df5295dd98b263a3f24bd4f9bd5e43a7bb677\"\u003e\u003ccode\u003e129df52\u003c/code\u003e\u003c/a\u003e Bump pyo3 from 0.28.2 to 0.28.3 (\u003ca href=\"https://redirect.github.com/messense/nh3/issues/123\"\u003e#123\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/messense/nh3/compare/v0.3.3...v0.3.6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `semgrep` from 1.166.0 to 1.168.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/semgrep/semgrep/releases\"\u003esemgrep's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eRelease v1.168.0\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/semgrep/semgrep/releases/tag/v1.168.0\"\u003e1.168.0\u003c/a\u003e - 2026-06-24\u003c/h2\u003e\n\u003ch3\u003e### Added\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdded an experimental \u003ccode\u003e--x-dependency-paths\u003c/code\u003e flag to \u003ccode\u003escan\u003c/code\u003e and \u003ccode\u003eci\u003c/code\u003e that includes the full dependency path(s) for transitive supply-chain findings in \u003ccode\u003e--json\u003c/code\u003e and \u003ccode\u003e--sarif\u003c/code\u003e output. (SC-3547)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMalicious supply chain rules are now labeled \u0026quot;Malicious\u0026quot; instead of \u0026quot;Basic\u0026quot; in the scan analysis summary table. (SC-3504)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Infra/Release Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003esemgrep-core no longer depends on libpcre 8.x; libpcre2 10.x is now the sole regex engine. (drop-libpcre)\u003c/li\u003e\n\u003cli\u003eAliengrep (generic mode) now uses the maintained libpcre2 10.x regular-expression library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (aliengrep-pcre2)\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003emetavariable-regex\u003c/code\u003e and \u003ccode\u003emetavariable-comparison\u003c/code\u003e (\u003ccode\u003ere.match()\u003c/code\u003e) runtimes now use the maintained libpcre2 10.x library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (eval-generic-pcre2)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eRelease v1.167.0\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/semgrep/semgrep/releases/tag/v1.167.0\"\u003e1.167.0\u003c/a\u003e - 2026-06-17\u003c/h2\u003e\n\u003ch3\u003e### Added\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more. (const-folding)\u003c/li\u003e\n\u003cli\u003eAdded a \u003ccode\u003enosemgrep_disabled\u003c/code\u003e field to the scan configuration so the platform can disable \u003ccode\u003enosemgrep\u003c/code\u003e inline ignore comments org-wide for a scan. (APPEX-1122)\u003c/li\u003e\n\u003cli\u003eSemgrep now skips binary files (images, archives, compiled executables,\netc.) during scanning by default, detected via matching file extensions\nto known file-format magic bytes Pass \u003ccode\u003e--no-exclude-binary-files\u003c/code\u003e to\nscan binary files as before. (ENGINE-2708)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Fixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003esemgrep ci\u003c/code\u003e with \u003ccode\u003e--sarif\u003c/code\u003e now correctly populates the output's \u003ccode\u003eignores\u003c/code\u003e\nfield with nosemgrep-suppressed findings, in accordance with other output\nformatters. (\u003ca href=\"https://redirect.github.com/semgrep/semgrep/issues/6651\"\u003egh-6651\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Infra/Release Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdated the \u003ccode\u003eocaml-tree-sitter-core\u003c/code\u003e submodule to the latest upstream \u003ccode\u003emain\u003c/code\u003e, providing\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eimproved thread-safety\u003c/li\u003e\n\u003cli\u003ebumps the tree-sitter CLI option used from 0.20.6 to 0.20.8.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e(ocaml-tree-sitter-core-bump)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/semgrep/semgrep/blob/v1.168.0/CHANGELOG.md\"\u003esemgrep's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/semgrep/semgrep/releases/tag/v1.168.0\"\u003e1.168.0\u003c/a\u003e - 2026-06-24\u003c/h2\u003e\n\u003ch3\u003e### Added\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdded an experimental \u003ccode\u003e--x-dependency-paths\u003c/code\u003e flag to \u003ccode\u003escan\u003c/code\u003e and \u003ccode\u003eci\u003c/code\u003e that includes the full dependency path(s) for transitive supply-chain findings in \u003ccode\u003e--json\u003c/code\u003e and \u003ccode\u003e--sarif\u003c/code\u003e output. (SC-3547)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Changed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eMalicious supply chain rules are now labeled \u0026quot;Malicious\u0026quot; instead of \u0026quot;Basic\u0026quot; in the scan analysis summary table. (SC-3504)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Infra/Release Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003esemgrep-core no longer depends on libpcre 8.x; libpcre2 10.x is now the sole regex engine. (drop-libpcre)\u003c/li\u003e\n\u003cli\u003eAliengrep (generic mode) now uses the maintained libpcre2 10.x regular-expression library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (aliengrep-pcre2)\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003emetavariable-regex\u003c/code\u003e and \u003ccode\u003emetavariable-comparison\u003c/code\u003e (\u003ccode\u003ere.match()\u003c/code\u003e) runtimes now use the maintained libpcre2 10.x library instead of the deprecated libpcre 8.x. Matching behavior is unchanged. (eval-generic-pcre2)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/semgrep/semgrep/releases/tag/v1.167.0\"\u003e1.167.0\u003c/a\u003e - 2026-06-17\u003c/h2\u003e\n\u003ch3\u003e### Added\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for more operators for folding for constant propagation, including subtraction, division, bit ops, bit shifts, comparisons, and more. (const-folding)\u003c/li\u003e\n\u003cli\u003eAdded a \u003ccode\u003enosemgrep_disabled\u003c/code\u003e field to the scan configuration so the platform can disable \u003ccode\u003enosemgrep\u003c/code\u003e inline ignore comments org-wide for a scan. (APPEX-1122)\u003c/li\u003e\n\u003cli\u003eSemgrep now skips binary files (images, archives, compiled executables,\netc.) during scanning by default, detected via matching file extensions\nto known file-format magic bytes Pass \u003ccode\u003e--no-exclude-binary-files\u003c/code\u003e to\nscan binary files as before. (ENGINE-2708)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Fixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003esemgrep ci\u003c/code\u003e with \u003ccode\u003e--sarif\u003c/code\u003e now correctly populates the output's \u003ccode\u003eignores\u003c/code\u003e\nfield with nosemgrep-suppressed findings, in accordance with other output\nformatters. (\u003ca href=\"https://redirect.github.com/semgrep/semgrep/issues/6651\"\u003egh-6651\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e### Infra/Release Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eUpdated the \u003ccode\u003eocaml-tree-sitter-core\u003c/code\u003e submodule to the latest upstream \u003ccode\u003emain\u003c/code\u003e, providing\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eimproved thread-safety\u003c/li\u003e\n\u003cli\u003ebumps the tree-sitter CLI option used from 0.20.6 to 0.20.8.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e(ocaml-tree-sitter-core-bump)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/3167f9c4edb5ad588c558e311c5a1a03b7f593da\"\u003e\u003ccode\u003e3167f9c\u003c/code\u003e\u003c/a\u003e chore: release 1.168.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/94ac223eb9fade687c2e044936f5ca370dad08c6\"\u003e\u003ccode\u003e94ac223\u003c/code\u003e\u003c/a\u003e\u003ccode\u003esemgrep/semgrep-proprietary#6651\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/fd5e60e96c7d66dcdb43d2c1086f003308d21420\"\u003e\u003ccode\u003efd5e60e\u003c/code\u003e\u003c/a\u003e\u003ccode\u003esemgrep/semgrep-proprietary#6602\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/acf763e9d16e31e1ab8c5ece9d4ab55e8f2e3ee3\"\u003e\u003ccode\u003eacf763e\u003c/code\u003e\u003c/a\u003e\u003ccode\u003esemgrep/semgrep-proprietary#6655\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/b635c1f9e1816b154d2247e1e605532e53f683f6\"\u003e\u003ccode\u003eb635c1f\u003c/code\u003e\u003c/a\u003e\u003ccode\u003esemgrep/semgrep-proprietary#6653\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/b0a3bb4eeb0f55e0f4bd30498294b0e68be390fb\"\u003e\u003ccode\u003eb0a3bb4\u003c/code\u003e\u003c/a\u003e\u003ccode\u003esemgrep/semgrep-proprietary#6654\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/d03aad013dbdac44d934282d744beabef62851e7\"\u003e\u003ccode\u003ed03aad0\u003c/code\u003e\u003c/a\u003e chore(spacegrep): migrate Comment.ml from libpcre 8.x to libpcre2 10.x (semgr...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/8855bc510dd2712f23f82211ff5fe65650555262\"\u003e\u003ccode\u003e8855bc5\u003c/code\u003e\u003c/a\u003e refactor(docker): do not create duplicate unused artifacts (semgrep/semgrep-p...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/51c6552cec03860634f8e451d0af6e6b3ff76cae\"\u003e\u003ccode\u003e51c6552\u003c/code\u003e\u003c/a\u003e refactor(ci): delegate archive-handling to \u003ccode\u003e{download,upload}\u003c/code\u003e-artifact (semg...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/semgrep/semgrep/commit/d9d88135564aff166adcc3622911c997fd224989\"\u003e\u003ccode\u003ed9d8813\u003c/code\u003e\u003c/a\u003e\u003ccode\u003esemgrep/semgrep-proprietary#6652\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/semgrep/semgrep/compare/v1.166.0...v1.168.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/anulum/director-ai/pull/130","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/anulum%2Fdirector-ai/issues/130","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/130/packages"}},{"old_version":"6.0.2","new_version":"6.1.0","update_type":"minor","path":null,"pr_created_at":"2026-06-11T01:29:05.000Z","version_change":"6.0.2 → 6.1.0","issue":{"uuid":"4636387573","node_id":"PR_kwDORtR3rs7lHOUF","number":5,"state":"open","title":"chore(deps): bump the uv group across 1 directory with 19 updates","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-11T01:29:05.000Z","updated_at":"2026-06-11T01:30:14.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"uv","update_count":19,"packages":[{"name":"flask","old_version":"3.1.2","new_version":"3.1.3","repository_url":"https://github.com/pallets/flask"},{"name":"python-dotenv","old_version":"1.2.1","new_version":"1.2.2","repository_url":"https://github.com/theskumar/python-dotenv"},{"name":"cryptography","old_version":"46.0.3","new_version":"46.0.7","repository_url":"https://github.com/pyca/cryptography"},{"name":"filelock","old_version":"3.20.1","new_version":"3.20.3","repository_url":"https://github.com/tox-dev/py-filelock"},{"name":"idna","old_version":"3.11","new_version":"3.15","repository_url":"https://github.com/kjd/idna"},{"name":"lxml","old_version":"6.0.2","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"},{"name":"marshmallow","old_version":"3.26.1","new_version":"3.26.2","repository_url":"https://github.com/marshmallow-code/marshmallow"},{"name":"mistune","old_version":"3.1.4","new_version":"3.2.1","repository_url":"https://github.com/lepture/mistune"},{"name":"nbconvert","old_version":"7.16.6","new_version":"7.17.1","repository_url":"https://github.com/jupyter/nbconvert"},{"name":"nltk","old_version":"3.9.2","new_version":"3.9.4","repository_url":"https://github.com/nltk/nltk"},{"name":"pypdf","old_version":"6.4.2","new_version":"6.10.2","repository_url":"https://github.com/py-pdf/pypdf"},{"name":"python-multipart","old_version":"0.0.21","new_version":"0.0.27","repository_url":"https://github.com/Kludex/python-multipart"},{"name":"requests","old_version":"2.32.5","new_version":"2.33.0","repository_url":"https://github.com/psf/requests"},{"name":"starlette","old_version":"0.50.0","new_version":"1.0.1","repository_url":"https://github.com/Kludex/starlette"},{"name":"torch","old_version":"2.9.1","new_version":"2.10.0","repository_url":"https://github.com/pytorch/pytorch"},{"name":"tornado","old_version":"6.5.4","new_version":"6.5.5","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"urllib3","old_version":"2.6.2","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"},{"name":"virtualenv","old_version":"20.35.4","new_version":"20.36.1","repository_url":"https://github.com/pypa/virtualenv"},{"name":"werkzeug","old_version":"3.1.4","new_version":"3.1.6","repository_url":"https://github.com/pallets/werkzeug"}],"path":null,"ecosystem":"pip"},"body":"Bumps the uv group with 19 updates in the /backend directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [flask](https://github.com/pallets/flask) | `3.1.2` | `3.1.3` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.1` | `1.2.2` |\n| [cryptography](https://github.com/pyca/cryptography) | `46.0.3` | `46.0.7` |\n| [filelock](https://github.com/tox-dev/py-filelock) | `3.20.1` | `3.20.3` |\n| [idna](https://github.com/kjd/idna) | `3.11` | `3.15` |\n| [lxml](https://github.com/lxml/lxml) | `6.0.2` | `6.1.0` |\n| [marshmallow](https://github.com/marshmallow-code/marshmallow) | `3.26.1` | `3.26.2` |\n| [mistune](https://github.com/lepture/mistune) | `3.1.4` | `3.2.1` |\n| [nbconvert](https://github.com/jupyter/nbconvert) | `7.16.6` | `7.17.1` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.4.2` | `6.10.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.21` | `0.0.27` |\n| [requests](https://github.com/psf/requests) | `2.32.5` | `2.33.0` |\n| [starlette](https://github.com/Kludex/starlette) | `0.50.0` | `1.0.1` |\n| [torch](https://github.com/pytorch/pytorch) | `2.9.1` | `2.10.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.4` | `6.5.5` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.6.2` | `2.7.0` |\n| [virtualenv](https://github.com/pypa/virtualenv) | `20.35.4` | `20.36.1` |\n| [werkzeug](https://github.com/pallets/werkzeug) | `3.1.4` | `3.1.6` |\n\n\nUpdates `flask` from 3.1.2 to 3.1.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pallets/flask/releases\"\u003eflask's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.1.3\u003c/h2\u003e\n\u003cp\u003eThis is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.\u003c/p\u003e\n\u003cp\u003ePyPI: \u003ca href=\"https://pypi.org/project/Flask/3.1.3/\"\u003ehttps://pypi.org/project/Flask/3.1.3/\u003c/a\u003e\nChanges: \u003ca href=\"https://flask.palletsprojects.com/page/changes/#version-3-1-3\"\u003ehttps://flask.palletsprojects.com/page/changes/#version-3-1-3\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe session is marked as accessed for operations that only access the keys but not the values, such as \u003ccode\u003ein\u003c/code\u003e and \u003ccode\u003elen\u003c/code\u003e. \u003ca href=\"https://github.com/pallets/flask/security/advisories/GHSA-68rp-wp8r-4726\"\u003eGHSA-68rp-wp8r-4726\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pallets/flask/blob/main/CHANGES.rst\"\u003eflask's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 3.1.3\u003c/h2\u003e\n\u003cp\u003eReleased 2026-02-18\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe session is marked as accessed for operations that only access the keys\nbut not the values, such as \u003ccode\u003ein\u003c/code\u003e and \u003ccode\u003elen\u003c/code\u003e. :ghsa:\u003ccode\u003e68rp-wp8r-4726\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/22d924701a6ae2e4cd01e9a15bbaf3946094af65\"\u003e\u003ccode\u003e22d9247\u003c/code\u003e\u003c/a\u003e release version 3.1.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/089cb86dd22bff589a4eafb7ab8e42dc357623b4\"\u003e\u003ccode\u003e089cb86\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/c17f379390731543eea33a570a47bd4ef76a54fa\"\u003e\u003ccode\u003ec17f379\u003c/code\u003e\u003c/a\u003e request context tracks session access\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/27be9338405382445a7cb01151e084559b98d602\"\u003e\u003ccode\u003e27be933\u003c/code\u003e\u003c/a\u003e start version 3.1.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/4e652d3f68b90d50aa2301d3b7e68c3fafd9251d\"\u003e\u003ccode\u003e4e652d3\u003c/code\u003e\u003c/a\u003e Abort if the instance folder cannot be created (\u003ca href=\"https://redirect.github.com/pallets/flask/issues/5903\"\u003e#5903\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/3d03098a97ddc6a908aa4a50c2ef7381f8297d0a\"\u003e\u003ccode\u003e3d03098\u003c/code\u003e\u003c/a\u003e Abort if the instance folder cannot be created\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/407eb76b27884848383a37c7274654f0271e4bc4\"\u003e\u003ccode\u003e407eb76\u003c/code\u003e\u003c/a\u003e document using gevent for async (\u003ca href=\"https://redirect.github.com/pallets/flask/issues/5900\"\u003e#5900\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/ac5664d2281533eacafd64f5cc7d5edcdaccab60\"\u003e\u003ccode\u003eac5664d\u003c/code\u003e\u003c/a\u003e document using gevent for async\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/4f79d5b59a56bc4356a97f2e81a35f98cb18d7b3\"\u003e\u003ccode\u003e4f79d5b\u003c/code\u003e\u003c/a\u003e Increase required flit_core version to 3.11 (\u003ca href=\"https://redirect.github.com/pallets/flask/issues/5865\"\u003e#5865\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pallets/flask/commit/fe3b215d3ade4db68262dae1a3cdc464a1fc524f\"\u003e\u003ccode\u003efe3b215\u003c/code\u003e\u003c/a\u003e Increase required flit_core version to 3.11\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pallets/flask/compare/3.1.2...3.1.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `python-dotenv` from 1.2.1 to 1.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/theskumar/python-dotenv/releases\"\u003epython-dotenv's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.2.2\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for Python 3.14, including the free-threaded (3.14t) build. (#)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003edotenv run\u003c/code\u003e command now forwards flags directly to the specified command by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/607\"\u003etheskumar/python-dotenv#607\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved documentation clarity regarding override behavior and the reference page.\u003c/li\u003e\n\u003cli\u003eUpdated PyPy support to version 3.11.\u003c/li\u003e\n\u003cli\u003eDocumentation for FIFO file support.\u003c/li\u003e\n\u003cli\u003eSupport for Python 3.9.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved \u003ccode\u003eset_key\u003c/code\u003e and \u003ccode\u003eunset_key\u003c/code\u003e behavior when interacting with symlinks by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311\"\u003e#790c5\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCorrected the license specifier and added missing Python 3.14 classifiers in package metadata by \u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/590\"\u003etheskumar/python-dotenv#590\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e and \u003ccode\u003edotenv.unset_key\u003c/code\u003e used to follow symlinks in some\nsituations. This is no longer the case. For that behavior to be restored in\nall cases, \u003ccode\u003efollow_symlinks=True\u003c/code\u003e should be used.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the CLI, \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e used to follow symlinks in some situations. This\nis no longer the case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e, \u003ccode\u003edotenv.unset_key\u003c/code\u003e and the CLI commands \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e\nused to reset the file mode of the modified .env file to \u003ccode\u003e0o600\u003c/code\u003e in some\nsituations. This is no longer the case: The original mode of the file is now\npreserved. Is the file needed to be created or wasn't a regular file, mode\n\u003ccode\u003e0o600\u003c/code\u003e is used.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eskip 000 permission tests for root user by \u003ca href=\"https://github.com/burnout-projects\"\u003e\u003ccode\u003e@​burnout-projects\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/561\"\u003etheskumar/python-dotenv#561\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 5 to 6 in the github-actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/593\"\u003etheskumar/python-dotenv#593\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Windows testing to CI by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/604\"\u003etheskumar/python-dotenv#604\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove workflow efficiency with best practices by \u003ca href=\"https://github.com/theskumar\"\u003e\u003ccode\u003e@​theskumar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/609\"\u003etheskumar/python-dotenv#609\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove the use of \u003ccode\u003esh\u003c/code\u003e in tests by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/612\"\u003etheskumar/python-dotenv#612\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/590\"\u003etheskumar/python-dotenv#590\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/burnout-projects\"\u003e\u003ccode\u003e@​burnout-projects\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/561\"\u003etheskumar/python-dotenv#561\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/cpackham-atlnz\"\u003e\u003ccode\u003e@​cpackham-atlnz\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/597\"\u003etheskumar/python-dotenv#597\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2\"\u003ehttps://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md\"\u003epython-dotenv's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e[1.2.2] - 2026-03-01\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for Python 3.14, including the free-threaded (3.14t) build. (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/588\"\u003e#588\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003edotenv run\u003c/code\u003e command now forwards flags directly to the specified command by [\u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/607\"\u003e#607\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved documentation clarity regarding override behavior and the reference page.\u003c/li\u003e\n\u003cli\u003eUpdated PyPy support to version 3.11.\u003c/li\u003e\n\u003cli\u003eDocumentation for FIFO file support.\u003c/li\u003e\n\u003cli\u003eDropped Support for Python 3.9.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved \u003ccode\u003eset_key\u003c/code\u003e and \u003ccode\u003eunset_key\u003c/code\u003e behavior when interacting with symlinks by [\u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e] in [790c5c0]\u003c/li\u003e\n\u003cli\u003eCorrected the license specifier and added missing Python 3.14 classifiers in package metadata by [\u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/590\"\u003e#590\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e and \u003ccode\u003edotenv.unset_key\u003c/code\u003e used to follow symlinks in some\nsituations. This is no longer the case. For that behavior to be restored in\nall cases, \u003ccode\u003efollow_symlinks=True\u003c/code\u003e should be used.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the CLI, \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e used to follow symlinks in some situations. This\nis no longer the case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e, \u003ccode\u003edotenv.unset_key\u003c/code\u003e and the CLI commands \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e\nused to reset the file mode of the modified .env file to \u003ccode\u003e0o600\u003c/code\u003e in some\nsituations. This is no longer the case: The original mode of the file is now\npreserved. Is the file needed to be created or wasn't a regular file, mode\n\u003ccode\u003e0o600\u003c/code\u003e is used.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/36004e0e34be7665ff2b11a8a4005144f76f176d\"\u003e\u003ccode\u003e36004e0\u003c/code\u003e\u003c/a\u003e Bump version: 1.2.1 → 1.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/eb202520e5933c9daf42501e1e42fdb0144002c8\"\u003e\u003ccode\u003eeb20252\u003c/code\u003e\u003c/a\u003e docs: update changelog for v1.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311\"\u003e\u003ccode\u003e790c5c0\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/43340da220fb4ca4f95357bbe21a3c7f8f1278b1\"\u003e\u003ccode\u003e43340da\u003c/code\u003e\u003c/a\u003e Remove the use of \u003ccode\u003esh\u003c/code\u003e in tests (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/612\"\u003e#612\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/09d7cee32459e7abdcb5c9d8122a552589c06a9c\"\u003e\u003ccode\u003e09d7cee\u003c/code\u003e\u003c/a\u003e docs: clarify override behavior and document FIFO support (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/610\"\u003e#610\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/c8de2887c00198c22842c5ae5e92d1747467363c\"\u003e\u003ccode\u003ec8de288\u003c/code\u003e\u003c/a\u003e ci: improve workflow efficiency with best practices (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/609\"\u003e#609\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/7bd9e3dbfedc0983ad7d56d5570013035242bdf4\"\u003e\u003ccode\u003e7bd9e3d\u003c/code\u003e\u003c/a\u003e Add Windows testing to CI (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/604\"\u003e#604\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/1baaf04f336072e0ee324d5df9563ec767f14f81\"\u003e\u003ccode\u003e1baaf04\u003c/code\u003e\u003c/a\u003e Drop Python 3.9 support and update to PyPy 3.11 (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/608\"\u003e#608\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/4a22cf8993804aeede0c20b75bb1a29d3a99e9dc\"\u003e\u003ccode\u003e4a22cf8\u003c/code\u003e\u003c/a\u003e ci: enable testing on Python 3.14t (free-threaded) (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/588\"\u003e#588\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/e2e8e776b42e382ae38b44d3982dd649e7507dd4\"\u003e\u003ccode\u003ee2e8e77\u003c/code\u003e\u003c/a\u003e Fix license specifier (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/597\"\u003e#597\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `cryptography` from 46.0.3 to 46.0.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst\"\u003ecryptography's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e46.0.7 - 2026-04-07\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* **SECURITY ISSUE**: Fixed an issue where non-contiguous buffers could be\n  passed to APIs that accept Python buffers, which could lead to buffer\n  overflow. **CVE-2026-39892**\n* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.6.\n\u003cp\u003e.. _v46-0-6:\u003c/p\u003e\n\u003cp\u003e46.0.6 - 2026-03-25\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eSECURITY ISSUE\u003c/strong\u003e: Fixed a bug where name constraints were not applied\nto peer names during verification when the leaf certificate contains a\nwildcard DNS SAN. Ordinary X.509 topologies are not affected by this bug,\nincluding those used by the Web PKI. Credit to \u003cstrong\u003eOleh Konko (1seal)\u003c/strong\u003e for\nreporting the issue. \u003cstrong\u003eCVE-2026-34073\u003c/strong\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. _v46-0-5:\u003c/p\u003e\n\u003cp\u003e46.0.5 - 2026-02-10\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* An attacker could create a malicious public key that reveals portions of your\n  private key when using certain uncommon elliptic curves (binary curves).\n  This version now includes additional security checks to prevent this attack.\n  This issue only affects binary elliptic curves, which are rarely used in\n  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and\n  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.\n  **CVE-2026-26007**\n* Support for ``SECT*`` binary elliptic curves is deprecated and will be\n  removed in the next release.\n\u003cp\u003e.. v46-0-4:\u003c/p\u003e\n\u003cp\u003e46.0.4 - 2026-01-27\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eDropped support for win_arm64 wheels\u003c/code\u003e_.\u003c/li\u003e\n\u003cli\u003eUpdated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. _v46-0-3:\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/622d672e429a7cff836a23c5903683dbec1901f5\"\u003e\u003ccode\u003e622d672\u003c/code\u003e\u003c/a\u003e 46.0.7 release (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14602\"\u003e#14602\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/91d728897bdad30cd5c79a2b23e207f1f050d587\"\u003e\u003ccode\u003e91d7288\u003c/code\u003e\u003c/a\u003e Cherry-pick \u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14542\"\u003e#14542\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14543\"\u003e#14543\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/06e120e682cb200e3f7050c02f0bcdac90c4c6ad\"\u003e\u003ccode\u003e06e120e\u003c/code\u003e\u003c/a\u003e bump version for 46.0.5 release (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14289\"\u003e#14289\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/0eebb9dbb6343d9bc1d91e5a2482ed4e054a6d8c\"\u003e\u003ccode\u003e0eebb9d\u003c/code\u003e\u003c/a\u003e EC check key on cofactor \u0026gt; 1 (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14287\"\u003e#14287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/bedf6e186b814f69a3f54f51252c23a71d44ed2e\"\u003e\u003ccode\u003ebedf6e1\u003c/code\u003e\u003c/a\u003e fix openssl version on 46 branch (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14220\"\u003e#14220\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/e6f44fc8e6391f05d719fb9d369692325b87a471\"\u003e\u003ccode\u003ee6f44fc\u003c/code\u003e\u003c/a\u003e bump for 46.0.4 and drop win arm64 due to CI issues (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14217\"\u003e#14217\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/pyca/cryptography/compare/46.0.3...46.0.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `filelock` from 3.20.1 to 3.20.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tox-dev/py-filelock/releases\"\u003efilelock's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.20.3\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix TOCTOU symlink vulnerability in SoftFileLock by \u003ca href=\"https://github.com/gaborbernat\"\u003e\u003ccode\u003e@​gaborbernat\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/tox-dev/filelock/pull/465\"\u003etox-dev/filelock#465\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/tox-dev/filelock/compare/3.20.2...3.20.3\"\u003ehttps://github.com/tox-dev/filelock/compare/3.20.2...3.20.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e3.20.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSupport Unix systems without O_NOFOLLOW by \u003ca href=\"https://github.com/mwilliamson\"\u003e\u003ccode\u003e@​mwilliamson\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/tox-dev/filelock/pull/463\"\u003etox-dev/filelock#463\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate by \u003ca href=\"https://github.com/pre-commit-ci\"\u003e\u003ccode\u003e@​pre-commit-ci\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/tox-dev/filelock/pull/464\"\u003etox-dev/filelock#464\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mwilliamson\"\u003e\u003ccode\u003e@​mwilliamson\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/tox-dev/filelock/pull/463\"\u003etox-dev/filelock#463\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/tox-dev/filelock/compare/3.20.1...3.20.2\"\u003ehttps://github.com/tox-dev/filelock/compare/3.20.1...3.20.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst\"\u003efilelock's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e###########\nChangelog\n###########\u003c/p\u003e\n\u003chr /\u003e\n\u003cp\u003e3.29.3 (2026-06-10)\u003c/p\u003e\n\u003chr /\u003e\n\u003cul\u003e\n\u003cli\u003e🐛 fix(ci): restore release environment on tag job :pr:\u003ccode\u003e559\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003evalidate pid range in _parse_lock_holder :pr:\u003ccode\u003e556\u003c/code\u003e - by :user:\u003ccode\u003edxbjavid\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e🔧 ci(release): publish to PyPI on tag push :pr:\u003ccode\u003e557\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump astral-sh/setup-uv from 8.1.0 to 8.2.0 :pr:\u003ccode\u003e558\u003c/code\u003e - by :user:\u003ccode\u003edependabot[bot]\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003cp\u003e3.29.2 (2026-06-10)\u003c/p\u003e\n\u003chr /\u003e\n\u003cul\u003e\n\u003cli\u003ebuild(deps): bump actions/checkout from 6.0.2 to 6.0.3 :pr:\u003ccode\u003e555\u003c/code\u003e - by :user:\u003ccode\u003edependabot[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e554\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003echeck hostname in is_lock_held_by_us :pr:\u003ccode\u003e553\u003c/code\u003e - by :user:\u003ccode\u003edxbjavid\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e🔒 fix(soft): harden stale-lock breaking and self-heal malformed locks :pr:\u003ccode\u003e551\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eopen marker reads non-blocking to refuse attacker-placed fifo :pr:\u003ccode\u003e549\u003c/code\u003e - by :user:\u003ccode\u003edxbjavid\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003cp\u003e3.29.1 (2026-06-03)\u003c/p\u003e\n\u003chr /\u003e\n\u003cul\u003e\n\u003cli\u003e🐛 fix(soft): refuse to follow symlinks when reading the lock file :pr:\u003ccode\u003e548\u003c/code\u003e - by :user:\u003ccode\u003edxbjavid\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e547\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e546\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003echore: improve filelock maintenance path :pr:\u003ccode\u003e545\u003c/code\u003e - by :user:\u003ccode\u003elphuc2250gma\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003echore: improve filelock maintenance path :pr:\u003ccode\u003e544\u003c/code\u003e - by :user:\u003ccode\u003elphuc2250gma\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003echore: improve filelock maintenance path :pr:\u003ccode\u003e542\u003c/code\u003e - by :user:\u003ccode\u003elphuc2250gma\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003edocs: clarify per-thread scope of FileLock configuration :pr:\u003ccode\u003e543\u003c/code\u003e - by :user:\u003ccode\u003eGares95\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e541\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003edocs: fix API docs of \u003ccode\u003erelease()\u003c/code\u003e :pr:\u003ccode\u003e540\u003c/code\u003e - by :user:\u003ccode\u003eMrAnno\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e539\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e538\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e537\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump astral-sh/setup-uv from 8.0.0 to 8.1.0 :pr:\u003ccode\u003e536\u003c/code\u003e - by :user:\u003ccode\u003edependabot[bot]\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e[pre-commit.ci] pre-commit autoupdate :pr:\u003ccode\u003e535\u003c/code\u003e - by :user:\u003ccode\u003epre-commit-ci[bot]\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003cp\u003e3.29.0 (2026-04-19)\u003c/p\u003e\n\u003chr /\u003e\n\u003cul\u003e\n\u003cli\u003e✨ feat(soft): enable stale lock detection on Windows :pr:\u003ccode\u003e534\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e🐛 fix(async): use single-thread executor for lock consistency :pr:\u003ccode\u003e533\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003ebuild(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 :pr:\u003ccode\u003e530\u003c/code\u003e - by :user:\u003ccode\u003edependabot[bot]\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tox-dev/filelock/commit/41b42dd2c72aecf7da83dbda5903b8087dddc4d5\"\u003e\u003ccode\u003e41b42dd\u003c/code\u003e\u003c/a\u003e Fix TOCTOU symlink vulnerability in SoftFileLock (\u003ca href=\"https://redirect.github.com/tox-dev/py-filelock/issues/465\"\u003e#465\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tox-dev/filelock/commit/f2e7d4046b6a2b375a573bcfbad21827b99f8939\"\u003e\u003ccode\u003ef2e7d40\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/tox-dev/py-filelock/issues/464\"\u003e#464\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tox-dev/filelock/commit/50888548eb2f008d372e71f2835a47851ab83836\"\u003e\u003ccode\u003e5088854\u003c/code\u003e\u003c/a\u003e Support Unix systems without O_NOFOLLOW (\u003ca href=\"https://redirect.github.com/tox-dev/py-filelock/issues/463\"\u003e#463\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/tox-dev/py-filelock/compare/3.20.1...3.20.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 3.11 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in \u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining and\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e Release 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e Pre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from kjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e Convert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from kjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from StanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from StanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kjd/idna/compare/v3.11...v3.15\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lxml` from 6.0.2 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.3 (2026-04-09)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSeveral out of memory error cases now raise \u003ccode\u003eMemoryError\u003c/code\u003e that were not handled before.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSlicing with large step values (outside of \u003ccode\u003e+/- sys.maxsize\u003c/code\u003e) could trigger undefined C behaviour.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2125399: Some failing tests were fixed or disabled in PyPy.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2138421: Memory leak in error cases when setting the \u003ccode\u003epublic_id\u003c/code\u003e or \u003ccode\u003esystem_url\u003c/code\u003e of a document.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c7d76d6cb817c8e1f316e43b16cab5e6ad669ad0\"\u003e\u003ccode\u003ec7d76d6\u003c/code\u003e\u003c/a\u003e Change security policy to point to Github security advisories.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/378ccf82db8160928807c55ed580c0443aa94f42\"\u003e\u003ccode\u003e378ccf8\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/315270b810a9e3276c60daba549299d204ac962b\"\u003e\u003ccode\u003e315270b\u003c/code\u003e\u003c/a\u003e Docs: Reduce TOC depth of package pages and move module contents first.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6dbba7f3c72f655b05b26ef453fdee31af13ccf5\"\u003e\u003ccode\u003e6dbba7f\u003c/code\u003e\u003c/a\u003e Docs: Show current year in copyright line.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/e4385bfa5d79527350d5ef17372fb70ba80b4cce\"\u003e\u003ccode\u003ee4385bf\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5bed1e1a227cd9ba5a879aaeacdf504093a3f6e8\"\u003e\u003ccode\u003e5bed1e1\u003c/code\u003e\u003c/a\u003e Validate file hashes in release download script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c13ee10a429f1144779bb1cbf6ae3bec808ae9c1\"\u003e\u003ccode\u003ec13ee10\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.0.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.0.2...lxml-6.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `marshmallow` from 3.26.1 to 3.26.2\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst\"\u003emarshmallow's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.26.2 (2025-12-19)\u003c/h2\u003e\n\u003cp\u003eBug fixes:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e:cve:\u003ccode\u003e2025-68480\u003c/code\u003e: Merge error store messages without rebuilding collections.\nThanks 카푸치노 for reporting and :user:\u003ccode\u003edeckar01\u003c/code\u003e for the fix.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/1407d5102ae020421ddc8425474e976325a9539e\"\u003e\u003ccode\u003e1407d51\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/marshmallow-code/marshmallow/issues/2878\"\u003e#2878\u003c/a\u003e from marshmallow-code/3.x-mypy-unreachable\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/b2292f513845ccbd134bd55501a9bcbcdd18f8ac\"\u003e\u003ccode\u003eb2292f5\u003c/code\u003e\u003c/a\u003e Fix mypy errors\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/8acd211847244fa28e0174728ff310fddf0d7fa2\"\u003e\u003ccode\u003e8acd211\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/marshmallow-code/marshmallow/issues/2877\"\u003e#2877\u003c/a\u003e from marshmallow-code/3.x-delint\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/b4bcb4a96f16a3b94c1b52ac82a66b57bbee1d88\"\u003e\u003ccode\u003eb4bcb4a\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] auto fixes from pre-commit.com hooks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/b78af7a0ea3102f8c2379bebe115a015e4018a62\"\u003e\u003ccode\u003eb78af7a\u003c/code\u003e\u003c/a\u003e Delint\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/2c4451e5129411da79161add51cfc76fe852549d\"\u003e\u003ccode\u003e2c4451e\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/86d101a1aee2fe0a521c976015d1940437493cde\"\u003e\u003ccode\u003e86d101a\u003c/code\u003e\u003c/a\u003e Bump version and update changelog\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/489a8d421dc7955bb53b89e962d69465fbc5b6af\"\u003e\u003ccode\u003e489a8d4\u003c/code\u003e\u003c/a\u003e Only deep copy error message collections\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/6d4a17dad54ea9711040c6aa6ba4d59267242a41\"\u003e\u003ccode\u003e6d4a17d\u003c/code\u003e\u003c/a\u003e Add test coverage for error message modification\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/marshmallow-code/marshmallow/commit/0356a3f1c307830f8ded56d823abca5611c594c9\"\u003e\u003ccode\u003e0356a3f\u003c/code\u003e\u003c/a\u003e Merge error store messages without rebuilding collections\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/marshmallow-code/marshmallow/compare/3.26.1...3.26.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `mistune` from 3.1.4 to 3.2.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lepture/mistune/releases\"\u003emistune's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.2.1\u003c/h2\u003e\n\u003ch3\u003e   🐞 Bug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eResolve Windows compatibility issues in file inclusion and tests  -  by \u003ca href=\"https://github.com/Yuki9814\"\u003e\u003ccode\u003e@​Yuki9814\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/2547102\"\u003e\u003c!-- raw HTML omitted --\u003e(25471)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEscape html text  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/a3cb6e5\"\u003e\u003c!-- raw HTML omitted --\u003e(a3cb6)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate link reference  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/85eb54f\"\u003e\u003c!-- raw HTML omitted --\u003e(85eb5)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eHandle escaped dollar signs in inline math  -  by \u003ca href=\"https://github.com/saschabuehrle\"\u003e\u003ccode\u003e@​saschabuehrle\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/lepture/mistune/issues/370\"\u003elepture/mistune#370\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/7bd5709\"\u003e\u003c!-- raw HTML omitted --\u003e(7bd57)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEscape id of toc  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/04880a0\"\u003e\u003c!-- raw HTML omitted --\u003e(04880)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEscape id of headings  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/2855622\"\u003e\u003c!-- raw HTML omitted --\u003e(28556)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove double-encoding of image alt text  -  by \u003ca href=\"https://github.com/lawrence3699\"\u003e\u003ccode\u003e@​lawrence3699\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/0d6f3d8\"\u003e\u003c!-- raw HTML omitted --\u003e(0d6f3)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEscape xml for math plugin  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/5fa092e\"\u003e\u003c!-- raw HTML omitted --\u003e(5fa09)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse strict regex for image's height and width  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/8d0cb75\"\u003e\u003c!-- raw HTML omitted --\u003e(8d0cb)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch5\u003e    \u003ca href=\"https://github.com/lepture/mistune/compare/v3.2.0...v3.2.1\"\u003eView changes on GitHub\u003c/a\u003e\u003c/h5\u003e\n\u003ch2\u003ev3.2.0\u003c/h2\u003e\n\u003ch3\u003e   🚀 Features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport footnotes that start on the next line.  -  by \u003ca href=\"https://github.com/kylechui\"\u003e\u003ccode\u003e@​kylechui\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/2677e2d\"\u003e\u003c!-- raw HTML omitted --\u003e(2677e)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eProperly handle code blocks inside footnotes.  -  by \u003ca href=\"https://github.com/kylechui\"\u003e\u003ccode\u003e@​kylechui\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/0516c9e\"\u003e\u003c!-- raw HTML omitted --\u003e(0516c)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport python 3.14  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/7e0eb65\"\u003e\u003c!-- raw HTML omitted --\u003e(7e0eb)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003e   🐞 Bug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRender ref links and footnotes in footnotes.  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/bd90e44\"\u003e\u003c!-- raw HTML omitted --\u003e(bd90e)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRender ref links in TOC.  -  by \u003ca href=\"https://github.com/lemon24\"\u003e\u003ccode\u003e@​lemon24\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/a0a0148\"\u003e\u003c!-- raw HTML omitted --\u003e(a0a01)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate typing for mypy upgrades  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/8d49cba\"\u003e\u003c!-- raw HTML omitted --\u003e(8d49c)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRender correct html for footnotes  -  by \u003ca href=\"https://github.com/lepture\"\u003e\u003ccode\u003e@​lepture\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://github.com/lepture/mistune/commit/9b62204\"\u003e\u003c!-- raw HTML omitted --\u003e(9b622)\u003c!-- raw HTML omitted --\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch5\u003e    \u003ca href=\"https://github.com/lepture/mistune/compare/v3.1.4...v3.2.0\"\u003eView changes on GitHub\u003c/a\u003e\u003c/h5\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lepture/mistune/blob/main/docs/changes.rst\"\u003emistune's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 3.2.1\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on May 3, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eEscape link in \u003ccode\u003erender_toc_ul\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eEscape text in math plugin.\u003c/li\u003e\n\u003cli\u003eFix regex for math plugin.\u003c/li\u003e\n\u003cli\u003eEscape heading's ID attribute.\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eLINK_TITLE_RE\u003c/code\u003e to prevent DoS.\u003c/li\u003e\n\u003cli\u003eEscape class attribute for admonition directive.\u003c/li\u003e\n\u003cli\u003eRemove double-encoding of image alt text.\u003c/li\u003e\n\u003cli\u003eEscape class attribute for image directive.\u003c/li\u003e\n\u003cli\u003eFix width/height attribute for image directive.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 3.2.0\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Dec 23, 2025\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAnnounce supports for python 3.14\u003c/li\u003e\n\u003cli\u003eFix footnotes plugins for code blocks, ref links, blockquote and etc.\u003c/li\u003e\n\u003cli\u003eFix ref links in TOC.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/067f90861088a496942f5eb43236135352b85d39\"\u003e\u003ccode\u003e067f908\u003c/code\u003e\u003c/a\u003e chore: release 3.2.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/bf5503067a7d8c3b065fb143f67a3a08eca77bb6\"\u003e\u003ccode\u003ebf55030\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/lepture/mistune/issues/438\"\u003e#438\u003c/a\u003e from saschabuehrle/fix/issue-370\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/8d0cb7539a9ac82e633b98476b9922632eb8b948\"\u003e\u003ccode\u003e8d0cb75\u003c/code\u003e\u003c/a\u003e fix: use strict regex for image's height and width\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/5fa092e3053b86f16e4c49b9d3ba0b7ab63f09ab\"\u003e\u003ccode\u003e5fa092e\u003c/code\u003e\u003c/a\u003e fix: escape xml for math plugin\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/71ec9477ebfcf8dab0068804baf2c77461d77fbb\"\u003e\u003ccode\u003e71ec947\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/lepture/mistune/issues/440\"\u003e#440\u003c/a\u003e from lawrence3699/fix/image-alt-double-encoding\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/0d6f3d850283d51e9c60e5a1b3c9343a18df3722\"\u003e\u003ccode\u003e0d6f3d8\u003c/code\u003e\u003c/a\u003e fix: remove double-encoding of image alt text\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/2855622d7fe235c6c805716edff943b5945d1eea\"\u003e\u003ccode\u003e2855622\u003c/code\u003e\u003c/a\u003e fix: escape id of headings\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/04880a004cb28318e5ebd7ee9e63c79fc9f9ed04\"\u003e\u003ccode\u003e04880a0\u003c/code\u003e\u003c/a\u003e fix: escape id of toc\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/7bd57096715385062505b3f78972be9fa823d6d4\"\u003e\u003ccode\u003e7bd5709\u003c/code\u003e\u003c/a\u003e fix: handle escaped dollar signs in inline math (fixes \u003ca href=\"https://redirect.github.com/lepture/mistune/issues/370\"\u003e#370\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lepture/mistune/commit/85eb54ff17da26327399bf188f9ff9b8fd515278\"\u003e\u003ccode\u003e85eb54f\u003c/code\u003e\u003c/a\u003e fix: update link reference\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lepture/mistune/compare/v3.1.4...v3.2.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `nbconvert` from 7.16.6 to 7.17.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jupyter/nbconvert/releases\"\u003enbconvert's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev7.17.1\u003c/h2\u003e\n\u003ch2\u003e7.17.1\u003c/h2\u003e\n\u003cp\u003eThis is a security release, fixing two CVEs:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg\"\u003eCVE-2026-39377\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9\"\u003eCVE-2026-39378\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e(full advisories will be published seven days after release, on 2026-04-14).\u003c/p\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter/nbconvert/compare/v7.17.0...b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3\"\u003eFull Changelog\u003c/a\u003e)\u003c/p\u003e\n\u003ch3\u003eEnhancements made\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAllow configureable WebPDF JavaScript processing timeout \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2250\"\u003e#2250\u003c/a\u003e (\u003ca href=\"https://github.com/timkpaine\"\u003e\u003ccode\u003e@​timkpaine\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBugs fixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003ePermissionError\u003c/code\u003e when checking template paths on shared filesystems \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2252\"\u003e#2252\u003c/a\u003e (\u003ca href=\"https://github.com/ctcjab\"\u003e\u003ccode\u003e@​ctcjab\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eTweak webpdf template logic to fix duplicate extension problem \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2249\"\u003e#2249\u003c/a\u003e (\u003ca href=\"https://github.com/timkpaine\"\u003e\u003ccode\u003e@​timkpaine\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaintenance and upkeep improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003especify python version for pre \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2276\"\u003e#2276\u003c/a\u003e (\u003ca href=\"https://github.com/minrk\"\u003e\u003ccode\u003e@​minrk\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eContributors to this release\u003c/h3\u003e\n\u003cp\u003eThe following people contributed discussions, new ideas, code and documentation contributions, and review.\nSee \u003ca href=\"https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports\"\u003eour definition of contributors\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-01-29\u0026amp;to=2026-04-08\u0026amp;type=c\"\u003eGitHub contributors page for this release\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/akhmerov\"\u003e\u003ccode\u003e@​akhmerov\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aakhmerov+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/bollwyvl\"\u003e\u003ccode\u003e@​bollwyvl\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Abollwyvl+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/ctcjab\"\u003e\u003ccode\u003e@​ctcjab\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Actcjab+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/davidbrochart\"\u003e\u003ccode\u003e@​davidbrochart\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Adavidbrochart+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/Ken-B\"\u003e\u003ccode\u003e@​Ken-B\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AKen-B+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Akrassowski+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/mgeier\"\u003e\u003ccode\u003e@​mgeier\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Amgeier+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/minrk\"\u003e\u003ccode\u003e@​minrk\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/mpacer\"\u003e\u003ccode\u003e@​mpacer\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Ampacer+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/MSeal\"\u003e\u003ccode\u003e@​MSeal\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AMSeal+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/SylvainCorlay\"\u003e\u003ccode\u003e@​SylvainCorlay\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ASylvainCorlay+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/takluyver\"\u003e\u003ccode\u003e@​takluyver\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atakluyver+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/timkpaine\"\u003e\u003ccode\u003e@​timkpaine\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atimkpaine+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003ev7.17.0\u003c/h2\u003e\n\u003ch2\u003e7.17.0\u003c/h2\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter/nbconvert/compare/v7.16.6...c9ac1d1040459ed1ff9eb34e9918ce5a87cf9d71\"\u003eFull Changelog\u003c/a\u003e)\u003c/p\u003e\n\u003ch3\u003eEnhancements made\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for arbitrary browser arguments \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2227\"\u003e#2227\u003c/a\u003e (\u003ca href=\"https://github.com/shreve\"\u003e\u003ccode\u003e@​shreve\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBugs fixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix QtPNGExporter returning empty bytes on macOS \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2264\"\u003e#2264\u003c/a\u003e (\u003ca href=\"https://github.com/h3pdesign\"\u003e\u003ccode\u003e@​h3pdesign\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/QuLogic\"\u003e\u003ccode\u003e@​QuLogic\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jupyter/nbconvert/blob/main/CHANGELOG.md\"\u003enbconvert's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e7.17.1\u003c/h2\u003e\n\u003cp\u003eThis is a security release, fixing two CVEs:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/security/advisories/GHSA-4c99-qj7h-p3vg\"\u003eCVE-2026-39377\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/security/advisories/GHSA-7jqv-fw35-gmx9\"\u003eCVE-2026-39378\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e(full advisories will be published seven days after release, on 2026-04-14).\u003c/p\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter/nbconvert/compare/v7.17.0...b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3\"\u003eFull Changelog\u003c/a\u003e)\u003c/p\u003e\n\u003ch3\u003eEnhancements made\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAllow configureable WebPDF JavaScript processing timeout \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2250\"\u003e#2250\u003c/a\u003e (\u003ca href=\"https://github.com/timkpaine\"\u003e\u003ccode\u003e@​timkpaine\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBugs fixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003ePermissionError\u003c/code\u003e when checking template paths on shared filesystems \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2252\"\u003e#2252\u003c/a\u003e (\u003ca href=\"https://github.com/ctcjab\"\u003e\u003ccode\u003e@​ctcjab\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eTweak webpdf template logic to fix duplicate extension problem \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2249\"\u003e#2249\u003c/a\u003e (\u003ca href=\"https://github.com/timkpaine\"\u003e\u003ccode\u003e@​timkpaine\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaintenance and upkeep improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003especify python version for pre \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2276\"\u003e#2276\u003c/a\u003e (\u003ca href=\"https://github.com/minrk\"\u003e\u003ccode\u003e@​minrk\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eContributors to this release\u003c/h3\u003e\n\u003cp\u003eThe following people contributed discussions, new ideas, code and documentation contributions, and review.\nSee \u003ca href=\"https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports\"\u003eour definition of contributors\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter/nbconvert/graphs/contributors?from=2026-01-29\u0026amp;to=2026-04-08\u0026amp;type=c\"\u003eGitHub contributors page for this release\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/akhmerov\"\u003e\u003ccode\u003e@​akhmerov\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aakhmerov+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/bollwyvl\"\u003e\u003ccode\u003e@​bollwyvl\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Abollwyvl+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ACarreau+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/ctcjab\"\u003e\u003ccode\u003e@​ctcjab\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Actcjab+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/davidbrochart\"\u003e\u003ccode\u003e@​davidbrochart\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Adavidbrochart+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/Ken-B\"\u003e\u003ccode\u003e@​Ken-B\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AKen-B+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Akrassowski+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/mgeier\"\u003e\u003ccode\u003e@​mgeier\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Amgeier+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/minrk\"\u003e\u003ccode\u003e@​minrk\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Aminrk+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/mpacer\"\u003e\u003ccode\u003e@​mpacer\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Ampacer+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/MSeal\"\u003e\u003ccode\u003e@​MSeal\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3AMSeal+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/SylvainCorlay\"\u003e\u003ccode\u003e@​SylvainCorlay\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3ASylvainCorlay+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/takluyver\"\u003e\u003ccode\u003e@​takluyver\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atakluyver+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/timkpaine\"\u003e\u003ccode\u003e@​timkpaine\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter%2Fnbconvert+involves%3Atimkpaine+updated%3A2026-01-29..2026-04-08\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e)\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003e7.17.0\u003c/h2\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter/nbconvert/compare/v7.16.6...c9ac1d1040459ed1ff9eb34e9918ce5a87cf9d71\"\u003eFull Changelog\u003c/a\u003e)\u003c/p\u003e\n\u003ch3\u003eEnhancements made\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd support for arbitrary browser arguments \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2227\"\u003e#2227\u003c/a\u003e (\u003ca href=\"https://github.com/shreve\"\u003e\u003ccode\u003e@​shreve\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBugs fixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix QtPNGExporter returning empty bytes on macOS \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2264\"\u003e#2264\u003c/a\u003e (\u003ca href=\"https://github.com/h3pdesign\"\u003e\u003ccode\u003e@​h3pdesign\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/QuLogic\"\u003e\u003ccode\u003e@​QuLogic\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix CVE-2025-53000: Secure Inkscape Windows path (registry first + block CWD) \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2261\"\u003e#2261\u003c/a\u003e (\u003ca href=\"https://github.com/h3pdesign\"\u003e\u003ccode\u003e@​h3pdesign\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/mberlanda\"\u003e\u003ccode\u003e@​mberlanda\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/minrk\"\u003e\u003ccode\u003e@​minrk\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/salmankadaya\"\u003e\u003ccode\u003e@​salmankadaya\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/th3gowtham\"\u003e\u003ccode\u003e@​th3gowtham\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix get_export_names and get_exporter default args \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2228\"\u003e#2228\u003c/a\u003e (\u003ca href=\"https://github.com/shreve\"\u003e\u003ccode\u003e@​shreve\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/krassowski\"\u003e\u003ccode\u003e@​krassowski\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003ePyPA-Compliant Summary \u003ca href=\"https://redirect.github.com/jupyter/nbconvert/pull/2226\"\u003e#2226\u003c/a\u003e (\u003ca href=\"https://github.com/hackowitz-af\"\u003e\u003ccode\u003e@​hackowitz-af\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/Carreau\"\u003e\u003ccode\u003e@​Carreau\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/78ed30837a607deab7cf0a12dca072bf3f63417a\"\u003e\u003ccode\u003e78ed308\u003c/code\u003e\u003c/a\u003e Publish 7.17.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/f090a64606fde4c7f87cbf478f51b4aa46a425ec\"\u003e\u003ccode\u003ef090a64\u003c/code\u003e\u003c/a\u003e ruff format\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/b3b6ec01f872e9af8fd1769eb9cf1889c720ecf3\"\u003e\u003ccode\u003eb3b6ec0\u003c/code\u003e\u003c/a\u003e chore: update pre-commit hooks (\u003ca href=\"https://redirect.github.com/jupyter/nbconvert/issues/2277\"\u003e#2277\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/be4841f7da51c499b1937e41e6e71926dbe0daa3\"\u003e\u003ccode\u003ebe4841f\u003c/code\u003e\u003c/a\u003e ignore silly security lint in tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/26d57b295870f5572d9bd0535acee4a120339c10\"\u003e\u003ccode\u003e26d57b2\u003c/code\u003e\u003c/a\u003e fix type annotation on Lexer\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/0e6b8ccabf2aca6c18fac8c574f22b7155f441fb\"\u003e\u003ccode\u003e0e6b8cc\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/ba5e5cdd737704388251fa55fa9e58f5752fa39d\"\u003e\u003ccode\u003eba5e5cd\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/1db0c88d865146ce02b6405a8d96753d3d0cd0c2\"\u003e\u003ccode\u003e1db0c88\u003c/code\u003e\u003c/a\u003e Specify python version for pre (\u003ca href=\"https://redirect.github.com/jupyter/nbconvert/issues/2276\"\u003e#2276\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/7473fc3037a6317bff54380e3a7162d73bf089b3\"\u003e\u003ccode\u003e7473fc3\u003c/code\u003e\u003c/a\u003e chore: update pre-commit hooks (\u003ca href=\"https://redirect.github.com/jupyter/nbconvert/issues/2242\"\u003e#2242\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter/nbconvert/commit/4322f7f290694929f414cefadc942111afad3762\"\u003e\u003ccode\u003e4322f7f\u003c/code\u003e\u003c/a\u003e Bump the actions group across 1 directory with 2 updates (\u003ca href=\"https://redirect.github.com/jupyter/nbconvert/issues/2273\"\u003e#2273\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jupyter/nbconvert/compare/v7.16.6...v7.17.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `nltk` from 3.9.2 to 3.9.4\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/nltk/nltk/blob/develop/ChangeLog\"\u003enltk's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003eVersion 3.9.4 2026-03-24\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eSupport Python 3.14\u003c/li\u003e\n\u003cli\u003eFix bug in Levenshtein distance when substitution_cost \u0026gt; 2\u003c/li\u003e\n\u003cli\u003eFix bug in Treebank detokeniser re quote ordering\u003c/li\u003e\n\u003cli\u003eFix bug in Jaro similarity for empty strings\u003c/li\u003e\n\u003cli\u003eSeveral security enhancements\u003c/li\u003e\n\u003cli\u003eFix GHSA-rf74-v2fm-23pw: unbounded recursion in JSONTaggedDecoder\u003c/li\u003e\n\u003cli\u003eImplement TextTiling vocabulary introduction method (Hearst 1997)\u003c/li\u003e\n\u003cli\u003eFix ALINE feature matrix errors and add comprehensive tests\u003c/li\u003e\n\u003cli\u003eSupport multiple VerbNet versions, fix longid/shortid regex for VerbNet ids\u003c/li\u003e\n\u003cli\u003eLet downloader fallback to md5 when sha256 is unavailable\u003c/li\u003e\n\u003cli\u003eSeveral other minor bugfixes and code cleanups\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to the following contributors to 3.9.4:\nMin-Yen Kan, Eric Kafe, Emily Voss, bowiechen, Hrudhai01,\njancallewaert, Mr-Neutr0n, pollak.peter89, ylwango613,\u003c/p\u003e\n\u003cp\u003eVersion 3.9.3 2026-02-21\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix CVE-2025-14009: secure ZIP extraction in nltk.downloader (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3468\"\u003e#3468\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBlock path traversal/arbitrary reads in nltk.data for protocol-less refs (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3467\"\u003e#3467\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBlock path traversal/abs paths in corpus readers and FS pointers (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3479\"\u003e#3479\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3480\"\u003e#3480\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eValidate external StanfordSegmenter JARs using SHA256 (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3477\"\u003e#3477\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd optional sandbox enforcement for filestring() (\u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3485\"\u003e#3485\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eMaintenance: downloader/zipped models, CI/tooling updates\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to the following contributors to 3.9.3:\nChris Clauss, Eric Kafe, HyperPS, purificant, Shivansh-Game, Christopher Smith\u003c/p\u003e\n\u003cp\u003eVersion 3.9.2 2025-10-01\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate download checksums to use SHA256 in built index\u003c/li\u003e\n\u003cli\u003eFix percentage escape in new-style string formatting\u003c/li\u003e\n\u003cli\u003ereplace shortened URLs using goo.gl\u003c/li\u003e\n\u003cli\u003eMake Wordnet interoperable with various taggers and tagged corpora\u003c/li\u003e\n\u003cli\u003eFix saving PerceptronTagger\u003c/li\u003e\n\u003cli\u003eDocument how to reproduce old Wordnet studies\u003c/li\u003e\n\u003cli\u003eproperly initialize Portuguese corpus reader\u003c/li\u003e\n\u003cli\u003esupport for mixed rules conversion into Chomsky Normal Form\u003c/li\u003e\n\u003cli\u003eonly import tkinter if a GUI is needed\u003c/li\u003e\n\u003cli\u003eissue \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/2112\"\u003e#2112\u003c/a\u003e with Corenlp\u003c/li\u003e\n\u003cli\u003enew environment variable NLTK_DOWNLOADER_FORCE_INTERACTIVE_SHELL\u003c/li\u003e\n\u003cli\u003eLesk defaults to most frequent sense in case of ties\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to the following contributors to 3.9.2:\nJose Cols, Peter de Blanc, GeneralPoxter, Eric Kafe, William LaCroix, Jason Liu,\nSamer Masterson, Mike014, purificant, Andrew Ernest Ritz, samertm, Ikram Ul Haq,\nChristopher Smith, Ryan Mannion\u003c/p\u003e\n\u003cp\u003eVersion 3.9.1 2024-08-19\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/ad9c96ba00a16923ffe917eacf63f1707bfa2d08\"\u003e\u003ccode\u003ead9c96b\u003c/code\u003e\u003c/a\u003e Update copyright year\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/7edcddfda566627b897397397cc4d10ae91cb86d\"\u003e\u003ccode\u003e7edcddf\u003c/code\u003e\u003c/a\u003e Updates for 3.9.4 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/67a2736f89b286b028db08bd247134f17a11fc6b\"\u003e\u003ccode\u003e67a2736\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3180\"\u003e#3180\u003c/a\u003e from yzhaoinuw/bug-on-edit_distance_align\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/2b17ac5358a1c8d4b97455766efde0b786e6cdb2\"\u003e\u003ccode\u003e2b17ac5\u003c/code\u003e\u003c/a\u003e Fix edit_distance_align backtrace for high substitution costs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/4b72976a6ff3d180ed4012f11843e611a8f89516\"\u003e\u003ccode\u003e4b72976\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3018\"\u003e#3018\u003c/a\u003e from JuanIMartinezB/bug/shortid-longid\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/8a5619f53a281149e5342b1a00fe05fe2fc6517f\"\u003e\u003ccode\u003e8a5619f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3222\"\u003e#3222\u003c/a\u003e from Syzygy2048/feature/texttiling-vocabulary-introd...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/c6574d755e02b6163d9cd1d0b407076940e08864\"\u003e\u003ccode\u003ec6574d7\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3289\"\u003e#3289\u003c/a\u003e from ihitamandal/codeflash/optimize-windowdiff-2024-...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/98ff5d9eaa1a81511873b9aef857944519c28dc4\"\u003e\u003ccode\u003e98ff5d9\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3435\"\u003e#3435\u003c/a\u003e from Hrudhai01/fix-3260-detokenize-quotes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/aec4fce1b84ad725b8975f7365b23a4f626572a9\"\u003e\u003ccode\u003eaec4fce\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3522\"\u003e#3522\u003c/a\u003e from ekaf/pathsec\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/nltk/nltk/commit/eec4ee3591cb9cb8b8c2989f08012608c841d532\"\u003e\u003ccode\u003eeec4ee3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/nltk/nltk/issues/3526\"\u003e#3526\u003c/a\u003e from nltk/update-contributing\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/nltk/nltk/compare/3.9.2...3.9.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pypdf` from 6.4.2 to 6.10.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/py-pdf/pypdf/releases\"\u003epypdf's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.10.2, 2026-04-15\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDo not rely on possibly invalid /Size for incremental cloning (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3735\"\u003e#3735\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIntroduce limits for FlateDecode parameters and image decoding (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3734\"\u003e#3734\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.10.1...6.10.2\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.10.1, 2026-04-14\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eLimit the allowed size of xref and object streams (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3733\"\u003e#3733\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eConsider strict mode setting for decryption errors (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3731\"\u003e#3731\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation (DOC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUse new parameter names for compress_identical_objects by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.10.0...6.10.1\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.10.0, 2026-04-10\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDisallow custom XML entity declarations for XMP metadata (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3724\"\u003e#3724\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6...\n\n_Description has been truncated_","html_url":"https://github.com/tabrezahmed51/MiroFish_0118/pull/5","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/tabrezahmed51%2FMiroFish_0118/issues/5","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/5/packages"}},{"old_version":"4.9.1","new_version":"6.1.0","update_type":"major","path":null,"pr_created_at":"2026-06-09T22:06:21.000Z","version_change":"4.9.1 → 6.1.0","issue":{"uuid":"4625988340","node_id":"PR_kwDOSX4Rvc7klKWS","number":2,"state":"closed","title":"chore(deps): bump the pip group across 8 directories with 13 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-09T22:21:51.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-09T22:06:21.000Z","updated_at":"2026-06-09T22:21:53.000Z","time_to_close":930,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"pip","update_count":13,"packages":[{"name":"certifi","old_version":"2022.12.7","new_version":"2024.7.4","repository_url":"https://github.com/certifi/python-certifi"},{"name":"cryptography","old_version":"36.0.1","new_version":"46.0.7","repository_url":"https://github.com/pyca/cryptography"},{"name":"h11","old_version":"0.13.0","new_version":"0.16.0","repository_url":"https://github.com/python-hyper/h11"},{"name":"idna","old_version":"3.3","new_version":"3.15","repository_url":"https://github.com/kjd/idna"},{"name":"lxml","old_version":"4.9.1","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"},{"name":"pyopenssl","old_version":"22.0.0","new_version":"26.0.0","repository_url":"https://github.com/pyca/pyopenssl"},{"name":"requests","old_version":"2.27.1","new_version":"2.33.0","repository_url":"https://github.com/psf/requests"},{"name":"tqdm","old_version":"4.63.0","new_version":"4.66.3","repository_url":"https://github.com/tqdm/tqdm"},{"name":"urllib3","old_version":"1.26.19","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"}],"path":null,"ecosystem":"pip"},"body":"Bumps the pip group with 1 update in the /examples/benchmarks/Localformer directory: [torch](https://github.com/pytorch/pytorch).\nBumps the pip group with 1 update in the /examples/benchmarks/TFT directory: [tensorflow-gpu](https://github.com/tensorflow/tensorflow).\nBumps the pip group with 2 updates in the /examples/benchmarks/TRA directory: [torch](https://github.com/pytorch/pytorch) and [scikit-learn](https://github.com/scikit-learn/scikit-learn).\nBumps the pip group with 2 updates in the /examples/benchmarks/TabNet directory: [torch](https://github.com/pytorch/pytorch) and [scikit-learn](https://github.com/scikit-learn/scikit-learn).\nBumps the pip group with 1 update in the /examples/benchmarks/Transformer directory: [torch](https://github.com/pytorch/pytorch).\nBumps the pip group with 1 update in the /examples/benchmarks_dynamic/DDG-DA directory: [torch](https://github.com/pytorch/pytorch).\nBumps the pip group with 1 update in the /examples/hyperparameter/LightGBM directory: [lightgbm](https://github.com/microsoft/LightGBM).\nBumps the pip group with 9 updates in the /scripts/data_collector/br_index directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [certifi](https://github.com/certifi/python-certifi) | `2022.12.7` | `2024.7.4` |\n| [cryptography](https://github.com/pyca/cryptography) | `36.0.1` | `46.0.7` |\n| [h11](https://github.com/python-hyper/h11) | `0.13.0` | `0.16.0` |\n| [idna](https://github.com/kjd/idna) | `3.3` | `3.15` |\n| [lxml](https://github.com/lxml/lxml) | `4.9.1` | `6.1.0` |\n| [pyopenssl](https://github.com/pyca/pyopenssl) | `22.0.0` | `26.0.0` |\n| [requests](https://github.com/psf/requests) | `2.27.1` | `2.33.0` |\n| [tqdm](https://github.com/tqdm/tqdm) | `4.63.0` | `4.66.3` |\n| [urllib3](https://github.com/urllib3/urllib3) | `1.26.19` | `2.7.0` |\n\n\nUpdates `torch` from 1.2.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/releases\"\u003etorch's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ePyTorch 2.8.0 Release Notes\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#highlights\"\u003eHighlights\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes\"\u003eBackwards Incompatible Changes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#deprecations\"\u003eDeprecations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#new-features\"\u003eNew Features\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#improvements\"\u003eImprovements\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes\"\u003eBug fixes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#performance\"\u003ePerformance\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#documentation\"\u003eDocumentation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#developers\"\u003eDevelopers\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eHighlights\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/blob/main/RELEASE.md\"\u003etorch's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleasing PyTorch\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-compatibility-matrix\"\u003eRelease Compatibility Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-cuda-support-matrix\"\u003ePyTorch CUDA Support Matrix\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-cadence\"\u003eRelease Cadence\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#general-overview\"\u003eGeneral Overview\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#frequently-asked-questions\"\u003eFrequently Asked Questions\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-a-release-branch-preparations\"\u003eCutting a release branch preparations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-release-branches\"\u003eCutting release branches\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorchpytorch\"\u003e\u003ccode\u003epytorch/pytorch\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-ecosystem-libraries\"\u003ePyTorch ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-pytorch\"\u003eMaking release branch specific changes for PyTorch\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-ecosystem-libraries\"\u003eMaking release branch specific changes for ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#running-launch-execution-team-core-xfn-sync\"\u003eRunning Launch Execution team Core XFN sync\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#drafting-rcs-release-candidates-for-pytorch-and-domain-libraries\"\u003eDrafting RCs (https://github.com/pytorch/pytorch/blob/main/Release Candidates) for PyTorch and domain libraries\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-storage\"\u003eRelease Candidate Storage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-health-validation\"\u003eRelease Candidate health validation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-fixes\"\u003eCherry Picking Fixes\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#how-to-do-cherry-picking\"\u003eHow to do Cherry Picking\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-reverts\"\u003eCherry Picking Reverts\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#preparing-and-creating-final-release-candidate\"\u003ePreparing and Creating Final Release Candidate\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#promoting-rcs-to-stable\"\u003ePromoting RCs to Stable\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#additional-steps-to-prepare-for-release-day\"\u003eAdditional Steps to prepare for release day\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#modify-release-matrix\"\u003eModify release matrix\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#open-google-colab-issue\"\u003eOpen Google Colab issue\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-releases\"\u003ePatch Releases\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-criteria\"\u003ePatch Release Criteria\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process\"\u003ePatch Release Process\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process-description\"\u003ePatch Release Process Description\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triage\"\u003eTriage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#issue-tracker-for-patch-releases\"\u003eIssue Tracker for Patch releases\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-a-release-schedule--cherry-picking\"\u003eBuilding a release schedule / cherry picking\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-binaries--promotion-to-stable\"\u003eBuilding Binaries / Promotion to Stable\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#hardware--software-support-in-binary-build-matrix\"\u003eHardware / Software Support in Binary Build Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#python\"\u003ePython\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#accelerator-software\"\u003eAccelerator Software\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-support-cases\"\u003eSpecial support cases\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#operating-systems\"\u003eOperating Systems\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#submitting-tutorials\"\u003eSubmitting Tutorials\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-topics\"\u003eSpecial Topics\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#updating-submodules-for-a-release\"\u003eUpdating submodules for a release\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triton-dependency-for-the-release\"\u003eTriton dependency for the release\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003eRelease Compatibility Matrix\u003c/h2\u003e\n\u003cp\u003eFollowing is the Release Compatibility Matrix for PyTorch releases:\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/ba56102387ef21a3b04b357e5b183d48f0afefc7\"\u003e\u003ccode\u003eba56102\u003c/code\u003e\u003c/a\u003e Cherrypick: Add the RunLLM widget to the website (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/159592\"\u003e#159592\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c525a02c89217181b5731d8043c7309a84e84066\"\u003e\u003ccode\u003ec525a02\u003c/code\u003e\u003c/a\u003e [dynamo, docs] cherry pick torch.compile programming model docs into 2.8 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/15\"\u003e#15\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a1cb3cc05d46d198467bebbb6e8fba50a325d4e7\"\u003e\u003ccode\u003ea1cb3cc\u003c/code\u003e\u003c/a\u003e [Release Only] Remove nvshmem from list of preload libraries (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158925\"\u003e#158925\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c76b2356bc31654de2af0c98cce1bef291f06f89\"\u003e\u003ccode\u003ec76b235\u003c/code\u003e\u003c/a\u003e Move out super large one off foreach_copy test (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158880\"\u003e#158880\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/20a0e225a01d4ebbffd44a6a59acff628359c772\"\u003e\u003ccode\u003e20a0e22\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;[Dynamo] Allow inlining into AO quantization modules (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/152934\"\u003e#152934\u003c/a\u003e)\u0026quot; (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158\"\u003e#158\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/9167ac8c75481e2beb3746aa37b7f48a213c631e\"\u003e\u003ccode\u003e9167ac8\u003c/code\u003e\u003c/a\u003e [MPS] Switch Cholesky  decomp to column wise (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158237\"\u003e#158237\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/5534685c62399db8d1e51b47e2dcbc17deaab230\"\u003e\u003ccode\u003e5534685\u003c/code\u003e\u003c/a\u003e [MPS] Reimplement \u003ccode\u003etri[ul]\u003c/code\u003e as Metal shaders (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158867\"\u003e#158867\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/d19e08d74b2a27e661bf57a9015014b757e8ea31\"\u003e\u003ccode\u003ed19e08d\u003c/code\u003e\u003c/a\u003e Cherry pick PR 158746 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158801\"\u003e#158801\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a6c044ab9aa14f0864c6a572f7c023432511c5ea\"\u003e\u003ccode\u003ea6c044a\u003c/code\u003e\u003c/a\u003e [cherry-pick] Unify torch.tensor and torch.ops.aten.scalar_tensor behavior (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/620ebd0646252bbb22524f5c252ec7e9ab977bee\"\u003e\u003ccode\u003e620ebd0\u003c/code\u003e\u003c/a\u003e [Dynamo] Use proper sources for constructing dataclass defaults (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158689\"\u003e#158689\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pytorch/pytorch/compare/v1.2.0...v2.8.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tensorflow-gpu` from 1.15.0 to 2.12.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tensorflow/tensorflow/releases\"\u003etensorflow-gpu's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eTensorFlow 2.12.0\u003c/h2\u003e\n\u003ch1\u003eRelease 2.12.0\u003c/h1\u003e\n\u003ch2\u003eTensorFlow\u003c/h2\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eBuild, Compilation and Packaging\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved redundant packages \u003ccode\u003etensorflow-gpu\u003c/code\u003e and \u003ccode\u003etf-nightly-gpu\u003c/code\u003e. These packages were removed and replaced with packages that direct users to switch to \u003ccode\u003etensorflow\u003c/code\u003e or \u003ccode\u003etf-nightly\u003c/code\u003e respectively. Since TensorFlow 2.1, the only difference between these two sets of packages was their names, so there is no loss of functionality or GPU support. See \u003ca href=\"https://pypi.org/project/tensorflow-gpu\"\u003ehttps://pypi.org/project/tensorflow-gpu\u003c/a\u003e for more details.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.function\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003etf.function\u003c/code\u003e now uses the Python inspect library directly for parsing the signature of the Python function it is decorated on. This change may break code where the function signature is malformed, but was ignored previously, such as:\n\u003cul\u003e\n\u003cli\u003eUsing \u003ccode\u003efunctools.wraps\u003c/code\u003e on a function with different signature\u003c/li\u003e\n\u003cli\u003eUsing \u003ccode\u003efunctools.partial\u003c/code\u003e with an invalid \u003ccode\u003etf.function\u003c/code\u003e input\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etf.function\u003c/code\u003e now enforces input parameter names to be valid Python identifiers. Incompatible names are automatically sanitized similarly to existing SavedModel signature behavior.\u003c/li\u003e\n\u003cli\u003eParameterless \u003ccode\u003etf.function\u003c/code\u003es are assumed to have an empty \u003ccode\u003einput_signature\u003c/code\u003e instead of an undefined one even if the \u003ccode\u003einput_signature\u003c/code\u003e is unspecified.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etf.types.experimental.TraceType\u003c/code\u003e now requires an additional \u003ccode\u003eplaceholder_value\u003c/code\u003e method to be defined.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etf.function\u003c/code\u003e now traces with placeholder values generated by TraceType instead of the value itself.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eExperimental APIs \u003ccode\u003etf.config.experimental.enable_mlir_graph_optimization\u003c/code\u003e and \u003ccode\u003etf.config.experimental.disable_mlir_graph_optimization\u003c/code\u003e were removed.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMajor Features and Improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSupport for Python 3.11 has been added.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSupport for Python 3.7 has been removed. We are not releasing any more patches for Python 3.7.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.lite\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd 16-bit float type support for built-in op \u003ccode\u003efill\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eTranspose now supports 6D tensors.\u003c/li\u003e\n\u003cli\u003eFloat LSTM now supports diagonal recurrent tensors: \u003ca href=\"https://arxiv.org/abs/1903.08023\"\u003ehttps://arxiv.org/abs/1903.08023\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.experimental.dtensor\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCoordination service now works with \u003ccode\u003edtensor.initialize_accelerator_system\u003c/code\u003e, and enabled by default.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003etf.experimental.dtensor.is_dtensor\u003c/code\u003e to check if a tensor is a DTensor instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.data\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for alternative checkpointing protocol which makes it possible to checkpoint the state of the input pipeline without having to store the contents of internal buffers. The new functionality can be enabled through the \u003ccode\u003eexperimental_symbolic_checkpoint\u003c/code\u003e option of \u003ccode\u003etf.data.Options()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAdded a new \u003ccode\u003ererandomize_each_iteration\u003c/code\u003e argument for the \u003ccode\u003etf.data.Dataset.random()\u003c/code\u003e operation, which controls whether the sequence of generated random numbers should be re-randomized every epoch or not (the default behavior). If \u003ccode\u003eseed\u003c/code\u003e is set and \u003ccode\u003ererandomize_each_iteration=True\u003c/code\u003e, the \u003ccode\u003erandom()\u003c/code\u003e operation will produce a different (deterministic) sequence of numbers every epoch.\u003c/li\u003e\n\u003cli\u003eAdded a new \u003ccode\u003ererandomize_each_iteration\u003c/code\u003e argument for the \u003ccode\u003etf.data.Dataset.sample_from_datasets()\u003c/code\u003e operation, which controls whether the sequence of generated random numbers used for sampling should be re-randomized every epoch or not. If \u003ccode\u003eseed\u003c/code\u003e is set and \u003ccode\u003ererandomize_each_iteration=True\u003c/code\u003e, the \u003ccode\u003esample_from_datasets()\u003c/code\u003e operation will use a different (deterministic) sequence of numbers every epoch.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.test\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003etf.test.experimental.sync_devices\u003c/code\u003e, which is useful for accurately measuring performance in benchmarks.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.experimental.dtensor\u003c/code\u003e:\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tensorflow/tensorflow/blob/master/RELEASE.md\"\u003etensorflow-gpu's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease 2.12.0\u003c/h1\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eBuild, Compilation and Packaging\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved redundant packages \u003ccode\u003etensorflow-gpu\u003c/code\u003e and \u003ccode\u003etf-nightly-gpu\u003c/code\u003e. These packages were removed and replaced with packages that direct users to switch to \u003ccode\u003etensorflow\u003c/code\u003e or \u003ccode\u003etf-nightly\u003c/code\u003e respectively. Since TensorFlow 2.1, the only difference between these two sets of packages was their names, so there is no loss of functionality or GPU support. See \u003ca href=\"https://pypi.org/project/tensorflow-gpu\"\u003ehttps://pypi.org/project/tensorflow-gpu\u003c/a\u003e for more details.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.function\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003etf.function\u003c/code\u003e now uses the Python inspect library directly for parsing the signature of the Python function it is decorated on. This change may break code where the function signature is malformed, but was ignored previously, such as:\n\u003cul\u003e\n\u003cli\u003eUsing \u003ccode\u003efunctools.wraps\u003c/code\u003e on a function with different signature\u003c/li\u003e\n\u003cli\u003eUsing \u003ccode\u003efunctools.partial\u003c/code\u003e with an invalid \u003ccode\u003etf.function\u003c/code\u003e input\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etf.function\u003c/code\u003e now enforces input parameter names to be valid Python identifiers. Incompatible names are automatically sanitized similarly to existing SavedModel signature behavior.\u003c/li\u003e\n\u003cli\u003eParameterless \u003ccode\u003etf.function\u003c/code\u003es are assumed to have an empty \u003ccode\u003einput_signature\u003c/code\u003e instead of an undefined one even if the \u003ccode\u003einput_signature\u003c/code\u003e is unspecified.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etf.types.experimental.TraceType\u003c/code\u003e now requires an additional \u003ccode\u003eplaceholder_value\u003c/code\u003e method to be defined.\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003etf.function\u003c/code\u003e now traces with placeholder values generated by TraceType instead of the value itself.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eExperimental APIs \u003ccode\u003etf.config.experimental.enable_mlir_graph_optimization\u003c/code\u003e and \u003ccode\u003etf.config.experimental.disable_mlir_graph_optimization\u003c/code\u003e were removed.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMajor Features and Improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSupport for Python 3.11 has been added.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSupport for Python 3.7 has been removed. We are not releasing any more patches for Python 3.7.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.lite\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd 16-bit float type support for built-in op \u003ccode\u003efill\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eTranspose now supports 6D tensors.\u003c/li\u003e\n\u003cli\u003eFloat LSTM now supports diagonal recurrent tensors: \u003ca href=\"https://arxiv.org/abs/1903.08023\"\u003ehttps://arxiv.org/abs/1903.08023\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.experimental.dtensor\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCoordination service now works with \u003ccode\u003edtensor.initialize_accelerator_system\u003c/code\u003e, and enabled by default.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003etf.experimental.dtensor.is_dtensor\u003c/code\u003e to check if a tensor is a DTensor instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.data\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for alternative checkpointing protocol which makes it possible to checkpoint the state of the input pipeline without having to store the contents of internal buffers. The new functionality can be enabled through the \u003ccode\u003eexperimental_symbolic_checkpoint\u003c/code\u003e option of \u003ccode\u003etf.data.Options()\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eAdded a new \u003ccode\u003ererandomize_each_iteration\u003c/code\u003e argument for the \u003ccode\u003etf.data.Dataset.random()\u003c/code\u003e operation, which controls whether the sequence of generated random numbers should be re-randomized every epoch or not (the default behavior). If \u003ccode\u003eseed\u003c/code\u003e is set and \u003ccode\u003ererandomize_each_iteration=True\u003c/code\u003e, the \u003ccode\u003erandom()\u003c/code\u003e operation will produce a different (deterministic) sequence of numbers every epoch.\u003c/li\u003e\n\u003cli\u003eAdded a new \u003ccode\u003ererandomize_each_iteration\u003c/code\u003e argument for the \u003ccode\u003etf.data.Dataset.sample_from_datasets()\u003c/code\u003e operation, which controls whether the sequence of generated random numbers used for sampling should be re-randomized every epoch or not. If \u003ccode\u003eseed\u003c/code\u003e is set and \u003ccode\u003ererandomize_each_iteration=True\u003c/code\u003e, the \u003ccode\u003esample_from_datasets()\u003c/code\u003e operation will use a different (deterministic) sequence of numbers every epoch.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.test\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded \u003ccode\u003etf.test.experimental.sync_devices\u003c/code\u003e, which is useful for accurately measuring performance in benchmarks.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003etf.experimental.dtensor\u003c/code\u003e:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded experimental support to ReduceScatter fuse on GPU (NCCL).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/0db597d0d758aba578783b5bf46c889700a45085\"\u003e\u003ccode\u003e0db597d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tensorflow/tensorflow/issues/60051\"\u003e#60051\u003c/a\u003e from tensorflow/venkat2469-patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/1a12f5939238da4c4372a095e589f2801baecf41\"\u003e\u003ccode\u003e1a12f59\u003c/code\u003e\u003c/a\u003e Update RELEASE.md\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/aa4d558019c48a7ab5ff403b56e7d80fda4d13ce\"\u003e\u003ccode\u003eaa4d558\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tensorflow/tensorflow/issues/60050\"\u003e#60050\u003c/a\u003e from tensorflow/venkat-patch-6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/bd1ab8a9ef0df2fbaefd6cfa994687c0aa1dca55\"\u003e\u003ccode\u003ebd1ab8a\u003c/code\u003e\u003c/a\u003e Update the security section in RELEASE.md\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/4905be05fd63d9943dec222ee83dcc6f522b671b\"\u003e\u003ccode\u003e4905be0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tensorflow/tensorflow/issues/60049\"\u003e#60049\u003c/a\u003e from tensorflow/venkat-patch-5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/9f96caad340d0f4bdb10a1addd61fe8a40fa6fdb\"\u003e\u003ccode\u003e9f96caa\u003c/code\u003e\u003c/a\u003e Update setup.py on TF release branch with released version of Estimator and k...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/e719b6b83b60fb03ff06c5397686888834fc5296\"\u003e\u003ccode\u003ee719b6b\u003c/code\u003e\u003c/a\u003e Update Relese.md (\u003ca href=\"https://redirect.github.com/tensorflow/tensorflow/issues/60033\"\u003e#60033\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/64a9d548b520659a9a226250dfd204e0038069bc\"\u003e\u003ccode\u003e64a9d54\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tensorflow/tensorflow/issues/60017\"\u003e#60017\u003c/a\u003e from tensorflow/joefernandez-patch-2.12-release-notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/7a4ebfd7f814a1b45a9d57c880fcbf8abb111fff\"\u003e\u003ccode\u003e7a4ebfd\u003c/code\u003e\u003c/a\u003e Update RELEASE.md\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tensorflow/tensorflow/commit/e0e10a9f2e3e09656f14b7b1339d94c7b43f84e6\"\u003e\u003ccode\u003ee0e10a9\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tensorflow/tensorflow/issues/59988\"\u003e#59988\u003c/a\u003e from tensorflow-jenkins/version-numbers-2.12.0-8756\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tensorflow/tensorflow/compare/v1.15.0...v2.12.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `torch` from 1.7.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/releases\"\u003etorch's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ePyTorch 2.8.0 Release Notes\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#highlights\"\u003eHighlights\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes\"\u003eBackwards Incompatible Changes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#deprecations\"\u003eDeprecations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#new-features\"\u003eNew Features\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#improvements\"\u003eImprovements\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes\"\u003eBug fixes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#performance\"\u003ePerformance\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#documentation\"\u003eDocumentation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#developers\"\u003eDevelopers\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eHighlights\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/blob/main/RELEASE.md\"\u003etorch's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleasing PyTorch\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-compatibility-matrix\"\u003eRelease Compatibility Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-cuda-support-matrix\"\u003ePyTorch CUDA Support Matrix\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-cadence\"\u003eRelease Cadence\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#general-overview\"\u003eGeneral Overview\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#frequently-asked-questions\"\u003eFrequently Asked Questions\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-a-release-branch-preparations\"\u003eCutting a release branch preparations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-release-branches\"\u003eCutting release branches\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorchpytorch\"\u003e\u003ccode\u003epytorch/pytorch\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-ecosystem-libraries\"\u003ePyTorch ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-pytorch\"\u003eMaking release branch specific changes for PyTorch\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-ecosystem-libraries\"\u003eMaking release branch specific changes for ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#running-launch-execution-team-core-xfn-sync\"\u003eRunning Launch Execution team Core XFN sync\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#drafting-rcs-release-candidates-for-pytorch-and-domain-libraries\"\u003eDrafting RCs (https://github.com/pytorch/pytorch/blob/main/Release Candidates) for PyTorch and domain libraries\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-storage\"\u003eRelease Candidate Storage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-health-validation\"\u003eRelease Candidate health validation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-fixes\"\u003eCherry Picking Fixes\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#how-to-do-cherry-picking\"\u003eHow to do Cherry Picking\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-reverts\"\u003eCherry Picking Reverts\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#preparing-and-creating-final-release-candidate\"\u003ePreparing and Creating Final Release Candidate\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#promoting-rcs-to-stable\"\u003ePromoting RCs to Stable\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#additional-steps-to-prepare-for-release-day\"\u003eAdditional Steps to prepare for release day\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#modify-release-matrix\"\u003eModify release matrix\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#open-google-colab-issue\"\u003eOpen Google Colab issue\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-releases\"\u003ePatch Releases\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-criteria\"\u003ePatch Release Criteria\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process\"\u003ePatch Release Process\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process-description\"\u003ePatch Release Process Description\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triage\"\u003eTriage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#issue-tracker-for-patch-releases\"\u003eIssue Tracker for Patch releases\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-a-release-schedule--cherry-picking\"\u003eBuilding a release schedule / cherry picking\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-binaries--promotion-to-stable\"\u003eBuilding Binaries / Promotion to Stable\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#hardware--software-support-in-binary-build-matrix\"\u003eHardware / Software Support in Binary Build Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#python\"\u003ePython\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#accelerator-software\"\u003eAccelerator Software\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-support-cases\"\u003eSpecial support cases\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#operating-systems\"\u003eOperating Systems\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#submitting-tutorials\"\u003eSubmitting Tutorials\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-topics\"\u003eSpecial Topics\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#updating-submodules-for-a-release\"\u003eUpdating submodules for a release\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triton-dependency-for-the-release\"\u003eTriton dependency for the release\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003eRelease Compatibility Matrix\u003c/h2\u003e\n\u003cp\u003eFollowing is the Release Compatibility Matrix for PyTorch releases:\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/ba56102387ef21a3b04b357e5b183d48f0afefc7\"\u003e\u003ccode\u003eba56102\u003c/code\u003e\u003c/a\u003e Cherrypick: Add the RunLLM widget to the website (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/159592\"\u003e#159592\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c525a02c89217181b5731d8043c7309a84e84066\"\u003e\u003ccode\u003ec525a02\u003c/code\u003e\u003c/a\u003e [dynamo, docs] cherry pick torch.compile programming model docs into 2.8 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/15\"\u003e#15\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a1cb3cc05d46d198467bebbb6e8fba50a325d4e7\"\u003e\u003ccode\u003ea1cb3cc\u003c/code\u003e\u003c/a\u003e [Release Only] Remove nvshmem from list of preload libraries (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158925\"\u003e#158925\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c76b2356bc31654de2af0c98cce1bef291f06f89\"\u003e\u003ccode\u003ec76b235\u003c/code\u003e\u003c/a\u003e Move out super large one off foreach_copy test (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158880\"\u003e#158880\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/20a0e225a01d4ebbffd44a6a59acff628359c772\"\u003e\u003ccode\u003e20a0e22\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;[Dynamo] Allow inlining into AO quantization modules (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/152934\"\u003e#152934\u003c/a\u003e)\u0026quot; (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158\"\u003e#158\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/9167ac8c75481e2beb3746aa37b7f48a213c631e\"\u003e\u003ccode\u003e9167ac8\u003c/code\u003e\u003c/a\u003e [MPS] Switch Cholesky  decomp to column wise (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158237\"\u003e#158237\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/5534685c62399db8d1e51b47e2dcbc17deaab230\"\u003e\u003ccode\u003e5534685\u003c/code\u003e\u003c/a\u003e [MPS] Reimplement \u003ccode\u003etri[ul]\u003c/code\u003e as Metal shaders (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158867\"\u003e#158867\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/d19e08d74b2a27e661bf57a9015014b757e8ea31\"\u003e\u003ccode\u003ed19e08d\u003c/code\u003e\u003c/a\u003e Cherry pick PR 158746 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158801\"\u003e#158801\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a6c044ab9aa14f0864c6a572f7c023432511c5ea\"\u003e\u003ccode\u003ea6c044a\u003c/code\u003e\u003c/a\u003e [cherry-pick] Unify torch.tensor and torch.ops.aten.scalar_tensor behavior (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/620ebd0646252bbb22524f5c252ec7e9ab977bee\"\u003e\u003ccode\u003e620ebd0\u003c/code\u003e\u003c/a\u003e [Dynamo] Use proper sources for constructing dataclass defaults (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158689\"\u003e#158689\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pytorch/pytorch/compare/v1.2.0...v2.8.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `scikit-learn` from 0.23.2 to 1.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/scikit-learn/scikit-learn/releases\"\u003escikit-learn's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eScikit-learn 1.5.0\u003c/h2\u003e\n\u003cp\u003eWe're happy to announce the 1.5.0 release.\u003c/p\u003e\n\u003cp\u003eYou can read the release highlights under \u003ca href=\"https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_5_0.html\"\u003ehttps://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_5_0.html\u003c/a\u003e and the long version of the change log under \u003ca href=\"https://scikit-learn.org/stable/whats_new/v1.5.html\"\u003ehttps://scikit-learn.org/stable/whats_new/v1.5.html\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThis version supports Python versions 3.9 to 3.12.\u003c/p\u003e\n\u003cp\u003eYou can upgrade with pip as usual:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003epip install -U scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThe conda-forge builds can be installed using:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003econda install -c conda-forge scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003ch2\u003eScikit-learn 1.4.2\u003c/h2\u003e\n\u003cp\u003eWe're happy to announce the 1.4.2 release.\u003c/p\u003e\n\u003cp\u003eThis release only includes support for numpy 2.\u003c/p\u003e\n\u003cp\u003eThis version supports Python versions 3.9 to 3.12.\u003c/p\u003e\n\u003cp\u003eYou can upgrade with pip as usual:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003epip install -U scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003ch2\u003eScikit-learn 1.4.1.post1\u003c/h2\u003e\n\u003cp\u003eWe're happy to announce the 1.4.1.post1 release.\u003c/p\u003e\n\u003cp\u003eYou can see the changelog here: \u003ca href=\"https://scikit-learn.org/stable/whats_new/v1.4.html#version-1-4-1-post1\"\u003ehttps://scikit-learn.org/stable/whats_new/v1.4.html#version-1-4-1-post1\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThis version supports Python versions 3.9 to 3.12.\u003c/p\u003e\n\u003cp\u003eYou can upgrade with pip as usual:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003epip install -U scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThe conda-forge builds can be installed using:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003econda install -c conda-forge scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/b51d0c9648241d1fd53dc9151689f62a61633a3d\"\u003e\u003ccode\u003eb51d0c9\u003c/code\u003e\u003c/a\u003e trigger whell builder [cd build]\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/919ae9bf72554a180baa3d8f4537b49c730b7580\"\u003e\u003ccode\u003e919ae9b\u003c/code\u003e\u003c/a\u003e MAINT Reoder what's new for 1.5 (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/29039\"\u003e#29039\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/0ac28ade871ca71a89a71c834a7b47829b075829\"\u003e\u003ccode\u003e0ac28ad\u003c/code\u003e\u003c/a\u003e DOC Release highlights 1.5 (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/29007\"\u003e#29007\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/729b54d5af208432f788ae7945842f0cf597bd36\"\u003e\u003ccode\u003e729b54d\u003c/code\u003e\u003c/a\u003e test py3.12 against numpy 2 [cd build]\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/1e50434f18275bb8727c2a2e24cb953db143d8a5\"\u003e\u003ccode\u003e1e50434\u003c/code\u003e\u003c/a\u003e set version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/ffbe4ab45bd9a113737231721fa2f55a70f3d0ab\"\u003e\u003ccode\u003effbe4ab\u003c/code\u003e\u003c/a\u003e DOC remove obsolete SVM example (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/27108\"\u003e#27108\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/4647729e5ee8c46e4fedace2d3c50c37f0a6693d\"\u003e\u003ccode\u003e4647729\u003c/code\u003e\u003c/a\u003e DOC Fix time complexity of MLP (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/28592\"\u003e#28592\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/9bd7047b4a6c673bcfd2911997f124e265f8ad57\"\u003e\u003ccode\u003e9bd7047\u003c/code\u003e\u003c/a\u003e FIX convergence criterion of MeanShift (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/28951\"\u003e#28951\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/b79420f1c2e82d814dec8026e96421751bfc9c96\"\u003e\u003ccode\u003eb79420f\u003c/code\u003e\u003c/a\u003e FIX add long long for int32/int64 windows compat in NumPy 2.0 (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/29029\"\u003e#29029\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/37f544db78503ed1a50da02cbb4f1a4e466fb0a7\"\u003e\u003ccode\u003e37f544d\u003c/code\u003e\u003c/a\u003e DOC replace pandas with Polars in examples/gaussian_process/plot_gpr_co2.py (...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/scikit-learn/scikit-learn/compare/0.23.2...1.5.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `torch` from 1.7.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/releases\"\u003etorch's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ePyTorch 2.8.0 Release Notes\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#highlights\"\u003eHighlights\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes\"\u003eBackwards Incompatible Changes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#deprecations\"\u003eDeprecations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#new-features\"\u003eNew Features\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#improvements\"\u003eImprovements\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes\"\u003eBug fixes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#performance\"\u003ePerformance\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#documentation\"\u003eDocumentation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#developers\"\u003eDevelopers\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eHighlights\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/blob/main/RELEASE.md\"\u003etorch's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleasing PyTorch\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-compatibility-matrix\"\u003eRelease Compatibility Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-cuda-support-matrix\"\u003ePyTorch CUDA Support Matrix\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-cadence\"\u003eRelease Cadence\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#general-overview\"\u003eGeneral Overview\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#frequently-asked-questions\"\u003eFrequently Asked Questions\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-a-release-branch-preparations\"\u003eCutting a release branch preparations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-release-branches\"\u003eCutting release branches\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorchpytorch\"\u003e\u003ccode\u003epytorch/pytorch\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-ecosystem-libraries\"\u003ePyTorch ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-pytorch\"\u003eMaking release branch specific changes for PyTorch\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-ecosystem-libraries\"\u003eMaking release branch specific changes for ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#running-launch-execution-team-core-xfn-sync\"\u003eRunning Launch Execution team Core XFN sync\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#drafting-rcs-release-candidates-for-pytorch-and-domain-libraries\"\u003eDrafting RCs (https://github.com/pytorch/pytorch/blob/main/Release Candidates) for PyTorch and domain libraries\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-storage\"\u003eRelease Candidate Storage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-health-validation\"\u003eRelease Candidate health validation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-fixes\"\u003eCherry Picking Fixes\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#how-to-do-cherry-picking\"\u003eHow to do Cherry Picking\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-reverts\"\u003eCherry Picking Reverts\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#preparing-and-creating-final-release-candidate\"\u003ePreparing and Creating Final Release Candidate\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#promoting-rcs-to-stable\"\u003ePromoting RCs to Stable\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#additional-steps-to-prepare-for-release-day\"\u003eAdditional Steps to prepare for release day\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#modify-release-matrix\"\u003eModify release matrix\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#open-google-colab-issue\"\u003eOpen Google Colab issue\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-releases\"\u003ePatch Releases\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-criteria\"\u003ePatch Release Criteria\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process\"\u003ePatch Release Process\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process-description\"\u003ePatch Release Process Description\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triage\"\u003eTriage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#issue-tracker-for-patch-releases\"\u003eIssue Tracker for Patch releases\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-a-release-schedule--cherry-picking\"\u003eBuilding a release schedule / cherry picking\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-binaries--promotion-to-stable\"\u003eBuilding Binaries / Promotion to Stable\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#hardware--software-support-in-binary-build-matrix\"\u003eHardware / Software Support in Binary Build Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#python\"\u003ePython\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#accelerator-software\"\u003eAccelerator Software\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-support-cases\"\u003eSpecial support cases\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#operating-systems\"\u003eOperating Systems\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#submitting-tutorials\"\u003eSubmitting Tutorials\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-topics\"\u003eSpecial Topics\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#updating-submodules-for-a-release\"\u003eUpdating submodules for a release\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triton-dependency-for-the-release\"\u003eTriton dependency for the release\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003eRelease Compatibility Matrix\u003c/h2\u003e\n\u003cp\u003eFollowing is the Release Compatibility Matrix for PyTorch releases:\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/ba56102387ef21a3b04b357e5b183d48f0afefc7\"\u003e\u003ccode\u003eba56102\u003c/code\u003e\u003c/a\u003e Cherrypick: Add the RunLLM widget to the website (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/159592\"\u003e#159592\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c525a02c89217181b5731d8043c7309a84e84066\"\u003e\u003ccode\u003ec525a02\u003c/code\u003e\u003c/a\u003e [dynamo, docs] cherry pick torch.compile programming model docs into 2.8 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/15\"\u003e#15\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a1cb3cc05d46d198467bebbb6e8fba50a325d4e7\"\u003e\u003ccode\u003ea1cb3cc\u003c/code\u003e\u003c/a\u003e [Release Only] Remove nvshmem from list of preload libraries (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158925\"\u003e#158925\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c76b2356bc31654de2af0c98cce1bef291f06f89\"\u003e\u003ccode\u003ec76b235\u003c/code\u003e\u003c/a\u003e Move out super large one off foreach_copy test (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158880\"\u003e#158880\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/20a0e225a01d4ebbffd44a6a59acff628359c772\"\u003e\u003ccode\u003e20a0e22\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;[Dynamo] Allow inlining into AO quantization modules (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/152934\"\u003e#152934\u003c/a\u003e)\u0026quot; (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158\"\u003e#158\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/9167ac8c75481e2beb3746aa37b7f48a213c631e\"\u003e\u003ccode\u003e9167ac8\u003c/code\u003e\u003c/a\u003e [MPS] Switch Cholesky  decomp to column wise (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158237\"\u003e#158237\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/5534685c62399db8d1e51b47e2dcbc17deaab230\"\u003e\u003ccode\u003e5534685\u003c/code\u003e\u003c/a\u003e [MPS] Reimplement \u003ccode\u003etri[ul]\u003c/code\u003e as Metal shaders (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158867\"\u003e#158867\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/d19e08d74b2a27e661bf57a9015014b757e8ea31\"\u003e\u003ccode\u003ed19e08d\u003c/code\u003e\u003c/a\u003e Cherry pick PR 158746 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158801\"\u003e#158801\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a6c044ab9aa14f0864c6a572f7c023432511c5ea\"\u003e\u003ccode\u003ea6c044a\u003c/code\u003e\u003c/a\u003e [cherry-pick] Unify torch.tensor and torch.ops.aten.scalar_tensor behavior (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/620ebd0646252bbb22524f5c252ec7e9ab977bee\"\u003e\u003ccode\u003e620ebd0\u003c/code\u003e\u003c/a\u003e [Dynamo] Use proper sources for constructing dataclass defaults (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158689\"\u003e#158689\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pytorch/pytorch/compare/v1.2.0...v2.8.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `scikit-learn` from 0.23.2 to 1.5.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/scikit-learn/scikit-learn/releases\"\u003escikit-learn's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eScikit-learn 1.5.0\u003c/h2\u003e\n\u003cp\u003eWe're happy to announce the 1.5.0 release.\u003c/p\u003e\n\u003cp\u003eYou can read the release highlights under \u003ca href=\"https://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_5_0.html\"\u003ehttps://scikit-learn.org/stable/auto_examples/release_highlights/plot_release_highlights_1_5_0.html\u003c/a\u003e and the long version of the change log under \u003ca href=\"https://scikit-learn.org/stable/whats_new/v1.5.html\"\u003ehttps://scikit-learn.org/stable/whats_new/v1.5.html\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThis version supports Python versions 3.9 to 3.12.\u003c/p\u003e\n\u003cp\u003eYou can upgrade with pip as usual:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003epip install -U scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThe conda-forge builds can be installed using:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003econda install -c conda-forge scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003ch2\u003eScikit-learn 1.4.2\u003c/h2\u003e\n\u003cp\u003eWe're happy to announce the 1.4.2 release.\u003c/p\u003e\n\u003cp\u003eThis release only includes support for numpy 2.\u003c/p\u003e\n\u003cp\u003eThis version supports Python versions 3.9 to 3.12.\u003c/p\u003e\n\u003cp\u003eYou can upgrade with pip as usual:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003epip install -U scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003ch2\u003eScikit-learn 1.4.1.post1\u003c/h2\u003e\n\u003cp\u003eWe're happy to announce the 1.4.1.post1 release.\u003c/p\u003e\n\u003cp\u003eYou can see the changelog here: \u003ca href=\"https://scikit-learn.org/stable/whats_new/v1.4.html#version-1-4-1-post1\"\u003ehttps://scikit-learn.org/stable/whats_new/v1.4.html#version-1-4-1-post1\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eThis version supports Python versions 3.9 to 3.12.\u003c/p\u003e\n\u003cp\u003eYou can upgrade with pip as usual:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003epip install -U scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eThe conda-forge builds can be installed using:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003econda install -c conda-forge scikit-learn\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/b51d0c9648241d1fd53dc9151689f62a61633a3d\"\u003e\u003ccode\u003eb51d0c9\u003c/code\u003e\u003c/a\u003e trigger whell builder [cd build]\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/919ae9bf72554a180baa3d8f4537b49c730b7580\"\u003e\u003ccode\u003e919ae9b\u003c/code\u003e\u003c/a\u003e MAINT Reoder what's new for 1.5 (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/29039\"\u003e#29039\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/0ac28ade871ca71a89a71c834a7b47829b075829\"\u003e\u003ccode\u003e0ac28ad\u003c/code\u003e\u003c/a\u003e DOC Release highlights 1.5 (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/29007\"\u003e#29007\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/729b54d5af208432f788ae7945842f0cf597bd36\"\u003e\u003ccode\u003e729b54d\u003c/code\u003e\u003c/a\u003e test py3.12 against numpy 2 [cd build]\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/1e50434f18275bb8727c2a2e24cb953db143d8a5\"\u003e\u003ccode\u003e1e50434\u003c/code\u003e\u003c/a\u003e set version\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/ffbe4ab45bd9a113737231721fa2f55a70f3d0ab\"\u003e\u003ccode\u003effbe4ab\u003c/code\u003e\u003c/a\u003e DOC remove obsolete SVM example (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/27108\"\u003e#27108\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/4647729e5ee8c46e4fedace2d3c50c37f0a6693d\"\u003e\u003ccode\u003e4647729\u003c/code\u003e\u003c/a\u003e DOC Fix time complexity of MLP (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/28592\"\u003e#28592\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/9bd7047b4a6c673bcfd2911997f124e265f8ad57\"\u003e\u003ccode\u003e9bd7047\u003c/code\u003e\u003c/a\u003e FIX convergence criterion of MeanShift (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/28951\"\u003e#28951\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/b79420f1c2e82d814dec8026e96421751bfc9c96\"\u003e\u003ccode\u003eb79420f\u003c/code\u003e\u003c/a\u003e FIX add long long for int32/int64 windows compat in NumPy 2.0 (\u003ca href=\"https://redirect.github.com/scikit-learn/scikit-learn/issues/29029\"\u003e#29029\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/scikit-learn/scikit-learn/commit/37f544db78503ed1a50da02cbb4f1a4e466fb0a7\"\u003e\u003ccode\u003e37f544d\u003c/code\u003e\u003c/a\u003e DOC replace pandas with Polars in examples/gaussian_process/plot_gpr_co2.py (...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/scikit-learn/scikit-learn/compare/0.23.2...1.5.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `torch` from 1.2.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/releases\"\u003etorch's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ePyTorch 2.8.0 Release Notes\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#highlights\"\u003eHighlights\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes\"\u003eBackwards Incompatible Changes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#deprecations\"\u003eDeprecations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#new-features\"\u003eNew Features\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#improvements\"\u003eImprovements\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes\"\u003eBug fixes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#performance\"\u003ePerformance\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#documentation\"\u003eDocumentation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#developers\"\u003eDevelopers\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eHighlights\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/blob/main/RELEASE.md\"\u003etorch's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleasing PyTorch\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-compatibility-matrix\"\u003eRelease Compatibility Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-cuda-support-matrix\"\u003ePyTorch CUDA Support Matrix\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-cadence\"\u003eRelease Cadence\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#general-overview\"\u003eGeneral Overview\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#frequently-asked-questions\"\u003eFrequently Asked Questions\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-a-release-branch-preparations\"\u003eCutting a release branch preparations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-release-branches\"\u003eCutting release branches\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorchpytorch\"\u003e\u003ccode\u003epytorch/pytorch\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-ecosystem-libraries\"\u003ePyTorch ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-pytorch\"\u003eMaking release branch specific changes for PyTorch\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-ecosystem-libraries\"\u003eMaking release branch specific changes for ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#running-launch-execution-team-core-xfn-sync\"\u003eRunning Launch Execution team Core XFN sync\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#drafting-rcs-release-candidates-for-pytorch-and-domain-libraries\"\u003eDrafting RCs (https://github.com/pytorch/pytorch/blob/main/Release Candidates) for PyTorch and domain libraries\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-storage\"\u003eRelease Candidate Storage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-health-validation\"\u003eRelease Candidate health validation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-fixes\"\u003eCherry Picking Fixes\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#how-to-do-cherry-picking\"\u003eHow to do Cherry Picking\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-reverts\"\u003eCherry Picking Reverts\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#preparing-and-creating-final-release-candidate\"\u003ePreparing and Creating Final Release Candidate\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#promoting-rcs-to-stable\"\u003ePromoting RCs to Stable\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#additional-steps-to-prepare-for-release-day\"\u003eAdditional Steps to prepare for release day\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#modify-release-matrix\"\u003eModify release matrix\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#open-google-colab-issue\"\u003eOpen Google Colab issue\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-releases\"\u003ePatch Releases\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-criteria\"\u003ePatch Release Criteria\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process\"\u003ePatch Release Process\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#patch-release-process-description\"\u003ePatch Release Process Description\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triage\"\u003eTriage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#issue-tracker-for-patch-releases\"\u003eIssue Tracker for Patch releases\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-a-release-schedule--cherry-picking\"\u003eBuilding a release schedule / cherry picking\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#building-binaries--promotion-to-stable\"\u003eBuilding Binaries / Promotion to Stable\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#hardware--software-support-in-binary-build-matrix\"\u003eHardware / Software Support in Binary Build Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#python\"\u003ePython\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#accelerator-software\"\u003eAccelerator Software\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-support-cases\"\u003eSpecial support cases\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#operating-systems\"\u003eOperating Systems\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#submitting-tutorials\"\u003eSubmitting Tutorials\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#special-topics\"\u003eSpecial Topics\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#updating-submodules-for-a-release\"\u003eUpdating submodules for a release\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#triton-dependency-for-the-release\"\u003eTriton dependency for the release\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003ch2\u003eRelease Compatibility Matrix\u003c/h2\u003e\n\u003cp\u003eFollowing is the Release Compatibility Matrix for PyTorch releases:\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/ba56102387ef21a3b04b357e5b183d48f0afefc7\"\u003e\u003ccode\u003eba56102\u003c/code\u003e\u003c/a\u003e Cherrypick: Add the RunLLM widget to the website (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/159592\"\u003e#159592\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c525a02c89217181b5731d8043c7309a84e84066\"\u003e\u003ccode\u003ec525a02\u003c/code\u003e\u003c/a\u003e [dynamo, docs] cherry pick torch.compile programming model docs into 2.8 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/15\"\u003e#15\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a1cb3cc05d46d198467bebbb6e8fba50a325d4e7\"\u003e\u003ccode\u003ea1cb3cc\u003c/code\u003e\u003c/a\u003e [Release Only] Remove nvshmem from list of preload libraries (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158925\"\u003e#158925\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/c76b2356bc31654de2af0c98cce1bef291f06f89\"\u003e\u003ccode\u003ec76b235\u003c/code\u003e\u003c/a\u003e Move out super large one off foreach_copy test (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158880\"\u003e#158880\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/20a0e225a01d4ebbffd44a6a59acff628359c772\"\u003e\u003ccode\u003e20a0e22\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;[Dynamo] Allow inlining into AO quantization modules (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/152934\"\u003e#152934\u003c/a\u003e)\u0026quot; (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158\"\u003e#158\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/9167ac8c75481e2beb3746aa37b7f48a213c631e\"\u003e\u003ccode\u003e9167ac8\u003c/code\u003e\u003c/a\u003e [MPS] Switch Cholesky  decomp to column wise (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158237\"\u003e#158237\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/5534685c62399db8d1e51b47e2dcbc17deaab230\"\u003e\u003ccode\u003e5534685\u003c/code\u003e\u003c/a\u003e [MPS] Reimplement \u003ccode\u003etri[ul]\u003c/code\u003e as Metal shaders (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158867\"\u003e#158867\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/d19e08d74b2a27e661bf57a9015014b757e8ea31\"\u003e\u003ccode\u003ed19e08d\u003c/code\u003e\u003c/a\u003e Cherry pick PR 158746 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158801\"\u003e#158801\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/a6c044ab9aa14f0864c6a572f7c023432511c5ea\"\u003e\u003ccode\u003ea6c044a\u003c/code\u003e\u003c/a\u003e [cherry-pick] Unify torch.tensor and torch.ops.aten.scalar_tensor behavior (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/620ebd0646252bbb22524f5c252ec7e9ab977bee\"\u003e\u003ccode\u003e620ebd0\u003c/code\u003e\u003c/a\u003e [Dynamo] Use proper sources for constructing dataclass defaults (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/158689\"\u003e#158689\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pytorch/pytorch/compare/v1.2.0...v2.8.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `torch` from 1.10.0 to 2.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/releases\"\u003etorch's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ePyTorch 2.8.0 Release Notes\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#highlights\"\u003eHighlights\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes\"\u003eBackwards Incompatible Changes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#deprecations\"\u003eDeprecations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#new-features\"\u003eNew Features\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#improvements\"\u003eImprovements\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes\"\u003eBug fixes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#performance\"\u003ePerformance\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#documentation\"\u003eDocumentation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#developers\"\u003eDevelopers\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eHighlights\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/blob/main/RELEASE.md\"\u003etorch's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eReleasing PyTorch\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-compatibility-matrix\"\u003eRelease Compatibility Matrix\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-cuda-support-matrix\"\u003ePyTorch CUDA Support Matrix\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-cadence\"\u003eRelease Cadence\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#general-overview\"\u003eGeneral Overview\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#frequently-asked-questions\"\u003eFrequently Asked Questions\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-a-release-branch-preparations\"\u003eCutting a release branch preparations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cutting-release-branches\"\u003eCutting release branches\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorchpytorch\"\u003e\u003ccode\u003epytorch/pytorch\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#pytorch-ecosystem-libraries\"\u003ePyTorch ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-pytorch\"\u003eMaking release branch specific changes for PyTorch\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#making-release-branch-specific-changes-for-ecosystem-libraries\"\u003eMaking release branch specific changes for ecosystem libraries\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#running-launch-execution-team-core-xfn-sync\"\u003eRunning Launch Execution team Core XFN sync\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"#drafting-rcs-release-candidates-for-pytorch-and-domain-libraries\"\u003eDrafting RCs (https://github.com/pytorch/pytorch/blob/main/Release Candidates) for PyTorch and domain libraries\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-storage\"\u003eRelease Candidate Storage\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#release-candidate-health-validation\"\u003eRelease Candidate health validation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-fixes\"\u003eCherry Picking Fixes\u003c/a\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#how-to-do-cherry-picking\"\u003eHow to do Cherry Picking\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/main/#cherry-picking-reverts\"\u003eCherry Picking Reverts\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n...\n\n_Description has been truncated_","html_url":"https://github.com/dsplab75/qlib/pull/2","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/dsplab75%2Fqlib/issues/2","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2/packages"}},{"old_version":"5.3.1","new_version":"6.1.0","update_type":"major","path":"/workshops/rag/solution","pr_created_at":"2026-06-08T15:54:59.000Z","version_change":"5.3.1 → 6.1.0","issue":{"uuid":"4614401471","node_id":"PR_kwDOOdzCTc7j-u8W","number":3,"state":"closed","title":"chore(deps): bump lxml from 5.3.1 to 6.1.0 in /workshops/rag/solution","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-06-10T01:38:08.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-08T15:54:59.000Z","updated_at":"2026-06-10T01:38:09.000Z","time_to_close":121389,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps)","packages":[{"name":"lxml","old_version":"5.3.1","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"}],"path":"/workshops/rag/solution","ecosystem":"pip"},"body":"Bumps [lxml](https://github.com/lxml/lxml) from 5.3.1 to 6.1.0.\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/releases\"\u003elxml's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elxml-6.1.0\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.4\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.3\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.2\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.1\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.0\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-5.4.0\u003c/h2\u003e\n\u003ch1\u003e5.4.0 (2025-04-22)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2107279: Binary wheels use libxml2 2.13.8 and libxslt 1.1.43 to resolve several CVEs.\n(Binary wheels for Windows continue to use a patched libxml2 2.11.9 and libxslt 1.1.39.)\nIssue found by Anatoly Katyushin, see \u003ca href=\"https://bugs.launchpad.net/lxml/+bug/2107279\"\u003ehttps://bugs.launchpad.net/lxml/+bug/2107279\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003elxml-5.3.2\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.3 (2026-04-09)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSeveral out of memory error cases now raise \u003ccode\u003eMemoryError\u003c/code\u003e that were not handled before.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSlicing with large step values (outside of \u003ccode\u003e+/- sys.maxsize\u003c/code\u003e) could trigger undefined C behaviour.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2125399: Some failing tests were fixed or disabled in PyPy.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2138421: Memory leak in error cases when setting the \u003ccode\u003epublic_id\u003c/code\u003e or \u003ccode\u003esystem_url\u003c/code\u003e of a document.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c7d76d6cb817c8e1f316e43b16cab5e6ad669ad0\"\u003e\u003ccode\u003ec7d76d6\u003c/code\u003e\u003c/a\u003e Change security policy to point to Github security advisories.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/378ccf82db8160928807c55ed580c0443aa94f42\"\u003e\u003ccode\u003e378ccf8\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/315270b810a9e3276c60daba549299d204ac962b\"\u003e\u003ccode\u003e315270b\u003c/code\u003e\u003c/a\u003e Docs: Reduce TOC depth of package pages and move module contents first.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6dbba7f3c72f655b05b26ef453fdee31af13ccf5\"\u003e\u003ccode\u003e6dbba7f\u003c/code\u003e\u003c/a\u003e Docs: Show current year in copyright line.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/e4385bfa5d79527350d5ef17372fb70ba80b4cce\"\u003e\u003ccode\u003ee4385bf\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5bed1e1a227cd9ba5a879aaeacdf504093a3f6e8\"\u003e\u003ccode\u003e5bed1e1\u003c/code\u003e\u003c/a\u003e Validate file hashes in release download script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c13ee10a429f1144779bb1cbf6ae3bec808ae9c1\"\u003e\u003ccode\u003ec13ee10\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.0.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-5.3.1...lxml-6.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lxml\u0026package-manager=uv\u0026previous-version=5.3.1\u0026new-version=6.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/lisaross/second-brain-ai-assistant-course/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/lisaross/second-brain-ai-assistant-course/pull/3","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/lisaross%2Fsecond-brain-ai-assistant-course/issues/3","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/3/packages"}},{"old_version":"6.0.2","new_version":"6.1.0","update_type":"minor","path":null,"pr_created_at":"2026-06-07T01:11:06.000Z","version_change":"6.0.2 → 6.1.0","issue":{"uuid":"4605702553","node_id":"PR_kwDOM8hlPc7ji2P7","number":10,"state":"closed","title":"Bump lxml from 6.0.2 to 6.1.0","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-07T01:15:29.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-07T01:11:06.000Z","updated_at":"2026-06-07T01:15:30.000Z","time_to_close":263,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"lxml","old_version":"6.0.2","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"}],"path":null,"ecosystem":"pip"},"body":"Bumps [lxml](https://github.com/lxml/lxml) from 6.0.2 to 6.1.0.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.3 (2026-04-09)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSeveral out of memory error cases now raise \u003ccode\u003eMemoryError\u003c/code\u003e that were not handled before.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSlicing with large step values (outside of \u003ccode\u003e+/- sys.maxsize\u003c/code\u003e) could trigger undefined C behaviour.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2125399: Some failing tests were fixed or disabled in PyPy.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2138421: Memory leak in error cases when setting the \u003ccode\u003epublic_id\u003c/code\u003e or \u003ccode\u003esystem_url\u003c/code\u003e of a document.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c7d76d6cb817c8e1f316e43b16cab5e6ad669ad0\"\u003e\u003ccode\u003ec7d76d6\u003c/code\u003e\u003c/a\u003e Change security policy to point to Github security advisories.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/378ccf82db8160928807c55ed580c0443aa94f42\"\u003e\u003ccode\u003e378ccf8\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/315270b810a9e3276c60daba549299d204ac962b\"\u003e\u003ccode\u003e315270b\u003c/code\u003e\u003c/a\u003e Docs: Reduce TOC depth of package pages and move module contents first.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6dbba7f3c72f655b05b26ef453fdee31af13ccf5\"\u003e\u003ccode\u003e6dbba7f\u003c/code\u003e\u003c/a\u003e Docs: Show current year in copyright line.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/e4385bfa5d79527350d5ef17372fb70ba80b4cce\"\u003e\u003ccode\u003ee4385bf\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5bed1e1a227cd9ba5a879aaeacdf504093a3f6e8\"\u003e\u003ccode\u003e5bed1e1\u003c/code\u003e\u003c/a\u003e Validate file hashes in release download script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c13ee10a429f1144779bb1cbf6ae3bec808ae9c1\"\u003e\u003ccode\u003ec13ee10\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.0.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.0.2...lxml-6.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lxml\u0026package-manager=uv\u0026previous-version=6.0.2\u0026new-version=6.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ewjoachim/writober/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/ewjoachim/writober/pull/10","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/ewjoachim%2Fwritober/issues/10","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/10/packages"}},{"old_version":"5.3.0","new_version":"6.1.0","update_type":"major","path":null,"pr_created_at":"2026-06-04T15:32:38.000Z","version_change":"5.3.0 → 6.1.0","issue":{"uuid":"4589995774","node_id":"PR_kwDOONC7l87ivg_q","number":8,"state":"closed","title":"Bump the uv group across 4 directories with 9 updates","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-17T02:39:43.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-04T15:32:38.000Z","updated_at":"2026-06-17T02:39:45.000Z","time_to_close":1076825,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","group_name":"uv","update_count":9,"packages":[{"name":"mcp","old_version":"1.2.0","new_version":"1.23.0","repository_url":"https://github.com/modelcontextprotocol/python-sdk"},{"name":"requests","old_version":"2.32.3","new_version":"2.33.0","repository_url":"https://github.com/psf/requests"},{"name":"h11","old_version":"0.14.0","new_version":"0.16.0","repository_url":"https://github.com/python-hyper/h11"},{"name":"idna","old_version":"3.10","new_version":"3.15","repository_url":"https://github.com/kjd/idna"},{"name":"lxml","old_version":"5.3.0","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"},{"name":"python-dotenv","old_version":"1.0.1","new_version":"1.2.2","repository_url":"https://github.com/theskumar/python-dotenv"},{"name":"starlette","old_version":"0.41.2","new_version":"1.0.1","repository_url":"https://github.com/Kludex/starlette"},{"name":"urllib3","old_version":"2.2.3","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"}],"path":null,"ecosystem":"pip"},"body":"Bumps the uv group with 8 updates in the /src/fetch directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.2.0` | `1.23.0` |\n| [requests](https://github.com/psf/requests) | `2.32.3` | `2.33.0` |\n| [h11](https://github.com/python-hyper/h11) | `0.14.0` | `0.16.0` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.0.1` | `1.2.2` |\n| [starlette](https://github.com/Kludex/starlette) | `0.41.2` | `1.0.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.2.3` | `2.7.0` |\n\nBumps the uv group with 5 updates in the /src/sentry directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.0.0` | `1.23.0` |\n| [h11](https://github.com/python-hyper/h11) | `0.14.0` | `0.16.0` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [starlette](https://github.com/Kludex/starlette) | `0.41.3` | `1.0.1` |\n| [pytest](https://github.com/pytest-dev/pytest) | `8.3.3` | `9.0.3` |\n\nBumps the uv group with 4 updates in the /src/sqlite directory: [mcp](https://github.com/modelcontextprotocol/python-sdk), [h11](https://github.com/python-hyper/h11), [idna](https://github.com/kjd/idna) and [starlette](https://github.com/Kludex/starlette).\nBumps the uv group with 5 updates in the /src/time directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [mcp](https://github.com/modelcontextprotocol/python-sdk) | `1.0.0` | `1.23.0` |\n| [h11](https://github.com/python-hyper/h11) | `0.14.0` | `0.16.0` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [starlette](https://github.com/Kludex/starlette) | `0.41.3` | `1.0.1` |\n| [pytest](https://github.com/pytest-dev/pytest) | `8.3.3` | `9.0.3` |\n\n\nUpdates `mcp` from 1.2.0 to 1.23.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/releases\"\u003emcp's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.23.0\u003c/h2\u003e\n\u003ch2\u003eSummary\u003c/h2\u003e\n\u003cp\u003eThis release brings us up to speed with the latest MCP spec \u003ccode\u003e2025-11-25\u003c/code\u003e. Take a look at the \u003ca href=\"https://modelcontextprotocol.io/specification/2025-11-25\"\u003elatest spec\u003c/a\u003e as well as the release \u003ca href=\"https://blog.modelcontextprotocol.io/posts/2025-11-25-first-mcp-anniversary/\"\u003eblog post.\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd tests for JSON Schema 2020-12 field preservation (SEP-1613) by \u003ca href=\"https://github.com/felixweinberger\"\u003e\u003ccode\u003e@​felixweinberger\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1649\"\u003emodelcontextprotocol/python-sdk#1649\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd client_secret_basic authentication support by \u003ca href=\"https://github.com/jonshea\"\u003e\u003ccode\u003e@​jonshea\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1334\"\u003emodelcontextprotocol/python-sdk#1334\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImplement SEP-1577 - Sampling With Tools by \u003ca href=\"https://github.com/ochafik\"\u003e\u003ccode\u003e@​ochafik\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1594\"\u003emodelcontextprotocol/python-sdk#1594\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSEP-1330: Elicitation Enum Schema Improvements and Standards Compliance by \u003ca href=\"https://github.com/chughtapan\"\u003e\u003ccode\u003e@​chughtapan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1246\"\u003emodelcontextprotocol/python-sdk#1246\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e[auth][conformance] add conformance auth client by \u003ca href=\"https://github.com/pcarleton\"\u003e\u003ccode\u003e@​pcarleton\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1640\"\u003emodelcontextprotocol/python-sdk#1640\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImplement SEP-986: Tool name validation by \u003ca href=\"https://github.com/felixweinberger\"\u003e\u003ccode\u003e@​felixweinberger\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1655\"\u003emodelcontextprotocol/python-sdk#1655\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: url for spec by \u003ca href=\"https://github.com/felixweinberger\"\u003e\u003ccode\u003e@​felixweinberger\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1659\"\u003emodelcontextprotocol/python-sdk#1659\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: implement SEP-991 URL-based client ID (CIMD) support by \u003ca href=\"https://github.com/pcarleton\"\u003e\u003ccode\u003e@​pcarleton\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1652\"\u003emodelcontextprotocol/python-sdk#1652\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUpdate doc string on custom_route by \u003ca href=\"https://github.com/pcarleton\"\u003e\u003ccode\u003e@​pcarleton\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1660\"\u003emodelcontextprotocol/python-sdk#1660\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImplement SEP-1036: URL mode elicitation for secure out-of-band interactions by \u003ca href=\"https://github.com/cbcoutinho\"\u003e\u003ccode\u003e@​cbcoutinho\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1580\"\u003emodelcontextprotocol/python-sdk#1580\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSkip empty SSE data to avoid parsing errors by \u003ca href=\"https://github.com/felixweinberger\"\u003e\u003ccode\u003e@​felixweinberger\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1670\"\u003emodelcontextprotocol/python-sdk#1670\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSEP-1686: Tasks by \u003ca href=\"https://github.com/maxisbey\"\u003e\u003ccode\u003e@​maxisbey\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1645\"\u003emodelcontextprotocol/python-sdk#1645\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd on_session_created callback option by \u003ca href=\"https://github.com/crondinini-ant\"\u003e\u003ccode\u003e@​crondinini-ant\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1710\"\u003emodelcontextprotocol/python-sdk#1710\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd SSE polling support (SEP-1699) by \u003ca href=\"https://github.com/felixweinberger\"\u003e\u003ccode\u003e@​felixweinberger\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1654\"\u003emodelcontextprotocol/python-sdk#1654\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport client_credentials flow with JWT and Basic auth by \u003ca href=\"https://github.com/pcarleton\"\u003e\u003ccode\u003e@​pcarleton\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1663\"\u003emodelcontextprotocol/python-sdk#1663\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: backwards-compatible create_message overloads for SEP-1577 by \u003ca href=\"https://github.com/felixweinberger\"\u003e\u003ccode\u003e@​felixweinberger\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1713\"\u003emodelcontextprotocol/python-sdk#1713\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAuto-enable DNS rebinding protection for localhost servers by \u003ca href=\"https://github.com/pcarleton\"\u003e\u003ccode\u003e@​pcarleton\u003c/code\u003e\u003c/a\u003e  (d3a184119e4479ea6a63590bc41f01dc06e3fa99)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ochafik\"\u003e\u003ccode\u003e@​ochafik\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1594\"\u003emodelcontextprotocol/python-sdk#1594\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/compare/v1.22.0...v1.23.0\"\u003ehttps://github.com/modelcontextprotocol/python-sdk/compare/v1.22.0...v1.23.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.22.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat: Pass through and expose additional parameters in \u003ccode\u003eClientSessionGroup.call_tool\u003c/code\u003e and \u003ccode\u003e.connect_to_server\u003c/code\u003e by \u003ca href=\"https://github.com/inaku-Gyan\"\u003e\u003ccode\u003e@​inaku-Gyan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1576\"\u003emodelcontextprotocol/python-sdk#1576\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: Lazy import \u003ccode\u003ejsonschema\u003c/code\u003e library by \u003ca href=\"https://github.com/wuliang229\"\u003e\u003ccode\u003e@​wuliang229\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1596\"\u003emodelcontextprotocol/python-sdk#1596\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: Update examples to use stateless HTTP with JSON responses by \u003ca href=\"https://github.com/domdomegg\"\u003e\u003ccode\u003e@​domdomegg\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1499\"\u003emodelcontextprotocol/python-sdk#1499\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/wuliang229\"\u003e\u003ccode\u003e@​wuliang229\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1596\"\u003emodelcontextprotocol/python-sdk#1596\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/compare/v1.21.1...v1.22.0\"\u003ehttps://github.com/modelcontextprotocol/python-sdk/compare/v1.21.1...v1.22.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.21.2\u003c/h2\u003e\n\u003ch2\u003eHotfix Release\u003c/h2\u003e\n\u003cp\u003eThis is a hotfix release to address a critical bug in OAuth scope handling that caused failures on 401 responses.\u003c/p\u003e\n\u003ch3\u003eRelated:\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1630\"\u003emodelcontextprotocol/python-sdk#1630\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/pull/1632\"\u003emodelcontextprotocol/python-sdk#1632\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/d3a184119e4479ea6a63590bc41f01dc06e3fa99\"\u003e\u003ccode\u003ed3a1841\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/fa851d93a2036a37cce73e098f7dbc80a6c48765\"\u003e\u003ccode\u003efa851d9\u003c/code\u003e\u003c/a\u003e feat: backwards-compatible create_message overloads for SEP-1577 (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1713\"\u003e#1713\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/f82b0c937178815c1e96460455778578050c6d1a\"\u003e\u003ccode\u003ef82b0c9\u003c/code\u003e\u003c/a\u003e Support client_credentials flow with JWT and Basic auth (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1663\"\u003e#1663\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/281fd4765e0fc2efaf2039d248c3bc0698416a8a\"\u003e\u003ccode\u003e281fd47\u003c/code\u003e\u003c/a\u003e Add SSE polling support (SEP-1699) (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1654\"\u003e#1654\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/2cd178a962ab454e3add228ecd721784b7b36e99\"\u003e\u003ccode\u003e2cd178a\u003c/code\u003e\u003c/a\u003e Add on_session_created callback option (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1710\"\u003e#1710\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/c92bb2f7ffaa61813d7cc350887f4ece38307769\"\u003e\u003ccode\u003ec92bb2f\u003c/code\u003e\u003c/a\u003e SEP-1686: Tasks (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1645\"\u003e#1645\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/5983a650cc07d2dc6c6ba098e99d3545889157a9\"\u003e\u003ccode\u003e5983a65\u003c/code\u003e\u003c/a\u003e Skip empty SSE data to avoid parsing errors (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1670\"\u003e#1670\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/02b78899296ce3631565345501e3d956b83ffe94\"\u003e\u003ccode\u003e02b7889\u003c/code\u003e\u003c/a\u003e Implement SEP-1036: URL mode elicitation for secure out-of-band interactions ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/27279bc157cbc03f7fe7758fd55a4b34c5652f42\"\u003e\u003ccode\u003e27279bc\u003c/code\u003e\u003c/a\u003e Update doc string on custom_route (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1660\"\u003e#1660\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/commit/f22501315eab5b8358c603ac7f730f77bb09e4c4\"\u003e\u003ccode\u003ef225013\u003c/code\u003e\u003c/a\u003e feat: implement SEP-991 URL-based client ID (CIMD) support (\u003ca href=\"https://redirect.github.com/modelcontextprotocol/python-sdk/issues/1652\"\u003e#1652\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/compare/v1.2.0...v1.23.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.32.3 to 2.33.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/releases\"\u003erequests's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.33.0\u003c/h2\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at \u003ca href=\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e. Give it a try, and report any gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/M0d3v1\"\u003e\u003ccode\u003e@​M0d3v1\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6865\"\u003epsf/requests#6865\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/aminvakil\"\u003e\u003ccode\u003e@​aminvakil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7220\"\u003epsf/requests#7220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/E8Price\"\u003e\u003ccode\u003e@​E8Price\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6960\"\u003epsf/requests#6960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mitre88\"\u003e\u003ccode\u003e@​mitre88\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7244\"\u003epsf/requests#7244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/magsen\"\u003e\u003ccode\u003e@​magsen\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6553\"\u003epsf/requests#6553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Rohan5commit\"\u003e\u003ccode\u003e@​Rohan5commit\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7227\"\u003epsf/requests#7227\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.32.5\u003c/h2\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has created\na new class of issues in Requests that have had negative impact across a number\nof use cases. The Requests team has decided to revert this feature as long term\nmaintenance of it is proving to be unsustainable in its current iteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev2.32.4\u003c/h2\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base that\nuses Requests, please take a look at \u003ca href=\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e. Give it a try, and report\nany gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now extracts\ncontents to a non-deterministic location to prevent malicious file\nreplacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause\nmalformed authentication to be applied to Requests on\nPython 3.11+. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has created\na new class of issues in Requests that have had negative impact across a number\nof use cases. The Requests team has decided to revert this feature as long term\nmaintenance of it is proving to be unsustainable in its current iteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted\nenvironment will retrieve credentials for the wrong hostname/machine from a\nnetrc file.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761\"\u003e\u003ccode\u003ebc04dfd\u003c/code\u003e\u003c/a\u003e v2.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"\u003e\u003ccode\u003e66d21cb\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028\"\u003e\u003ccode\u003e8b9bc8f\u003c/code\u003e\u003c/a\u003e Move badges to top of README (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7293\"\u003e#7293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286\"\u003e\u003ccode\u003ee331a28\u003c/code\u003e\u003c/a\u003e Remove unused extraction call (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7292\"\u003e#7292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29\"\u003e\u003ccode\u003e753fd08\u003c/code\u003e\u003c/a\u003e docs: fix FAQ grammar in httplib2 example\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71\"\u003e\u003ccode\u003e774a0b8\u003c/code\u003e\u003c/a\u003e docs(socks): same block as other sections\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303\"\u003e\u003ccode\u003e9c72a41\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 4.33.0 to 4.34.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be\"\u003e\u003ccode\u003eebf7190\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 4.32.0 to 4.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798\"\u003e\u003ccode\u003e0e4ae38\u003c/code\u003e\u003c/a\u003e docs: exclude Response.is_permanent_redirect from API docs (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7244\"\u003e#7244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a\"\u003e\u003ccode\u003ed568f47\u003c/code\u003e\u003c/a\u003e docs: clarify Quickstart POST example (\u003ca href=\"https://redirect.github.com/psf/requests/issues/6960\"\u003e#6960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/psf/requests/compare/v2.32.3...v2.33.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `h11` from 0.14.0 to 0.16.0\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/1c5b07581f058886c8bdd87adababd7d959dc7ca\"\u003e\u003ccode\u003e1c5b075\u003c/code\u003e\u003c/a\u003e this time for surer\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/d9c369935e853a7ee1aeb7e481f6dddf9b9c9b8a\"\u003e\u003ccode\u003ed9c3699\u003c/code\u003e\u003c/a\u003e this time for sure...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/d91b9dd2290a25c8c3f5ec15feb57de5873e6e39\"\u003e\u003ccode\u003ed91b9dd\u003c/code\u003e\u003c/a\u003e blacken\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/5a4683ca466b59bbab9b19cfea20ee157b31cee0\"\u003e\u003ccode\u003e5a4683c\u003c/code\u003e\u003c/a\u003e Soothe mypy\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/9c9567f0a92d13a83a8d8ebdbc757c8c2d384536\"\u003e\u003ccode\u003e9c9567f\u003c/code\u003e\u003c/a\u003e Bump version to 0.16.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/114803a29ce50116dc47951c690ad4892b1a36ed\"\u003e\u003ccode\u003e114803a\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/9462006f6ce4941661888228cbd4ac1ea80689b0\"\u003e\u003ccode\u003e9462006\u003c/code\u003e\u003c/a\u003e Bump version to 0.15.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/70a96bea8e55403e5d92db14c111432c6d7a8685\"\u003e\u003ccode\u003e70a96be\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/python-hyper/h11/issues/181\"\u003e#181\u003c/a\u003e from Julien00859/Julien00859/get_int_max_str_digits\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/60782ad107e538b9312aac7e1c119c8358bf797c\"\u003e\u003ccode\u003e60782ad\u003c/code\u003e\u003c/a\u003e Reject Content-Length longer 1 billion TB\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-hyper/h11/commit/dff7cc397a26ed4acdedd92d1bda6c8f18a6ed9f\"\u003e\u003ccode\u003edff7cc3\u003c/code\u003e\u003c/a\u003e Validate Chunked-Encoding chunk footer\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 3.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in \u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining and\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e Release 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e Pre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from kjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e Convert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from kjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from StanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from StanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kjd/idna/compare/v3.10...v3.15\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lxml` from 5.3.0 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/releases\"\u003elxml's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elxml-6.1.0\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.4\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.3\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.2\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.1\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-6.0.0\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-5.4.0\u003c/h2\u003e\n\u003ch1\u003e5.4.0 (2025-04-22)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2107279: Binary wheels use libxml2 2.13.8 and libxslt 1.1.43 to resolve several CVEs.\n(Binary wheels for Windows continue to use a patched libxml2 2.11.9 and libxslt 1.1.39.)\nIssue found by Anatoly Katyushin, see \u003ca href=\"https://bugs.launchpad.net/lxml/+bug/2107279\"\u003ehttps://bugs.launchpad.net/lxml/+bug/2107279\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003elxml-5.3.2\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003ch2\u003elxml-5.3.1\u003c/h2\u003e\n\u003cp\u003eNo release notes provided.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.3 (2026-04-09)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSeveral out of memory error cases now raise \u003ccode\u003eMemoryError\u003c/code\u003e that were not handled before.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSlicing with large step values (outside of \u003ccode\u003e+/- sys.maxsize\u003c/code\u003e) could trigger undefined C behaviour.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2125399: Some failing tests were fixed or disabled in PyPy.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2138421: Memory leak in error cases when setting the \u003ccode\u003epublic_id\u003c/code\u003e or \u003ccode\u003esystem_url\u003c/code\u003e of a document.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c7d76d6cb817c8e1f316e43b16cab5e6ad669ad0\"\u003e\u003ccode\u003ec7d76d6\u003c/code\u003e\u003c/a\u003e Change security policy to point to Github security advisories.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/378ccf82db8160928807c55ed580c0443aa94f42\"\u003e\u003ccode\u003e378ccf8\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/315270b810a9e3276c60daba549299d204ac962b\"\u003e\u003ccode\u003e315270b\u003c/code\u003e\u003c/a\u003e Docs: Reduce TOC depth of package pages and move module contents first.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6dbba7f3c72f655b05b26ef453fdee31af13ccf5\"\u003e\u003ccode\u003e6dbba7f\u003c/code\u003e\u003c/a\u003e Docs: Show current year in copyright line.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/e4385bfa5d79527350d5ef17372fb70ba80b4cce\"\u003e\u003ccode\u003ee4385bf\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5bed1e1a227cd9ba5a879aaeacdf504093a3f6e8\"\u003e\u003ccode\u003e5bed1e1\u003c/code\u003e\u003c/a\u003e Validate file hashes in release download script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c13ee10a429f1144779bb1cbf6ae3bec808ae9c1\"\u003e\u003ccode\u003ec13ee10\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.0.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-5.3.0...lxml-6.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `python-dotenv` from 1.0.1 to 1.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/theskumar/python-dotenv/releases\"\u003epython-dotenv's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.2.2\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for Python 3.14, including the free-threaded (3.14t) build. (#)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003edotenv run\u003c/code\u003e command now forwards flags directly to the specified command by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/607\"\u003etheskumar/python-dotenv#607\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved documentation clarity regarding override behavior and the reference page.\u003c/li\u003e\n\u003cli\u003eUpdated PyPy support to version 3.11.\u003c/li\u003e\n\u003cli\u003eDocumentation for FIFO file support.\u003c/li\u003e\n\u003cli\u003eSupport for Python 3.9.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved \u003ccode\u003eset_key\u003c/code\u003e and \u003ccode\u003eunset_key\u003c/code\u003e behavior when interacting with symlinks by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311\"\u003e#790c5\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCorrected the license specifier and added missing Python 3.14 classifiers in package metadata by \u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/590\"\u003etheskumar/python-dotenv#590\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e and \u003ccode\u003edotenv.unset_key\u003c/code\u003e used to follow symlinks in some\nsituations. This is no longer the case. For that behavior to be restored in\nall cases, \u003ccode\u003efollow_symlinks=True\u003c/code\u003e should be used.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the CLI, \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e used to follow symlinks in some situations. This\nis no longer the case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e, \u003ccode\u003edotenv.unset_key\u003c/code\u003e and the CLI commands \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e\nused to reset the file mode of the modified .env file to \u003ccode\u003e0o600\u003c/code\u003e in some\nsituations. This is no longer the case: The original mode of the file is now\npreserved. Is the file needed to be created or wasn't a regular file, mode\n\u003ccode\u003e0o600\u003c/code\u003e is used.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eskip 000 permission tests for root user by \u003ca href=\"https://github.com/burnout-projects\"\u003e\u003ccode\u003e@​burnout-projects\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/561\"\u003etheskumar/python-dotenv#561\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 5 to 6 in the github-actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/593\"\u003etheskumar/python-dotenv#593\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Windows testing to CI by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/604\"\u003etheskumar/python-dotenv#604\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove workflow efficiency with best practices by \u003ca href=\"https://github.com/theskumar\"\u003e\u003ccode\u003e@​theskumar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/609\"\u003etheskumar/python-dotenv#609\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove the use of \u003ccode\u003esh\u003c/code\u003e in tests by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/612\"\u003etheskumar/python-dotenv#612\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/590\"\u003etheskumar/python-dotenv#590\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/burnout-projects\"\u003e\u003ccode\u003e@​burnout-projects\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/561\"\u003etheskumar/python-dotenv#561\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/cpackham-atlnz\"\u003e\u003ccode\u003e@​cpackham-atlnz\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/597\"\u003etheskumar/python-dotenv#597\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2\"\u003ehttps://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.2.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md\"\u003epython-dotenv's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e[1.2.2] - 2026-03-01\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for Python 3.14, including the free-threaded (3.14t) build. (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/588\"\u003e#588\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003edotenv run\u003c/code\u003e command now forwards flags directly to the specified command by [\u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/607\"\u003e#607\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved documentation clarity regarding override behavior and the reference page.\u003c/li\u003e\n\u003cli\u003eUpdated PyPy support to version 3.11.\u003c/li\u003e\n\u003cli\u003eDocumentation for FIFO file support.\u003c/li\u003e\n\u003cli\u003eDropped Support for Python 3.9.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved \u003ccode\u003eset_key\u003c/code\u003e and \u003ccode\u003eunset_key\u003c/code\u003e behavior when interacting with symlinks by [\u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e] in [790c5c0]\u003c/li\u003e\n\u003cli\u003eCorrected the license specifier and added missing Python 3.14 classifiers in package metadata by [\u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/590\"\u003e#590\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e and \u003ccode\u003edotenv.unset_key\u003c/code\u003e used to follow symlinks in some\nsituations. This is no longer the case. For that behavior to be restored in\nall cases, \u003ccode\u003efollow_symlinks=True\u003c/code\u003e should be used.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the CLI, \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e used to follow symlinks in some situations. This\nis no longer the case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e, \u003ccode\u003edotenv.unset_key\u003c/code\u003e and the CLI commands \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e\nused to reset the file mode of the modified .env file to \u003ccode\u003e0o600\u003c/code\u003e in some\nsituations. This is no longer the case: The original mode of the file is now\npreserved. Is the file needed to be created or wasn't a regular file, mode\n\u003ccode\u003e0o600\u003c/code\u003e is used.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.2.1] - 2025-10-26\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMove more config to \u003ccode\u003epyproject.toml\u003c/code\u003e, removed \u003ccode\u003esetup.cfg\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for reading \u003ccode\u003e.env\u003c/code\u003e from FIFOs (Unix) by [\u003ca href=\"https://github.com/sidharth-sudhir\"\u003e\u003ccode\u003e@​sidharth-sudhir\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/586\"\u003e#586\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.2.0] - 2025-10-26\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade build system to use PEP 517 \u0026amp; PEP 518 to use \u003ccode\u003ebuild\u003c/code\u003e and \u003ccode\u003epyproject.toml\u003c/code\u003e by [\u003ca href=\"https://github.com/EpicWink\"\u003e\u003ccode\u003e@​EpicWink\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/583\"\u003e#583\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for Python 3.14 by [\u003ca href=\"https://github.com/23f3001135\"\u003e\u003ccode\u003e@​23f3001135\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/579\"\u003e#579\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for disabling of \u003ccode\u003eload_dotenv()\u003c/code\u003e using \u003ccode\u003ePYTHON_DOTENV_DISABLED\u003c/code\u003e env var. by [\u003ca href=\"https://github.com/matthewfranglen\"\u003e\u003ccode\u003e@​matthewfranglen\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/569\"\u003e#569\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.1.1] - 2025-06-24\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eCLI: Ensure \u003ccode\u003efind_dotenv\u003c/code\u003e work reliably on python 3.13 by [\u003ca href=\"https://github.com/theskumar\"\u003e\u003ccode\u003e@​theskumar\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/563\"\u003e#563\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/36004e0e34be7665ff2b11a8a4005144f76f176d\"\u003e\u003ccode\u003e36004e0\u003c/code\u003e\u003c/a\u003e Bump version: 1.2.1 → 1.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/eb202520e5933c9daf42501e1e42fdb0144002c8\"\u003e\u003ccode\u003eeb20252\u003c/code\u003e\u003c/a\u003e docs: update changelog for v1.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311\"\u003e\u003ccode\u003e790c5c0\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/43340da220fb4ca4f95357bbe21a3c7f8f1278b1\"\u003e\u003ccode\u003e43340da\u003c/code\u003e\u003c/a\u003e Remove the use of \u003ccode\u003esh\u003c/code\u003e in tests (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/612\"\u003e#612\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/09d7cee32459e7abdcb5c9d8122a552589c06a9c\"\u003e\u003ccode\u003e09d7cee\u003c/code\u003e\u003c/a\u003e docs: clarify override behavior and document FIFO support (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/610\"\u003e#610\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/c8de2887c00198c22842c5ae5e92d1747467363c\"\u003e\u003ccode\u003ec8de288\u003c/code\u003e\u003c/a\u003e ci: improve workflow efficiency with best practices (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/609\"\u003e#609\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/7bd9e3dbfedc0983ad7d56d5570013035242bdf4\"\u003e\u003ccode\u003e7bd9e3d\u003c/code\u003e\u003c/a\u003e Add Windows testing to CI (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/604\"\u003e#604\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/1baaf04f336072e0ee324d5df9563ec767f14f81\"\u003e\u003ccode\u003e1baaf04\u003c/code\u003e\u003c/a\u003e Drop Python 3.9 support and update to PyPy 3.11 (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/608\"\u003e#608\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/4a22cf8993804aeede0c20b75bb1a29d3a99e9dc\"\u003e\u003ccode\u003e4a22cf8\u003c/code\u003e\u003c/a\u003e ci: enable testing on Python 3.14t (free-threaded) (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/588\"\u003e#588\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/e2e8e776b42e382ae38b44d3982dd649e7507dd4\"\u003e\u003ccode\u003ee2e8e77\u003c/code\u003e\u003c/a\u003e Fix license specifier (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/597\"\u003e#597\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/theskumar/python-dotenv/compare/v1.0.1...v1.2.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `starlette` from 0.41.2 to 1.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/starlette/releases\"\u003estarlette's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 1.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore malformed \u003ccode\u003eHost\u003c/code\u003e header when constructing \u003ccode\u003erequest.url\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3279\"\u003eKludex/starlette#3279\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/1.0.0...1.0.1\"\u003ehttps://github.com/Kludex/starlette/compare/1.0.0...1.0.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 1.0.0\u003c/h2\u003e\n\u003cp\u003eStarlette 1.0 is here! 🎉\u003c/p\u003e\n\u003cp\u003eAfter nearly eight years since its creation, Starlette has reached its first stable release.\u003c/p\u003e\n\u003cp\u003eA special thank you to \u003ca href=\"https://github.com/lovelydinosaur\"\u003e\u003ccode\u003e@​lovelydinosaur\u003c/code\u003e\u003c/a\u003e, the creator of Starlette, Uvicorn, HTTPX and MkDocs, whose work helped to lay the foundation for the modern async Python ecosystem. 🙏\u003c/p\u003e\n\u003cp\u003eThank you to \u003ca href=\"https://github.com/adriangb\"\u003e\u003ccode\u003e@​adriangb\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/graingert\"\u003e\u003ccode\u003e@​graingert\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/agronholm\"\u003e\u003ccode\u003e@​agronholm\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/florimondmanca\"\u003e\u003ccode\u003e@​florimondmanca\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/aminalaee\"\u003e\u003ccode\u003e@​aminalaee\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/alex-oleshkevich\"\u003e\u003ccode\u003e@​alex-oleshkevich\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/abersheeran\"\u003e\u003ccode\u003e@​abersheeran\u003c/code\u003e\u003c/a\u003e, and \u003ca href=\"https://github.com/uSpike\"\u003e\u003ccode\u003e@​uSpike\u003c/code\u003e\u003c/a\u003e for helping make Starlette what it is today. And to all my sponsors - especially \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/huggingface\"\u003e\u003ccode\u003e@​huggingface\u003c/code\u003e\u003c/a\u003e, and \u003ca href=\"https://github.com/elevenlabs\"\u003e\u003ccode\u003e@​elevenlabs\u003c/code\u003e\u003c/a\u003e - thank you for your support!\u003c/p\u003e\n\u003cp\u003eThank you to all \u003ca href=\"https://github.com/encode/starlette/graphs/contributors\"\u003e290+ contributors\u003c/a\u003e who have shaped Starlette over the years! ❤️\u003c/p\u003e\n\u003cp\u003eRead more on the \u003ca href=\"https://marcelotryle.com/blog/2026/03/22/starlette-10-is-here/\"\u003eblog post\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eCheck out the full release notes at \u003ca href=\"https://www.starlette.io/release-notes/#100-march-22-2026\"\u003ehttps://www.starlette.io/release-notes/#100-march-22-2026\u003c/a\u003e\u003c/p\u003e\n\u003chr /\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/encode/starlette/compare/1.0.0rc1...1.0.0\"\u003ehttps://github.com/encode/starlette/compare/1.0.0rc1...1.0.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 1.0.0rc1\u003c/h2\u003e\n\u003cp\u003eWe're ready! 🚀\u003c/p\u003e\n\u003cp\u003eThe first release candidate for Starlette 1.0 is here! After years on ZeroVer, we're finally making the jump.\u003c/p\u003e\n\u003cp\u003eThis release removes all deprecated features marked for 1.0.0, along with some last-minute bug fixes.\u003c/p\u003e\n\u003cp\u003eA special thank you to \u003ca href=\"https://github.com/lovelydinosaur\"\u003e\u003ccode\u003e@​lovelydinosaur\u003c/code\u003e\u003c/a\u003e, the creator of Starlette, Uvicorn, HTTPX and MkDocs, whose work helped to lay the foundation for the modern async Python ecosystem. 🙏\u003c/p\u003e\n\u003cp\u003eThank you to \u003ca href=\"https://github.com/adriangb\"\u003e\u003ccode\u003e@​adriangb\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/graingert\"\u003e\u003ccode\u003e@​graingert\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/agronholm\"\u003e\u003ccode\u003e@​agronholm\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/florimondmanca\"\u003e\u003ccode\u003e@​florimondmanca\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/aminalaee\"\u003e\u003ccode\u003e@​aminalaee\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/alex-oleshkevich\"\u003e\u003ccode\u003e@​alex-oleshkevich\u003c/code\u003e\u003c/a\u003e, and \u003ca href=\"https://github.com/abersheeran\"\u003e\u003ccode\u003e@​abersheeran\u003c/code\u003e\u003c/a\u003e for helping make Starlette what it is today. And to all my sponsors - especially \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/huggingface\"\u003e\u003ccode\u003e@​huggingface\u003c/code\u003e\u003c/a\u003e, and \u003ca href=\"https://github.com/elevenlabs\"\u003e\u003ccode\u003e@​elevenlabs\u003c/code\u003e\u003c/a\u003e - thank you for your support!\u003c/p\u003e\n\u003cp\u003eThank you to all \u003ca href=\"https://github.com/encode/starlette/graphs/contributors\"\u003e290+ contributors\u003c/a\u003e who have shaped Starlette over the years!\u003c/p\u003e\n\u003cp\u003eCheck out the full release notes at \u003ca href=\"https://www.starlette.io/release-notes/#100rc1-february-23-2026\"\u003ehttps://www.starlette.io/release-notes/#100rc1-february-23-2026\u003c/a\u003e\u003c/p\u003e\n\u003chr /\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/0.52.1...1.0.0rc1\"\u003ehttps://github.com/Kludex/starlette/compare/0.52.1...1.0.0rc1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 0.52.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOnly use \u003ccode\u003etyping_extensions\u003c/code\u003e in older Python versions by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3109\"\u003eKludex/starlette#3109\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/starlette/blob/main/docs/release-notes.md\"\u003estarlette's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.0.1 (May 21, 2026)\u003c/h2\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore malformed \u003ccode\u003eHost\u003c/code\u003e header when constructing \u003ccode\u003erequest.url\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3279\"\u003e#3279\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.0.0 (March 22, 2026)\u003c/h2\u003e\n\u003cp\u003eStarlette 1.0 is here!\u003c/p\u003e\n\u003cp\u003eAfter nearly eight years since its creation, Starlette has reached its first stable release.\nThank you to everyone who tested the release candidate and reported issues.\u003c/p\u003e\n\u003cp\u003eYou can read more on the \u003ca href=\"https://marcelotryle.com/blog/2026/03/22/starlette-10-is-here/\"\u003eblog post\u003c/a\u003e.\u003c/p\u003e\n\u003ch4\u003eAdded\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eTrack session access and modification in \u003ccode\u003eSessionMiddleware\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3166\"\u003e#3166\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eHandle websocket denial responses in \u003ccode\u003eStreamingResponse\u003c/code\u003e and \u003ccode\u003eFileResponse\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3189\"\u003e#3189\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003ebytearray\u003c/code\u003e for field accumulation in \u003ccode\u003eFormParser\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3179\"\u003e#3179\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eMove \u003ccode\u003eparser.finalize()\u003c/code\u003e inside try/except in \u003ccode\u003eMultiPartParser.parse()\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3153\"\u003e#3153\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.0.0rc1 (February 23, 2026)\u003c/h2\u003e\n\u003cp\u003eWe're ready! I'm thrilled to announce the first release candidate for Starlette 1.0.\u003c/p\u003e\n\u003cp\u003eStarlette was created in June 2018 by Tom Christie, and has been on ZeroVer for years. Today, it's downloaded\nalmost \u003ca href=\"https://pypistats.org/packages/starlette\"\u003e10 million times a day\u003c/a\u003e, serves as the foundation for FastAPI,\nand has inspired many other frameworks. In the age of AI, Starlette continues to play an important role as a\ndependency of the Python MCP SDK.\u003c/p\u003e\n\u003cp\u003eThis release focuses on removing deprecated features that were marked for removal in 1.0.0, along with some\nlast minute bug fixes. It's a release candidate, so we can gather feedback from the community before the final\n1.0.0 release soon.\u003c/p\u003e\n\u003cp\u003eA huge thank you to all the contributors who have helped make Starlette what it is today.\nIn particular, I'd like to recognize:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lovelydinosaur\"\u003eKim Christie\u003c/a\u003e - The original creator of Starlette, Uvicorn, and MkDocs, and the\ncurrent maintainer of HTTPX. Kim's work helped lay the foundation for the modern async Python ecosystem.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/adriangb\"\u003eAdrian Garcia Badaracco\u003c/a\u003e - One of the smartest people I know, whom I have the pleasure of working with at Pydantic.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/graingert\"\u003eThomas Grainger\u003c/a\u003e - My async teacher, always ready to help with questions.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/agronholm\"\u003eAlex Grönholm\u003c/a\u003e - Another async mentor, always prompt to help with questions.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/florimondmanca\"\u003eFlorimond Manca\u003c/a\u003e - Always present in the early days of both Starlette and Uvicorn, and helped a lot in the ecosystem.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/aminalaee\"\u003eAmin Alaee\u003c/a\u003e - Contributed a lot with file-related PRs.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tiangolo\"\u003eSebastián Ramírez\u003c/a\u003e - Maintains FastAPI upstream, and always in contact to help with upstream issues.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/alex-oleshkevich\"\u003eAlex Oleshkevich\u003c/a\u003e - Helped a lot on templates and many discussions.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/48f8e331b23ca692f4713ac1f370bff1b5cd034c\"\u003e\u003ccode\u003e48f8e33\u003c/code\u003e\u003c/a\u003e Version 1.0.1 (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3281\"\u003e#3281\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/f078832be1aa27ab0e7ec3153479a347749e967a\"\u003e\u003ccode\u003ef078832\u003c/code\u003e\u003c/a\u003e Remove Hugging Face sponsor block from docs (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3280\"\u003e#3280\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/472951eba8f6e35be845fd1b91625a1b5488294b\"\u003e\u003ccode\u003e472951e\u003c/code\u003e\u003c/a\u003e chore(deps): bump the github-actions group with 2 updates (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3277\"\u003e#3277\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6\"\u003e\u003ccode\u003e764dab0\u003c/code\u003e\u003c/a\u003e Ignore malformed \u003ccode\u003eHost\u003c/code\u003e header when constructing \u003ccode\u003erequest.url\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3279\"\u003e#3279\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/19d08115ce56da8d4da2838ecdd9c5882cb2b365\"\u003e\u003ccode\u003e19d0811\u003c/code\u003e\u003c/a\u003e Harden GitHub Actions workflows and Dependabot config (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3276\"\u003e#3276\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/01f46378120fe2c6312074ed7e997e3b5f7d8c20\"\u003e\u003ccode\u003e01f4637\u003c/code\u003e\u003c/a\u003e chore(deps): bump idna from 3.10 to 3.15 (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3274\"\u003e#3274\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/b8fa5140d2ef9f22483d777e936ab4c2df897179\"\u003e\u003ccode\u003eb8fa514\u003c/code\u003e\u003c/a\u003e docs: fix typos in TestClient docs and test_requests comment (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3266\"\u003e#3266\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/e935b6b5d4616c2317bbdadfb4cf07a8e7637955\"\u003e\u003ccode\u003ee935b6b\u003c/code\u003e\u003c/a\u003e fix uvicorn domain (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3269\"\u003e#3269\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/96af9521a7e46bc0d00b5227186f03b70b6d242f\"\u003e\u003ccode\u003e96af952\u003c/code\u003e\u003c/a\u003e Add 7-day cooldown for dependency resolution via uv exclude-newer (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3265\"\u003e#3265\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/61e385bd6dc438a90493c50f65ed232430f873fb\"\u003e\u003ccode\u003e61e385b\u003c/code\u003e\u003c/a\u003e Add zizmor GitHub Actions security analysis workflow (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3264\"\u003e#3264\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/Kludex/starlette/compare/0.41.2...1.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 2.2.3 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3 is raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects \u003ca href=\"https://opencollective.com/urllib3\"\u003eplease consider contributing financially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been read and decompressed partially. (Reported by \u003ca href=\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or \u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed using the official \u003ca href=\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by \u003ca href=\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca href=\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed data buffered from previous partial reads. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the response after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt=0\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing \u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior of chunked request bodies. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling schemeless URIs were passed to \u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to accept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e, matching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling use with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3 is raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects \u003ca href=\"https://opencollective.com/urllib3\"\u003eplease consider contributing financially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the streaming API were bypassed when HTTP redirects were followed. (CVE-2026-21441 reported by \u003ca href=\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High, GHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours as 6 hours by default. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on Emscripten. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed\nusing the official \u003ccode\u003eBrotli \u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763) \u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720) \u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979) \u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777) \u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636) \u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the\nresponse after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e Release 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e Fix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e Switch to nightly PyPy3.11 in CI for now (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e Avoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when \u003ccode\u003eamt=0\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e Bump dev dependencies (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e Upgrade mypy to version 1.20.2 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e Drop support for EOL PyPy3.10 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e Upgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix warnings (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/urllib3/urllib3/compare/2.2.3...2.7.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `mcp` from 1.0.0 to 1.23.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/modelcontextprotocol/python-sdk/releases\"\u003emcp's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.23.0\u003c/h2\u003e\n\u003ch2\u003eSummary\u003c/h2\u003e\n\u003cp\u003eThis release brings us up to speed with the latest MCP spec \u003ccode\u003e2025-11-25\u003c/code\u003e. Take a look at the \u003ca href=\"https://modelcontextprotocol.io/specification/2025-11-25\"\u003elatest spec\u003c/a\u003e as well as the release \u003ca href=\"https://blog.modelcontextprotocol.io/posts/2025-11-25-first-mcp-anniversary/\"\u003eblog post.\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd tests for JSON Schema 2020-12 field preservation (SEP-1613) by \u003ca href=\"https://github.com/felixweinberger\"\u003e\u003ccode\u003e@​felixweinberger\u003c/code...\n\n_Description has been truncated_","html_url":"https://github.com/dporkka/mcpservers/pull/8","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/dporkka%2Fmcpservers/issues/8","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/8/packages"}},{"old_version":"\u003e=5.0.0","new_version":"\u003e=6.1.1","update_type":"minor","path":null,"pr_created_at":"2026-06-02T05:59:22.000Z","version_change":"\u003e=5.0.0 → \u003e=6.1.1","issue":{"uuid":"4568869913","node_id":"PR_kwDORUBXS87hp-85","number":27,"state":"open","title":"chore(deps): update lxml requirement from \u003e=5.0.0 to \u003e=6.1.1","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-02T05:59:22.000Z","updated_at":"2026-06-02T05:59:23.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): update","packages":[{"name":"lxml","old_version":"\u003e=5.0.0","new_version":"\u003e=6.1.1","repository_url":"https://github.com/lxml/lxml"}],"path":null,"ecosystem":"pip"},"body":"Updates the requirements on [lxml](https://github.com/lxml/lxml) to permit the latest version.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-5.0.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/bess-solutions/open-bess-edge/pull/27","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/bess-solutions%2Fopen-bess-edge/issues/27","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/27/packages"}},{"old_version":"6.1.0","new_version":"6.1.1","update_type":"patch","path":null,"pr_created_at":"2026-05-31T20:58:13.000Z","version_change":"6.1.0 → 6.1.1","issue":{"uuid":"4558984415","node_id":"PR_kwDOSgX7gc7hJ8AC","number":3,"state":"closed","title":"chore(deps): bump the python-minor-patch group with 5 updates","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-06-08T03:11:49.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-31T20:58:13.000Z","updated_at":"2026-06-08T03:11:51.000Z","time_to_close":627216,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"python-minor-patch","update_count":5,"packages":[{"name":"numpy","old_version":"2.4.4","new_version":"2.4.6","repository_url":"https://github.com/numpy/numpy"},{"name":"gymnasium","old_version":"1.2.3","new_version":"1.3.0","repository_url":"https://github.com/Farama-Foundation/Gymnasium"},{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"},{"name":"requests","old_version":"2.34.1","new_version":"2.34.2","repository_url":"https://github.com/psf/requests"},{"name":"ruff","old_version":"0.15.12","new_version":"0.15.15","repository_url":"https://github.com/astral-sh/ruff"}],"path":null,"ecosystem":"pip"},"body":"Bumps the python-minor-patch group with 5 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [numpy](https://github.com/numpy/numpy) | `2.4.4` | `2.4.6` |\n| [gymnasium](https://github.com/Farama-Foundation/Gymnasium) | `1.2.3` | `1.3.0` |\n| [lxml](https://github.com/lxml/lxml) | `6.1.0` | `6.1.1` |\n| [requests](https://github.com/psf/requests) | `2.34.1` | `2.34.2` |\n| [ruff](https://github.com/astral-sh/ruff) | `0.15.12` | `0.15.15` |\n\nUpdates `numpy` from 2.4.4 to 2.4.6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/numpy/numpy/releases\"\u003enumpy's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.4.6 (May 18, 2026)\u003c/h2\u003e\n\u003ch1\u003eNumPy 2.4.6 Release Notes\u003c/h1\u003e\n\u003cp\u003eNumPy 2.4.6 is a quick release that fixes a regression discovered in the 2.4.5\nrelease.\u003c/p\u003e\n\u003cp\u003eThis release supports Python versions 3.11-3.14\u003c/p\u003e\n\u003ch2\u003eContributors\u003c/h2\u003e\n\u003cp\u003eA total of 4 people contributed to this release. People with a \u0026quot;+\u0026quot; by their\nnames contributed a patch for the first time.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e!EarlMilktea\u003c/li\u003e\n\u003cli\u003eCharles Harris\u003c/li\u003e\n\u003cli\u003eSebastian Berg\u003c/li\u003e\n\u003cli\u003eWarren Weckesser\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ePull requests merged\u003c/h2\u003e\n\u003cp\u003eA total of 4 pull requests were merged for this release.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31444\"\u003e#31444\u003c/a\u003e: MAINT: Prepare 2.4.x for further development\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31453\"\u003e#31453\u003c/a\u003e: BUG: Fix regression in \u003ccode\u003earr.conj()\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31459\"\u003e#31459\u003c/a\u003e: BUG: \u003ccode\u003enp.linalg.svd(..., hermitian=True)\u003c/code\u003e returns non-unitary...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31460\"\u003e#31460\u003c/a\u003e: BUG: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator...\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev2.4.5 (May 15, 2026)\u003c/h2\u003e\n\u003ch1\u003eNumPy 2.4.5 Release Notes\u003c/h1\u003e\n\u003cp\u003eNumPy 2.4.5 is a patch release that fixes bugs discovered after the 2.4.4\nrelease, has some typing improvements, and maintains infrastructure.\u003c/p\u003e\n\u003cp\u003eThis release supports Python versions 3.11-3.14\u003c/p\u003e\n\u003ch2\u003eContributors\u003c/h2\u003e\n\u003cp\u003eA total of 17 people contributed to this release. People with a \u0026quot;+\u0026quot; by their\nnames contributed a patch for the first time.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAleksei Nikiforov\u003c/li\u003e\n\u003cli\u003eAnarion Zuo +\u003c/li\u003e\n\u003cli\u003eAnkit Ahlawat\u003c/li\u003e\n\u003cli\u003eBreno Favaretto +\u003c/li\u003e\n\u003cli\u003eCharles Harris\u003c/li\u003e\n\u003cli\u003eIgor Krivenko +\u003c/li\u003e\n\u003cli\u003eIjtihed Kilani +\u003c/li\u003e\n\u003cli\u003eJoren Hammudoglu\u003c/li\u003e\n\u003cli\u003eMaarten Baert +\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/b832a09cf2a169c833dd2371e7c07aa00b293242\"\u003e\u003ccode\u003eb832a09\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31462\"\u003e#31462\u003c/a\u003e from charris/prepare-2.4.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/57cc147d2ceacffc6534642bfbdebb3a80428e1e\"\u003e\u003ccode\u003e57cc147\u003c/code\u003e\u003c/a\u003e REL: Prepare for the NumPy 2.4.6 release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/0c72b0b53b6b83c004e434b2c7855e73c000d21e\"\u003e\u003ccode\u003e0c72b0b\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31459\"\u003e#31459\u003c/a\u003e from charris/backport-31347\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/9778d26e0475d381ccb7817c3b4dd8cacef2b9eb\"\u003e\u003ccode\u003e9778d26\u003c/code\u003e\u003c/a\u003e BUG: core: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator. (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/e0e38767d5d0f848ab44befeedcad71e8ef589c7\"\u003e\u003ccode\u003ee0e3876\u003c/code\u003e\u003c/a\u003e BUG: core: Don't call INCREF/DECREF on descr in NpyStringAcquireAllocator. (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/d1bffeb9ec4ec0bf029c94ea35abffa92d5c30f2\"\u003e\u003ccode\u003ed1bffeb\u003c/code\u003e\u003c/a\u003e BUG: \u003ccode\u003enp.linalg.svd(..., hermitian=True)\u003c/code\u003e returns non-unitary \u003ccode\u003evh\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31347\"\u003e#31347\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/8d8d7e5a14a1da0bfb0faf609a7a7610c431e6e9\"\u003e\u003ccode\u003e8d8d7e5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31453\"\u003e#31453\u003c/a\u003e from seberg/issue-31452\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/bddaab7ace45f90148d8f2bb6e67daab2d45ec76\"\u003e\u003ccode\u003ebddaab7\u003c/code\u003e\u003c/a\u003e BUG: Fix regression in \u003ccode\u003earr.conj()\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/37a1ecca8dff09b2c579a991194ac55b9971f3a7\"\u003e\u003ccode\u003e37a1ecc\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31444\"\u003e#31444\u003c/a\u003e from charris/begin-2.4.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/3c0e043217a759a8a948ade158fec14348c3b459\"\u003e\u003ccode\u003e3c0e043\u003c/code\u003e\u003c/a\u003e MAINT: Prepare 2.4.x for further development\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/numpy/numpy/compare/v2.4.4...v2.4.6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `gymnasium` from 1.2.3 to 1.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/releases\"\u003egymnasium's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.3.0\u003c/h2\u003e\n\u003ch1\u003eGymnasium v1.3.0\u003c/h1\u003e\n\u003cp\u003eThis release brings a new Taxi environment version, a new \u003ccode\u003eRepeatAction\u003c/code\u003e wrapper, and a range of bug fixes across vector environments and wrappers.\u003c/p\u003e\n\u003ch2\u003eCore Changes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003eTaxi\u003c/code\u003e environment has been updated to \u003ccode\u003ev4\u003c/code\u003e to correct the \u003ccode\u003eis_rainy\u003c/code\u003e implementation, which previously did not behave as documented by \u003ca href=\"https://github.com/pseudo-rnd-thoughts\"\u003e\u003ccode\u003e@​pseudo-rnd-thoughts\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1561\"\u003eFarama-Foundation/Gymnasium#1561\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003epygame\u003c/code\u003e has been replaced with \u003ca href=\"https://pyga.me/\"\u003e\u003ccode\u003epygame-ce\u003c/code\u003e\u003c/a\u003e, unlocking Python 3.14 compatibility. The drop-in replacement preserves the existing rendering behaviour by \u003ca href=\"https://github.com/mwydmuch\"\u003e\u003ccode\u003e@​mwydmuch\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1512\"\u003eFarama-Foundation/Gymnasium#1512\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdded \u003ccode\u003eRepeatAction\u003c/code\u003e wrapper that repeats a given action for a fixed number of steps, useful for frame-skipping and coarser control loops by \u003ca href=\"https://github.com/Lidang-Jiang\"\u003e\u003ccode\u003e@​Lidang-Jiang\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1553\"\u003eFarama-Foundation/Gymnasium#1553\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eOptimised \u003ccode\u003eBox.__init__\u003c/code\u003e to reduce overhead through lazy evaluation of variables by \u003ca href=\"https://github.com/pseudo-rnd-thoughts\"\u003e\u003ccode\u003e@​pseudo-rnd-thoughts\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1529\"\u003eFarama-Foundation/Gymnasium#1529\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix vector \u003ccode\u003eRecordVideo\u003c/code\u003e wrapper to remove memory leaks across episodes by \u003ca href=\"https://github.com/JonahFSD\"\u003e\u003ccode\u003e@​JonahFSD\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1527\"\u003eFarama-Foundation/Gymnasium#1527\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix Vector \u003ccode\u003eNormalizeReward\u003c/code\u003e wrapper to work identically as the non-vectorized version by \u003ca href=\"https://github.com/JonahFSD\"\u003e\u003ccode\u003e@​JonahFSD\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1526\"\u003eFarama-Foundation/Gymnasium#1526\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBug Fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved the \u003ccode\u003eVectorEnv\u003c/code\u003e destructor, which was causing \u003ccode\u003eVectorEnv.close()\u003c/code\u003e to be called unintentionally by \u003ca href=\"https://github.com/TimSchneider42\"\u003e\u003ccode\u003e@​TimSchneider42\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1522\"\u003eFarama-Foundation/Gymnasium#1522\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eNormalizeObservation\u003c/code\u003e vectorized wrapper to override the \u003ccode\u003eobservation_space\u003c/code\u003e and a \u003ccode\u003efloat32\u003c/code\u003e cast by \u003ca href=\"https://github.com/JonahFSD\"\u003e\u003ccode\u003e@​JonahFSD\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1528\"\u003eFarama-Foundation/Gymnasium#1528\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eRenderFrame\u003c/code\u003e's typing by \u003ca href=\"https://github.com/jorenham\"\u003e\u003ccode\u003e@​jorenham\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1560\"\u003eFarama-Foundation/Gymnasium#1560\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed A2C tutorial's entropy computation when a scalar (rather than tensor) is passed to the loss function by \u003ca href=\"https://github.com/epoint95\"\u003e\u003ccode\u003e@​epoint95\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/pull/1524\"\u003eFarama-Foundation/Gymnasium#1524\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eThird-Party Environments\u003c/h2\u003e\n\u003cp\u003e10 new community environments have been added to the \u003ca href=\"https://gymnasium.farama.org/environments/third_party_environments/\"\u003ethird-party environments list\u003c/a\u003e, including a new Cybersecurity environments section.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog:\u003c/strong\u003e \u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/compare/v1.2.3...v1.3.0\"\u003ehttps://github.com/Farama-Foundation/Gymnasium/compare/v1.2.3...v1.3.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/eb5c00e00df3a17cef75dca144cda25a0f6556f6\"\u003e\u003ccode\u003eeb5c00e\u003c/code\u003e\u003c/a\u003e Update to use Taxi-v4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/4436f89e262a795e4f7d33726013848285377a86\"\u003e\u003ccode\u003e4436f89\u003c/code\u003e\u003c/a\u003e fix incorrect \u003ccode\u003eTypeVar\u003c/code\u003e use in \u003ccode\u003ecore\u003c/code\u003e for \u003ccode\u003eRenderFrame\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/issues/1560\"\u003e#1560\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/877ba301b041cb0454f25b0234f1ec6d298d533c\"\u003e\u003ccode\u003e877ba30\u003c/code\u003e\u003c/a\u003e Update to 1.3.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/c3b809fe2e51dcdcd805e7dd4ee20b31e3b444fb\"\u003e\u003ccode\u003ec3b809f\u003c/code\u003e\u003c/a\u003e Update Taxi to V4 and fix \u003ccode\u003eis_rainy\u003c/code\u003e implementation (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/issues/1561\"\u003e#1561\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/9e6f8555a9952439444cd24ee6729116f4e2a12e\"\u003e\u003ccode\u003e9e6f855\u003c/code\u003e\u003c/a\u003e Add \u003ccode\u003eRepeatAction\u003c/code\u003e wrapper (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/issues/1553\"\u003e#1553\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/1532e667c22c0c201340228982f22792f43eb9dc\"\u003e\u003ccode\u003e1532e66\u003c/code\u003e\u003c/a\u003e Add external environment Hill Climb Racing Env (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/issues/1554\"\u003e#1554\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/df8704c73c75475a23db092fda0308435ae6c664\"\u003e\u003ccode\u003edf8704c\u003c/code\u003e\u003c/a\u003e Add boltcrypt to third party environments (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/issues/1557\"\u003e#1557\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/01c0d3969157c8ab499e7291c35902960683ee1f\"\u003e\u003ccode\u003e01c0d39\u003c/code\u003e\u003c/a\u003e Add external environment firecastrl (wildfire env) (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/issues/1551\"\u003e#1551\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/9edc68ea69ee5336aa70ffcb0b6b733e8558a812\"\u003e\u003ccode\u003e9edc68e\u003c/code\u003e\u003c/a\u003e Fix spelling in \u003ccode\u003etest_mujoco_v5.py\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Farama-Foundation/Gymnasium/issues/1550\"\u003e#1550\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/commit/a31fa4b11334f761fefc8440256d02dd524be408\"\u003e\u003ccode\u003ea31fa4b\u003c/code\u003e\u003c/a\u003e Change action seed for \u003ccode\u003eMuJoCo/test_verify_reward_survive\u003c/code\u003e test, to be valid ...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/Farama-Foundation/Gymnasium/compare/v1.2.3...v1.3.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lxml` from 6.1.0 to 6.1.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.34.1 to 2.34.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/releases\"\u003erequests's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.34.2\u003c/h2\u003e\n\u003ch2\u003e2.34.2 (2026-05-14)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMoved \u003ccode\u003eheaders\u003c/code\u003e input type back to \u003ccode\u003eMapping\u003c/code\u003e to avoid invariance issues with \u003ccode\u003eMutableMapping\u003c/code\u003e and inferred dict types. Users calling \u003ccode\u003eRequest.headers.update()\u003c/code\u003e may need to narrow typing in their code. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7441\"\u003e#7441\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.34.2 (2026-05-14)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMoved \u003ccode\u003eheaders\u003c/code\u003e input type back to \u003ccode\u003eMapping\u003c/code\u003e to avoid invariance issues\nwith \u003ccode\u003eMutableMapping\u003c/code\u003e and inferred dict types. Users calling\n\u003ccode\u003eRequest.headers.update()\u003c/code\u003e may need to narrow typing in their code. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7441\"\u003e#7441\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/6e83187b8feb273ed4c6cdab5efd8d54901dfab3\"\u003e\u003ccode\u003e6e83187\u003c/code\u003e\u003c/a\u003e v2.34.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/84d10f0be83e8f6aeca8a05230c52216431c4d0b\"\u003e\u003ccode\u003e84d10f0\u003c/code\u003e\u003c/a\u003e Move Request.headers back to Mapping (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7441\"\u003e#7441\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/psf/requests/compare/v2.34.1...v2.34.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ruff` from 0.15.12 to 0.15.15\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/astral-sh/ruff/releases\"\u003eruff's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.15.15\u003c/h2\u003e\n\u003ch2\u003eRelease Notes\u003c/h2\u003e\n\u003cp\u003eReleased on 2026-05-28.\u003c/p\u003e\n\u003ch3\u003ePreview features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix Markdown closing fence handling (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25310\"\u003e#25310\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003epyflakes\u003c/code\u003e] Report duplicate imports in \u003ccode\u003etyping.TYPE_CHECKING\u003c/code\u003e block (\u003ccode\u003eF811\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/22560\"\u003e#22560\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[\u003ccode\u003epyflakes\u003c/code\u003e] Treat function-scope bare annotations as locals per PEP 526 (\u003ccode\u003eF821\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/21540\"\u003e#21540\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAvoid redundant \u003ccode\u003eTokenValue\u003c/code\u003e drops in the lexer (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25300\"\u003e#25300\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eReduce memory usage by dropping token-excess capacity and improve performance by approximating the initial tokens \u003ccode\u003eVec\u003c/code\u003e size (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25354\"\u003e#25354\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eThinVec\u003c/code\u003e in AST to shrink \u003ccode\u003eStmt\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25361\"\u003e#25361\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003eline-length\u003c/code\u003e example for \u003ccode\u003e--config\u003c/code\u003e option (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25389\"\u003e#25389\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003eflake8-comprehensions\u003c/code\u003e] Document \u003ccode\u003eRecursionError\u003c/code\u003e edge case in \u003ccode\u003e__len__\u003c/code\u003e (\u003ccode\u003eC416\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25286\"\u003e#25286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003emccabe\u003c/code\u003e] Improve example (\u003ccode\u003eC901\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25287\"\u003e#25287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003epyupgrade\u003c/code\u003e] Clarify fix safety docs (\u003ccode\u003eUP007\u003c/code\u003e, \u003ccode\u003eUP045\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25288\"\u003e#25288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003erefurb\u003c/code\u003e] Document \u003ccode\u003eFURB192\u003c/code\u003e exception change for empty sequences (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25317\"\u003e#25317\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003eruff\u003c/code\u003e] Document false negative for user-defined types (\u003ccode\u003eRUF013\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25289\"\u003e#25289\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFormatter\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix formatting of lambdas nested within f-strings (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25398\"\u003e#25398\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eServer\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eReturn code action for \u003ccode\u003ecodeAction/resolve\u003c/code\u003e requests that contain no or no valid URL (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25365\"\u003e#25365\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eExpand semantic syntax errors for invalid walruses (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25415\"\u003e#25415\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eContributors\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/chirizxc\"\u003e\u003ccode\u003e@​chirizxc\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ntBre\"\u003e\u003ccode\u003e@​ntBre\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/adityasingh2400\"\u003e\u003ccode\u003e@​adityasingh2400\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/charliermarsh\"\u003e\u003ccode\u003e@​charliermarsh\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fallintoplace\"\u003e\u003ccode\u003e@​fallintoplace\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/martin-schlossarek\"\u003e\u003ccode\u003e@​martin-schlossarek\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MichaReiser\"\u003e\u003ccode\u003e@​MichaReiser\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md\"\u003eruff's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.15.15\u003c/h2\u003e\n\u003cp\u003eReleased on 2026-05-28.\u003c/p\u003e\n\u003ch3\u003ePreview features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix Markdown closing fence handling (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25310\"\u003e#25310\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003epyflakes\u003c/code\u003e] Report duplicate imports in \u003ccode\u003etyping.TYPE_CHECKING\u003c/code\u003e block (\u003ccode\u003eF811\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/22560\"\u003e#22560\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e[\u003ccode\u003epyflakes\u003c/code\u003e] Treat function-scope bare annotations as locals per PEP 526 (\u003ccode\u003eF821\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/21540\"\u003e#21540\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAvoid redundant \u003ccode\u003eTokenValue\u003c/code\u003e drops in the lexer (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25300\"\u003e#25300\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eReduce memory usage by dropping token-excess capacity and improve performance by approximating the initial tokens \u003ccode\u003eVec\u003c/code\u003e size (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25354\"\u003e#25354\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eThinVec\u003c/code\u003e in AST to shrink \u003ccode\u003eStmt\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25361\"\u003e#25361\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix \u003ccode\u003eline-length\u003c/code\u003e example for \u003ccode\u003e--config\u003c/code\u003e option (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25389\"\u003e#25389\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003eflake8-comprehensions\u003c/code\u003e] Document \u003ccode\u003eRecursionError\u003c/code\u003e edge case in \u003ccode\u003e__len__\u003c/code\u003e (\u003ccode\u003eC416\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25286\"\u003e#25286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003emccabe\u003c/code\u003e] Improve example (\u003ccode\u003eC901\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25287\"\u003e#25287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003epyupgrade\u003c/code\u003e] Clarify fix safety docs (\u003ccode\u003eUP007\u003c/code\u003e, \u003ccode\u003eUP045\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25288\"\u003e#25288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003erefurb\u003c/code\u003e] Document \u003ccode\u003eFURB192\u003c/code\u003e exception change for empty sequences (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25317\"\u003e#25317\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[\u003ccode\u003eruff\u003c/code\u003e] Document false negative for user-defined types (\u003ccode\u003eRUF013\u003c/code\u003e) (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25289\"\u003e#25289\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFormatter\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix formatting of lambdas nested within f-strings (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25398\"\u003e#25398\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eServer\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eReturn code action for \u003ccode\u003ecodeAction/resolve\u003c/code\u003e requests that contain no or no valid URL (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25365\"\u003e#25365\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eExpand semantic syntax errors for invalid walruses (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/pull/25415\"\u003e#25415\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eContributors\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/chirizxc\"\u003e\u003ccode\u003e@​chirizxc\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ntBre\"\u003e\u003ccode\u003e@​ntBre\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/adityasingh2400\"\u003e\u003ccode\u003e@​adityasingh2400\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/charliermarsh\"\u003e\u003ccode\u003e@​charliermarsh\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fallintoplace\"\u003e\u003ccode\u003e@​fallintoplace\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/martin-schlossarek\"\u003e\u003ccode\u003e@​martin-schlossarek\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/MichaReiser\"\u003e\u003ccode\u003e@​MichaReiser\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Ruchir28\"\u003e\u003ccode\u003e@​Ruchir28\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/db5aa0a5f1b92cb91d910bf0866a967554dd94f5\"\u003e\u003ccode\u003edb5aa0a\u003c/code\u003e\u003c/a\u003e Bump 0.15.15 (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25431\"\u003e#25431\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/366fe21ba369ccdd01eb99c1043c9a969c99230b\"\u003e\u003ccode\u003e366fe21\u003c/code\u003e\u003c/a\u003e [ty] Improve diagnostics for syntax errors in forward annotations (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25158\"\u003e#25158\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/e2e1e647d182b8567845039c9a65fb0608a4dcfc\"\u003e\u003ccode\u003ee2e1e64\u003c/code\u003e\u003c/a\u003e [ty] Remove excess capacity from more Salsa cached collections (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25411\"\u003e#25411\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/1bd77e1646f2213d86b8da215f08279187867d72\"\u003e\u003ccode\u003e1bd77e1\u003c/code\u003e\u003c/a\u003e [ty] Use diagnostic message as tie breaker when sorting (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25424\"\u003e#25424\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/7e1bc1e75f15795f12c846294b13df4535f2abbf\"\u003e\u003ccode\u003e7e1bc1e\u003c/code\u003e\u003c/a\u003e Add agent skills for working on ty (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25422\"\u003e#25422\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/574e10752f8cfa9e0cdbe3b01e96c4380950469b\"\u003e\u003ccode\u003e574e107\u003c/code\u003e\u003c/a\u003e Expand semantic syntax errors for invalid walruses (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25415\"\u003e#25415\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/4a7ca062fccd80443a43aa61e5dc7e5858e88dc1\"\u003e\u003ccode\u003e4a7ca06\u003c/code\u003e\u003c/a\u003e [ty] Display docs for matching parameter when hovering over the name of an ar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/54327092dbfe455040690d63bb1e5e4b5f551239\"\u003e\u003ccode\u003e5432709\u003c/code\u003e\u003c/a\u003e Refine a few agents instructions (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25423\"\u003e#25423\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/3cb09eba689ebb49e799131092121928cc789c18\"\u003e\u003ccode\u003e3cb09eb\u003c/code\u003e\u003c/a\u003e [ty] Support \u003ccode\u003etyping.TypeForm\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25334\"\u003e#25334\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/astral-sh/ruff/commit/c8cd59f189f2b6f55d542b29bddb953622add6fc\"\u003e\u003ccode\u003ec8cd59f\u003c/code\u003e\u003c/a\u003e [ty] Infer class attributes assigned by metaclass initialization (\u003ca href=\"https://redirect.github.com/astral-sh/ruff/issues/25342\"\u003e#25342\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/astral-sh/ruff/compare/0.15.12...0.15.15\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/MustafaBeratYavas/rl-based-algorithmic-trading-and-portfolio-management/pull/3","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/MustafaBeratYavas%2Frl-based-algorithmic-trading-and-portfolio-management/issues/3","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/3/packages"}},{"old_version":"5.3.0","new_version":"6.1.0","update_type":"major","path":null,"pr_created_at":"2026-05-28T22:52:45.000Z","version_change":"5.3.0 → 6.1.0","issue":{"uuid":"4544368049","node_id":"PR_kwDOQbHgbc7gb0Ms","number":6,"state":"closed","title":"chore(deps): bump the pip group across 9 directories with 18 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-05-28T22:52:52.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-28T22:52:45.000Z","updated_at":"2026-05-28T22:52:54.000Z","time_to_close":7,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"pip","update_count":18,"packages":[{"name":"authlib","old_version":"1.5.2","new_version":"1.6.12","repository_url":"https://github.com/authlib/authlib"},{"name":"dulwich","old_version":"0.22.8","new_version":"1.2.5","repository_url":"https://github.com/dulwich/dulwich"},{"name":"idna","old_version":"3.10","new_version":"3.15","repository_url":"https://github.com/kjd/idna"},{"name":"langchain-core","old_version":"0.3.49","new_version":"1.3.3","repository_url":"https://github.com/langchain-ai/langchain"},{"name":"langchain-openai","old_version":"0.3.11","new_version":"1.1.14","repository_url":"https://github.com/langchain-ai/langchain"},{"name":"langchain-text-splitters","old_version":"0.3.7","new_version":"1.1.2","repository_url":"https://github.com/langchain-ai/langchain"},{"name":"langsmith","old_version":"0.3.19","new_version":"0.8.0","repository_url":"https://github.com/langchain-ai/langsmith-sdk"},{"name":"lxml","old_version":"5.3.0","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"},{"name":"mem0ai","old_version":"0.1.88","new_version":"2.0.0b2","repository_url":"https://github.com/mem0ai/mem0"},{"name":"nltk","old_version":"3.9.2","new_version":"3.9.4","repository_url":"https://github.com/nltk/nltk"},{"name":"pillow","old_version":"12.0.0","new_version":"12.2.0","repository_url":"https://github.com/python-pillow/Pillow"},{"name":"pip","old_version":"24.2","new_version":"26.1","repository_url":"https://github.com/pypa/pip"},{"name":"poetry","old_version":"2.1.3","new_version":"2.3.4","repository_url":"https://github.com/python-poetry/poetry"},{"name":"python-dotenv","old_version":"1.1.1","new_version":"1.2.2","repository_url":"https://github.com/theskumar/python-dotenv"},{"name":"python-multipart","old_version":"0.0.20","new_version":"0.0.27","repository_url":"https://github.com/Kludex/python-multipart"},{"name":"pytorch-lightning","old_version":"2.5.1.post0","new_version":"2.6.1","repository_url":"https://github.com/Lightning-AI/pytorch-lightning"},{"name":"ujson","old_version":"5.10.0","new_version":"5.12.1","repository_url":"https://github.com/ultrajson/ultrajson"},{"name":"urllib3","old_version":"2.3.0","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"}],"path":null,"ecosystem":"pip"},"body":"Bumps the pip group with 18 updates in the /dakota_rl_training/outputs/tinker_qwen30b/wandb/run-20251119_104422-i55d4x26/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 18 updates in the /dakota_rl_training/outputs/tinker_qwen4b/wandb/run-20251120_085502-ntfgah7s/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 18 updates in the /dakota_rl_training/outputs/tinker_qwen4b/wandb/run-20251120_085815-o69alc9b/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 18 updates in the /dakota_rl_training/outputs/tinker_qwen4b/wandb/run-20251120_090142-tbmfb9o0/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 18 updates in the /dakota_rl_training/outputs/tinker_smoke/wandb/run-20251118_182158-ymh8qjl6/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 18 updates in the /dakota_rl_training/outputs/tinker_smoke/wandb/run-20251118_182714-8xv4ah4h/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 17 updates in the /wandb/run-20251105_064731-wq8xuzar/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 17 updates in the /wandb/run-20251105_064758-5jy9n26c/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\nBumps the pip group with 18 updates in the /wandb/run-20251118_210438-u82h659i/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [authlib](https://github.com/authlib/authlib) | `1.5.2` | `1.6.12` |\n| [dulwich](https://github.com/dulwich/dulwich) | `0.22.8` | `1.2.5` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [langchain-core](https://github.com/langchain-ai/langchain) | `0.3.49` | `1.3.3` |\n| [langchain-openai](https://github.com/langchain-ai/langchain) | `0.3.11` | `1.1.14` |\n| [langchain-text-splitters](https://github.com/langchain-ai/langchain) | `0.3.7` | `1.1.2` |\n| [langsmith](https://github.com/langchain-ai/langsmith-sdk) | `0.3.19` | `0.8.0` |\n| [lxml](https://github.com/lxml/lxml) | `5.3.0` | `6.1.0` |\n| [mem0ai](https://github.com/mem0ai/mem0) | `0.1.88` | `2.0.0b2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.2` | `3.9.4` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.0.0` | `12.2.0` |\n| [pip](https://github.com/pypa/pip) | `24.2` | `26.1` |\n| [poetry](https://github.com/python-poetry/poetry) | `2.1.3` | `2.3.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.1` | `1.2.2` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.20` | `0.0.27` |\n| [pytorch-lightning](https://github.com/Lightning-AI/pytorch-lightning) | `2.5.1.post0` | `2.6.1` |\n| [ujson](https://github.com/ultrajson/ultrajson) | `5.10.0` | `5.12.1` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n\n\nUpdates `authlib` from 1.5.2 to 1.6.12\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/authlib/authlib/releases\"\u003eauthlib's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.6.12\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eInvalidScopeError\u003c/code\u003e  in \u003ccode\u003eOpenIDImplicitGrant\u003c/code\u003e and \u003ccode\u003eOpenIDHybridGrant\u003c/code\u003e.\n\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.11...v1.6.12\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.11...v1.6.12\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.11\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.10...v1.6.11\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.10...v1.6.11\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix CSRF issue with starlette client\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.10\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.9...v1.6.10\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.9...v1.6.10\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eUnsupportedResponseTypeError\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.9\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.8...v1.6.9\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.8...v1.6.9\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eChanges in \u003ccode\u003ejose\u003c/code\u003e module\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eNot using header's \u003ccode\u003ejwk\u003c/code\u003e automatically\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eES256K\u003c/code\u003e into default jwt algorithms\u003c/li\u003e\n\u003cli\u003eRemove deprecated algorithm from default registry\u003c/li\u003e\n\u003cli\u003eGenerate random \u003ccode\u003ecek\u003c/code\u003e when \u003ccode\u003ecek\u003c/code\u003e length doesn't match\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.8\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.7...v1.6.8\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.7...v1.6.8\u003c/a\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eEdDSA\u003c/code\u003e to default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.6.7\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.6...v1.6.7\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.6...v1.6.7\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003eSet supported algorithms for the default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/p\u003e\n\u003ch2\u003ev1.6.6\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efix(ClientAuth): fix incorrect signature when Content-Type is x-www-form-urlencoded by \u003ca href=\"https://github.com/shc261392\"\u003e\u003ccode\u003e@​shc261392\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/778\"\u003eauthlib/authlib#778\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix: Use \u003ccode\u003eexpires_in\u003c/code\u003e when \u003ccode\u003eexpires_at\u003c/code\u003e is unparsable by \u003ca href=\"https://github.com/bendavis78\"\u003e\u003ccode\u003e@​bendavis78\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/842\"\u003eauthlib/authlib#842\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eget_jwt_config\u003c/code\u003e takes a \u003ccode\u003eclient\u003c/code\u003e parameter. by \u003ca href=\"https://github.com/azmeuk\"\u003e\u003ccode\u003e@​azmeuk\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/844\"\u003eauthlib/authlib#844\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/shc261392\"\u003e\u003ccode\u003e@​shc261392\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/778\"\u003eauthlib/authlib#778\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/bendavis78\"\u003e\u003ccode\u003e@​bendavis78\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/842\"\u003eauthlib/authlib#842\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/authlib/authlib/compare/v1.6.5...v1.6.6\"\u003ehttps://github.com/authlib/authlib/compare/v1.6.5...v1.6.6\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.6.5\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd a \u003ccode\u003erequest\u003c/code\u003e param to RFC7591 \u003ccode\u003egenerate_client_info\u003c/code\u003e and \u003ccode\u003egenerate_client_secret\u003c/code\u003e methods by \u003ca href=\"https://github.com/azmeuk\"\u003e\u003ccode\u003e@​azmeuk\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/825\"\u003eauthlib/authlib#825\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: support list params in prepare_grant_uri by \u003ca href=\"https://github.com/lisongmin\"\u003e\u003ccode\u003e@​lisongmin\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/827\"\u003eauthlib/authlib#827\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump SonarSource/sonarqube-scan-action from 5 to 6 in /.github/workflows by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/authlib/authlib/pull/828\"\u003eauthlib/authlib#828\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/authlib/authlib/blob/1.6.12/docs/changelog.rst\"\u003eauthlib's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 1.6.12\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on may 4, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eInvalidScopeError\u003c/code\u003e\nin \u003ccode\u003eOpenIDImplicitGrant\u003c/code\u003e and \u003ccode\u003eOpenIDHybridGrant\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.11\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Apr 16, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix CSRF vulnerability in the Starlette OAuth client when a \u003ccode\u003ecache\u003c/code\u003e is\nconfigured.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.10\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Apr 13, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix redirecting to unvalidated \u003ccode\u003eredirect_uri\u003c/code\u003e on \u003ccode\u003eUnsupportedResponseTypeError\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.9\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Mar 2, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eNot using header's \u003ccode\u003ejwk\u003c/code\u003e automatically.\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eES256K\u003c/code\u003e into default jwt algorithms.\u003c/li\u003e\n\u003cli\u003eRemove deprecated algorithm from default registry.\u003c/li\u003e\n\u003cli\u003eGenerate random \u003ccode\u003ecek\u003c/code\u003e when \u003ccode\u003ecek\u003c/code\u003e length doesn't match.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.8\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Feb 17, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eEdDSA\u003c/code\u003e to default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.7\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eReleased on Feb 6, 2026\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eSet supported algorithms for the default \u003ccode\u003ejwt\u003c/code\u003e instance.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eVersion 1.6.6\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/e46e515b3a87ea63ab0606b248d75f69d83a2391\"\u003e\u003ccode\u003ee46e515\u003c/code\u003e\u003c/a\u003e chore: bump to 1.6.12\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/9babc131e13b018a267ae78747cba7caa6dfb7d5\"\u003e\u003ccode\u003e9babc13\u003c/code\u003e\u003c/a\u003e fix: redirecting to unvalidated redirect_uri on InvalidScopeError in OIDC grants\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/0dc0e5b4dc84f155319518a3732113af6fa47525\"\u003e\u003ccode\u003e0dc0e5b\u003c/code\u003e\u003c/a\u003e chore: bump to 1.6.11\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/aa7b8e46e00d0622658666476782042ac00153a5\"\u003e\u003ccode\u003eaa7b8e4\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/401a7709c3fe43bce1b2105d16a475b688faa788\"\u003e\u003ccode\u003e401a770\u003c/code\u003e\u003c/a\u003e fix: CSRF issue with starlette client\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/ef09aebbba4439dedb22bd15777d1b3458b6f0ab\"\u003e\u003ccode\u003eef09aeb\u003c/code\u003e\u003c/a\u003e chore: release 1.6.10\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/3be08468201a7766a93012ce149ea12822cab096\"\u003e\u003ccode\u003e3be0846\u003c/code\u003e\u003c/a\u003e fix: redirecting to unvalidated redirect_uri on UnsupportedResponseTypeError\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/9266eaa2227ad7e21dc731b2a4a01909aabd934b\"\u003e\u003ccode\u003e9266eaa\u003c/code\u003e\u003c/a\u003e chore: release 1.6.9\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/b9bb2b25bf8b7e01512d847a95c1749646eaa72b\"\u003e\u003ccode\u003eb9bb2b2\u003c/code\u003e\u003c/a\u003e fix(oidc): fail close at validating c_hash and at_hash\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/authlib/authlib/commit/1b0a1d988842bff7347c4ec0a70e45c3ba55504e\"\u003e\u003ccode\u003e1b0a1d9\u003c/code\u003e\u003c/a\u003e fix(jose): generate random cek when cek length doesn't match\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/authlib/authlib/compare/v1.5.2...1.6.12\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `dulwich` from 0.22.8 to 1.2.5\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/dulwich/dulwich/releases\"\u003edulwich's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003edulwich 1.2.5\u003c/h2\u003e\n\u003cp\u003eThis is a security release. All users are encouraged to upgrade.\u003c/p\u003e\n\u003ch2\u003eSecurity fixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eGHSA-gfhv-vqv2-4544\u003c/strong\u003e -- Validate submodule paths in \u003ccode\u003eporcelain.submodule_update\u003c/code\u003e (and thus \u003ccode\u003eporcelain.clone(recurse_submodules=True)\u003c/code\u003e). A crafted upstream repository could carry a submodule whose path was \u003ccode\u003e.git/hooks\u003c/code\u003e (or any other path inside \u003ccode\u003e.git\u003c/code\u003e or above the work tree), causing the submodule's tree contents to be written there with their executable bits intact. The dulwich analogue of git's CVE-2024-32002 / CVE-2024-32004. (Reported by tonghuaroot)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eCVE-2026-42305\u003c/strong\u003e -- Harden tree path validation against entry names that are harmless on POSIX but dangerous when checked out on Windows. \u003ccode\u003evalidate_path_element_ntfs\u003c/code\u003e now also rejects Windows path separators, the alternate data stream marker \u003ccode\u003e:\u003c/code\u003e, NTFS 8.3 short-name aliases of \u003ccode\u003e.git\u003c/code\u003e, and reserved Windows device names. \u003ccode\u003ecore.protectNTFS\u003c/code\u003e now defaults to true on every platform, and both \u003ccode\u003ecore.protectNTFS\u003c/code\u003e and \u003ccode\u003ecore.protectHFS\u003c/code\u003e are now read under their correct option names. (Reported by Christopher Toth)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eCVE-2026-42563\u003c/strong\u003e -- Shell-quote values substituted into \u003ccode\u003eProcessMergeDriver\u003c/code\u003e commands. A malicious branch could inject shell commands when a merge driver referencing \u003ccode\u003e%P\u003c/code\u003e was configured. (Reported by Ravishanker Kusuma (hayageek))\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eCVE-2026-47712\u003c/strong\u003e -- Sanitize commit subjects used in \u003ccode\u003eporcelain.format_patch\u003c/code\u003e filenames so a malicious subject (e.g. \u003ccode\u003ex/../../x\u003c/code\u003e) cannot direct the generated patch outside \u003ccode\u003eoutdir\u003c/code\u003e. (Reported by Christopher Toth)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003ereceive.maxInputSize\u003c/strong\u003e -- Honour \u003ccode\u003ereceive.maxInputSize\u003c/code\u003e in \u003ccode\u003eReceivePackHandler\u003c/code\u003e. Previously a remote unauthenticated client could send a tiny crafted pack that declared a huge \u003ccode\u003edest_size\u003c/code\u003e and trigger hundreds of MB of allocation over \u003ccode\u003egit-receive-pack\u003c/code\u003e. (Reported by Liyi, Ziyue, Strick, Maurice and Chenchen @ University of Sydney)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edulwich-1.2.4\u003c/h2\u003e\n\u003cp\u003eTolerate ref names with empty path components (e.g. `refs/tags//v1.0`) for now, emitting a `DeprecationWarning` rather than raising a `RefFormatError`. Such names are constructed by older Poetry releases (fixed in Poetry 2.4.0) and were silently accepted before Dulwich 1.2.3. `local_branch_name`, `local_tag_name` and `local_replace_name` likewise warn about, and strip, a leading slash instead of raising `ValueError`. Both will become errors again in a future release. (Jelmer Vernooij, \u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/2192\"\u003e#2192\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003edulwich-1.2.1\u003c/h2\u003e\n\u003ch2\u003eChanges since 1.2.0\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDerive the LFS endpoint as the remote's on-disk LFS store\n(\u003ccode\u003e\u0026lt;remote\u0026gt;/.git/lfs\u003c/code\u003e for worktrees, \u003ccode\u003e\u0026lt;remote\u0026gt;/lfs\u003c/code\u003e for bare repos)\nwhen \u003ccode\u003eremote.origin.url\u003c/code\u003e points at a local filesystem path or\n\u003ccode\u003efile://\u003c/code\u003e URL, matching git-lfs behaviour. Previously the built-in\nsmudge filter constructed an HTTP-style \u003ccode\u003e\u0026lt;remote\u0026gt;.git/info/lfs\u003c/code\u003e path\nthat did not exist on disk, leaving LFS-tracked files as pointers\nwhen cloning from a local repo.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eDeduplicate objects when writing a multi-pack-index. Objects present\nin multiple packs (e.g. after \u003ccode\u003egit gc\u003c/code\u003e creates a cruft pack) would\notherwise produce an OIDL chunk with repeated SHAs, causing\n\u003ccode\u003egit multi-pack-index verify\u003c/code\u003e to fail with \u0026quot;oid lookup out of order\u0026quot;.\n(\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/2152\"\u003e#2152\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eExtend ignorecase and precomposeunicode support to index lookups.\n(\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/1807\"\u003e#1807\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.2.0\u003c/h2\u003e\n\u003ch2\u003eNotable changes since 1.1.0\u003c/h2\u003e\n\u003ch3\u003eNew features\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003eam\u003c/code\u003e command and \u003ccode\u003eporcelain.am()\u003c/code\u003e for applying mailbox-style email patches (\u003ccode\u003egit am\u003c/code\u003e), with state persistence for \u003ccode\u003e--continue\u003c/code\u003e, \u003ccode\u003e--skip\u003c/code\u003e, \u003ccode\u003e--abort\u003c/code\u003e, and \u003ccode\u003e--quit\u003c/code\u003e recovery (\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/1692\"\u003e#1692\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003eapply\u003c/code\u003e command and \u003ccode\u003eporcelain.apply_patch()\u003c/code\u003e for applying unified diffs, including rename/copy detection, binary patches with Git's base85 encoding, and \u003ccode\u003e--3way\u003c/code\u003e merge fallback (\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/1784\"\u003e#1784\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eExpand \u003ccode\u003elog\u003c/code\u003e command options: \u003ccode\u003e--oneline\u003c/code\u003e, \u003ccode\u003e--abbrev-commit\u003c/code\u003e, \u003ccode\u003e--author\u003c/code\u003e, \u003ccode\u003e--committer\u003c/code\u003e, \u003ccode\u003e--grep\u003c/code\u003e, \u003ccode\u003e--since\u003c/code\u003e/\u003ccode\u003e--after\u003c/code\u003e, \u003ccode\u003e--until\u003c/code\u003e/\u003ccode\u003e--before\u003c/code\u003e, \u003ccode\u003e-n\u003c/code\u003e/\u003ccode\u003e--max-count\u003c/code\u003e, \u003ccode\u003e--no-merges\u003c/code\u003e, \u003ccode\u003e--merges\u003c/code\u003e, \u003ccode\u003e--stat\u003c/code\u003e, \u003ccode\u003e-p\u003c/code\u003e/\u003ccode\u003e--patch\u003c/code\u003e, \u003ccode\u003e--name-only\u003c/code\u003e, and \u003ccode\u003e--follow\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/1779\"\u003e#1779\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eAdd support for push options (\u003ccode\u003e-o\u003c/code\u003e/\u003ccode\u003e--push-option\u003c/code\u003e) in \u003ccode\u003epush\u003c/code\u003e, enabling AGit flow and other server-side push option workflows.\u003c/li\u003e\n\u003cli\u003eAdd missing push options: \u003ccode\u003e--all\u003c/code\u003e, \u003ccode\u003e--tags\u003c/code\u003e, \u003ccode\u003e--delete\u003c/code\u003e, \u003ccode\u003e--dry-run\u003c/code\u003e, \u003ccode\u003e--prune\u003c/code\u003e, \u003ccode\u003e--set-upstream\u003c/code\u003e, \u003ccode\u003e--follow-tags\u003c/code\u003e, and \u003ccode\u003e--mirror\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/1844\"\u003e#1844\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eAdd support for atomic push operations (\u003ccode\u003e--atomic\u003c/code\u003e): either all ref updates succeed or none are applied (\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/1781\"\u003e#1781\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eAdd support for \u003ccode\u003eextensions.relativeworktrees\u003c/code\u003e repository extension, allowing worktrees to use relative paths (\u003ca href=\"https://redirect.github.com/dulwich/dulwich/issues/2112\"\u003e#2112\u003c/a\u003e).\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jelmer/dulwich/blob/main/NEWS\"\u003edulwich's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e1.2.5\t2026-05-28\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSECURITY(GHSA-gfhv-vqv2-4544): Validate submodule paths in\n\u003ccode\u003eporcelain.submodule_update\u003c/code\u003e (and thus\n\u003ccode\u003eporcelain.clone(recurse_submodules=True)\u003c/code\u003e). A crafted upstream\nrepository could carry a submodule whose path was \u003ccode\u003e.git/hooks\u003c/code\u003e (or\nany other path inside \u003ccode\u003e.git\u003c/code\u003e or above the work tree), causing the\nsubmodule's tree contents to be written there with their executable\nbits intact -- dropping a hook that later commands would run. Submodule\npaths are now rejected if they are absolute or carry a component that\nthe configured path validator refuses, and the submodule's own tree is\nmaterialized with the same validator. This is the dulwich analogue of git's\nCVE-2024-32002 / CVE-2024-32004.\n(Jelmer Vernooij; reported by tonghuaroot)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSECURITY(CVE-2026-42305): Harden tree path validation against entry\nnames that are harmless on POSIX but dangerous when checked out on\nWindows. A crafted tree could previously carry such names through to\nthe work tree. \u003ccode\u003evalidate_path_element_ntfs\u003c/code\u003e now also rejects:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eWindows path separators, so an entry named\n\u003ccode\u003e.git\\hooks\\pre-commit.exe\u003c/code\u003e can no longer materialize a file\ninside \u003ccode\u003e.git\u003c/code\u003e that Git for Windows would execute.\u003c/li\u003e\n\u003cli\u003eThe alternate data stream marker \u003ccode\u003e:\u003c/code\u003e (e.g.\n\u003ccode\u003e.git::$INDEX_ALLOCATION\u003c/code\u003e, which writes into \u003ccode\u003e.git\u003c/code\u003e directly).\u003c/li\u003e\n\u003cli\u003eNTFS 8.3 short-name aliases of \u003ccode\u003e.git\u003c/code\u003e (\u003ccode\u003egit~\u0026lt;digits\u0026gt;\u003c/code\u003e); only\n\u003ccode\u003egit~1\u003c/code\u003e was rejected before.\u003c/li\u003e\n\u003cli\u003eReserved Windows device names (\u003ccode\u003eCON\u003c/code\u003e, \u003ccode\u003ePRN\u003c/code\u003e, \u003ccode\u003eAUX\u003c/code\u003e, \u003ccode\u003eNUL\u003c/code\u003e,\n\u003ccode\u003eCOM1\u003c/code\u003e-\u003ccode\u003eCOM9\u003c/code\u003e, \u003ccode\u003eLPT1\u003c/code\u003e-\u003ccode\u003eLPT9\u003c/code\u003e), including with an extension or\ntrailing dots/spaces such as \u003ccode\u003eNUL.txt\u003c/code\u003e or \u003ccode\u003eCOM1 .bar\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eIn addition, \u003ccode\u003ecore.protectNTFS\u003c/code\u003e now defaults to true on every\nplatform (matching git after CVE-2019-1353), so a POSIX clone no longer\naccepts paths that would be unsafe on a later Windows clone, and both\n\u003ccode\u003ecore.protectNTFS\u003c/code\u003e and \u003ccode\u003ecore.protectHFS\u003c/code\u003e are now read under their\ncorrect option names, having previously been silently ignored. POSIX\nusers who need literal NTFS-unsafe filenames can opt out with\n\u003ccode\u003ecore.protectNTFS=false\u003c/code\u003e.\n(Jelmer Vernooij; reported by Christopher Toth)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSECURITY (CVE-2026-42563): Shell-quote values substituted into\n\u003ccode\u003eProcessMergeDriver\u003c/code\u003e commands. \u003ccode\u003e%P\u003c/code\u003e is a path from the git\ntree, so a malicious branch could inject shell commands when the\nuser had a merge driver configured that referenced \u003ccode\u003e%P\u003c/code\u003e.\n(Jelmer Vernooij; reported by Ravishanker Kusuma (hayageek))\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSECURITY(CVE-2026-47712): Sanitize commit subjects used in\n\u003ccode\u003eporcelain.format_patch\u003c/code\u003e filenames so a malicious subject (e.g.\n\u003ccode\u003ex/../../x\u003c/code\u003e) cannot direct the generated patch outside \u003ccode\u003eoutdir\u003c/code\u003e.\n\u003ccode\u003eget_summary\u003c/code\u003e now matches git's \u003ccode\u003eformat_sanitized_subject\u003c/code\u003e.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/073f4dfa9840af2da59887ed828b026b609faa6c\"\u003e\u003ccode\u003e073f4df\u003c/code\u003e\u003c/a\u003e Release 1.2.5\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/5f85d3e4b0d47dd7fbf37934f9a4b9b6b98bb467\"\u003e\u003ccode\u003e5f85d3e\u003c/code\u003e\u003c/a\u003e tests: fix Windows-only failures in NTFS and merge-driver tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/25313ad7f9d5036b03617dc3dfc284a586966dab\"\u003e\u003ccode\u003e25313ad\u003c/code\u003e\u003c/a\u003e Merge branch 'advisory-5'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/1ca18147a1d03b61c2ae203c46bf0b2a2f5dd421\"\u003e\u003ccode\u003e1ca1814\u003c/code\u003e\u003c/a\u003e submodule: Reject unsafe submodule paths in submodule_update\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/3559ef15c1e2a8d2a56c98f36b53b29c5d60b9fd\"\u003e\u003ccode\u003e3559ef1\u003c/code\u003e\u003c/a\u003e Merge branch 'advisory-4'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/f860ca489d63624ae6d7c7945fbbd19018b8125c\"\u003e\u003ccode\u003ef860ca4\u003c/code\u003e\u003c/a\u003e server: Honour receive.maxInputSize to bound received packs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/0fd6e6bb61f8017b1af4b5fdbf7602ddbcf6d17e\"\u003e\u003ccode\u003e0fd6e6b\u003c/code\u003e\u003c/a\u003e Merge branch 'advisory-3'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/0110b885a1ab5b2128473263a6ff5b7230732e49\"\u003e\u003ccode\u003e0110b88\u003c/code\u003e\u003c/a\u003e Merge branch 'advisory-2'\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/49eb56e51aad637fc23d54bf2a08cb42739b8290\"\u003e\u003ccode\u003e49eb56e\u003c/code\u003e\u003c/a\u003e Add NEWS entry for CVE-2026-42305\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jelmer/dulwich/commit/57efc4aa1581e038915a0fd79365be53b150f4a9\"\u003e\u003ccode\u003e57efc4a\u003c/code\u003e\u003c/a\u003e Merge branch 'advisory-1'\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/dulwich/dulwich/compare/dulwich-0.22.8...dulwich-1.2.5\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 3.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in \u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining and\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e Release 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e Pre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from kjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e Convert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from kjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from StanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from StanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kjd/idna/compare/v3.10...v3.15\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langchain-core` from 0.3.49 to 1.3.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langchain/releases\"\u003elangchain-core's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elangchain-core==1.3.3\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.2\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37198\"\u003e#37198\u003c/a\u003e)\nfix(core): set deprecation \u003ccode\u003esince\u003c/code\u003e to 1.3.3 to match release (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37200\"\u003e#37200\u003c/a\u003e)\nfix(core, langchain): harden \u003ccode\u003eload()\u003c/code\u003e against untrusted manifests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37197\"\u003e#37197\u003c/a\u003e)\nchore: bump notebook from 7.5.0 to 7.5.6 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37109\"\u003e#37109\u003c/a\u003e)\nchore: bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260408 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37129\"\u003e#37129\u003c/a\u003e)\nfix(core): preserve structured \u003ccode\u003einputs\u003c/code\u003e on tool runs in tracers (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37108\"\u003e#37108\u003c/a\u003e)\nrelease(perplexity): 1.2.0 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37091\"\u003e#37091\u003c/a\u003e)\nchore(docs): update x handle references (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37081\"\u003e#37081\u003c/a\u003e)\nfix(core): make \u003ccode\u003eremoval\u003c/code\u003e optional in \u003ccode\u003ewarn_deprecated\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37056\"\u003e#37056\u003c/a\u003e)\nfix(core): validate batch_size in _batch and _abatch to prevent infinite loop (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36663\"\u003e#36663\u003c/a\u003e)\nchore(core): mark stream_v2/astream_v2 as beta (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36992\"\u003e#36992\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.2\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.1\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36990\"\u003e#36990\u003c/a\u003e)\nfeat(core): add content-block-centric streaming (v2) (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36834\"\u003e#36834\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.1\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.0\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36972\"\u003e#36972\u003c/a\u003e)\nfeat(core): allow _format_output to pass through list of ToolOutputMixin instances (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36963\"\u003e#36963\u003c/a\u003e)\nchore: bump nbconvert from 7.17.0 to 7.17.1 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36923\"\u003e#36923\u003c/a\u003e)\nfeat(core): Update inheritance behavior for tracer metadata for special keys (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36900\"\u003e#36900\u003c/a\u003e)\nchore: bump langsmith from 0.7.13 to 0.7.31 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36813\"\u003e#36813\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.0\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.2.31\u003c/p\u003e\n\u003cp\u003erelease(core): release 1.3.0 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36851\"\u003e#36851\u003c/a\u003e)\nrelease(core): 1.3.0a3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36829\"\u003e#36829\u003c/a\u003e)\nchore(core): keep checkpoint_ns behavior in streaming metadata for backwards compat (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36828\"\u003e#36828\u003c/a\u003e)\nfeat(core): Add chat model and LLM invocation params to traceable metadata (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36771\"\u003e#36771\u003c/a\u003e)\nfix(core): restore cloud metadata IPs and link-local range in SSRF policy (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36816\"\u003e#36816\u003c/a\u003e)\nchore(deps): bump pytest to \u003ccode\u003e9.0.3\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36801\"\u003e#36801\u003c/a\u003e)\nchore(core): harden private SSRF utilities (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36768\"\u003e#36768\u003c/a\u003e)\nfix(openai): handle content blocks without type key in responses api conversion (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36725\"\u003e#36725\u003c/a\u003e)\nchore: bump pytest from 9.0.2 to 9.0.3 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36719\"\u003e#36719\u003c/a\u003e)\nrelease(core): 1.3.0.a2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36698\"\u003e#36698\u003c/a\u003e)\nfix(core): Use reference counting for storing inherited run trees to support garbage collection (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36660\"\u003e#36660\u003c/a\u003e)\ndocs(core): nit (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36685\"\u003e#36685\u003c/a\u003e)\nrelease(core): 1.3.0a1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36656\"\u003e#36656\u003c/a\u003e)\nchore(core): reduce streaming metadata / perf (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36588\"\u003e#36588\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.0a3\u003c/h2\u003e\n\u003cp\u003eInitial release\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/5039dfec1f8e78459540a7f1b52fb0d6d82e3f07\"\u003e\u003ccode\u003e5039dfe\u003c/code\u003e\u003c/a\u003e release(core): 1.3.3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37198\"\u003e#37198\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/55a7707837742c2f7a9b7e4a5dd428bf615f3b82\"\u003e\u003ccode\u003e55a7707\u003c/code\u003e\u003c/a\u003e fix(core): set deprecation \u003ccode\u003esince\u003c/code\u003e to 1.3.3 to match release (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37200\"\u003e#37200\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/c979c6187b6d82f4bef35b10b84b39fa44806b22\"\u003e\u003ccode\u003ec979c61\u003c/code\u003e\u003c/a\u003e fix(core, langchain): harden \u003ccode\u003eload()\u003c/code\u003e against untrusted manifests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37197\"\u003e#37197\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/d7031101da78e3f6b6c5956b48a5170c1a33292b\"\u003e\u003ccode\u003ed703110\u003c/code\u003e\u003c/a\u003e docs: update README.md (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37190\"\u003e#37190\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/4d50a2a68b38e9acc53027ea7e7cc89e2d80b4c7\"\u003e\u003ccode\u003e4d50a2a\u003c/code\u003e\u003c/a\u003e ci(infra): run pre-release checks before TestPyPI publish (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37194\"\u003e#37194\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/9bd730e1991baac4ea80aa07d93110dc1b52ee25\"\u003e\u003ccode\u003e9bd730e\u003c/code\u003e\u003c/a\u003e fix(fireworks): require \u003ccode\u003eapi_key\u003c/code\u003e in \u003ccode\u003eFireworksEmbeddings\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37193\"\u003e#37193\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/f475f4191fc3a8d3cf14063b44d524594c080c04\"\u003e\u003ccode\u003ef475f41\u003c/code\u003e\u003c/a\u003e release(mistralai): 1.1.4 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37191\"\u003e#37191\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/7dbff48aff508b01dc231ea0cbd4e4e09da92c97\"\u003e\u003ccode\u003e7dbff48\u003c/code\u003e\u003c/a\u003e fix(mistralai): strip non-wire keys from \u003ccode\u003eToolMessage\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37188\"\u003e#37188\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/913816c440ea79295370e1af6484e17b86e5d03c\"\u003e\u003ccode\u003e913816c\u003c/code\u003e\u003c/a\u003e release(fireworks): 1.3.1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37189\"\u003e#37189\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/4498d3dc84a85688fa4d15476403a900bc7f9114\"\u003e\u003ccode\u003e4498d3d\u003c/code\u003e\u003c/a\u003e fix(fireworks): strip non-wire keys from \u003ccode\u003eToolMessage\u003c/code\u003e text content blocks (#...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/langchain-ai/langchain/compare/langchain-core==0.3.49...langchain-core==1.3.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langchain-openai` from 0.3.11 to 1.1.14\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langchain/releases\"\u003elangchain-openai's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elangchain-openai==1.1.14\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-openai==1.1.13\u003c/p\u003e\n\u003cp\u003erelease(openai): 1.1.14 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36820\"\u003e#36820\u003c/a\u003e)\nfix(openai): use SSRF-safe transport for image token counting (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36819\"\u003e#36819\u003c/a\u003e)\nchore(deps): bump pytest to \u003ccode\u003e9.0.3\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36801\"\u003e#36801\u003c/a\u003e)\nchore: bump langsmith from 0.6.3 to 0.7.31 in /libs/partners/openai (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36795\"\u003e#36795\u003c/a\u003e)\nchore: bump pillow from 12.1.1 to 12.2.0 in /libs/partners/openai (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36777\"\u003e#36777\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-openai==1.1.13\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-openai==1.1.12\u003c/p\u003e\n\u003cp\u003erelease(openai): 1.1.13 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36729\"\u003e#36729\u003c/a\u003e)\nfix(openai): handle content blocks without type key in responses api conversion (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36725\"\u003e#36725\u003c/a\u003e)\nchore(model-profiles): refresh model profile data (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36539\"\u003e#36539\u003c/a\u003e)\nchore(openai): fix broken vcr cassette playback and add ci guard (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36502\"\u003e#36502\u003c/a\u003e)\nfix(openai,groq,openrouter): use is-not-None checks in usage metadata token extraction (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36500\"\u003e#36500\u003c/a\u003e)\nfix(core): fixed typos in the documentation (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36459\"\u003e#36459\u003c/a\u003e)\nchore(model-profiles): refresh model profile data (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36455\"\u003e#36455\u003c/a\u003e)\nfeat(core): impute placeholder filenames for OpenAI file inputs (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36433\"\u003e#36433\u003c/a\u003e)\nchore: pygments\u0026gt;=2.20.0 across all packages (CVE-2026-4539) (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36385\"\u003e#36385\u003c/a\u003e)\nchore(model-profiles): refresh model profile data (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36368\"\u003e#36368\u003c/a\u003e)\nfix(openai): update computer call test (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36352\"\u003e#36352\u003c/a\u003e)\nfix(openai): let user-provided User-Agent override the Azure default (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35523\"\u003e#35523\u003c/a\u003e)\nchore: bump requests from 2.32.5 to 2.33.0 in /libs/partners/openai (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36248\"\u003e#36248\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-openai==1.1.12\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-openai==1.1.11\u003c/p\u003e\n\u003cp\u003efix(openai): bump min core version (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36180\"\u003e#36180\u003c/a\u003e)\nrelease(openai): 1.1.12 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36178\"\u003e#36178\u003c/a\u003e)\nfix(core,model-profiles): add missing \u003ccode\u003eModelProfile\u003c/code\u003e fields, warn on schema drift (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36129\"\u003e#36129\u003c/a\u003e)\nfix(openai): support phase parameter (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36161\"\u003e#36161\u003c/a\u003e)\nfix(openai): preserve namespace field in streaming function_call chunks (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36108\"\u003e#36108\u003c/a\u003e)\nci: suppress pytest streaming output in CI (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36092\"\u003e#36092\u003c/a\u003e)\nci: avoid unnecessary dep installs in lint targets (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36046\"\u003e#36046\u003c/a\u003e)\nchore(model-profiles): refresh model profile data (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36039\"\u003e#36039\u003c/a\u003e)\nchore: bump orjson from 3.11.5 to 3.11.6 in /libs/partners/openai (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35860\"\u003e#35860\u003c/a\u003e)\nfix(openai): add type: message to Responses API input items (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35693\"\u003e#35693\u003c/a\u003e)\nperf(.github): set a timeout on get min versions HTTP calls (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35851\"\u003e#35851\u003c/a\u003e)\nfeat(model-profiles): new fields + \u003ccode\u003eMakefile\u003c/code\u003e target (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35788\"\u003e#35788\u003c/a\u003e)\nfix(openai): close PIL Image handles in token counting to prevent fd leak (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35742\"\u003e#35742\u003c/a\u003e)\nfix(openai): typo (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35763\"\u003e#35763\u003c/a\u003e)\nchore(model-profiles): refresh model profile data (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35754\"\u003e#35754\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-openai==1.1.11\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-openai==1.1.10\u003c/p\u003e\n\u003cp\u003efix(openai): bump min core version (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35705\"\u003e#35705\u003c/a\u003e)\nrelease(openai): 1.1.11 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35703\"\u003e#35703\u003c/a\u003e)\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/b7447c6969fc928ec3f29c200e2e56c0a46c4c77\"\u003e\u003ccode\u003eb7447c6\u003c/code\u003e\u003c/a\u003e fix(infra): skip serdes tests in min-version release step (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36818\"\u003e#36818\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/41c0cc58b0dac82000d24715f7a4b44dc8b01fd3\"\u003e\u003ccode\u003e41c0cc5\u003c/code\u003e\u003c/a\u003e release(openai): 1.1.14 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36820\"\u003e#36820\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/0516156ef98f5001129f6d47bc8682d6536d58fb\"\u003e\u003ccode\u003e0516156\u003c/code\u003e\u003c/a\u003e fix(openai): use SSRF-safe transport for image token counting (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36819\"\u003e#36819\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/338aa8131a8124e7aa1e042616ccd2366ff9f699\"\u003e\u003ccode\u003e338aa81\u003c/code\u003e\u003c/a\u003e fix(core): restore cloud metadata IPs and link-local range in SSRF policy (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/3\"\u003e#3\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/51e954877efd2d2c3c5bf09364dcfec8794eadb0\"\u003e\u003ccode\u003e51e9548\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36797\"\u003e#36797\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/e85c418cfa559d4a794ddc6db92c6febab44651c\"\u003e\u003ccode\u003ee85c418\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/model-profiles (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36798\"\u003e#36798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/789126e6c78ad74664bea26228dda6e72e135dce\"\u003e\u003ccode\u003e789126e\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/standard-tests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36799\"\u003e#36799\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/937b3eb3827551d17ee4736f9acc4aa57e88c716\"\u003e\u003ccode\u003e937b3eb\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/langchain_v1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36800\"\u003e#36800\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/a06c205738cf5953e28c37287ddb1559d67c01f6\"\u003e\u003ccode\u003ea06c205\u003c/code\u003e\u003c/a\u003e ci(infra): validate issue checkboxes by section (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36811\"\u003e#36811\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/aa33b06deb0d65489ce254b48a8aaf8a86304c18\"\u003e\u003ccode\u003eaa33b06\u003c/code\u003e\u003c/a\u003e fix(langchain-classic): suppress mypy errors in compat code (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36806\"\u003e#36806\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/langchain-ai/langchain/compare/langchain-openai==0.3.11...langchain-openai==1.1.14\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langchain-text-splitters` from 0.3.7 to 1.1.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langchain/releases\"\u003elangchain-text-splitters's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elangchain-text-splitters==1.1.2\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-text-splitters==1.1.1\u003c/p\u003e\n\u003cp\u003erelease(text-splitters): 1.1.2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36822\"\u003e#36822\u003c/a\u003e)\nfix(text-splitters): deprecate and use SSRF-safe transport in split_text_from_url (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36821\"\u003e#36821\u003c/a\u003e)\nchore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36797\"\u003e#36797\u003c/a\u003e)\nchore(deps): bump pytest to \u003ccode\u003e9.0.3\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36801\"\u003e#36801\u003c/a\u003e)\nchore: bump pytest from 9.0.2 to 9.0.3 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36714\"\u003e#36714\u003c/a\u003e)\nchore: add comment explaining \u003ccode\u003epygments\u0026gt;=2.20.0\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36570\"\u003e#36570\u003c/a\u003e)\nrelease(core): 1.2.26 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36511\"\u003e#36511\u003c/a\u003e)\nchore: pygments\u0026gt;=2.20.0 across all packages (CVE-2026-4539) (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36385\"\u003e#36385\u003c/a\u003e)\nfix(text-splitters): prevent silent data loss for empty dict values in RecursiveJsonSplitter (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35079\"\u003e#35079\u003c/a\u003e)\nfeat(text-splitters): support spacy tests with Python 3.14 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36198\"\u003e#36198\u003c/a\u003e)\nfix(infra): correct lint_diff relative paths in package makefiles (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36333\"\u003e#36333\u003c/a\u003e)\nchore: bump requests from 2.32.5 to 2.33.0 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36238\"\u003e#36238\u003c/a\u003e)\nchore: bump nltk from 3.9.3 to 3.9.4 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36237\"\u003e#36237\u003c/a\u003e)\nchore(partners): bump \u003ccode\u003elangchain-core\u003c/code\u003e min to \u003ccode\u003e1.2.21\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36183\"\u003e#36183\u003c/a\u003e)\nchore(text-splitters): bump nltk in lock file (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36112\"\u003e#36112\u003c/a\u003e)\nci: suppress pytest streaming output in CI (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36092\"\u003e#36092\u003c/a\u003e)\nchore(text-splitters): speed up ci (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36050\"\u003e#36050\u003c/a\u003e)\nci: avoid unnecessary dep installs in lint targets (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36046\"\u003e#36046\u003c/a\u003e)\nchore: bump orjson from 3.11.5 to 3.11.6 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35856\"\u003e#35856\u003c/a\u003e)\nchore: bump locks, lint (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35985\"\u003e#35985\u003c/a\u003e)\nperf(.github): set a timeout on get min versions HTTP calls (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35851\"\u003e#35851\u003c/a\u003e)\nchore: bump tornado from 6.5.2 to 6.5.5 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35774\"\u003e#35774\u003c/a\u003e)\nchore: bump the minor-and-patch group across 3 directories with 3 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35589\"\u003e#35589\u003c/a\u003e)\nchore: bump the other-deps group across 3 directories with 2 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35512\"\u003e#35512\u003c/a\u003e)\nchore: bump nltk from 3.9.2 to 3.9.3 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35449\"\u003e#35449\u003c/a\u003e)\nchore: bump the other-deps group across 3 directories with 2 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35407\"\u003e#35407\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-text-splitters==1.1.1\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-text-splitters==1.1.0\u003c/p\u003e\n\u003cp\u003erelease(text-splitters): 1.1.1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35318\"\u003e#35318\u003c/a\u003e)\nfix(text-splitters): prevent JSFrameworkTextSplitter from mutating self._separators on each split_text() call (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35316\"\u003e#35316\u003c/a\u003e)\nchore: bump transformers from 5.1.0 to 5.2.0 in /libs/text-splitters in the other-deps group across 1 directory (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35279\"\u003e#35279\u003c/a\u003e)\nchore: bump the other-deps group across 3 directories with 2 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35255\"\u003e#35255\u003c/a\u003e)\nstyle: bump ruff version to 0.15 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35042\"\u003e#35042\u003c/a\u003e)\nfix: Server-Side Request Forgery (SSRF) in HTMLHeaderTextSplitter.split_text_from_url (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35196\"\u003e#35196\u003c/a\u003e)\nfeat(text-splitters): add model_kwargs to SentenceTransformersTokenTextSplitter (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35113\"\u003e#35113\u003c/a\u003e)\nchore(deps): bump langsmith from 0.4.31 to 0.6.3 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35162\"\u003e#35162\u003c/a\u003e)\nchore(deps): bump the other-deps group across 3 directories with 12 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35127\"\u003e#35127\u003c/a\u003e)\nchore(deps): bump the other-deps group across 3 directories with 8 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35120\"\u003e#35120\u003c/a\u003e)\nchore: add \u003ccode\u003emake type\u003c/code\u003e target (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35015\"\u003e#35015\u003c/a\u003e)\nrevert: \u0026quot;chore: add typing target in \u003ccode\u003eMakefile\u003c/code\u003e\u0026quot; (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35013\"\u003e#35013\u003c/a\u003e)\nchore: add typing target in \u003ccode\u003eMakefile\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/35012\"\u003e#35012\u003c/a\u003e)\nfix(text-splitters): reverse preserved elements iterator in \u003ccode\u003eHTMLSemanticPreservingSplitter\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/34080\"\u003e#34080\u003c/a\u003e)\nchore: enrich \u003ccode\u003epyproject.toml\u003c/code\u003e files (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/34980\"\u003e#34980\u003c/a\u003e)\nchore(deps): bump the uv group across 20 directories with 3 updates (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/34941\"\u003e#34941\u003c/a\u003e)\nchore: upgrade urllib3 to 2.6.3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/34940\"\u003e#34940\u003c/a\u003e)\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/58c4e5bbdd9d18d7fe7ec83b5a05477d06fe2a8e\"\u003e\u003ccode\u003e58c4e5b\u003c/code\u003e\u003c/a\u003e release(text-splitters): 1.1.2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36822\"\u003e#36822\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/c289bf10e940e960a132d7403482283114063063\"\u003e\u003ccode\u003ec289bf1\u003c/code\u003e\u003c/a\u003e fix(text-splitters): deprecate and use SSRF-safe transport in split_text_from...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/b7447c6969fc928ec3f29c200e2e56c0a46c4c77\"\u003e\u003ccode\u003eb7447c6\u003c/code\u003e\u003c/a\u003e fix(infra): skip serdes tests in min-version release step (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36818\"\u003e#36818\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/41c0cc58b0dac82000d24715f7a4b44dc8b01fd3\"\u003e\u003ccode\u003e41c0cc5\u003c/code\u003e\u003c/a\u003e release(openai): 1.1.14 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36820\"\u003e#36820\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/0516156ef98f5001129f6d47bc8682d6536d58fb\"\u003e\u003ccode\u003e0516156\u003c/code\u003e\u003c/a\u003e fix(openai): use SSRF-safe transport for image token counting (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36819\"\u003e#36819\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/338aa8131a8124e7aa1e042616ccd2366ff9f699\"\u003e\u003ccode\u003e338aa81\u003c/code\u003e\u003c/a\u003e fix(core): restore cloud metadata IPs and link-local range in SSRF policy (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/3\"\u003e#3\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/51e954877efd2d2c3c5bf09364dcfec8794eadb0\"\u003e\u003ccode\u003e51e9548\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/text-splitters (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36797\"\u003e#36797\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/e85c418cfa559d4a794ddc6db92c6febab44651c\"\u003e\u003ccode\u003ee85c418\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/model-profiles (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36798\"\u003e#36798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/789126e6c78ad74664bea26228dda6e72e135dce\"\u003e\u003ccode\u003e789126e\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/standard-tests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36799\"\u003e#36799\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/937b3eb3827551d17ee4736f9acc4aa57e88c716\"\u003e\u003ccode\u003e937b3eb\u003c/code\u003e\u003c/a\u003e chore: bump langsmith from 0.6.3 to 0.7.31 in /libs/langchain_v1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36800\"\u003e#36800\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/langchain-ai/langchain/compare/langchain-text-splitters==0.3.7...langchain-text-splitters==1.1.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langsmith` from 0.3.19 to 0.8.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langsmith-sdk/releases\"\u003elangsmith's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.8.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat(js,py): JS 0.6.0, Py 0.8.0 by \u003ca href=\"https://github.com/jacoblee93\"\u003e\u003ccode\u003e@​jacoblee93\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2831\"\u003elangchain-ai/langsmith-sdk#2831\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease(js): 0.6.0 by \u003ca href=\"https://github.com/jacoblee93\"\u003e\u003ccode\u003e@​jacoblee93\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2832\"\u003elangchain-ai/langsmith-sdk#2832\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erelease(py): 0.8.0 by \u003ca href=\"https://github.com/jacoblee93\"\u003e\u003ccode\u003e@​jacoblee93\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/langchain-ai/langsmith-sdk/pull/2833\"\u003elangchain-ai/langsmith-sdk#2833\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/langchain-ai/langsmith-sdk/compare/v0.7.38...v0.8.0\"\u003ehttps://github.com/langchain-ai/langsmith-sdk/compare/v0.7.38...v0.8...\n\n_Description has been truncated_","html_url":"https://github.com/HarleyCoops/Qwen3-RailroadEngineer1959-RL/pull/6","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/HarleyCoops%2FQwen3-RailroadEngineer1959-RL/issues/6","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/6/packages"}},{"old_version":"6.1.0","new_version":"6.1.1","update_type":"patch","path":null,"pr_created_at":"2026-05-28T20:56:21.000Z","version_change":"6.1.0 → 6.1.1","issue":{"uuid":"4543760423","node_id":"PR_kwDOSqs-LM7gZ0sS","number":5,"state":"open","title":"chore(deps): bump lxml from 6.1.0 to 6.1.1","user":"dependabot[bot]","labels":["dependencies","python:uv","dependabot-approved"],"assignees":[],"locked":false,"comments_count":4,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-28T20:56:21.000Z","updated_at":"2026-05-31T04:50:58.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps)","packages":[{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"}],"path":null,"ecosystem":"pip"},"body":"Bumps [lxml](https://github.com/lxml/lxml) from 6.1.0 to 6.1.1.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n","html_url":"https://github.com/TechMatrix-labs/pythinker-code/pull/5","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/TechMatrix-labs%2Fpythinker-code/issues/5","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/5/packages"}},{"old_version":"6.1.0","new_version":"6.1.1","update_type":"patch","path":null,"pr_created_at":"2026-05-28T10:05:33.000Z","version_change":"6.1.0 → 6.1.1","issue":{"uuid":"4539525071","node_id":"PR_kwDOSqM5uM7gL4Bz","number":6,"state":"closed","title":"[upd] pypi: Bump the minor group with 5 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-05-30T00:51:29.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-28T10:05:33.000Z","updated_at":"2026-05-30T00:51:31.000Z","time_to_close":139556,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"[upd] pypi: Bump","group_name":"minor","update_count":5,"packages":[{"name":"certifi","old_version":"2026.4.22","new_version":"2026.5.20","repository_url":"https://github.com/certifi/python-certifi"},{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"},{"name":"httpx-socks","old_version":"0.10.0","new_version":"0.11.0","repository_url":"https://github.com/romis2012/httpx-socks"},{"name":"typer","old_version":"0.25.1","new_version":"0.26.2","repository_url":"https://github.com/fastapi/typer"},{"name":"basedpyright","old_version":"1.39.4","new_version":"1.39.6","repository_url":"https://github.com/detachhead/basedpyright"}],"path":null,"ecosystem":"pip"},"body":"Bumps the minor group with 5 updates:\n\n| Package | From | To |\n| --- | --- | --- |\n| [certifi](https://github.com/certifi/python-certifi) | `2026.4.22` | `2026.5.20` |\n| [lxml](https://github.com/lxml/lxml) | `6.1.0` | `6.1.1` |\n| [httpx-socks](https://github.com/romis2012/httpx-socks) | `0.10.0` | `0.11.0` |\n| [typer](https://github.com/fastapi/typer) | `0.25.1` | `0.26.2` |\n| [basedpyright](https://github.com/detachhead/basedpyright) | `1.39.4` | `1.39.6` |\n\nUpdates `certifi` from 2026.4.22 to 2026.5.20\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/certifi/python-certifi/commit/d7ea151afc2ce6bef0555b9349902bd867e928dd\"\u003e\u003ccode\u003ed7ea151\u003c/code\u003e\u003c/a\u003e 2026.05.20 (\u003ca href=\"https://redirect.github.com/certifi/python-certifi/issues/413\"\u003e#413\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/certifi/python-certifi/compare/2026.04.22...2026.05.20\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lxml` from 6.1.0 to 6.1.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `httpx-socks` from 0.10.0 to 0.11.0\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/romis2012/httpx-socks/commit/ae0df29274f3b7018ee30b982a878921667c6511\"\u003e\u003ccode\u003eae0df29\u003c/code\u003e\u003c/a\u003e Delete setup.py\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/romis2012/httpx-socks/commit/4e372f0895438f8034dbc9cb2637dc4e121bd69f\"\u003e\u003ccode\u003e4e372f0\u003c/code\u003e\u003c/a\u003e Move project metadata to pyproject.toml, other fixes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/romis2012/httpx-socks/commit/07bac473517a6265e490eb53abcbbe59b5794fd3\"\u003e\u003ccode\u003e07bac47\u003c/code\u003e\u003c/a\u003e Fix http2 issue (\u003ca href=\"https://redirect.github.com/romis2012/httpx-socks/issues/27\"\u003e#27\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/romis2012/httpx-socks/compare/v0.10.0...v0.11.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `typer` from 0.25.1 to 0.26.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/fastapi/typer/releases\"\u003etyper's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.26.2\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e🐛 Ensure that an envvar set for a \u003ccode\u003etyper.Option\u003c/code\u003e list is split on whitespace. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1791\"\u003e#1791\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.26.1\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e🐛 Ensure that an envvar set for \u003ccode\u003etyper.Option\u003c/code\u003e works as expected. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1788\"\u003e#1788\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eInternal\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e⬆ Bump python-dotenv from 1.2.1 to 1.2.2. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1714\"\u003e#1714\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.26.0\u003c/h2\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e➖ Vendor Click and streamline Typer's functionality and code base. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1774\"\u003e#1774\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\n\u003cul\u003e\n\u003cli\u003eTyper no longer depends on Click as a third party dependency, it vendors (includes the source code of) Click.\u003c/li\u003e\n\u003cli\u003eThis simplifies the work done by both Click and Typer teams.\u003c/li\u003e\n\u003cli\u003eIt allows Typer to evolve independently, and enables several new planned features.\u003c/li\u003e\n\u003cli\u003eIt will solve several dependency conflict situations for projects that use some packages that depend on Click and some that depend on Typer.\u003c/li\u003e\n\u003cli\u003eThis also means that Click-specific functionality is no longer supported, like extracting the Click app and adding Click-specific plug-ins, or customizing the field types with Click-specific types.\u003c/li\u003e\n\u003cli\u003eYou can read more about it in the docs for \u003ca href=\"https://typer.tiangolo.com/tutorial/click/\"\u003eVendored Click\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocs\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e📝 Update and simplify docs about help and management. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1778\"\u003e#1778\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update contributing docs, reference central docs. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1777\"\u003e#1777\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update security policy. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1775\"\u003e#1775\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update link syntax to minimal Markdown. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1623\"\u003e#1623\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update and simplify usage of admonitions. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1755\"\u003e#1755\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eInternal\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e📌 Pin max version of Click to \u003ccode\u003e\u0026gt;= 8.2.1, \u0026lt; 8.4\u003c/code\u003e temporarily to prevent incompatibilities. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1753\"\u003e#1753\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\n\u003cul\u003e\n\u003cli\u003eSuperseded by vendoring Click.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e👷 Configure Dependabot to group updates and update weekly. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1768\"\u003e#1768\u003c/a\u003e by \u003ca href=\"https://github.com/YuriiMotov\"\u003e\u003ccode\u003e@​YuriiMotov\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔥 Remove config files now in central GitHub repo. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1780\"\u003e#1780\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump idna from 3.11 to 3.15. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1771\"\u003e#1771\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump pymdown-extensions from 10.21.2 to 10.21.3. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1772\"\u003e#1772\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Fix categorization of PR 1475 in release notes. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1769\"\u003e#1769\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e✅ Add Fish shell completion tests for colon options. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1475\"\u003e#1475\u003c/a\u003e by \u003ca href=\"https://github.com/Mohamed-Elwasila\"\u003e\u003ccode\u003e@​Mohamed-Elwasila\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e✅ Extend completion unit tests for zsh, powershell and pwsh. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1767\"\u003e#1767\u003c/a\u003e by \u003ca href=\"https://github.com/ADiTyaRaj8969\"\u003e\u003ccode\u003e@​ADiTyaRaj8969\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump actions/github-script from 7.1.0 to 9.0.0. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1746\"\u003e#1746\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔧 Fix GitHub link in docs. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1754\"\u003e#1754\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆️ Migrate to Zensical. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1470\"\u003e#1470\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump urllib3 from 2.6.3 to 2.7.0. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1741\"\u003e#1741\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔧 Remove unnecessary Ruff rule. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1752\"\u003e#1752\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔒️ Add zizmor and fix audit findings. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1705\"\u003e#1705\u003c/a\u003e by \u003ca href=\"https://github.com/YuriiMotov\"\u003e\u003ccode\u003e@​YuriiMotov\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/fastapi/typer/blob/master/docs/release-notes.md\"\u003etyper's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.26.2 (2026-05-27)\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e🐛 Ensure that an envvar set for a \u003ccode\u003etyper.Option\u003c/code\u003e list is split on whitespace. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1791\"\u003e#1791\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.26.1 (2026-05-26)\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e🐛 Ensure that an envvar set for \u003ccode\u003etyper.Option\u003c/code\u003e works as expected. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1788\"\u003e#1788\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eInternal\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e⬆ Bump python-dotenv from 1.2.1 to 1.2.2. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1714\"\u003e#1714\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.26.0 (2026-05-26)\u003c/h2\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e➖ Vendor Click and streamline Typer's functionality and code base. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1774\"\u003e#1774\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\n\u003cul\u003e\n\u003cli\u003eTyper no longer depends on Click as a third party dependency, it vendors (includes the source code of) Click.\u003c/li\u003e\n\u003cli\u003eThis simplifies the work done by both Click and Typer teams.\u003c/li\u003e\n\u003cli\u003eIt allows Typer to evolve independently, and enables several new planned features.\u003c/li\u003e\n\u003cli\u003eIt will solve several dependency conflict situations for projects that use some packages that depend on Click and some that depend on Typer.\u003c/li\u003e\n\u003cli\u003eThis also means that Click-specific functionality is no longer supported, like extracting the Click app and adding Click-specific plug-ins, or customizing the field types with Click-specific types.\u003c/li\u003e\n\u003cli\u003eYou can read more about it in the docs for \u003ca href=\"https://typer.tiangolo.com/tutorial/click/\"\u003eVendored Click\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocs\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e📝 Update and simplify docs about help and management. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1778\"\u003e#1778\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update contributing docs, reference central docs. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1777\"\u003e#1777\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update security policy. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1775\"\u003e#1775\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update link syntax to minimal Markdown. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1623\"\u003e#1623\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update and simplify usage of admonitions. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1755\"\u003e#1755\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eInternal\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e📌 Pin max version of Click to \u003ccode\u003e\u0026gt;= 8.2.1, \u0026lt; 8.4\u003c/code\u003e temporarily to prevent incompatibilities. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1753\"\u003e#1753\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\n\u003cul\u003e\n\u003cli\u003eSuperseded by vendoring Click.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003cli\u003e👷 Configure Dependabot to group updates and update weekly. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1768\"\u003e#1768\u003c/a\u003e by \u003ca href=\"https://github.com/YuriiMotov\"\u003e\u003ccode\u003e@​YuriiMotov\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔥 Remove config files now in central GitHub repo. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1780\"\u003e#1780\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump idna from 3.11 to 3.15. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1771\"\u003e#1771\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump pymdown-extensions from 10.21.2 to 10.21.3. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1772\"\u003e#1772\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Fix categorization of PR 1475 in release notes. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1769\"\u003e#1769\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e✅ Add Fish shell completion tests for colon options. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1475\"\u003e#1475\u003c/a\u003e by \u003ca href=\"https://github.com/Mohamed-Elwasila\"\u003e\u003ccode\u003e@​Mohamed-Elwasila\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e✅ Extend completion unit tests for zsh, powershell and pwsh. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1767\"\u003e#1767\u003c/a\u003e by \u003ca href=\"https://github.com/ADiTyaRaj8969\"\u003e\u003ccode\u003e@​ADiTyaRaj8969\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump actions/github-script from 7.1.0 to 9.0.0. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1746\"\u003e#1746\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔧 Fix GitHub link in docs. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1754\"\u003e#1754\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆️ Migrate to Zensical. PR \u003ca href=\"https://redirect.github.com/fastapi/typer/pull/1470\"\u003e#1470\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/eef433fcf337734f51ac68a77a82748adfacaa85\"\u003e\u003ccode\u003eeef433f\u003c/code\u003e\u003c/a\u003e 🔖 Release version 0.26.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/23474b03bca44ace3c0f7459653b2433626de74e\"\u003e\u003ccode\u003e23474b0\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/5568bab22f9de34dbcd25e02a566505a11349d35\"\u003e\u003ccode\u003e5568bab\u003c/code\u003e\u003c/a\u003e 🐛 Ensure that an envvar set for a \u003ccode\u003etyper.Option\u003c/code\u003e list is split on whitespace ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/8c70d4987284a37ca6c418297af0210dc01ed5ac\"\u003e\u003ccode\u003e8c70d49\u003c/code\u003e\u003c/a\u003e 🔖 Release version 0.26.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/75ee9272b048a2843cd7acddb8f0cc39b8140e4a\"\u003e\u003ccode\u003e75ee927\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/30288540dde2b68d820c450ea0452747be632a84\"\u003e\u003ccode\u003e3028854\u003c/code\u003e\u003c/a\u003e 🐛 Ensure that an envvar set for \u003ccode\u003etyper.Option\u003c/code\u003e works as expected (\u003ca href=\"https://redirect.github.com/fastapi/typer/issues/1788\"\u003e#1788\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/959a356fec72cedcfd4ee3f84790789f8e961989\"\u003e\u003ccode\u003e959a356\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/a79de202db26ae32d00674ba246b59864e2f89c1\"\u003e\u003ccode\u003ea79de20\u003c/code\u003e\u003c/a\u003e ⬆ Bump python-dotenv from 1.2.1 to 1.2.2 (\u003ca href=\"https://redirect.github.com/fastapi/typer/issues/1714\"\u003e#1714\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/8f44149ca511ebd26fcaf36c4712e7d8a8004a4d\"\u003e\u003ccode\u003e8f44149\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/typer/commit/d88415fc1d20adcb73f44961f6ae8cff156df016\"\u003e\u003ccode\u003ed88415f\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/fastapi/typer/compare/0.25.1...0.26.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `basedpyright` from 1.39.4 to 1.39.6\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/ad82d91ce241116737e65e660c5420dd0366f405\"\u003e\u003ccode\u003ead82d91\u003c/code\u003e\u003c/a\u003e 1.39.6\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/cf60738b8dbbcc89f02d097a2dfa6e91c540bd86\"\u003e\u003ccode\u003ecf60738\u003c/code\u003e\u003c/a\u003e fix vscode config for formatting markdown files now that we use two formatter...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/29e303a1b0b5f401f21c28fe3ea7da4b9db09e35\"\u003e\u003ccode\u003e29e303a\u003c/code\u003e\u003c/a\u003e print stderr from npm commands when build fails\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/f133f3d6b9a4ef3cf2d53a929a053875e1effbe4\"\u003e\u003ccode\u003ef133f3d\u003c/code\u003e\u003c/a\u003e uncomment some test code which started causing a test to fail. no idea why i ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/f71e96bfe63f0833f3d169cf0df9208a7734929f\"\u003e\u003ccode\u003ef71e96b\u003c/code\u003e\u003c/a\u003e remove python 3.9 check from \u003ccode\u003eTypeAlias4\u003c/code\u003e test because typeshed has dropped s...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/e4c40b76f5cb70a44825aa65da7fdaa3f32b4f85\"\u003e\u003ccode\u003ee4c40b7\u003c/code\u003e\u003c/a\u003e fix tests\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/d7c522bc2a8b105d206b5efce0d6dd4e2610b917\"\u003e\u003ccode\u003ed7c522b\u003c/code\u003e\u003c/a\u003e ruff ignore new \u003ccode\u003ebenchmarkData\u003c/code\u003e files from upstream\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/a7cf33dce12ce64f8fb2fecf039c4422c232784a\"\u003e\u003ccode\u003ea7cf33d\u003c/code\u003e\u003c/a\u003e fix eslint in vscode\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/14c96beec311ff57bb3ef416ac86f886648b1adb\"\u003e\u003ccode\u003e14c96be\u003c/code\u003e\u003c/a\u003e fix logic for reporting invalid \u003ccode\u003epythonPlatform\u003c/code\u003e detected by the new eslint v...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/DetachHead/basedpyright/commit/280802ce1b2bdbaf78a880b94355ebf702241ca9\"\u003e\u003ccode\u003e280802c\u003c/code\u003e\u003c/a\u003e remove remnants of webpack\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/detachhead/basedpyright/compare/v1.39.4...v1.39.6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\n\n\n\u003c/details\u003e","html_url":"https://github.com/Amanzuu/Search-Engine-Project/pull/6","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Amanzuu%2FSearch-Engine-Project/issues/6","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/6/packages"}},{"old_version":"6.1.0","new_version":"6.1.1","update_type":"patch","path":null,"pr_created_at":"2026-05-27T00:53:06.000Z","version_change":"6.1.0 → 6.1.1","issue":{"uuid":"4528571642","node_id":"PR_kwDOC8BTjM7foTQH","number":20949,"state":"open","title":"build(deps): bump lxml from 6.1.0 to 6.1.1","user":"dependabot[bot]","labels":["dependencies","python","Changed"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-27T00:53:06.000Z","updated_at":"2026-05-27T03:14:30.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps)","packages":[{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"}],"path":null,"ecosystem":"pip"},"body":"Bumps [lxml](https://github.com/lxml/lxml) from 6.1.0 to 6.1.1.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lxml\u0026package-manager=pip\u0026previous-version=6.1.0\u0026new-version=6.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e\n\n\u003c!-- CURSOR_SUMMARY --\u003e\n---\n\n\u003e [!NOTE]\n\u003e **Low Risk**\n\u003e Lockfile-only patch bump of an optional dev dependency with no production code changes; verify CI/dev installs still resolve correctly.\n\u003e \n\u003e **Overview**\n\u003e Bumps the optional **dev** dependency **`lxml`** from **6.1.0** to **6.1.1** by raising the floor in `pyproject.toml` (`\u003e=6.1.1`) and refreshing **`poetry.lock`** (package version, wheel artifact hashes, and lock `content-hash`).\n\u003e \n\u003e No application or test source changes—only dependency resolution. **`lxml`** remains tied to the `dev` extra and is used in-repo for JUnit XML parsing (`lxml.etree` in `chia/_tests/process_junit.py`), not runtime node/wallet code.\n\u003e \n\u003e \u003csup\u003eReviewed by [Cursor Bugbot](https://cursor.com/bugbot) for commit 20feb6eaf2b40e6d6a554e9d40874d215c4b200b. Bugbot is set up for automated code reviews on this repo. Configure [here](https://www.cursor.com/dashboard/bugbot).\u003c/sup\u003e\n\u003c!-- /CURSOR_SUMMARY --\u003e","html_url":"https://github.com/Chia-Network/chia-blockchain/pull/20949","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Chia-Network%2Fchia-blockchain/issues/20949","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/20949/packages"}},{"old_version":"6.0.0","new_version":"6.1.0","update_type":"minor","path":null,"pr_created_at":"2026-05-26T03:09:58.000Z","version_change":"6.0.0 → 6.1.0","issue":{"uuid":"4521014144","node_id":"PR_kwDOOCoWus7fPvj8","number":1,"state":"open","title":"Bump the uv group across 1 directory with 4 updates","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-26T03:09:58.000Z","updated_at":"2026-05-26T03:11:19.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","group_name":"uv","update_count":4,"packages":[{"name":"idna","old_version":"3.10","new_version":"3.15","repository_url":"https://github.com/kjd/idna"},{"name":"langchain-core","old_version":"1.3.0","new_version":"1.3.3","repository_url":"https://github.com/langchain-ai/langchain"},{"name":"lxml","old_version":"6.0.0","new_version":"6.1.0","repository_url":"https://github.com/lxml/lxml"},{"name":"urllib3","old_version":"2.6.3","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"}],"path":null,"ecosystem":"pip"},"body":"Bumps the uv group with 4 updates in the / directory: [idna](https://github.com/kjd/idna), [langchain-core](https://github.com/langchain-ai/langchain), [lxml](https://github.com/lxml/lxml) and [urllib3](https://github.com/urllib3/urllib3).\n\nUpdates `idna` from 3.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in \u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining and\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e Release 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e Pre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from kjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e Convert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from kjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from StanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from StanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kjd/idna/compare/v3.10...v3.15\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `langchain-core` from 1.3.0 to 1.3.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/langchain-ai/langchain/releases\"\u003elangchain-core's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003elangchain-core==1.3.3\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.2\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37198\"\u003e#37198\u003c/a\u003e)\nfix(core): set deprecation \u003ccode\u003esince\u003c/code\u003e to 1.3.3 to match release (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37200\"\u003e#37200\u003c/a\u003e)\nfix(core, langchain): harden \u003ccode\u003eload()\u003c/code\u003e against untrusted manifests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37197\"\u003e#37197\u003c/a\u003e)\nchore: bump notebook from 7.5.0 to 7.5.6 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37109\"\u003e#37109\u003c/a\u003e)\nchore: bump types-pyyaml from 6.0.12.20250915 to 6.0.12.20260408 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37129\"\u003e#37129\u003c/a\u003e)\nfix(core): preserve structured \u003ccode\u003einputs\u003c/code\u003e on tool runs in tracers (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37108\"\u003e#37108\u003c/a\u003e)\nrelease(perplexity): 1.2.0 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37091\"\u003e#37091\u003c/a\u003e)\nchore(docs): update x handle references (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37081\"\u003e#37081\u003c/a\u003e)\nfix(core): make \u003ccode\u003eremoval\u003c/code\u003e optional in \u003ccode\u003ewarn_deprecated\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37056\"\u003e#37056\u003c/a\u003e)\nfix(core): validate batch_size in _batch and _abatch to prevent infinite loop (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36663\"\u003e#36663\u003c/a\u003e)\nchore(core): mark stream_v2/astream_v2 as beta (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36992\"\u003e#36992\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.2\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.1\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.2 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36990\"\u003e#36990\u003c/a\u003e)\nfeat(core): add content-block-centric streaming (v2) (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36834\"\u003e#36834\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003elangchain-core==1.3.1\u003c/h2\u003e\n\u003cp\u003eChanges since langchain-core==1.3.0\u003c/p\u003e\n\u003cp\u003erelease(core): 1.3.1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36972\"\u003e#36972\u003c/a\u003e)\nfeat(core): allow _format_output to pass through list of ToolOutputMixin instances (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36963\"\u003e#36963\u003c/a\u003e)\nchore: bump nbconvert from 7.17.0 to 7.17.1 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36923\"\u003e#36923\u003c/a\u003e)\nfeat(core): Update inheritance behavior for tracer metadata for special keys (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36900\"\u003e#36900\u003c/a\u003e)\nchore: bump langsmith from 0.7.13 to 0.7.31 in /libs/core (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/36813\"\u003e#36813\u003c/a\u003e)\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/5039dfec1f8e78459540a7f1b52fb0d6d82e3f07\"\u003e\u003ccode\u003e5039dfe\u003c/code\u003e\u003c/a\u003e release(core): 1.3.3 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37198\"\u003e#37198\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/55a7707837742c2f7a9b7e4a5dd428bf615f3b82\"\u003e\u003ccode\u003e55a7707\u003c/code\u003e\u003c/a\u003e fix(core): set deprecation \u003ccode\u003esince\u003c/code\u003e to 1.3.3 to match release (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37200\"\u003e#37200\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/c979c6187b6d82f4bef35b10b84b39fa44806b22\"\u003e\u003ccode\u003ec979c61\u003c/code\u003e\u003c/a\u003e fix(core, langchain): harden \u003ccode\u003eload()\u003c/code\u003e against untrusted manifests (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37197\"\u003e#37197\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/d7031101da78e3f6b6c5956b48a5170c1a33292b\"\u003e\u003ccode\u003ed703110\u003c/code\u003e\u003c/a\u003e docs: update README.md (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37190\"\u003e#37190\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/4d50a2a68b38e9acc53027ea7e7cc89e2d80b4c7\"\u003e\u003ccode\u003e4d50a2a\u003c/code\u003e\u003c/a\u003e ci(infra): run pre-release checks before TestPyPI publish (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37194\"\u003e#37194\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/9bd730e1991baac4ea80aa07d93110dc1b52ee25\"\u003e\u003ccode\u003e9bd730e\u003c/code\u003e\u003c/a\u003e fix(fireworks): require \u003ccode\u003eapi_key\u003c/code\u003e in \u003ccode\u003eFireworksEmbeddings\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37193\"\u003e#37193\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/f475f4191fc3a8d3cf14063b44d524594c080c04\"\u003e\u003ccode\u003ef475f41\u003c/code\u003e\u003c/a\u003e release(mistralai): 1.1.4 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37191\"\u003e#37191\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/7dbff48aff508b01dc231ea0cbd4e4e09da92c97\"\u003e\u003ccode\u003e7dbff48\u003c/code\u003e\u003c/a\u003e fix(mistralai): strip non-wire keys from \u003ccode\u003eToolMessage\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37188\"\u003e#37188\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/913816c440ea79295370e1af6484e17b86e5d03c\"\u003e\u003ccode\u003e913816c\u003c/code\u003e\u003c/a\u003e release(fireworks): 1.3.1 (\u003ca href=\"https://redirect.github.com/langchain-ai/langchain/issues/37189\"\u003e#37189\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/langchain-ai/langchain/commit/4498d3dc84a85688fa4d15476403a900bc7f9114\"\u003e\u003ccode\u003e4498d3d\u003c/code\u003e\u003c/a\u003e fix(fireworks): strip non-wire keys from \u003ccode\u003eToolMessage\u003c/code\u003e text content blocks (#...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/langchain-ai/langchain/compare/langchain-core==1.3.0...langchain-core==1.3.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `lxml` from 6.0.0 to 6.1.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.3 (2026-04-09)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eSeveral out of memory error cases now raise \u003ccode\u003eMemoryError\u003c/code\u003e that were not handled before.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSlicing with large step values (outside of \u003ccode\u003e+/- sys.maxsize\u003c/code\u003e) could trigger undefined C behaviour.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2125399: Some failing tests were fixed or disabled in PyPy.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eLP#2138421: Memory leak in error cases when setting the \u003ccode\u003epublic_id\u003c/code\u003e or \u003ccode\u003esystem_url\u003c/code\u003e of a document.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c7d76d6cb817c8e1f316e43b16cab5e6ad669ad0\"\u003e\u003ccode\u003ec7d76d6\u003c/code\u003e\u003c/a\u003e Change security policy to point to Github security advisories.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/378ccf82db8160928807c55ed580c0443aa94f42\"\u003e\u003ccode\u003e378ccf8\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/315270b810a9e3276c60daba549299d204ac962b\"\u003e\u003ccode\u003e315270b\u003c/code\u003e\u003c/a\u003e Docs: Reduce TOC depth of package pages and move module contents first.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6dbba7f3c72f655b05b26ef453fdee31af13ccf5\"\u003e\u003ccode\u003e6dbba7f\u003c/code\u003e\u003c/a\u003e Docs: Show current year in copyright line.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/e4385bfa5d79527350d5ef17372fb70ba80b4cce\"\u003e\u003ccode\u003ee4385bf\u003c/code\u003e\u003c/a\u003e Update project income report.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5bed1e1a227cd9ba5a879aaeacdf504093a3f6e8\"\u003e\u003ccode\u003e5bed1e1\u003c/code\u003e\u003c/a\u003e Validate file hashes in release download script.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/c13ee10a429f1144779bb1cbf6ae3bec808ae9c1\"\u003e\u003ccode\u003ec13ee10\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.0.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.0.0...lxml-6.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 2.6.3 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3 is raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects \u003ca href=\"https://opencollective.com/urllib3\"\u003eplease consider contributing financially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been read and decompressed partially. (Reported by \u003ca href=\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or \u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed using the official \u003ca href=\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by \u003ca href=\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca href=\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed data buffered from previous partial reads. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the response after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt=0\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing \u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior of chunked request bodies. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling schemeless URIs were passed to \u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to accept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e, matching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling use with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed\nusing the official \u003ccode\u003eBrotli \u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763) \u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720) \u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979) \u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777) \u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636) \u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the\nresponse after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e Release 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e Fix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e Switch to nightly PyPy3.11 in CI for now (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e Avoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when \u003ccode\u003eamt=0\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e Bump dev dependencies (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e Upgrade mypy to version 1.20.2 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e Drop support for EOL PyPy3.10 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e Upgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix warnings (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/urllib3/urllib3/compare/2.6.3...2.7.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/GlacierEQ/ollama-deep-researcher/network/alerts).\n\n\u003c/details\u003e\n\n---\n\n🔄 This PR updates four Python dependencies (idna, langchain-core, lxml, urllib3) in the uv dependency group to their latest versions. The updates include important security fixes, particularly for lxml and urllib3, along with bug fixes and feature improvements across all packages.\n\n\u003cdetails\u003e\n\u003csummary\u003e🔍 \u003cstrong\u003eDetailed Analysis\u003c/strong\u003e\u003c/summary\u003e\n\n### Key Changes\n- **idna**: Updated from 3.10 to 3.15 with security fixes for CVE-2026-45409 and CVE-2026-45409, addressing quadratic time processing vulnerabilities\n- **langchain-core**: Updated from 1.3.0 to 1.3.3 with security hardening for `load()` function against untrusted manifests and improved tool handling\n- **lxml**: Updated from 6.0.0 to 6.1.0 fixing XXE vulnerability (CVE-2026-41066) in `iterparse()` and `ETCompatXMLParser`\n- **urllib3**: Updated from 2.6.3 to 2.7.0 addressing decompression-bomb bypass vulnerabilities and proxy header stripping issues\n\n### Technical Implementation\n```mermaid\nflowchart TD\n    A[Dependabot Scan] --\u003e B[Identify Updates]\n    B --\u003e C[Security Patches]\n    B --\u003e D[Feature Updates]\n    B --\u003e E[Bug Fixes]\n    C --\u003e F[idna: CVE fixes]\n    C --\u003e G[lxml: XXE protection]\n    C --\u003e H[urllib3: Decompression safeguards]\n    D --\u003e I[langchain-core: Tool improvements]\n    E --\u003e J[Various stability fixes]\n    F --\u003e K[Updated Dependencies]\n    G --\u003e K\n    H --\u003e K\n    I --\u003e K\n    J --\u003e K\n```\n\n### Impact\n- **Security Enhancement**: Critical vulnerabilities patched in idna, lxml, and urllib3 protecting against XXE attacks, quadratic time processing, and decompression bombs\n- **Stability Improvement**: Bug fixes across all packages improve reliability, particularly in HTTP response handling and XML parsing\n- **Feature Addition**: New capabilities like configurable chunk sizes in lxml and improved tool handling in langchain-core enhance functionality\n\n\u003c/details\u003e\n\n_Created with [Palmier](https://www.palmier.io)_","html_url":"https://github.com/GlacierEQ/ollama-deep-researcher/pull/1","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/GlacierEQ%2Follama-deep-researcher/issues/1","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/1/packages"}},{"old_version":"6.1.0","new_version":"6.1.1","update_type":"patch","path":null,"pr_created_at":"2026-05-26T01:14:57.000Z","version_change":"6.1.0 → 6.1.1","issue":{"uuid":"4520522281","node_id":"PR_kwDOQkYl-s7fOJBz","number":290,"state":"closed","title":"chore(deps): Bump the python-minor group across 1 directory with 21 updates","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-06-03T05:24:22.000Z","author_association":null,"state_reason":null,"created_at":"2026-05-26T01:14:57.000Z","updated_at":"2026-06-03T05:24:24.000Z","time_to_close":706165,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): Bump","group_name":"python-minor","update_count":21,"packages":[{"name":"fastapi","old_version":"0.136.1","new_version":"0.136.3","repository_url":"https://github.com/fastapi/fastapi"},{"name":"uvicorn","old_version":"0.46.0","new_version":"0.48.0","repository_url":"https://github.com/Kludex/uvicorn"},{"name":"python-multipart","old_version":"0.0.27","new_version":"0.0.29","repository_url":"https://github.com/Kludex/python-multipart"},{"name":"starlette","old_version":"1.0.0","new_version":"1.1.0","repository_url":"https://github.com/Kludex/starlette"},{"name":"sse-starlette","old_version":"3.4.1","new_version":"3.4.4","repository_url":"https://github.com/sysid/sse-starlette"},{"name":"sqlalchemy","old_version":"2.0.49","new_version":"2.0.50","repository_url":"https://github.com/sqlalchemy/sqlalchemy"},{"name":"greenlet","old_version":"3.5.0","new_version":"3.5.1","repository_url":"https://github.com/python-greenlet/greenlet"},{"name":"pyjwt","old_version":"2.12.1","new_version":"2.13.0","repository_url":"https://github.com/jpadilla/pyjwt"},{"name":"pydantic","old_version":"2.13.3","new_version":"2.13.4","repository_url":"https://github.com/pydantic/pydantic"},{"name":"pydantic-settings","old_version":"2.14.0","new_version":"2.14.1","repository_url":"https://github.com/pydantic/pydantic-settings"},{"name":"pandas","old_version":"3.0.2","new_version":"3.0.3","repository_url":"https://github.com/pandas-dev/pandas"},{"name":"google-cloud-aiplatform","old_version":"1.150.0","new_version":"1.153.1","repository_url":"https://github.com/googleapis/python-aiplatform"},{"name":"google-auth","old_version":"2.50.0","new_version":"2.53.0","repository_url":"https://github.com/googleapis/google-auth-library-python"},{"name":"anthropic","old_version":"0.45.2","new_version":"0.104.1","repository_url":"https://github.com/anthropics/anthropic-sdk-python"},{"name":"pgvector","old_version":"0.3.6","new_version":"0.4.2","repository_url":"https://github.com/pgvector/pgvector-python"},{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"},{"name":"orjson","old_version":"3.11.8","new_version":"3.11.9","repository_url":"https://github.com/ijl/orjson"},{"name":"sentry-sdk","old_version":"2.59.0","new_version":"2.60.0","repository_url":"https://github.com/getsentry/sentry-python"},{"name":"faker","old_version":"40.15.0","new_version":"40.19.1","repository_url":"https://github.com/joke2k/faker"},{"name":"black","old_version":"26.3.1","new_version":"26.5.1","repository_url":"https://github.com/psf/black"},{"name":"ruff","old_version":"0.15.12","new_version":"0.15.14","repository_url":"https://github.com/astral-sh/ruff"}],"path":null,"ecosystem":"pip"},"body":"Bumps the python-minor group with 21 updates in the /backend directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [fastapi](https://github.com/fastapi/fastapi) | `0.136.1` | `0.136.3` |\n| [uvicorn](https://github.com/Kludex/uvicorn) | `0.46.0` | `0.48.0` |\n| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.27` | `0.0.29` |\n| [starlette](https://github.com/Kludex/starlette) | `1.0.0` | `1.1.0` |\n| [sse-starlette](https://github.com/sysid/sse-starlette) | `3.4.1` | `3.4.4` |\n| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.49` | `2.0.50` |\n| [greenlet](https://github.com/python-greenlet/greenlet) | `3.5.0` | `3.5.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.12.1` | `2.13.0` |\n| [pydantic](https://github.com/pydantic/pydantic) | `2.13.3` | `2.13.4` |\n| [pydantic-settings](https://github.com/pydantic/pydantic-settings) | `2.14.0` | `2.14.1` |\n| [pandas](https://github.com/pandas-dev/pandas) | `3.0.2` | `3.0.3` |\n| [google-cloud-aiplatform](https://github.com/googleapis/python-aiplatform) | `1.150.0` | `1.153.1` |\n| [google-auth](https://github.com/googleapis/google-auth-library-python) | `2.50.0` | `2.53.0` |\n| [anthropic](https://github.com/anthropics/anthropic-sdk-python) | `0.45.2` | `0.104.1` |\n| [pgvector](https://github.com/pgvector/pgvector-python) | `0.3.6` | `0.4.2` |\n| [lxml](https://github.com/lxml/lxml) | `6.1.0` | `6.1.1` |\n| [orjson](https://github.com/ijl/orjson) | `3.11.8` | `3.11.9` |\n| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.59.0` | `2.60.0` |\n| [faker](https://github.com/joke2k/faker) | `40.15.0` | `40.19.1` |\n| [black](https://github.com/psf/black) | `26.3.1` | `26.5.1` |\n| [ruff](https://github.com/astral-sh/ruff) | `0.15.12` | `0.15.14` |\n\n\nUpdates `fastapi` from 0.136.1 to 0.136.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/fastapi/fastapi/releases\"\u003efastapi's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.136.3\u003c/h2\u003e\n\u003ch3\u003eRefactors\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e♻️ Do not accept underscore headers when using \u003ccode\u003econvert_underscores=True\u003c/code\u003e (the default). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15589\"\u003e#15589\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.136.2\u003c/h2\u003e\n\u003ch3\u003eRefactors\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e♻️ Validate Server Sent Event fields to avoid applications from sending broken data. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15588\"\u003e#15588\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocs\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e📝 Document \u003ccode\u003e--entrypoint\u003c/code\u003e CLI option. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15464\"\u003e#15464\u003c/a\u003e by \u003ca href=\"https://github.com/YuriiMotov\"\u003e\u003ccode\u003e@​YuriiMotov\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update and simplify docs about help and management. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15583\"\u003e#15583\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Add docs references to central contributing docs. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15580\"\u003e#15580\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update security policy. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15577\"\u003e#15577\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🍱 Update sponsors: TalorData image. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15562\"\u003e#15562\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Update docs, simplify usage of admonitions, only default ones. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15553\"\u003e#15553\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Fix image URLs in \u003ccode\u003eindex.md\u003c/code\u003e. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15534\"\u003e#15534\u003c/a\u003e by \u003ca href=\"https://github.com/YuriiMotov\"\u003e\u003ccode\u003e@​YuriiMotov\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e✏️ Fix Azkaban spelling typo in \u003ccode\u003evirtual-environments.md‎\u003c/code\u003e. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15463\"\u003e#15463\u003c/a\u003e by \u003ca href=\"https://github.com/isaacbernat\"\u003e\u003ccode\u003e@​isaacbernat\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e💄 Improve layout and styling. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15462\"\u003e#15462\u003c/a\u003e by \u003ca href=\"https://github.com/alejsdev\"\u003e\u003ccode\u003e@​alejsdev\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e💄 Refactor opinions section with interactive tabs and new logos. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15458\"\u003e#15458\u003c/a\u003e by \u003ca href=\"https://github.com/alejsdev\"\u003e\u003ccode\u003e@​alejsdev\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e📝 Add FastAPI Conf '26 announcement to docs. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15457\"\u003e#15457\u003c/a\u003e by \u003ca href=\"https://github.com/alejsdev\"\u003e\u003ccode\u003e@​alejsdev\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eTranslations\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e🌐 Improve translation consistency in \u003ccode\u003e‎docs/pt/docs/advanced/generate-clients.md‎\u003c/code\u003e. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15456\"\u003e#15456\u003c/a\u003e by \u003ca href=\"https://github.com/Will-thom\"\u003e\u003ccode\u003e@​Will-thom\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for ja (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15530\"\u003e#15530\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for uk (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15529\"\u003e#15529\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for pt (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15528\"\u003e#15528\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for de (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15527\"\u003e#15527\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for tr (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15526\"\u003e#15526\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for ko (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15525\"\u003e#15525\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for zh-hant (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15524\"\u003e#15524\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for fr (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15522\"\u003e#15522\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for es (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15523\"\u003e#15523\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for zh (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15520\"\u003e#15520\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Update translations for ru (update-outdated). PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15521\"\u003e#15521\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🌐 Fix typos in Spanish LLM-prompt. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15472\"\u003e#15472\u003c/a\u003e by \u003ca href=\"https://github.com/crr004\"\u003e\u003ccode\u003e@​crr004\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eInternal\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e✅ Update tests, don't double dispose the engine. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15587\"\u003e#15587\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⚡️ Speed up test suite via caching and fixture scopes to make it ~24% faster. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/13583\"\u003e#13583\u003c/a\u003e by \u003ca href=\"https://github.com/dikos1337\"\u003e\u003ccode\u003e@​dikos1337\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔥 Remove config files now in central GitHub repo. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15585\"\u003e#15585\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump urllib3 from 2.6.3 to 2.7.0. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15502\"\u003e#15502\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump idna from 3.11 to 3.15. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15565\"\u003e#15565\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e⬆ Bump cloudflare/wrangler-action from 3.15.0 to 4.0.0. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15571\"\u003e#15571\u003c/a\u003e by \u003ca href=\"https://github.com/apps/dependabot\"\u003e\u003ccode\u003e@​dependabot[bot]\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔧 Migrate docs from MkDocs to Zensical. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15563\"\u003e#15563\u003c/a\u003e by \u003ca href=\"https://github.com/tiangolo\"\u003e\u003ccode\u003e@​tiangolo\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003e🔒️ Only allow team members to modify dependencies. PR \u003ca href=\"https://redirect.github.com/fastapi/fastapi/pull/15548\"\u003e#15548\u003c/a\u003e by \u003ca href=\"https://github.com/svlandeg\"\u003e\u003ccode\u003e@​svlandeg\u003c/code\u003e\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/82064857539e6286522c347b4b11331b48dd2378\"\u003e\u003ccode\u003e8206485\u003c/code\u003e\u003c/a\u003e 🔖 Release version 0.136.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/c910e0139f983d0e04e2d1d235cd71803afeae34\"\u003e\u003ccode\u003ec910e01\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/063b5bf582d31fb155cc6bc6f88cf512329d0fd5\"\u003e\u003ccode\u003e063b5bf\u003c/code\u003e\u003c/a\u003e ♻️ Do not accept underscore headers when using \u003ccode\u003econvert_underscores=True\u003c/code\u003e (th...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/22b02e26f9e8c7e32bd8266e2b0ebe8bb3a0db2b\"\u003e\u003ccode\u003e22b02e2\u003c/code\u003e\u003c/a\u003e 🔖 Release version 0.136.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/3b252a2a22ba27a8ab83d6bde7d9cddbc5bf738e\"\u003e\u003ccode\u003e3b252a2\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/c7fb7851b3389f24c51701d705458989be53ccbb\"\u003e\u003ccode\u003ec7fb785\u003c/code\u003e\u003c/a\u003e ♻️ Validate Server Sent Event fields to avoid applications from sending broke...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/cb83b83dcf78eab4ea17d504db5abcda705fbdc4\"\u003e\u003ccode\u003ecb83b83\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/00f805cec94c0bf48c1f9a563535a3ab2e6f90ab\"\u003e\u003ccode\u003e00f805c\u003c/code\u003e\u003c/a\u003e ✅ Update tests, don't double dispose the engine (\u003ca href=\"https://redirect.github.com/fastapi/fastapi/issues/15587\"\u003e#15587\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/3675137523dc167981aa3a3c44599b4f3079ccd8\"\u003e\u003ccode\u003e3675137\u003c/code\u003e\u003c/a\u003e 📝 Update release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/fastapi/fastapi/commit/7b57e42986bb4d40c9eb6580537d13fb8e76097e\"\u003e\u003ccode\u003e7b57e42\u003c/code\u003e\u003c/a\u003e 📝 Document \u003ccode\u003e--entrypoint\u003c/code\u003e CLI option (\u003ca href=\"https://redirect.github.com/fastapi/fastapi/issues/15464\"\u003e#15464\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/fastapi/fastapi/compare/0.136.1...0.136.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `uvicorn` from 0.46.0 to 0.48.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/uvicorn/releases\"\u003euvicorn's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 0.48.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDefault \u003ccode\u003essl_ciphers\u003c/code\u003e to \u003ccode\u003eNone\u003c/code\u003e and use OpenSSL defaults by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/uvicorn/pull/2940\"\u003eKludex/uvicorn#2940\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIgnore duplicate forwarding headers in \u003ccode\u003eProxyHeadersMiddleware\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/uvicorn/pull/2944\"\u003eKludex/uvicorn#2944\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/uvicorn/compare/0.47.0...0.48.0\"\u003ehttps://github.com/Kludex/uvicorn/compare/0.47.0...0.48.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 0.47.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEagerly import the ASGI app in the parent process by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/uvicorn/pull/2919\"\u003eKludex/uvicorn#2919\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003essl_context_factory\u003c/code\u003e for custom \u003ccode\u003eSSLContext\u003c/code\u003e configuration by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/uvicorn/pull/2920\"\u003eKludex/uvicorn#2920\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eTreat \u003ccode\u003efd=0\u003c/code\u003e as a valid file descriptor with reload/workers by \u003ca href=\"https://github.com/eltoder\"\u003e\u003ccode\u003e@​eltoder\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/uvicorn/pull/2927\"\u003eKludex/uvicorn#2927\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/uvicorn/compare/0.46.0...0.47.0\"\u003ehttps://github.com/Kludex/uvicorn/compare/0.46.0...0.47.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md\"\u003euvicorn's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.48.0 (May 24, 2026)\u003c/h2\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDefault \u003ccode\u003essl_ciphers\u003c/code\u003e to \u003ccode\u003eNone\u003c/code\u003e and use OpenSSL defaults (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2940\"\u003e#2940\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore duplicate forwarding headers in \u003ccode\u003eProxyHeadersMiddleware\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.47.0 (May 14, 2026)\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003essl_context_factory\u003c/code\u003e for custom \u003ccode\u003eSSLContext\u003c/code\u003e configuration (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2920\"\u003e#2920\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEagerly import the ASGI app in the parent process (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2919\"\u003e#2919\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eTreat \u003ccode\u003efd=0\u003c/code\u003e as a valid file descriptor with reload/workers (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2927\"\u003e#2927\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/73e84e58d7f6b8b3dfd8a9e3e42d716862250f33\"\u003e\u003ccode\u003e73e84e5\u003c/code\u003e\u003c/a\u003e Version 0.48.0 (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2951\"\u003e#2951\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/45ea11690b4a62fa6df339d2b6ee3b8545a418e0\"\u003e\u003ccode\u003e45ea116\u003c/code\u003e\u003c/a\u003e Ignore duplicate forwarding headers in \u003ccode\u003eProxyHeadersMiddleware\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2944\"\u003e#2944\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/dd4394c3cbfd9f27a696a7b08047149690058158\"\u003e\u003ccode\u003edd4394c\u003c/code\u003e\u003c/a\u003e chore(deps): bump idna from 3.11 to 3.15 (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2941\"\u003e#2941\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/abe07818a191cd036dc3824d802d052207e01c7e\"\u003e\u003ccode\u003eabe0781\u003c/code\u003e\u003c/a\u003e Default \u003ccode\u003essl_ciphers\u003c/code\u003e to \u003ccode\u003eNone\u003c/code\u003e and use OpenSSL defaults (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2940\"\u003e#2940\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/479a2c0c89186714f1aac52aecdebebf271395ac\"\u003e\u003ccode\u003e479a2c0\u003c/code\u003e\u003c/a\u003e Version 0.47.0 (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2937\"\u003e#2937\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/89347fd166ebedf98fb3f806ce8ea44e93b1c2b5\"\u003e\u003ccode\u003e89347fd\u003c/code\u003e\u003c/a\u003e Add 7-day cooldown for dependency resolution via uv exclude-newer (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2936\"\u003e#2936\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/767315b38ae509cee9fe8ee9d09f6da920536096\"\u003e\u003ccode\u003e767315b\u003c/code\u003e\u003c/a\u003e Drop unused contents/actions permissions from zizmor workflow (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2935\"\u003e#2935\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/f25ee43e68a9678453cbca99ad96f1a447ff34af\"\u003e\u003ccode\u003ef25ee43\u003c/code\u003e\u003c/a\u003e chore(deps): bump urllib3 from 2.6.3 to 2.7.0 (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2933\"\u003e#2933\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/8782666189a3d36c978de5698620db705659bf44\"\u003e\u003ccode\u003e8782666\u003c/code\u003e\u003c/a\u003e Fix typo in \u003ccode\u003edocs/deployment/index.md\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2932\"\u003e#2932\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/uvicorn/commit/ad5ff87c869e8a34e9b04fcd5ca38d65c526893c\"\u003e\u003ccode\u003ead5ff87\u003c/code\u003e\u003c/a\u003e Treat \u003ccode\u003efd=0\u003c/code\u003e as a valid file descriptor with reload/workers (\u003ca href=\"https://redirect.github.com/Kludex/uvicorn/issues/2927\"\u003e#2927\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/Kludex/uvicorn/compare/0.46.0...0.48.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `python-multipart` from 0.0.27 to 0.0.29\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/python-multipart/releases\"\u003epython-multipart's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 0.0.29\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eHandle malformed RFC 2231 continuations in \u003ccode\u003eparse_options_header\u003c/code\u003e by \u003ca href=\"https://github.com/manunio\"\u003e\u003ccode\u003e@​manunio\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/python-multipart/pull/270\"\u003eKludex/python-multipart#270\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/python-multipart/compare/0.0.28...0.0.29\"\u003ehttps://github.com/Kludex/python-multipart/compare/0.0.28...0.0.29\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 0.0.28\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSpeed up partial-boundary tail scan via \u003ccode\u003ebytes.find\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/python-multipart/pull/281\"\u003eKludex/python-multipart#281\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCap multipart boundary length at 256 bytes by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/python-multipart/pull/282\"\u003eKludex/python-multipart#282\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.28\"\u003ehttps://github.com/Kludex/python-multipart/compare/0.0.27...0.0.28\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/python-multipart/blob/main/CHANGELOG.md\"\u003epython-multipart's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.0.29 (2026-05-17)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eHandle malformed RFC 2231 continuations in \u003ccode\u003eparse_options_header\u003c/code\u003e \u003ca href=\"https://redirect.github.com/Kludex/python-multipart/pull/270\"\u003e#270\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e0.0.28 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSpeed up partial-boundary tail scan via \u003ccode\u003ebytes.find\u003c/code\u003e \u003ca href=\"https://redirect.github.com/Kludex/python-multipart/pull/281\"\u003e#281\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eCap multipart boundary length at 256 bytes \u003ca href=\"https://redirect.github.com/Kludex/python-multipart/pull/282\"\u003e#282\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/e3d6853978b91b77e9739d47389124d633894c39\"\u003e\u003ccode\u003ee3d6853\u003c/code\u003e\u003c/a\u003e Version 0.0.29 (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/288\"\u003e#288\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/a60dcdcb34d55b396ced6f5bdb1d1e6df84832ae\"\u003e\u003ccode\u003ea60dcdc\u003c/code\u003e\u003c/a\u003e Handle malformed RFC 2231 continuations in \u003ccode\u003eparse_options_header\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/270\"\u003e#270\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/75c33b24d91f1e3c65b597832984d6c46d1a38df\"\u003e\u003ccode\u003e75c33b2\u003c/code\u003e\u003c/a\u003e Add 7-day cooldown for dependency resolution via uv exclude-newer (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/286\"\u003e#286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/a078b8ef00474c3f3a6cf750cd092cf880354a11\"\u003e\u003ccode\u003ea078b8e\u003c/code\u003e\u003c/a\u003e Bump urllib3 from 2.6.3 to 2.7.0 (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/285\"\u003e#285\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/7d8d28b210ac6cb055399562b0dc0e5cf9aef14a\"\u003e\u003ccode\u003e7d8d28b\u003c/code\u003e\u003c/a\u003e Version 0.0.28 (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/284\"\u003e#284\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/b0dd125457d0f98de23bf2f894aedb1a54639d4e\"\u003e\u003ccode\u003eb0dd125\u003c/code\u003e\u003c/a\u003e Cap multipart boundary length at 256 bytes (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/282\"\u003e#282\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/d1b57392cf7d0c19235ba454eb5686fd27dc2384\"\u003e\u003ccode\u003ed1b5739\u003c/code\u003e\u003c/a\u003e Speed up partial-boundary tail scan via \u003ccode\u003ebytes.find\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/281\"\u003e#281\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/09cb8c3da7638d45ecdf7c154832303214bba829\"\u003e\u003ccode\u003e09cb8c3\u003c/code\u003e\u003c/a\u003e Make the long_boundary benchmark dominated by the patched code path (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/280\"\u003e#280\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/a6467c93c14aa4b09ef65450ead8011c45e5c7a0\"\u003e\u003ccode\u003ea6467c9\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;Switch CodSpeed benchmarks to walltime mode\u0026quot; (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/279\"\u003e#279\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/python-multipart/commit/9a9690035a956fbdcca06f98461244cf790375a7\"\u003e\u003ccode\u003e9a96900\u003c/code\u003e\u003c/a\u003e Switch CodSpeed benchmarks to walltime mode (\u003ca href=\"https://redirect.github.com/Kludex/python-multipart/issues/278\"\u003e#278\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/Kludex/python-multipart/compare/0.0.27...0.0.29\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `starlette` from 1.0.0 to 1.1.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/starlette/releases\"\u003estarlette's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 1.1.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUse \u003ccode\u003e\u0026quot;application/octet-stream\u0026quot;\u003c/code\u003e as the \u003ccode\u003eFileResponse\u003c/code\u003e media type fallback by \u003ca href=\"https://github.com/ATOM00blue\"\u003e\u003ccode\u003e@​ATOM00blue\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3283\"\u003eKludex/starlette#3283\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOnly dispatch standard HTTP verbs in \u003ccode\u003eHTTPEndpoint\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3286\"\u003eKludex/starlette#3286\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReject absolute paths in \u003ccode\u003eStaticFiles.lookup_path\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3287\"\u003eKludex/starlette#3287\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ATOM00blue\"\u003e\u003ccode\u003e@​ATOM00blue\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3283\"\u003eKludex/starlette#3283\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/1.0.1...1.1.0\"\u003ehttps://github.com/Kludex/starlette/compare/1.0.1...1.1.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 1.0.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore malformed \u003ccode\u003eHost\u003c/code\u003e header when constructing \u003ccode\u003erequest.url\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3279\"\u003eKludex/starlette#3279\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/1.0.0...1.0.1\"\u003ehttps://github.com/Kludex/starlette/compare/1.0.0...1.0.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/starlette/blob/main/docs/release-notes.md\"\u003estarlette's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.1.0 (May 23, 2026)\u003c/h2\u003e\n\u003ch4\u003eAdded\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eUse \u003ccode\u003e\u0026quot;application/octet-stream\u0026quot;\u003c/code\u003e as the \u003ccode\u003eFileResponse\u003c/code\u003e media type fallback \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3283\"\u003e#3283\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eOnly dispatch standard HTTP verbs in \u003ccode\u003eHTTPEndpoint\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3286\"\u003e#3286\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eReject absolute paths in \u003ccode\u003eStaticFiles.lookup_path\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3287\"\u003e#3287\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.0.1 (May 21, 2026)\u003c/h2\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eIgnore malformed \u003ccode\u003eHost\u003c/code\u003e header when constructing \u003ccode\u003erequest.url\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3279\"\u003e#3279\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/a4ff83b1aacaf8955e241dd00444c27823be163a\"\u003e\u003ccode\u003ea4ff83b\u003c/code\u003e\u003c/a\u003e Version 1.1.0 (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3289\"\u003e#3289\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/fd53168a7767b6b55ba5af787fd88f49e33cabc5\"\u003e\u003ccode\u003efd53168\u003c/code\u003e\u003c/a\u003e Reject absolute paths in \u003ccode\u003eStaticFiles.lookup_path\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3287\"\u003e#3287\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/e3f972225adb1d84b80dba132f520cc24cb84229\"\u003e\u003ccode\u003ee3f9722\u003c/code\u003e\u003c/a\u003e Only dispatch standard HTTP verbs in \u003ccode\u003eHTTPEndpoint\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3286\"\u003e#3286\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/348f86dc92fed6e3c0314154e38deec90a6bcabd\"\u003e\u003ccode\u003e348f86d\u003c/code\u003e\u003c/a\u003e Use \u003ccode\u003e\u0026quot;application/octet-stream\u0026quot;\u003c/code\u003e as the \u003ccode\u003eFileResponse\u003c/code\u003e media type fallback (#...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/48f8e331b23ca692f4713ac1f370bff1b5cd034c\"\u003e\u003ccode\u003e48f8e33\u003c/code\u003e\u003c/a\u003e Version 1.0.1 (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3281\"\u003e#3281\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/f078832be1aa27ab0e7ec3153479a347749e967a\"\u003e\u003ccode\u003ef078832\u003c/code\u003e\u003c/a\u003e Remove Hugging Face sponsor block from docs (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3280\"\u003e#3280\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/472951eba8f6e35be845fd1b91625a1b5488294b\"\u003e\u003ccode\u003e472951e\u003c/code\u003e\u003c/a\u003e chore(deps): bump the github-actions group with 2 updates (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3277\"\u003e#3277\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/764dab0dcfb9033d75442d7a359645c9f94648c6\"\u003e\u003ccode\u003e764dab0\u003c/code\u003e\u003c/a\u003e Ignore malformed \u003ccode\u003eHost\u003c/code\u003e header when constructing \u003ccode\u003erequest.url\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3279\"\u003e#3279\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/19d08115ce56da8d4da2838ecdd9c5882cb2b365\"\u003e\u003ccode\u003e19d0811\u003c/code\u003e\u003c/a\u003e Harden GitHub Actions workflows and Dependabot config (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3276\"\u003e#3276\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/01f46378120fe2c6312074ed7e997e3b5f7d8c20\"\u003e\u003ccode\u003e01f4637\u003c/code\u003e\u003c/a\u003e chore(deps): bump idna from 3.10 to 3.15 (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3274\"\u003e#3274\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/Kludex/starlette/compare/1.0.0...1.1.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `sse-starlette` from 3.4.1 to 3.4.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/sysid/sse-starlette/releases\"\u003esse-starlette's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.4.4\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/sysid/sse-starlette/compare/v3.4.3...v3.4.4\"\u003ehttps://github.com/sysid/sse-starlette/compare/v3.4.3...v3.4.4\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.4.3\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003echore(deps): bump granian from 2.6.0 to 2.7.4 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/sysid/sse-starlette/pull/185\"\u003esysid/sse-starlette#185\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump urllib3 from 2.6.3 to 2.7.0 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/sysid/sse-starlette/pull/186\"\u003esysid/sse-starlette#186\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/sysid/sse-starlette/compare/v3.4.2...v3.4.3\"\u003ehttps://github.com/sysid/sse-starlette/compare/v3.4.2...v3.4.3\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev3.4.2\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/sysid/sse-starlette/compare/v3.4.1...v3.4.2\"\u003ehttps://github.com/sysid/sse-starlette/compare/v3.4.1...v3.4.2\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/e0933950b83ab99575b34b3641cd7f88b62e11c2\"\u003e\u003ccode\u003ee093395\u003c/code\u003e\u003c/a\u003e Bump version to 3.4.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/a6799e1063bd2c102336b8963a288736b0588972\"\u003e\u003ccode\u003ea6799e1\u003c/code\u003e\u003c/a\u003e new release workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/d033a9755865b1521baf5d7f4b9ce6c5b4b2c843\"\u003e\u003ccode\u003ed033a97\u003c/code\u003e\u003c/a\u003e Bump version to 3.4.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/6a34c6aa05037b4b63864384bc61f7e855d18008\"\u003e\u003ccode\u003e6a34c6a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/sysid/sse-starlette/issues/186\"\u003e#186\u003c/a\u003e from sysid/dependabot/uv/urllib3-2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/e0be426235833f4d5084669bbba947193a2720e0\"\u003e\u003ccode\u003ee0be426\u003c/code\u003e\u003c/a\u003e chore(deps): bump urllib3 from 2.6.3 to 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/d8d43ab64b1090644ae42c4c2a4d361947296a26\"\u003e\u003ccode\u003ed8d43ab\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/sysid/sse-starlette/issues/185\"\u003e#185\u003c/a\u003e from sysid/dependabot/uv/granian-2.7.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/5854ac05f8f0170d7e4ccfd9b28a681f96038913\"\u003e\u003ccode\u003e5854ac0\u003c/code\u003e\u003c/a\u003e chore(deps): bump granian from 2.6.0 to 2.7.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/1d56ff3c33cd2544908890ecb3ff4ca2d55c2ee3\"\u003e\u003ccode\u003e1d56ff3\u003c/code\u003e\u003c/a\u003e Bump version to 3.4.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/sysid/sse-starlette/commit/8387e1155ae38552dc8064d85cf1d75c8700827f\"\u003e\u003ccode\u003e8387e11\u003c/code\u003e\u003c/a\u003e update pyproject.toml\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/sysid/sse-starlette/compare/v3.4.1...v3.4.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `sqlalchemy` from 2.0.49 to 2.0.50\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/sqlalchemy/sqlalchemy/releases\"\u003esqlalchemy's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.0.50\u003c/h1\u003e\n\u003cp\u003eReleased: May 24, 2026\u003c/p\u003e\n\u003ch2\u003eorm\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e[orm] [bug]\u003c/strong\u003e Fixed issue where using \u003ccode\u003e_orm.joinedload()\u003c/code\u003e with\n\u003ccode\u003ePropComparator.of_type()\u003c/code\u003e targeting a joined-table subclass combined\nwith \u003ccode\u003ePropComparator.and_()\u003c/code\u003e referencing a column on that subclass\nwould generate invalid SQL, where the subclass column was not adapted to\nthe subquery alias.  Pull request courtesy Joaquin Hui Gomez.\u003c/p\u003e\n\u003cp\u003eReferences: \u003ca href=\"https://www.sqlalchemy.org/trac/ticket/13203\"\u003e#13203\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e[orm] [bug]\u003c/strong\u003e Fixed issue where the presence of a \u003ccode\u003eSessionEvents.do_orm_execute()\u003c/code\u003e\nevent hook would cause internal execution options such as \u003ccode\u003eyield_per\u003c/code\u003e and\nloader-specific state from the first \u003ccode\u003eorm_pre_session_exec\u003c/code\u003e pass to leak\ninto the second pass, leading to errors when using relationship loaders\nsuch as \u003ccode\u003eselectinload()\u003c/code\u003e and \u003ccode\u003eimmediateload()\u003c/code\u003e.  The execution\noptions passed to the second compilation pass are now based on the original\noptions plus only the explicit updates made via\n\u003ccode\u003eORMExecuteState.update_execution_options()\u003c/code\u003e within the event hook.\u003c/p\u003e\n\u003cp\u003eReferences: \u003ca href=\"https://www.sqlalchemy.org/trac/ticket/13301\"\u003e#13301\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e[orm] [bug]\u003c/strong\u003e Fixed issue where using \u003ccode\u003e_orm.with_polymorphic()\u003c/code\u003e on a leaf class (a\nsubclass with no further descendants) or a non-inherited class would fail\nwith an \u003ccode\u003eAttributeError\u003c/code\u003e when used in an ORM statement, due to\n\u003ccode\u003e_orm.configure_mappers()\u003c/code\u003e not being triggered implicitly. The fix\nensures that \u003ccode\u003eAliasedInsp\u003c/code\u003e participates in the \u003ccode\u003e_post_inspect\u003c/code\u003e\nhook, triggering mapper configuration during ORM statement compilation.\u003c/p\u003e\n\u003cp\u003eReferences: \u003ca href=\"https://www.sqlalchemy.org/trac/ticket/13319\"\u003e#13319\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003esql\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e[sql] [bug]\u003c/strong\u003e Fixed issue where floor division (\u003ccode\u003e//\u003c/code\u003e) between a \u003ccode\u003eFloat\u003c/code\u003e or\n\u003ccode\u003eNumeric\u003c/code\u003e numerator and an \u003ccode\u003eInteger\u003c/code\u003e denominator would omit\nthe \u003ccode\u003eFLOOR()\u003c/code\u003e SQL wrapper on dialects where\n\u003ccode\u003eDialect.div_is_floordiv\u003c/code\u003e is \u003ccode\u003eTrue\u003c/code\u003e (the default, including\nPostgreSQL and SQLite).  \u003ccode\u003eFLOOR()\u003c/code\u003e is now applied if either the\ndenominator or the numerator is a non-integer, so that expressions such as\n\u003ccode\u003efloat_col // int_col\u003c/code\u003e render as \u003ccode\u003eFLOOR(float_col / int_col)\u003c/code\u003e instead\nof the incorrect \u003ccode\u003efloat_col / int_col\u003c/code\u003e.  Pull request courtesy r266-tech.\u003c/p\u003e\n\u003cp\u003eReferences: \u003ca href=\"https://www.sqlalchemy.org/trac/ticket/10528\"\u003e#10528\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003epostgresql\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/sqlalchemy/sqlalchemy/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `greenlet` from 3.5.0 to 3.5.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/python-greenlet/greenlet/blob/master/CHANGES.rst\"\u003egreenlet's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e3.5.1 (2026-05-20)\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eAdd preliminary support for Python 3.15b1. This has not been\nreviewed by CPython core developers, but all tests pass. Binary\nwheels of this version won't work on earlier Python 3.15 builds and\nmay not work on later 3.15 builds.\u003c/li\u003e\n\u003cli\u003eFix the discrepancy in the way the two \u003ccode\u003egetcurrent\u003c/code\u003e APIs behave\nduring greenlet teardown. One API (the C API used by, e.g.,  gevent) raised a\n\u003ccode\u003eRuntimeError\u003c/code\u003e; the other (the Python \u003ccode\u003egreenlet.getcurrent\u003c/code\u003e API)\nreturned \u003ccode\u003eNone\u003c/code\u003e. This second way is incompatible with greenlet's type\nannotations, so \u003ccode\u003egreenlet.getcurrent\u003c/code\u003e now raises a\n\u003ccode\u003eRuntimeError\u003c/code\u003e as well.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-greenlet/greenlet/commit/b5e5fc43a51c27ecffa1b1c7107c91464a6b26e2\"\u003e\u003ccode\u003eb5e5fc4\u003c/code\u003e\u003c/a\u003e Preparing release 3.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-greenlet/greenlet/commit/c8e177413d34bc36ed56d2c185c232ab0538be90\"\u003e\u003ccode\u003ec8e1774\u003c/code\u003e\u003c/a\u003e Tweak wording in CHANGES about greenlet.getcurrent.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-greenlet/greenlet/commit/7fb10c570f37b3eb4c8909c6164fdfac3269ddb6\"\u003e\u003ccode\u003e7fb10c5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/python-greenlet/greenlet/issues/510\"\u003e#510\u003c/a\u003e from python-greenlet/315\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-greenlet/greenlet/commit/9718ce5a23ea3360232b78a806a837d6c3d6183d\"\u003e\u003ccode\u003e9718ce5\u003c/code\u003e\u003c/a\u003e Add Py 3.15; make both API versions of getcurrent() consistent in raising Run...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-greenlet/greenlet/commit/276e08afc4ddba87e4366390e3eeaecd61ccb3b8\"\u003e\u003ccode\u003e276e08a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/python-greenlet/greenlet/issues/509\"\u003e#509\u003c/a\u003e from python-greenlet/dependabot/github_actions/github...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-greenlet/greenlet/commit/32b0ad69828eb69d879c70dbee948e685268901b\"\u003e\u003ccode\u003e32b0ad6\u003c/code\u003e\u003c/a\u003e Bump pypa/gh-action-pypi-publish in the github-actions group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-greenlet/greenlet/commit/173b692dc84288ef41572612ac744754f98eaa90\"\u003e\u003ccode\u003e173b692\u003c/code\u003e\u003c/a\u003e Back to development: 3.5.1\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/python-greenlet/greenlet/compare/3.5.0...3.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pyjwt` from 2.12.1 to 2.13.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/releases\"\u003epyjwt's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.13.0\u003c/h2\u003e\n\u003ch1\u003ePyJWT 2.13.0 — Security Release\u003c/h1\u003e\n\u003cp\u003eThis release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\"\u003e\u003ccode\u003eGHSA-xgmm-8j9v-c9wx\u003c/code\u003e\u003c/a\u003e — JWK JSON accepted as HMAC secret (algorithm confusion).\u003c/strong\u003e \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in \u003ccode\u003ealgorithms=[…]\u003c/code\u003e and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. \u003cem\u003eReported by \u003ca href=\"https://github.com/aradona91\"\u003e\u003ccode\u003e@​aradona91\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\"\u003e\u003ccode\u003eGHSA-jq35-7prp-9v3f\u003c/code\u003e\u003c/a\u003e — Algorithm allow-list bypass with \u003ccode\u003ePyJWK\u003c/code\u003e / \u003ccode\u003ePyJWKClient\u003c/code\u003e.\u003c/strong\u003e When verifying with a \u003ccode\u003ePyJWK\u003c/code\u003e, the caller's \u003ccode\u003ealgorithms=[…]\u003c/code\u003e allow-list was checked against the token header \u003ccode\u003ealg\u003c/code\u003e as a string only; actual verification used the algorithm bound to the \u003ccode\u003ePyJWK\u003c/code\u003e. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header \u003ccode\u003ealg\u003c/code\u003e to match the \u003ccode\u003ePyJWK\u003c/code\u003e's algorithm before verification. \u003cem\u003eReported by \u003ca href=\"https://github.com/sushi-gif\"\u003e\u003ccode\u003e@​sushi-gif\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\"\u003e\u003ccode\u003eGHSA-w7vc-732c-9m39\u003c/code\u003e\u003c/a\u003e — DoS via base64 decode of unused payload segment when \u003ccode\u003eb64=false\u003c/code\u003e.\u003c/strong\u003e For detached-payload JWS (\u003ccode\u003eb64=false\u003c/code\u003e), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied \u003ccode\u003edetached_payload\u003c/code\u003e. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. \u003cem\u003eReported by \u003ca href=\"https://github.com/thesmartshadow\"\u003e\u003ccode\u003e@​thesmartshadow\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\"\u003e\u003ccode\u003eGHSA-993g-76c3-p5m4\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e accepts non-HTTP(S) URIs.\u003c/strong\u003e \u003ccode\u003ePyJWKClient.fetch_data\u003c/code\u003e passed its URI to \u003ccode\u003eurllib.request.urlopen\u003c/code\u003e, which by default also handles \u003ccode\u003efile://\u003c/code\u003e, \u003ccode\u003eftp://\u003c/code\u003e, and \u003ccode\u003edata:\u003c/code\u003e schemes. An application that fed an attacker-influenced URI into \u003ccode\u003ePyJWKClient\u003c/code\u003e could be coerced into reading local files or reaching other unintended schemes. \u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects any URI whose scheme isn't \u003ccode\u003ehttp\u003c/code\u003e or \u003ccode\u003ehttps\u003c/code\u003e. \u003cem\u003eReported by \u003ca href=\"https://github.com/KEIJOT\"\u003e\u003ccode\u003e@​KEIJOT\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\"\u003e\u003ccode\u003eGHSA-fhv5-28vv-h8m8\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e cache wiped on fetch error.\u003c/strong\u003e A \u003ccode\u003efinally\u003c/code\u003e-block \u003ccode\u003eput(jwk_set=None)\u003c/code\u003e cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. \u003cem\u003eReported by \u003ca href=\"https://github.com/eddieran\"\u003e\u003ccode\u003e@​eddieran\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReject empty HMAC keys outright in \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e with \u003ccode\u003eInvalidKeyError\u003c/code\u003e instead of accepting them with only a warning. Defends against the \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e footgun. \u003cem\u003eThanks to \u003ca href=\"https://github.com/SnailSploit\"\u003e\u003ccode\u003e@​SnailSploit\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"https://github.com/spartan8806\"\u003e\u003ccode\u003e@​spartan8806\u003c/code\u003e\u003c/a\u003e for the reports.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003eForward per-call \u003ccode\u003eoptions\u003c/code\u003e (including \u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e) from \u003ccode\u003ePyJWT.decode\u003c/code\u003e through to \u003ccode\u003ePyJWS._verify_signature\u003c/code\u003e. The option was previously silently dropped between the two layers, so it only took effect when set on the \u003ccode\u003ePyJWT\u003c/code\u003e instance. \u003cem\u003eThanks to \u003ca href=\"https://github.com/WLUB\"\u003e\u003ccode\u003e@​WLUB\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRFC 7797 §3 compliance for \u003ccode\u003eb64=false\u003c/code\u003e:\u003c/strong\u003e the encoder now auto-adds \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e to \u003ccode\u003ecrit\u003c/code\u003e, and the decoder rejects tokens that set \u003ccode\u003eb64=false\u003c/code\u003e without listing it in \u003ccode\u003ecrit\u003c/code\u003e. \u003cem\u003eThanks to \u003ca href=\"https://github.com/MachineLearning-Nerd\"\u003e\u003ccode\u003e@​MachineLearning-Nerd\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eChanged\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups, by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/pull/1152\"\u003e#1152\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eUpgrade notes\u003c/h2\u003e\n\u003cp\u003eMost fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eEmpty HMAC keys now raise.\u003c/strong\u003e If your app passed \u003ccode\u003e\u0026quot;\u0026quot;\u003c/code\u003e or \u003ccode\u003eb\u0026quot;\u0026quot;\u003c/code\u003e as a secret (often via a missing env var, e.g. \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e), \u003ccode\u003eencode\u003c/code\u003e/\u003ccode\u003edecode\u003c/code\u003e will now raise \u003ccode\u003eInvalidKeyError\u003c/code\u003e. This is the intended behavior — fix the configuration.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWK\u003c/code\u003e decoding now requires the token's \u003ccode\u003ealg\u003c/code\u003e to match the JWK's algorithm.\u003c/strong\u003e Previously a mismatch was silently honored if the header \u003ccode\u003ealg\u003c/code\u003e appeared in the allow-list. Tokens that relied on this mismatch will now fail with \u003ccode\u003eInvalidAlgorithmError\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects non-HTTP(S) URIs at construction time.\u003c/strong\u003e Tests or dev environments that fetched JWKS from \u003ccode\u003efile://\u003c/code\u003e URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct \u003ccode\u003ePyJWKSet.from_dict(...)\u003c/code\u003e directly).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eb64=false\u003c/code\u003e tokens are now strictly RFC 7515 / 7797 compliant.\u003c/strong\u003e Tokens with a non-empty compact-form payload segment, or that omit \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e from \u003ccode\u003ecrit\u003c/code\u003e, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e set per-call now takes effect.\u003c/strong\u003e Callers who passed \u003ccode\u003eoptions={\u0026quot;enforce_minimum_key_length\u0026quot;: True}\u003c/code\u003e to \u003ccode\u003ejwt.decode()\u003c/code\u003e previously got no enforcement; they will now get \u003ccode\u003eInvalidKeyError\u003c/code\u003e on undersized keys, as documented.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull changelog:\u003c/strong\u003e \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\"\u003ehttps://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst\"\u003epyjwt's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ccode\u003ev2.13.0 \u0026lt;https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u0026gt;\u003c/code\u003e__\u003c/h2\u003e\n\u003cp\u003eSecurity\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject JWK JSON documents passed as raw HMAC secrets in\n  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that\n  the existing PEM/SSH guard did not cover. Reported by @aradona91 in\n  `GHSA-xgmm-8j9v-c9wx \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\u0026gt;`__.\n- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during\n  verification so the caller's ``algorithms=[...]`` allow-list cannot be\n  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported\n  by @sushi-gif in `GHSA-jq35-7prp-9v3f \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\u0026gt;`__.\n- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-\n  influenced URIs cannot read local files or reach unintended schemes via\n  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported\n  by @KEIJOT in `GHSA-993g-76c3-p5m4 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\u0026gt;`__.\n- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.\n  The previous ``finally``-block ``put(None)`` pattern cleared the cache\n  on any transient outage, turning one bad JWKS request into application-\n  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\u0026gt;`__.\n- Skip the unconditional base64 decode of the compact-form payload segment\n  when ``b64=false`` is set in the protected header, and require that\n  segment to be empty (RFC 7515 Appendix F detached form). Closes an\n  unauthenticated DoS amplifier. Reported by @thesmartshadow in\n  `GHSA-w7vc-732c-9m39 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\u0026gt;`__.\n\u003cp\u003eFixed\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with\n  ``InvalidKeyError`` instead of accepting them with only a warning.\n  Thanks to @SnailSploit and @spartan8806 for independently flagging the\n  footgun.\n- Forward per-call ``options`` (including ``enforce_minimum_key_length``)\n  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the\n  option actually takes effect when set at the call site rather than only\n  on the ``PyJWT`` instance. Thanks to @WLUB for the report.\n- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds\n  ``\u0026amp;quot;b64\u0026amp;quot;`` to the ``crit`` header parameter, and the decoder rejects\n  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to\n  @MachineLearning-Nerd for the report.\n\nChanged\n\u003c/code\u003e\u003c/pre\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ccode\u003e[#1152](https://github.com/jpadilla/pyjwt/issues/1152) \u0026amp;lt;https://github.com/jpadilla/pyjwt/pull/1152\u0026amp;gt;\u003c/code\u003e__\n\u003c/code\u003e\u003c/pre\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff\"\u003e\u003ccode\u003e7144e45\u003c/code\u003e\u003c/a\u003e Apply ruff format\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab\"\u003e\u003ccode\u003ed2f4bec\u003c/code\u003e\u003c/a\u003e Restore \u003ccode\u003ecast()\u003c/code\u003e calls with cross-version \u003ccode\u003etype: ignore\u003c/code\u003e for \u003ccode\u003eprepare_key\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774\"\u003e\u003ccode\u003e22f478c\u003c/code\u003e\u003c/a\u003e Remove redundant casts in \u003ccode\u003eRSAAlgorithm.prepare_key\u003c/code\u003e and `ECAlgorithm.prepare...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81\"\u003e\u003ccode\u003e95791b1\u003c/code\u003e\u003c/a\u003e Bundle security fixes and hardening into 2.13.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508\"\u003e\u003ccode\u003edcc27a9\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1155\"\u003e#1155\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a\"\u003e\u003ccode\u003e9d08a9a\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1146\"\u003e#1146\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64\"\u003e\u003ccode\u003eb87c100\u003c/code\u003e\u003c/a\u003e Bump codecov/codecov-action from 5 to 6 (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1154\"\u003e#1154\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812\"\u003e\u003ccode\u003e40e3147\u003c/code\u003e\u003c/a\u003e Migrate development extras to dependency groups (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1152\"\u003e#1152\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pydantic` from 2.13.3 to 2.13.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pydantic/pydantic/releases\"\u003epydantic's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.13.4 2026-05-06\u003c/h2\u003e\n\u003ch2\u003ev2.13.4 (2026-05-06)\u003c/h2\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003ch4\u003ePackaging\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eBump libc from 0.2.155 to 0.2.185 by \u003ca href=\"https://github.com/Viicos\"\u003e\u003ccode\u003e@​Viicos\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic/pull/13109\"\u003e#13109\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdapt \u003ccode\u003epydantic-core\u003c/code\u003e linker flags on macOS by \u003ca href=\"https://github.com/washingtoneg\"\u003e\u003ccode\u003e@​washingtoneg\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"https://github.com/Viicos\"\u003e\u003ccode\u003e@​Viicos\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic/pull/13147\"\u003e#13147\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eFixes\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve \u003ccode\u003eRootModel\u003c/code\u003e core metadata by \u003ca href=\"https://github.com/Viicos\"\u003e\u003ccode\u003e@​Viicos\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic/pull/13129\"\u003e#13129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/pydantic/pydantic/compare/v2.13.3...v2.13.4\"\u003ehttps://github.com/pydantic/pydantic/compare/v2.13.3...v2.13.4\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pydantic/pydantic/blob/main/HISTORY.md\"\u003epydantic's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.13.4 (2026-05-06)\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/pydantic/pydantic/releases/tag/v2.13.4\"\u003eGitHub release\u003c/a\u003e\u003c/p\u003e\n\u003ch3\u003eWhat's Changed\u003c/h3\u003e\n\u003ch4\u003ePackaging\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eBump libc from 0.2.155 to 0.2.185 by \u003ca href=\"https://github.com/Viicos\"\u003e\u003ccode\u003e@​Viicos\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic/pull/13109\"\u003e#13109\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdapt \u003ccode\u003epydantic-core\u003c/code\u003e linker flags on macOS by \u003ca href=\"https://github.com/washingtoneg\"\u003e\u003ccode\u003e@​washingtoneg\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"https://github.com/Viicos\"\u003e\u003ccode\u003e@​Viicos\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic/pull/13147\"\u003e#13147\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eFixes\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003ePreserve \u003ccode\u003eRootModel\u003c/code\u003e core metadata by \u003ca href=\"https://github.com/Viicos\"\u003e\u003ccode\u003e@​Viicos\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic/pull/13129\"\u003e#13129\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/cf67d4b3193c3fe43ede18612ed62785eee11382\"\u003e\u003ccode\u003ecf67d4b\u003c/code\u003e\u003c/a\u003e Fix linting\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/f0d8a214a5803036db46a56b1f62f1e56b81d662\"\u003e\u003ccode\u003ef0d8a21\u003c/code\u003e\u003c/a\u003e Prepare release v2.13.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/5e3fe1d41a00f441204241c66078003ae0391f9a\"\u003e\u003ccode\u003e5e3fe1d\u003c/code\u003e\u003c/a\u003e Check for pydantic tag pattern in CI\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/7f9edcc2a191d2eaa9751220eb910914e716a686\"\u003e\u003ccode\u003e7f9edcc\u003c/code\u003e\u003c/a\u003e Document tagging conventions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/b46a0c9b8a4dd967fda8ec1a92f6437076bf262c\"\u003e\u003ccode\u003eb46a0c9\u003c/code\u003e\u003c/a\u003e Adapt \u003ccode\u003epydantic-core\u003c/code\u003e linker flags on macOS\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/50629c851e61d887d5420452c311ec6203f1f400\"\u003e\u003ccode\u003e50629c8\u003c/code\u003e\u003c/a\u003e Update to PyPy 7.3.22\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/8522ebb71e5e9a6f7188af5f009f01785b8cf725\"\u003e\u003ccode\u003e8522ebb\u003c/code\u003e\u003c/a\u003e Preserve \u003ccode\u003eRootModel\u003c/code\u003e core metadata\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/a37f3aff090ca342dc5f48304889963530b993f8\"\u003e\u003ccode\u003ea37f3af\u003c/code\u003e\u003c/a\u003e Adapt \u003ccode\u003eMISSING\u003c/code\u003e sentinel test to work with unreleased \u003ccode\u003etyping_extensions\u003c/code\u003e ver...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/909259a9df660518033aa686b689f045a6eaf9d2\"\u003e\u003ccode\u003e909259a\u003c/code\u003e\u003c/a\u003e Remove Logfire example in documentation\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic/commit/2c4174c366606fc2dc46cb806833a080aefa77df\"\u003e\u003ccode\u003e2c4174c\u003c/code\u003e\u003c/a\u003e Bump libc from 0.2.155 to 0.2.185\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/pydantic/pydantic/compare/v2.13.3...v2.13.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pydantic-settings` from 2.14.0 to 2.14.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pydantic/pydantic-settings/releases\"\u003epydantic-settings's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.14.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump the python-packages group with 4 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/pull/850\"\u003epydantic/pydantic-settings#850\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the python-packages group with 5 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/pull/854\"\u003epydantic/pydantic-settings#854\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the github-actions group with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/pull/853\"\u003epydantic/pydantic-settings#853\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the python-packages group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/pull/856\"\u003epydantic/pydantic-settings#856\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix field named \u003ccode\u003ecls\u003c/code\u003e conflicting with classmethod parameter by \u003ca href=\"https://github.com/hramezani\"\u003e\u003ccode\u003e@​hramezani\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/pull/858\"\u003epydantic/pydantic-settings#858\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003ePrepare release 2.14.1 by \u003ca href=\"https://github.com/hramezani\"\u003e\u003ccode\u003e@​hramezani\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/pull/859\"\u003epydantic/pydantic-settings#859\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1\"\u003ehttps://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic-settings/commit/e95c30bec8cfaee88ee275138c064aea97a25bdf\"\u003e\u003ccode\u003ee95c30b\u003c/code\u003e\u003c/a\u003e Prepare release 2.14.1 (\u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/issues/859\"\u003e#859\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic-settings/commit/0c8734581b6cf70a995afad603ac456631d00621\"\u003e\u003ccode\u003e0c87345\u003c/code\u003e\u003c/a\u003e Fix field named \u003ccode\u003ecls\u003c/code\u003e conflicting with classmethod parameter (\u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/issues/858\"\u003e#858\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic-settings/commit/7bd0072795a800065b42210b6dca90fc9b83daf7\"\u003e\u003ccode\u003e7bd0072\u003c/code\u003e\u003c/a\u003e Bump the python-packages group with 2 updates (\u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/issues/856\"\u003e#856\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic-settings/commit/b03e573d017ed48e1c2774a5e0b715db9766c76b\"\u003e\u003ccode\u003eb03e573\u003c/code\u003e\u003c/a\u003e Bump the github-actions group with 3 updates (\u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/issues/853\"\u003e#853\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic-settings/commit/eaa3b434938411ec8a3717ea646614561e713f51\"\u003e\u003ccode\u003eeaa3b43\u003c/code\u003e\u003c/a\u003e Bump the python-packages group with 5 updates (\u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/issues/854\"\u003e#854\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pydantic/pydantic-settings/commit/9f95615c24c6813c1d7d203576581a79cb6d9e8e\"\u003e\u003ccode\u003e9f95615\u003c/code\u003e\u003c/a\u003e Bump the python-packages group with 4 updates (\u003ca href=\"https://redirect.github.com/pydantic/pydantic-settings/issues/850\"\u003e#850\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/pydantic/pydantic-settings/compare/v2.14.0...v2.14.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pandas` from 3.0.2 to 3.0.3\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pandas-dev/pandas/releases\"\u003epandas's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003epandas 3.0.3\u003c/h2\u003e\n\u003cp\u003eWe are pleased to announce the release of pandas 3.0.3.\nThis is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version.\u003c/p\u003e\n\u003cp\u003eSee the \u003ca href=\"https://pandas.pydata.org/docs/whatsnew/v3.0.3.html\"\u003efull whatsnew\u003c/a\u003e for a list of all the changes.\u003c/p\u003e\n\u003cp\u003ePandas 3.0 supports Python 3.11 and higher.\nThe release can be installed from PyPI:\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003epython -m pip install --upgrade pandas==3.0.*\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eOr from conda-forge\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003econda install -c conda-forge pandas=3.0\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003ePlease report any issues with the release on the \u003ca href=\"https://github.com/pandas-dev/pandas/issues\"\u003epandas issue tracker\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eThanks to all the contributors who made this release possible.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/72f2fea91530b5abb3cf2100cb22d84e504695c0\"\u003e\u003ccode\u003e72f2fea\u003c/code\u003e\u003c/a\u003e RLS: 3.0.3 (\u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/65590\"\u003e#65590\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/2897590094c2b6e3962d01a82665936f30be563d\"\u003e\u003ccode\u003e2897590\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/65436\"\u003e#65436\u003c/a\u003e on branch 3.0.x (Account for privatization of matplotlib `...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/49894b5b6037c50f6444504070d9b1e8e514001a\"\u003e\u003ccode\u003e49894b5\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/65499\"\u003e#65499\u003c/a\u003e on branch 3.0.x (BUG: fix check if pyarrow is installed in...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/1c6d1e30cc4b80bedb769a8b3731b0788f69c9dc\"\u003e\u003ccode\u003e1c6d1e3\u003c/code\u003e\u003c/a\u003e [backport 3.0.x] PERF: remove special casing for zoneinfo in tz_localize_to_u...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/2a547116afc46d88d4e6584670fd793949222a1e\"\u003e\u003ccode\u003e2a54711\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/64379\"\u003e#64379\u003c/a\u003e on branch 3.0.x (PERF: improve performance with ZoneInfo t...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/036bb7c0e7160b9d5a7f6bd26a9fc00921fa6977\"\u003e\u003ccode\u003e036bb7c\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/65482\"\u003e#65482\u003c/a\u003e on branch 3.0.x (PERF: don't call unique on dtypes for che...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/bf4c182b09251f5b469e8e246ae3ea3e1ae07164\"\u003e\u003ccode\u003ebf4c182\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/65410\"\u003e#65410\u003c/a\u003e on branch 3.0.x (TST: also convert str index to object in ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/dd02d75ce219135f9f3f65c13644d4be35585d42\"\u003e\u003ccode\u003edd02d75\u003c/code\u003e\u003c/a\u003e [backport 3.0.x] BUG: keep fsspec OpenFile alive for chained URL reads (\u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/6547\"\u003e#6547\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/aef3d0f6698667262c6d6ffc69180b280b0fa86a\"\u003e\u003ccode\u003eaef3d0f\u003c/code\u003e\u003c/a\u003e [backport 3.0.x] CI: lowercase types-pymysql/types-pyyaml to fix mamba 2.6.0 ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pandas-dev/pandas/commit/bb8e24876273a14322047f4b89e648f6a4abebae\"\u003e\u003ccode\u003ebb8e248\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/pandas-dev/pandas/issues/65399\"\u003e#65399\u003c/a\u003e on branch 3.0.x (DOC: fix source link for classes in the r...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pandas-dev/pandas/compare/v3.0.2...v3.0.3\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `google-cloud-aiplatform` from 1.150.0 to 1.153.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/googleapis/python-aiplatform/releases\"\u003egoogle-cloud-aiplatform's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.153.1\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/googleapis/python-aiplatform/compare/v1.153.0...v1.153.1\"\u003e1.153.1\u003c/a\u003e (2026-05-15)\u003c/h2\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRemove google-genai version contraints (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/cf4f183c085421e255267787214018de209430d1\"\u003ecf4f183\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemove SDK workaround for async_retrieve_contexts. (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/5aabd30b88de06f1c4d73cfd3e6d02bf4f73c943\"\u003e5aabd30\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRelax google-genai dep to \u0026gt;= 2.0 (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/6a17fdc1ed5b95839836ba0f9a29782b5af6b279\"\u003e6a17fdc\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMiscellaneous Chores\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eRelease 1.153.1 (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/addbff629c38c172267aa5caa3f4a79c8c444837\"\u003eaddbff6\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.153.0\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/googleapis/python-aiplatform/compare/v1.152.0...v1.153.0\"\u003e1.153.0\u003c/a\u003e (2026-05-14)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eGenAI Client(evals) - Add red_teaming_config support for create_evaluation_run (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/657f379dc516a1db75eca1686731b7a4944a3b41\"\u003e657f379\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eMigrate Agent Engines, Evaluation, Prompt Management, and Skill features to agentplatform (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/74ec5e1e8234713d16024c9bea06778366c4dd64\"\u003e74ec5e1\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eInject agents map from agent_info into agent_data for create_evaluation_run (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/a4ffb673911fb4e0e25174c1b92054eb4a443d34\"\u003ea4ffb67\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd Skill Registry Python SDK section in README (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/9f8e24c04f577bba7bb17a730a2264a94502cf4c\"\u003e9f8e24c\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev1.152.0\u003c/h2\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/googleapis/python-aiplatform/compare/v1.151.0...v1.152.0\"\u003e1.152.0\u003c/a\u003e (2026-05-11)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd GetSkillRevision and ListSkillRevisions methods in Vertex AI Skill Registry SDK (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/e4fdb7a5d9129cb46aa060f4c69f276b14b6864a\"\u003ee4fdb7a\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd ListSkills and DeleteSkill methods in Vertex AI Skill Registry SDK (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/8578bfd09b78990051b2839e8b0cf1f9e0cca4ef\"\u003e8578bfd\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd mTLS support for telemetry endpoint in adk.py. (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/7b0c9956c9f73e76a2ca3a2c8ad00f79d06f1e13\"\u003e7b0c995\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdd Update Skill method for Vertex AI Skill Registry SDK (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/48f792b07cda215cc62d16fac0df84eb3f60cba5\"\u003e48f792b\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eGenAI Client(evals) - Add allow_cross_region_model support for create_evaluation_run (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/3ce4b0264174463372b7e980c71231b651b7d411\"\u003e3ce4b02\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix name collision on SandboxEnvironment.state by renaming enum to SandboxState (\u003ca href=\"https://github.com/googleapis/python-aiplatform/commit/1f9c8e014b46a77ce64843434b1cad253bc4ce05\"\u003e1f9c8e0\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/googleapis/python-aiplatform/blob/main/CHANGELOG.md\"\u003egoogle-cloud-aiplatform's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ca href=\"https://github.com/googleapis/python-aiplatform/compare/v1.153.0...v1.153.1\"\u003e1.153.1\u003c/a\u003e (2...\n\n_Description has been truncated_","html_url":"https://github.com/Ibrahim-newaeon/Stratum-AI-Final-Updates-Dec-2025/pull/290","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Ibrahim-newaeon%2FStratum-AI-Final-Updates-Dec-2025/issues/290","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/290/packages"}},{"old_version":"\u003c7.0.0,\u003e=6.0.2","new_version":"\u003e=6.1.1,\u003c7.0.0","update_type":"minor","path":null,"pr_created_at":"2026-05-26T00:19:40.000Z","version_change":"\u003c7.0.0,\u003e=6.0.2 → \u003e=6.1.1,\u003c7.0.0","issue":{"uuid":"4520297200","node_id":"PR_kwDOSnyNFs7fNaBQ","number":1,"state":"open","title":"deps(deps): update lxml requirement from \u003c7.0.0,\u003e=6.0.2 to \u003e=6.1.1,\u003c7.0.0","user":"dependabot[bot]","labels":[],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-26T00:19:40.000Z","updated_at":"2026-05-26T00:19:40.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"deps(deps): update","packages":[{"name":"lxml","old_version":"\u003c7.0.0,\u003e=6.0.2","new_version":"\u003e=6.1.1,\u003c7.0.0","repository_url":"https://github.com/lxml/lxml"}],"path":null,"ecosystem":"pip"},"body":"Updates the requirements on [lxml](https://github.com/lxml/lxml) to permit the latest version.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.1.0 (2026-04-17)\u003c/h1\u003e\n\u003cp\u003eThis release fixes a possible external entity injection (XXE) vulnerability in\n\u003ccode\u003eiterparse()\u003c/code\u003e and the \u003ccode\u003eETCompatXMLParser\u003c/code\u003e.\u003c/p\u003e\n\u003ch2\u003eFeatures added\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eGH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes\nin \u003ccode\u003elxml.html.defs\u003c/code\u003e.  This allows \u003ccode\u003elxml_html_clean\u003c/code\u003e to pass them through.\nPatch by oomsveta.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe default chunk size for reading from file-likes in \u003ccode\u003eiterparse()\u003c/code\u003e is now configurable\nwith a new \u003ccode\u003echunk_size\u003c/code\u003e argument.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2146291: The \u003ccode\u003eresolve_entities\u003c/code\u003e option was still set to \u003ccode\u003eTrue\u003c/code\u003e for\n\u003ccode\u003eiterparse\u003c/code\u003e and \u003ccode\u003eETCompatXMLParser\u003c/code\u003e, allowing for external entity injection (XXE)\nwhen using these parsers without setting this option explicitly.\nThe default was now changed to \u003ccode\u003e'internal'\u003c/code\u003e only (as for the normal XML and HTML parsers\nsince lxml 5.0).\nIssue found by Sihao Qiu as CVE-2026-41066.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003e6.0.4 (2026-04-12)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eLP#2148019: Spurious MemoryError during namespace cleanup.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/43722f4402afa48b7890a96ce012eb0b9b1af5be\"\u003e\u003ccode\u003e43722f4\u003c/code\u003e\u003c/a\u003e Update changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/87470409b17188a5a7dbefcfa124af9cd792ffaa\"\u003e\u003ccode\u003e8747040\u003c/code\u003e\u003c/a\u003e Name version of option change in docstring.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/6c36e6cef77db5087a1fff1a0d1ca8fed963afe7\"\u003e\u003ccode\u003e6c36e6c\u003c/code\u003e\u003c/a\u003e Fix pypistats URL in download statistics script.\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.0.2...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/graham-a11y/Claude-seo/pull/1","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/graham-a11y%2FClaude-seo/issues/1","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/1/packages"}},{"old_version":"6.1.0","new_version":"6.1.1","update_type":"patch","path":null,"pr_created_at":"2026-05-25T23:06:33.000Z","version_change":"6.1.0 → 6.1.1","issue":{"uuid":"4520006161","node_id":"PR_kwDOO9zzg87fMc_W","number":116,"state":"open","title":"chore(deps): bump lxml from 6.1.0 to 6.1.1","user":"dependabot[bot]","labels":["dependencies"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-05-25T23:06:33.000Z","updated_at":"2026-05-25T23:06:34.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps)","packages":[{"name":"lxml","old_version":"6.1.0","new_version":"6.1.1","repository_url":"https://github.com/lxml/lxml"}],"path":null,"ecosystem":"pip"},"body":"Bumps [lxml](https://github.com/lxml/lxml) from 6.1.0 to 6.1.1.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/lxml/lxml/blob/master/CHANGES.txt\"\u003elxml's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e6.1.1 (2026-05-18)\u003c/h1\u003e\n\u003ch2\u003eBugs fixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe known link attributes in \u003ccode\u003elxml.html.defs.link_attrs\u003c/code\u003e were missing \u003ccode\u003exlink:href\u003c/code\u003e,\nwhich can be used for URL bypass attacks in embedded SVG/MathML/etc. content.\n\u003ca href=\"https://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\"\u003ehttps://github.com/fedora-python/lxml_html_clean/security/advisories/GHSA-4jhm-jv67-739f\u003c/a\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Linux wheels use a patched libxslt 1.1.43, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe Windows wheels use libxslt 1.1.45, fixing CVE-2025-7424 and CVE-2025-11731.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/b4a4c595fb875d6f50ae113449834209a364643a\"\u003e\u003ccode\u003eb4a4c59\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/a116dcbe671a792dd65bc73f53a8209e7d7c25ff\"\u003e\u003ccode\u003ea116dcb\u003c/code\u003e\u003c/a\u003e Fix typo: type annotions -\u0026gt; type annotations in PEP 560 comments (\u003ca href=\"https://redirect.github.com/lxml/lxml/issues/504\"\u003eGH-504\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/7287a75eedc4cdc247a7937d09013e936c34ace6\"\u003e\u003ccode\u003e7287a75\u003c/code\u003e\u003c/a\u003e Prepare release of 6.1.1.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/5927a6d5e851845140975d99b65461e255caaab0\"\u003e\u003ccode\u003e5927a6d\u003c/code\u003e\u003c/a\u003e Add missing \u0026quot;xlink:href\u0026quot; to the known HTML link attributes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/23efeb4910e43e9545b754ce1f138d91ed5cc25c\"\u003e\u003ccode\u003e23efeb4\u003c/code\u003e\u003c/a\u003e Build: Fix build in Py3.8.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/2c0563b3e8c272e62667c7850612347f65d2952e\"\u003e\u003ccode\u003e2c0563b\u003c/code\u003e\u003c/a\u003e Build: Add bug patch for libxslt 1.1.43 and apply it during the static librar...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/lxml/lxml/commit/8a35fcc3ed53975c762867c3ac8ae318c7960be7\"\u003e\u003ccode\u003e8a35fcc\u003c/code\u003e\u003c/a\u003e Fix doctest in PyPy3.9.\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/lxml/lxml/compare/lxml-6.1.0...lxml-6.1.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=lxml\u0026package-manager=uv\u0026previous-version=6.1.0\u0026new-version=6.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\n\n\n\u003c/details\u003e","html_url":"https://github.com/Brain-Modulation-Lab/DBSAnnotator/pull/116","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Brain-Modulation-Lab%2FDBSAnnotator/issues/116","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/116/packages"}}]}