{"id":500,"name":"tornado","ecosystem":"pip","repository_url":"https://github.com/tornadoweb/tornado","issues_count":3647,"created_at":"2025-06-06T15:01:34.897Z","updated_at":"2025-06-06T15:01:34.897Z","purl":"pkg:pypi/tornado","metadata":{"id":2951143,"name":"tornado","ecosystem":"pypi","description":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.","homepage":"http://www.tornadoweb.org/","licenses":"Apache-2.0","normalized_licenses":["Apache-2.0"],"repository_url":"https://github.com/tornadoweb/tornado","keywords_array":[],"namespace":null,"versions_count":77,"first_release_published_at":"2010-05-18T11:03:55.000Z","latest_release_published_at":"2025-05-22T18:15:20.000Z","latest_release_number":"6.5.1","last_synced_at":"2025-06-06T05:01:53.621Z","created_at":"2022-04-10T12:52:39.512Z","updated_at":"2025-06-06T05:01:53.622Z","registry_url":"https://pypi.org/project/tornado/","install_command":"pip install tornado --index-url https://pypi.org/simple","documentation_url":"https://tornado.readthedocs.io/","metadata":{"funding":null,"documentation":null,"classifiers":["License :: OSI Approved :: Apache Software License","Programming Language :: Python :: 3","Programming Language :: Python :: 3.10","Programming Language :: Python :: 3.11","Programming Language :: Python :: 3.12","Programming Language :: Python :: 3.13","Programming Language :: Python :: 3.9","Programming Language :: Python :: Implementation :: CPython","Programming Language :: Python :: Implementation :: PyPy"],"normalized_name":"tornado"},"repo_metadata":{"uuid":"301742","full_name":"tornadoweb/tornado","owner":"tornadoweb","description":"Tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed.","archived":false,"fork":false,"pushed_at":"2023-12-30T20:18:45.000Z","size":10191,"stargazers_count":21384,"open_issues_count":218,"forks_count":5571,"subscribers_count":994,"default_branch":"master","last_synced_at":"2024-01-06T08:28:31.676Z","etag":null,"topics":["asynchronous","python"],"latest_commit_sha":null,"homepage":"http://www.tornadoweb.org/","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tornadoweb.png","metadata":{"files":{"readme":"README.rst","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":"SECURITY.md","support":null,"governance":null}},"created_at":"2009-09-09T04:55:16.000Z","updated_at":"2024-01-05T22:51:00.000Z","dependencies_parsed_at":"2023-07-05T15:16:53.439Z","dependency_job_id":"f8015d5b-25da-4e7d-9740-7154fe2c1ea8","html_url":"https://github.com/tornadoweb/tornado","commit_stats":{"total_commits":3642,"total_committers":447,"mean_commits":8.14765100671141,"dds":0.3585941790225151,"last_synced_commit":"e0fa53ee96db720dc7800d0248c39a4ffb8911e9"},"previous_names":[],"tags_count":71,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tornadoweb","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":179449448,"owners_count":10817784,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"tornadoweb","name":"tornadoweb","uuid":"7468980","kind":"organization","description":"","email":null,"website":null,"location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/7468980?v=4","repositories_count":1,"last_synced_at":"2023-04-09T09:48:08.331Z","metadata":{"has_sponsors_listing":false},"html_url":"https://github.com/tornadoweb","created_at":"2022-11-02T16:23:22.380Z","updated_at":"2023-04-09T09:48:08.386Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tornadoweb","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tornadoweb/repositories"},"tags":[{"name":"v6.3.3","sha":"e4d698433b44f350d4908da9ca2cac475c92dfdc","kind":"tag","published_at":"2023-08-11T14:45:47.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.3.3","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.3.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.3.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.3.3/manifests"},{"name":"v6.3.2","sha":"34f5c1cf2696afec5532ca9e870ba32cbc7fee27","kind":"tag","published_at":"2023-05-14T01:38:10.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.3.2","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.3.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.3.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.3.2/manifests"},{"name":"v6.3.1","sha":"419838b9bcc51445241630def0478f1fbaa61b4b","kind":"tag","published_at":"2023-04-21T20:33:11.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.3.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.3.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.3.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.3.1/manifests"},{"name":"v6.3.0","sha":"298dc390bbc2d06b93d8e7b063c1a216184c11fe","kind":"tag","published_at":"2023-04-18T01:19:13.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.3.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.3.0/manifests"},{"name":"v6.3.0b1","sha":"c83389fa103d62eb3e4911d5dd9b1971852f4867","kind":"commit","published_at":"2023-04-09T20:45:26.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.3.0b1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.3.0b1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.3.0b1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.3.0b1/manifests"},{"name":"v6.2.0","sha":"a4f08a31a348445094d1efa17880ed5472db9f7d","kind":"tag","published_at":"2022-07-03T22:11:23.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.2.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.2.0/manifests"},{"name":"v6.2.0b2","sha":"1de5e68d1684e99b80e73beb59661c2fe1c57319","kind":"commit","published_at":"2022-06-17T20:40:41.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.2.0b2","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.2.0b2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.2.0b2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.2.0b2/manifests"},{"name":"v6.2.0b1","sha":"4470d6927a598b2d8e7aaf14398ab7ca5b0ed5c6","kind":"tag","published_at":"2022-06-10T19:09:39.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.2.0b1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.2.0b1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.2.0b1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.2.0b1/manifests"},{"name":"v6.1.0","sha":"2047e7ae3c825bf52dad10cc8402d09e11091bc1","kind":"tag","published_at":"2020-10-30T17:45:28.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.1.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.1.0/manifests"},{"name":"v6.1.0b2","sha":"bee08e25b1b990edd7ebfb7cd463ec18a98a3fde","kind":"commit","published_at":"2020-10-25T00:49:14.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.1.0b2","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.1.0b2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.1.0b2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.1.0b2/manifests"},{"name":"v6.1.0b1","sha":"69e750ef056969e1d0d204b558a64a014d27e0d1","kind":"tag","published_at":"2020-09-30T11:18:32.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.1.0b1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.1.0b1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.1.0b1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.1.0b1/manifests"},{"name":"v6.0.4","sha":"b4e39e52cd27d6b3b324a399dff046f71545c4a5","kind":"tag","published_at":"2020-03-04T02:12:02.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.0.4","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.0.4","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.0.4","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.0.4/manifests"},{"name":"v6.0.3","sha":"a36d05d1ef6527c56aaea2a749972845e64ef206","kind":"tag","published_at":"2019-06-23T22:22:48.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.0.3","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.0.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.0.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.0.3/manifests"},{"name":"v6.0.2","sha":"442a8124a4373f7140bbdd8f9db9ce4346290f9d","kind":"tag","published_at":"2019-03-23T16:37:57.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.0.2","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.0.2/manifests"},{"name":"v6.0.1","sha":"c9dad2a3082cf9d793e47389430939ae5e61a760","kind":"tag","published_at":"2019-03-03T17:01:06.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.0.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.0.1/manifests"},{"name":"v6.0.0","sha":"3c8728d8d0eb28fa43aa91073be222b04d799bde","kind":"tag","published_at":"2019-03-01T15:12:57.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.0.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.0.0/manifests"},{"name":"v6.0.0b1","sha":"4f1ebe47324ba73f60591bccf1d6f6d3a2f640a2","kind":"commit","published_at":"2019-02-10T23:08:24.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v6.0.0b1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v6.0.0b1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.0.0b1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v6.0.0b1/manifests"},{"name":"v5.1.1","sha":"cc2cf078a39abec6f8d181f76a4e5ba9432364f3","kind":"tag","published_at":"2018-09-16T18:53:43.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v5.1.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v5.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v5.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v5.1.1/manifests"},{"name":"v5.1.0","sha":"c890f840f28b668202682acae6fefb633e6e6fb2","kind":"tag","published_at":"2018-07-11T13:26:40.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v5.1.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v5.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v5.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v5.1.0/manifests"},{"name":"v5.1.0b1","sha":"9470c80afcd8f6f27d4a595907f004601517e8c8","kind":"commit","published_at":"2018-06-11T03:25:13.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v5.1.0b1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v5.1.0b1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v5.1.0b1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v5.1.0b1/manifests"},{"name":"v5.0.2","sha":"4fb847bf7abaddaa97ae60dd90b61246c5a523cd","kind":"tag","published_at":"2018-04-08T00:31:39.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v5.0.2","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v5.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v5.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v5.0.2/manifests"},{"name":"v5.0.1","sha":"b758925a1f07f28f7b2c3308eb45dadb0015f7ba","kind":"tag","published_at":"2018-03-18T15:39:45.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v5.0.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v5.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v5.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v5.0.1/manifests"},{"name":"v5.0.0","sha":"3fc6aec1a5bd438ba52cb762fc20792062a95f05","kind":"tag","published_at":"2018-03-05T13:41:51.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v5.0.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v5.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v5.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v5.0.0/manifests"},{"name":"v4.5.3","sha":"8e9e75502ff910629663c4cdd7779d43ea2dd150","kind":"tag","published_at":"2018-01-06T17:49:37.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.5.3","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.5.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.5.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.5.3/manifests"},{"name":"v4.5.2","sha":"810c341d2488c11813995dd2beadab7ba00ff44d","kind":"tag","published_at":"2017-08-27T18:51:11.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.5.2","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.5.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.5.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.5.2/manifests"},{"name":"v4.5.1","sha":"e4f26acdabca32f6cc94a2681fb518dbce132688","kind":"tag","published_at":"2017-04-20T13:32:30.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.5.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.5.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.5.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.5.1/manifests"},{"name":"v4.5.0","sha":"c9d2a3fa573987629ad576e991c2f3b65f4daab4","kind":"tag","published_at":"2017-04-16T23:46:46.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.5.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.5.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.5.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.5.0/manifests"},{"name":"v4.4.3","sha":"50f1890e3e972eb49caebfe5b4fb5ef5fbfdcbc9","kind":"tag","published_at":"2017-03-30T13:19:25.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.4.3","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.4.3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.4.3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.4.3/manifests"},{"name":"v4.4.2","sha":"c0f99bac0aeda25529e5c3df90034d4b2fa311fd","kind":"tag","published_at":"2016-09-30T22:45:01.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.4.2","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.4.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.4.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.4.2/manifests"},{"name":"v4.4.1","sha":"087085ab2b8373947e742465538e4a2a89a48f77","kind":"tag","published_at":"2016-07-23T16:27:38.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.4.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.4.1/manifests"},{"name":"v4.4.0","sha":"79ef301eb05cac82c075198e502d94dad296f6aa","kind":"tag","published_at":"2016-07-15T14:54:52.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.4.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.4.0/manifests"},{"name":"v4.4.0b1","sha":"24660996f1d6065eba8f20c03b4e494bf1d285fb","kind":"commit","published_at":"2016-07-08T18:16:41.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.4.0b1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.4.0b1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.4.0b1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.4.0b1/manifests"},{"name":"v4.3.0","sha":"26a5a6b8076ac0b6124b2bba9ff63627595f4fd6","kind":"tag","published_at":"2015-11-06T20:09:20.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.3.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.3.0/manifests"},{"name":"v4.3.0b2","sha":"aebf0088fc4258cd5a0f1d5d69d0f3de7b66ef6c","kind":"commit","published_at":"2015-10-24T22:03:48.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.3.0b2","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.3.0b2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.3.0b2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.3.0b2/manifests"},{"name":"v4.3.0b1","sha":"2c543d276dba89c37a07c2295cd8c7f0f7ab1562","kind":"commit","published_at":"2015-10-18T22:11:02.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.3.0b1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.3.0b1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.3.0b1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.3.0b1/manifests"},{"name":"v4.2.1","sha":"5d4d114354f86b663e4ed4d963075237bf7e8a35","kind":"tag","published_at":"2015-07-17T15:49:14.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.2.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.2.1/manifests"},{"name":"v4.2.0","sha":"fdfaf3dffa49479c7461050eacca07bc5ee8d207","kind":"tag","published_at":"2015-05-27T01:47:35.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.2.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.2.0/manifests"},{"name":"v4.2.0b1","sha":"61a16c906a80e625d7327733df321f2922061b82","kind":"commit","published_at":"2015-05-10T17:16:50.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.2.0b1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.2.0b1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.2.0b1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.2.0b1/manifests"},{"name":"v4.1.0","sha":"a30dcd09e4dcba9f41d13b3432a9f424c49de6a2","kind":"tag","published_at":"2015-02-07T17:52:45.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.1.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.1.0/manifests"},{"name":"v4.1.0b2","sha":"fff09e9028bed0cf1d3f3e711ff4e15d4a2440a2","kind":"commit","published_at":"2015-02-01T19:27:54.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.1.0b2","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.1.0b2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.1.0b2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.1.0b2/manifests"},{"name":"v4.1.0b1","sha":"343ceb106484dd2d9c4f30b732f7c7e16611ad1c","kind":"commit","published_at":"2015-01-25T00:12:08.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.1.0b1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.1.0b1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.1.0b1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.1.0b1/manifests"},{"name":"v4.0.2","sha":"b18b12b532790f40edf431625d184bf8e479956b","kind":"tag","published_at":"2014-09-11T03:48:13.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.0.2","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.0.2/manifests"},{"name":"v4.0.1","sha":"54bfbee58650a0312b22eb081e8a38d03fcf1a49","kind":"tag","published_at":"2014-08-12T13:11:30.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.0.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.0.1/manifests"},{"name":"v4.0.0","sha":"f1824029db933d822f5b0d02583e4e6137f2bfd2","kind":"tag","published_at":"2014-07-15T12:43:16.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.0.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.0.0/manifests"},{"name":"v4.0.0b3","sha":"8b5c4ae272d3ef57438a515dfe41b65180528a32","kind":"commit","published_at":"2014-07-09T02:50:05.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.0.0b3","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.0.0b3","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.0.0b3","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.0.0b3/manifests"},{"name":"v4.0.0b2","sha":"aa7b15f074d41bb39c9d456458edc6aedd53482d","kind":"commit","published_at":"2014-07-01T12:37:02.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.0.0b2","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.0.0b2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.0.0b2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.0.0b2/manifests"},{"name":"v4.0.0b1","sha":"681882b087d2340ceb447589c86b96b7a9360a2c","kind":"commit","published_at":"2014-06-21T20:02:18.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v4.0.0b1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v4.0.0b1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.0.0b1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v4.0.0b1/manifests"},{"name":"v3.2.2","sha":"67655497b06757752e48e236c78378b953bdff62","kind":"tag","published_at":"2014-06-04T03:39:59.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v3.2.2","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v3.2.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.2.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.2.2/manifests"},{"name":"v3.2.1","sha":"989693186242844e3f94955a91d452b220320ad0","kind":"tag","published_at":"2014-05-06T02:35:51.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v3.2.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v3.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.2.1/manifests"},{"name":"v3.2.0","sha":"76a6987a20b9b7b72d20cc479b8ad971a45095fd","kind":"tag","published_at":"2014-01-14T13:42:20.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v3.2.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v3.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.2.0/manifests"},{"name":"v3.2.0b2","sha":"b2039a3dd908bba4578653992b0e645eef2d6ce4","kind":"commit","published_at":"2014-01-08T03:01:38.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v3.2.0b2","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v3.2.0b2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.2.0b2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.2.0b2/manifests"},{"name":"v3.2.0b1","sha":"541331a0078768fad920a5298ecaf7af48932e60","kind":"commit","published_at":"2013-12-30T19:18:28.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v3.2.0b1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v3.2.0b1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.2.0b1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.2.0b1/manifests"},{"name":"v3.1.1","sha":"f36652d47fc42205c085ed65e740f4b155d4e5e4","kind":"tag","published_at":"2013-09-01T18:32:15.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v3.1.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v3.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.1.1/manifests"},{"name":"v3.1.0","sha":"2d7ce584ec49a2e2b0028a093182f84c756ad8e1","kind":"tag","published_at":"2013-06-15T18:16:04.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v3.1.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v3.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.1.0/manifests"},{"name":"v3.0.2","sha":"1a3088b58d5160c4befbc5119cd5459e0c24a5a1","kind":"tag","published_at":"2013-06-03T01:15:08.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v3.0.2","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v3.0.2","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.0.2","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.0.2/manifests"},{"name":"v3.0.1","sha":"e55590878524d4f47c8c75f38061587faf51d4c5","kind":"tag","published_at":"2013-04-09T03:27:16.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v3.0.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v3.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.0.1/manifests"},{"name":"v3.0.0","sha":"6c6b72f3a38771792717857c914b976a1a5187cb","kind":"tag","published_at":"2013-03-29T13:02:20.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v3.0.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v3.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v3.0.0/manifests"},{"name":"v2.4.1","sha":"169ac4ef4983058eadc72d7dc4860e8acb2c8109","kind":"tag","published_at":"2012-11-25T02:28:09.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v2.4.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v2.4.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.4.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.4.1/manifests"},{"name":"v2.4.0","sha":"648bebf0eeb220ebfaa8200bab3bac41add9d650","kind":"tag","published_at":"2012-09-04T05:09:50.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v2.4.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v2.4.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.4.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.4.0/manifests"},{"name":"v2.3.0","sha":"13598908a7872080c6cc20b0dcfbcb0ce89a3447","kind":"tag","published_at":"2012-06-01T04:39:50.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v2.3.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v2.3.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.3.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.3.0/manifests"},{"name":"v2.2.1","sha":"8d7f9f014ee2694648654dcbcda733dfdf2052b4","kind":"tag","published_at":"2012-04-24T05:04:40.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v2.2.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v2.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.2.1/manifests"},{"name":"v2.2.0","sha":"02bc76155de5bf4dca243e4d0c019c0ac4c8b3be","kind":"tag","published_at":"2012-01-30T19:02:02.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v2.2.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v2.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.2.0/manifests"},{"name":"v2.1.1","sha":"fa159286ff3e1b5e625fc42a717c628bf9491938","kind":"tag","published_at":"2011-10-04T17:00:56.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v2.1.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v2.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.1.1/manifests"},{"name":"v2.1.0","sha":"b419316cc72ec7c91239e6a8642088cda4cc3266","kind":"tag","published_at":"2011-09-21T04:22:10.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v2.1.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v2.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.1.0/manifests"},{"name":"v2.0.0","sha":"94078a68286abca52854cede8bb52a1cee1d815b","kind":"tag","published_at":"2011-06-22T05:28:57.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v2.0.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v2.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v2.0.0/manifests"},{"name":"v1.2.1","sha":"f36fb66f02509b93a7156cd357e82d03155936a9","kind":"tag","published_at":"2011-03-03T20:41:45.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v1.2.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v1.2.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v1.2.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v1.2.1/manifests"},{"name":"v1.2.0","sha":"f5436204e62b1f7b2716a21e024ae2c572739cf2","kind":"tag","published_at":"2011-02-20T20:56:55.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v1.2.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v1.2.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v1.2.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v1.2.0/manifests"},{"name":"v1.1.1","sha":"b91245427fac0672d94f7db26e59ec2bd0c46f57","kind":"tag","published_at":"2011-02-09T06:43:17.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v1.1.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v1.1.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v1.1.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v1.1.1/manifests"},{"name":"v1.1.0","sha":"2338348edda61c663fff8a7f6f77cf489bf63de6","kind":"tag","published_at":"2010-09-08T00:05:33.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v1.1.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v1.1.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v1.1.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v1.1.0/manifests"},{"name":"v1.0.1","sha":"2b5064b7ed962603ade0db0c8e21846a9879e30e","kind":"tag","published_at":"2010-08-13T17:56:56.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v1.0.1","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v1.0.1","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v1.0.1","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v1.0.1/manifests"},{"name":"v1.0.0","sha":"eb5b3d8df7a305ac1ffa0a12c813e5d7ee4d6cd3","kind":"tag","published_at":"2010-07-22T23:56:38.000Z","download_url":"https://codeload.github.com/tornadoweb/tornado/tar.gz/v1.0.0","html_url":"https://github.com/tornadoweb/tornado/releases/tag/v1.0.0","dependencies_parsed_at":null,"dependency_job_id":null,"tag_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v1.0.0","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tornadoweb%2Ftornado/tags/v1.0.0/manifests"}]},"repo_metadata_updated_at":"2024-01-06T08:29:34.659Z","dependent_packages_count":853,"downloads":61478667,"downloads_period":"last-month","dependent_repos_count":113286,"rankings":{"downloads":0.031180817561036453,"dependent_repos_count":0.009721078416087835,"dependent_packages_count":0.027879319231044357,"stargazers_count":0.23128829967333508,"forks_count":0.1582885032657321,"docker_downloads_count":0.015406992206629775,"average":0.0789608350589776},"purl":"pkg:pypi/tornado","advisories":[{"uuid":"GSA_kwCzR0hTQS03Y3gzLTZtNjYtN2M1bc4ABH_J","url":"https://github.com/advisories/GHSA-7cx3-6m66-7c5m","title":"Tornado vulnerable to excessive logging caused by malformed multipart form data","description":"### Summary\n\nWhen Tornado's ``multipart/form-data`` parser encounters certain errors, it logs a warning but continues trying to parse the remainder of the data. This allows remote attackers to generate an extremely high volume of logs, constituting a DoS attack. This DoS is compounded by the fact that the logging subsystem is synchronous.\n\n### Affected versions\n\nAll versions of Tornado prior to 6.5 are affected. The vulnerable parser is enabled by default.\n\n### Solution\n\nUpgrade to Tornado version 6.5. In the meantime, risk can be mitigated by blocking `Content-Type: multipart/form-data` in a proxy.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2025-05-16T14:12:40.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-7cx3-6m66-7c5m","https://nvd.nist.gov/vuln/detail/CVE-2025-47287","https://github.com/tornadoweb/tornado/commit/b39b892bf78fe8fea01dd45199aa88307e7162f3","https://lists.debian.org/debian-lts-announce/2025/05/msg00038.html","https://github.com/advisories/GHSA-7cx3-6m66-7c5m"],"source_kind":"github","identifiers":["GHSA-7cx3-6m66-7c5m","CVE-2025-47287"],"repository_url":"https://github.com/tornadoweb/tornado","blast_radius":0.0,"packages":[{"versions":[{"first_patched_version":"6.5","vulnerable_version_range":"\u003c 6.5"}],"ecosystem":"pypi","package_name":"tornado"}],"created_at":"2025-05-16T15:08:41.082Z","updated_at":"2025-05-29T06:32:21.000Z","epss_percentage":0.0012,"epss_percentile":0.32165},{"uuid":"GSA_kwCzR0hTQS04dnB3LW1ncGYtbXB2ds4AAgVX","url":"https://github.com/advisories/GHSA-8vpw-mgpf-mpvv","title":"Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)","description":"Tornado before 3.2.2 sends arbitrary responses that contain a fixed CSRF token and may be sent with HTTP compression, which makes it easier for remote attackers to conduct a BREACH attack and determine this token via a series of crafted requests.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-05-17T19:57:19.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.1,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2014-9720","https://github.com/tornadoweb/tornado/commit/1c36307463b1e8affae100bf9386948e6c1b2308","https://bugzilla.novell.com/show_bug.cgi?id=930362","https://bugzilla.redhat.com/show_bug.cgi?id=1222816","http://openwall.com/lists/oss-security/2015/05/19/4","http://www.tornadoweb.org/en/stable/releases/v3.2.2.html","https://github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2020-213.yaml","https://github.com/advisories/GHSA-8vpw-mgpf-mpvv"],"source_kind":"github","identifiers":["GHSA-8vpw-mgpf-mpvv","CVE-2014-9720"],"repository_url":"https://github.com/tornadoweb/tornado","blast_radius":35.88465132261778,"packages":[{"versions":[{"first_patched_version":"3.2.2","vulnerable_version_range":"\u003c 3.2.2"}],"ecosystem":"pypi","package_name":"tornado"}],"created_at":"2024-02-01T21:05:05.866Z","updated_at":"2024-11-13T22:52:59.000Z","epss_percentage":0.00904,"epss_percentile":0.74507},{"uuid":"GSA_kwCzR0hTQS03NTNqLW1wbXgtcXE2Z84AA8x8","url":"https://github.com/advisories/GHSA-753j-mpmx-qq6g","title":"Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado","description":"### Summary\nWhen Tornado receives a request with two `Transfer-Encoding: chunked` headers, it ignores them both. This enables request smuggling when Tornado is deployed behind a proxy server that emits such requests. [Pound](https://en.wikipedia.org/wiki/Pound_(networking)) does this.\n\n### PoC\n0. Install Tornado.\n1. Start a simple Tornado server that echoes each received request's body:\n```bash\ncat \u003c\u003c EOF \u003e server.py\nimport asyncio\nimport tornado\n\nclass MainHandler(tornado.web.RequestHandler):\n    def post(self):\n        self.write(self.request.body)\n\nasync def main():\n    tornado.web.Application([(r\"/\", MainHandler)]).listen(8000)\n    await asyncio.Event().wait()\n\nasyncio.run(main())\nEOF\npython3 server.py \u0026\n```\n2. Send a valid chunked request:\n```bash\nprintf 'POST / HTTP/1.1\\r\\nTransfer-Encoding: chunked\\r\\n\\r\\n1\\r\\nZ\\r\\n0\\r\\n\\r\\n' | nc localhost 8000\n```\n3. Observe that the response is as expected:\n```\nHTTP/1.1 200 OK\nServer: TornadoServer/6.3.3\nContent-Type: text/html; charset=UTF-8\nDate: Sat, 07 Oct 2023 17:32:05 GMT\nContent-Length: 1\n\nZ\n```\n4. Send a request with two `Transfer-Encoding: chunked` headers:\n```\nprintf 'POST / HTTP/1.1\\r\\nTransfer-Encoding: chunked\\r\\nTransfer-Encoding: chunked\\r\\n\\r\\n1\\r\\nZ\\r\\n0\\r\\n\\r\\n' | nc localhost 8000\n```\n5. Observe the strange response:\n```\nHTTP/1.1 200 OK\nServer: TornadoServer/6.3.3\nContent-Type: text/html; charset=UTF-8\nDate: Sat, 07 Oct 2023 17:35:40 GMT\nContent-Length: 0\n\nHTTP/1.1 400 Bad Request\n\n```\nThis is because Tornado believes that the request has no message body, so it tries to interpret `1\\r\\nZ\\r\\n0\\r\\n\\r\\n` as its own request, which causes a 400 response. With a little cleverness involving `chunk-ext`s, you can get Tornado to instead respond 405, which has the potential to desynchronize the connection, as opposed to 400 which should always result in a connection closure.\n\n### Impact\nAnyone using Tornado behind a proxy that forwards requests containing multiple `Transfer-Encoding: chunked` headers is vulnerable to request smuggling, which may entail ACL bypass, cache poisoning, or connection desynchronization.\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-06-06T21:41:20.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-753j-mpmx-qq6g","https://github.com/tornadoweb/tornado/commit/d65f6e71a77f53a1ff0a0dc55704be13f04eb572","https://github.com/advisories/GHSA-753j-mpmx-qq6g"],"source_kind":"github","identifiers":["GHSA-753j-mpmx-qq6g"],"repository_url":"https://github.com/tornadoweb/tornado","blast_radius":0.0,"packages":[{"versions":[{"first_patched_version":"6.4.1","vulnerable_version_range":"\u003c= 6.4.0"}],"ecosystem":"pypi","package_name":"tornado"}],"created_at":"2024-06-06T22:05:20.148Z","updated_at":"2024-07-11T00:06:02.000Z","epss_percentage":null,"epss_percentile":null},{"uuid":"GSA_kwCzR0hTQS13MjM1LTdwODQteHg1N84AA8x9","url":"https://github.com/advisories/GHSA-w235-7p84-xx57","title":"Tornado has a CRLF injection in CurlAsyncHTTPClient headers","description":"### Summary\nTornado’s `curl_httpclient.CurlAsyncHTTPClient` class is vulnerable to CRLF (carriage return/line feed) injection in the request headers.\n\n### Details\nWhen an HTTP request is sent using `CurlAsyncHTTPClient`, Tornado does not reject carriage return (\\r) or line feed (\\n) characters in the request headers. As a result, if an application includes an attacker-controlled header value in a request sent using `CurlAsyncHTTPClient`, the attacker can inject arbitrary headers into the request or cause the application to send arbitrary requests to the specified server.\n\nThis behavior differs from that of the standard `AsyncHTTPClient` class, which does reject CRLF characters.\n\nThis issue appears to stem from libcurl's (as well as pycurl's) lack of validation for the [`HTTPHEADER`](https://curl.se/libcurl/c/CURLOPT_HTTPHEADER.html) option. libcurl’s documentation states:\n\n\u003e The headers included in the linked list must not be CRLF-terminated, because libcurl adds CRLF after each header item itself. Failure to comply with this might result in strange behavior. libcurl passes on the verbatim strings you give it, without any filter or other safe guards. That includes white space and control characters.\n\npycurl similarly appears to assume that the headers adhere to the correct format. Therefore, without any validation on Tornado’s part, header names and values are included verbatim in the request sent by `CurlAsyncHTTPClient`, including any control characters that have special meaning in HTTP semantics.\n\n### PoC\nThe issue can be reproduced using the following script:\n\n```python\nimport asyncio\n\nfrom tornado import httpclient\nfrom tornado import curl_httpclient\n\nasync def main():\n    http_client = curl_httpclient.CurlAsyncHTTPClient()\n\n    request = httpclient.HTTPRequest(\n        # Burp Collaborator payload\n        \"http://727ymeu841qydmnwlol261ktkkqbe24qt.oastify.com/\",\n        method=\"POST\",\n        body=\"body\",\n        # Injected header using CRLF characters\n        headers={\"Foo\": \"Bar\\r\\nHeader: Injected\"}\n    )\n\n    response = await http_client.fetch(request)\n    print(response.body)\n\n    http_client.close()\n\nif __name__ == \"__main__\":\n    asyncio.run(main())\n```\n\nWhen the specified server receives the request, it contains the injected header (`Header: Injected`) on its own line:\n\n```http\nPOST / HTTP/1.1\nHost: 727ymeu841qydmnwlol261ktkkqbe24qt.oastify.com\nUser-Agent: Mozilla/5.0 (compatible; pycurl)\nAccept: */*\nAccept-Encoding: gzip,deflate\nFoo: Bar\nHeader: Injected\nContent-Length: 4\nContent-Type: application/x-www-form-urlencoded\n\nbody\n```\n\nThe attacker can also construct entirely new requests using a payload with multiple CRLF sequences. For example, specifying a header value of `\\r\\n\\r\\nPOST /attacker-controlled-url HTTP/1.1\\r\\nHost: 727ymeu841qydmnwlol261ktkkqbe24qt.oastify.com` results in the server receiving an additional, attacker-controlled request:\n\n```http\nPOST /attacker-controlled-url HTTP/1.1\nHost: 727ymeu841qydmnwlol261ktkkqbe24qt.oastify.com\nContent-Length: 4\nContent-Type: application/x-www-form-urlencoded\n\nbody\n```\n\n### Impact\nApplications using the Tornado library to send HTTP requests with untrusted header data are affected. This issue may facilitate the exploitation of server-side request forgery (SSRF) vulnerabilities.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-06-06T21:46:31.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-w235-7p84-xx57","https://github.com/tornadoweb/tornado/commit/7786f09f84c9f3f2012c4cf3878417cb9f053669","https://github.com/advisories/GHSA-w235-7p84-xx57"],"source_kind":"github","identifiers":["GHSA-w235-7p84-xx57"],"repository_url":"https://github.com/tornadoweb/tornado","blast_radius":0.0,"packages":[{"versions":[{"first_patched_version":"6.4.1","vulnerable_version_range":"\u003c= 6.4.0"}],"ecosystem":"pypi","package_name":"tornado"}],"created_at":"2024-06-06T22:05:19.820Z","updated_at":"2024-06-07T06:50:03.000Z","epss_percentage":null,"epss_percentile":null},{"uuid":"GSA_kwCzR0hTQS1mN2Z2LXY5cmgtcHJ2Y84AAfig","url":"https://github.com/advisories/GHSA-f7fv-v9rh-prvc","title":"Tornado CRLF injection vulnerability","description":"CRLF injection vulnerability in the `tornado.web.RequestHandler.set_header` function in Tornado before 2.2.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via crafted input.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2022-05-17T05:23:55.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":8.7,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2012-2374","http://openwall.com/lists/oss-security/2012/05/18/12","http://www.openwall.com/lists/oss-security/2012/05/18/6","http://www.tornadoweb.org/documentation/releases/v2.2.1.html","https://github.com/tornadoweb/tornado/commit/1ae91f6d58e6257e0ab49d295d8741ce1727bdb7","https://web.archive.org/web/20140720192646/http://secunia.com/advisories/49185","https://web.archive.org/web/20200229124524/http://www.securityfocus.com/bid/53612","https://github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2012-5.yaml","https://github.com/advisories/GHSA-f7fv-v9rh-prvc"],"source_kind":"github","identifiers":["GHSA-f7fv-v9rh-prvc","CVE-2012-2374"],"repository_url":"https://github.com/tornadoweb/tornado","blast_radius":43.971333310813336,"packages":[{"versions":[{"first_patched_version":"2.2.1","vulnerable_version_range":"\u003c 2.2.1"}],"ecosystem":"pypi","package_name":"tornado"}],"created_at":"2024-05-01T12:05:25.860Z","updated_at":"2024-11-18T22:05:53.000Z","epss_percentage":0.00329,"epss_percentile":0.54928},{"uuid":"GSA_kwCzR0hTQS1oajNmLTZnY3Atamc4as4AAzeO","url":"https://github.com/advisories/GHSA-hj3f-6gcp-jg8j","title":"Open redirect in Tornado","description":"Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-05-25T12:30:16.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":5.3,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2023-28370","https://github.com/tornadoweb/tornado/releases/tag/v6.3.2","https://github.com/tornadoweb/tornado/commit/32ad07c54e607839273b4e1819c347f5c8976b2f","https://github.com/pypa/advisory-database/tree/main/vulns/tornado/PYSEC-2023-75.yaml","https://jvn.jp/en/jp/JVN45127776","https://github.com/advisories/GHSA-hj3f-6gcp-jg8j"],"source_kind":"github","identifiers":["GHSA-hj3f-6gcp-jg8j","CVE-2023-28370"],"repository_url":"https://github.com/tornadoweb/tornado","blast_radius":26.78713408589778,"packages":[{"versions":[{"first_patched_version":"6.3.2","vulnerable_version_range":"\u003c 6.3.2"}],"ecosystem":"pypi","package_name":"tornado"}],"created_at":"2023-05-25T18:03:30.121Z","updated_at":"2024-11-18T22:08:09.000Z","epss_percentage":0.00308,"epss_percentile":0.53481},{"uuid":"GSA_kwCzR0hTQS04dzQ5LWg3ODUtbWozY84ABBnk","url":"https://github.com/advisories/GHSA-8w49-h785-mj3c","title":"Tornado has an HTTP cookie parsing DoS vulnerability","description":"The algorithm used for parsing HTTP cookies in Tornado versions prior to 6.4.2 sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in the event loop thread and may block the processing of other requests.\n\nSee also CVE-2024-7592 for a similar vulnerability in cpython.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2024-11-22T20:26:41.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-8w49-h785-mj3c","https://nvd.nist.gov/vuln/detail/CVE-2024-52804","https://github.com/tornadoweb/tornado/commit/d5ba4a1695fbf7c6a3e54313262639b198291533","https://github.com/advisories/GHSA-8w49-h785-mj3c"],"source_kind":"github","identifiers":["GHSA-8w49-h785-mj3c","CVE-2024-52804"],"repository_url":"https://github.com/tornadoweb/tornado","blast_radius":0.0,"packages":[{"versions":[{"first_patched_version":"6.4.2","vulnerable_version_range":"\u003c= 6.4.1"}],"ecosystem":"pypi","package_name":"tornado"}],"created_at":"2024-11-22T21:06:52.639Z","updated_at":"2024-11-22T22:27:53.000Z","epss_percentage":0.00228,"epss_percentile":0.45842},{"uuid":"GSA_kwCzR0hTQS1xcHB2LWo3NmgtMnJweM4AA1Sz","url":"https://github.com/advisories/GHSA-qppv-j76h-2rpx","title":"Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths","description":"## Summary\nTornado interprets `-`, `+`, and `_` in chunk length and `Content-Length` values, which are not allowed by the HTTP RFCs. This can result in request smuggling when Tornado is deployed behind certain proxies that interpret those non-standard characters differently. This is known to apply to older versions of haproxy, although the current release is not affected.\n\n## Details\nTornado uses the `int` constructor to parse the values of `Content-Length` headers and chunk lengths in the following locations:\n### `tornado/http1connection.py:445`\n```python3\n            self._expected_content_remaining = int(headers[\"Content-Length\"])\n```\n### `tornado/http1connection.py:621`\n```python3\n                content_length = int(headers[\"Content-Length\"])  # type: Optional[int]\n```\n### `tornado/http1connection.py:671`\n```python3\n            chunk_len = int(chunk_len_str.strip(), 16)\n```\nBecause `int(\"0_0\") == int(\"+0\") == int(\"-0\") == int(\"0\")`, using the `int` constructor to parse and validate strings that should contain only ASCII digits is not a good strategy. \n\n","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2023-08-14T21:34:17.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":0.0,"cvss_vector":null,"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-qppv-j76h-2rpx","https://github.com/tornadoweb/tornado/commit/b7a5dd29bb02950303ae96055082c12a1ea0a4fe","https://github.com/advisories/GHSA-qppv-j76h-2rpx"],"source_kind":"github","identifiers":["GHSA-qppv-j76h-2rpx"],"repository_url":"https://github.com/tornadoweb/tornado","blast_radius":0.0,"packages":[{"versions":[{"first_patched_version":"6.3.3","vulnerable_version_range":"\u003c 6.3.3"}],"ecosystem":"pypi","package_name":"tornado"}],"created_at":"2023-08-14T22:05:07.928Z","updated_at":"2023-09-07T20:25:28.000Z","epss_percentage":null,"epss_percentile":null}],"docker_usage_url":"https://docker.ecosyste.ms/usage/pypi/tornado","docker_dependents_count":9059,"docker_downloads_count":3884301635,"usage_url":"https://repos.ecosyste.ms/usage/pypi/tornado","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/pypi/tornado/dependencies","status":null,"funding_links":[],"critical":true,"versions_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/tornado/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/tornado/version_numbers","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/tornado/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages/tornado/related_packages","maintainers":[{"uuid":"Ben.Darnell","login":"Ben.Darnell","name":null,"email":null,"url":null,"packages_count":7,"html_url":"https://pypi.org/user/Ben.Darnell/","role":null,"created_at":"2022-12-07T20:06:50.489Z","updated_at":"2022-12-07T20:06:50.489Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/maintainers/Ben.Darnell/packages"},{"uuid":"emptysquare","login":"emptysquare","name":null,"email":null,"url":null,"packages_count":13,"html_url":"https://pypi.org/user/emptysquare/","role":null,"created_at":"2022-12-07T20:06:50.524Z","updated_at":"2022-12-07T20:06:50.524Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/maintainers/emptysquare/packages"}],"registry":{"name":"pypi.org","url":"https://pypi.org","ecosystem":"pypi","default":true,"packages_count":690322,"maintainers_count":292759,"namespaces_count":0,"keywords_count":228590,"github":"pypi","metadata":{"funded_packages_count":48950},"icon_url":"https://github.com/pypi.png","created_at":"2022-04-04T15:19:23.364Z","updated_at":"2025-06-06T05:32:09.692Z","packages_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/packages","maintainers_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/maintainers","namespaces_url":"https://packages.ecosyste.ms/api/v1/registries/pypi.org/namespaces"}},"unique_repositories_count":2602,"unique_repositories_count_past_30_days":2,"recent_issues":[{"uuid":"5091679351","node_id":"PR_kwDOQOaeec78HDh6","number":59,"state":"closed","title":"Bump the all group across 1 directory with 57 updates","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-08-07T15:42:01.000Z","author_association":null,"state_reason":null,"created_at":"2026-08-07T15:37:43.000Z","updated_at":"2026-08-07T15:42:03.000Z","time_to_close":258,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","group_name":"all","update_count":57,"packages":[{"name":"imageio","old_version":"2.37.3","new_version":"2.37.4","repository_url":"https://github.com/imageio/imageio"},{"name":"jupyter-book","old_version":"2.1.4","new_version":"2.1.6","repository_url":"https://github.com/jupyter-book/jupyter-book"},{"name":"matplotlib","old_version":"3.10.8","new_version":"3.11.1","repository_url":"https://github.com/matplotlib/matplotlib"},{"name":"numpy","old_version":"2.4.4","new_version":"2.5.1","repository_url":"https://github.com/numpy/numpy"},{"name":"zarr","old_version":"3.1.6","new_version":"3.3.0","repository_url":"https://github.com/zarr-developers/zarr-python"},{"name":"pydantic-zarr","old_version":"0.9.2","new_version":"0.10.0","repository_url":"https://github.com/zarr-developers/pydantic-zarr"},{"name":"ome-zarr-models","old_version":"1.6","new_version":"1.7","repository_url":"https://github.com/ome-zarr-models/ome-zarr-models-py"},{"name":"scipy","old_version":"1.17.1","new_version":"1.18.0","repository_url":"https://github.com/scipy/scipy"},{"name":"jupyterlab","old_version":"4.5.6","new_version":"4.6.2","repository_url":"https://github.com/jupyterlab/jupyterlab"},{"name":"jupytext","old_version":"1.19.1","new_version":"1.19.5","repository_url":"https://github.com/jupytext/jupytext"},{"name":"annotated-types","old_version":"0.7.0","new_version":"0.8.0","repository_url":"https://github.com/annotated-types/annotated-types"},{"name":"anyio","old_version":"4.13.0","new_version":"4.14.2","repository_url":"https://github.com/agronholm/anyio"},{"name":"asttokens","old_version":"3.0.1","new_version":"3.0.2","repository_url":"https://github.com/gristlabs/asttokens"},{"name":"beautifulsoup4","old_version":"4.14.3","new_version":"4.15.0"},{"name":"bleach","old_version":"6.3.0","new_version":"6.4.0","repository_url":"https://github.com/mozilla/bleach"},{"name":"certifi","old_version":"2026.2.25","new_version":"2026.7.22","repository_url":"https://github.com/certifi/python-certifi"},{"name":"cffi","old_version":"2.0.0","new_version":"2.1.1","repository_url":"https://github.com/python-cffi/cffi"},{"name":"charset-normalizer","old_version":"3.4.7","new_version":"3.4.9","repository_url":"https://github.com/jawah/charset_normalizer"},{"name":"debugpy","old_version":"1.8.20","new_version":"1.8.21","repository_url":"https://github.com/microsoft/debugpy"},{"name":"decorator","old_version":"5.2.1","new_version":"5.3.1","repository_url":"https://github.com/micheles/decorator"},{"name":"fastjsonschema","old_version":"2.21.2","new_version":"2.22.1","repository_url":"https://github.com/horejsek/python-fastjsonschema"},{"name":"fonttools","old_version":"4.62.1","new_version":"4.63.0","repository_url":"https://github.com/fonttools/fonttools"},{"name":"idna","old_version":"3.11","new_version":"3.18","repository_url":"https://github.com/kjd/idna"},{"name":"imageio","old_version":"2.37.3","new_version":"2.37.4","repository_url":"https://github.com/imageio/imageio"},{"name":"ipykernel","old_version":"7.2.0","new_version":"7.3.0","repository_url":"https://github.com/ipython/ipykernel"},{"name":"ipython","old_version":"9.12.0","new_version":"9.16.1","repository_url":"https://github.com/ipython/ipython"},{"name":"jedi","old_version":"0.19.2","new_version":"0.20.0","repository_url":"https://github.com/davidhalter/jedi"},{"name":"json5","old_version":"0.14.0","new_version":"0.15.0","repository_url":"https://github.com/dpranke/pyjson5"},{"name":"jupyter-client","old_version":"8.8.0","new_version":"8.9.1","repository_url":"https://github.com/jupyter/jupyter_client"},{"name":"jupyter-events","old_version":"0.12.0","new_version":"0.12.1","repository_url":"https://github.com/jupyter/jupyter_events"},{"name":"jupyter-server","old_version":"2.17.0","new_version":"2.20.0","repository_url":"https://github.com/jupyter-server/jupyter_server"},{"name":"markdown-it-py","old_version":"4.0.0","new_version":"4.2.0","repository_url":"https://github.com/executablebooks/markdown-it-py"},{"name":"matplotlib-inline","old_version":"0.2.1","new_version":"0.2.2","repository_url":"https://github.com/ipython/matplotlib-inline"},{"name":"mdit-py-plugins","old_version":"0.5.0","new_version":"0.6.1","repository_url":"https://github.com/executablebooks/mdit-py-plugins"},{"name":"mistune","old_version":"3.2.0","new_version":"3.3.4","repository_url":"https://github.com/lepture/mistune"},{"name":"nbclient","old_version":"0.10.4","new_version":"0.11.0","repository_url":"https://github.com/jupyter/nbclient"},{"name":"packaging","old_version":"26.0","new_version":"26.2","repository_url":"https://github.com/pypa/packaging"},{"name":"parso","old_version":"0.8.6","new_version":"0.8.7","repository_url":"https://github.com/davidhalter/parso"},{"name":"pillow","old_version":"12.2.0","new_version":"12.3.0","repository_url":"https://github.com/python-pillow/Pillow"},{"name":"platformdirs","old_version":"4.9.6","new_version":"4.11.0","repository_url":"https://github.com/tox-dev/platformdirs"},{"name":"prometheus-client","old_version":"0.25.0","new_version":"0.26.0","repository_url":"https://github.com/prometheus/client_python"},{"name":"prompt-toolkit","old_version":"3.0.52","new_version":"3.0.53","repository_url":"https://github.com/prompt-toolkit/python-prompt-toolkit"},{"name":"pydantic","old_version":"2.13.0","new_version":"2.13.4","repository_url":"https://github.com/pydantic/pydantic"},{"name":"pydantic-core","old_version":"2.46.0","new_version":"2.47.0","repository_url":"https://github.com/pydantic/pydantic"},{"name":"pywin32","old_version":"311","new_version":"312","repository_url":"https://github.com/mhammond/pywin32"},{"name":"pywinpty","old_version":"3.0.3","new_version":"3.0.5","repository_url":"https://github.com/andfoy/pywinpty"},{"name":"requests","old_version":"2.33.1","new_version":"2.34.2","repository_url":"https://github.com/psf/requests"},{"name":"rpds-py","old_version":"0.30.0","new_version":"2026.6.3","repository_url":"https://github.com/crate-py/rpds"},{"name":"setuptools","old_version":"82.0.1","new_version":"83.0.0","repository_url":"https://github.com/pypa/setuptools"},{"name":"soupsieve","old_version":"2.8.3","new_version":"2.9.1","repository_url":"https://github.com/facelessuser/soupsieve"},{"name":"tifffile","old_version":"2026.4.11","new_version":"2026.7.31","repository_url":"https://github.com/cgohlke/tifffile"},{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"traitlets","old_version":"5.14.3","new_version":"5.16.1","repository_url":"https://github.com/ipython/traitlets"},{"name":"types-python-dateutil","old_version":"2.9.0.20260408","new_version":"2.9.0.20260716","repository_url":"https://github.com/python/typeshed"},{"name":"typing-extensions","old_version":"4.15.0","new_version":"4.16.0","repository_url":"https://github.com/python/typing_extensions"},{"name":"urllib3","old_version":"2.6.3","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"},{"name":"wcwidth","old_version":"0.6.0","new_version":"0.8.2","repository_url":"https://github.com/jquast/wcwidth"}],"path":null,"ecosystem":"pip"},"body":"Bumps the all group with 57 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [imageio[tifffile]](https://github.com/imageio/imageio) | `2.37.3` | `2.37.4` |\n| [jupyter-book](https://github.com/jupyter-book/jupyter-book) | `2.1.4` | `2.1.6` |\n| [matplotlib](https://github.com/matplotlib/matplotlib) | `3.10.8` | `3.11.1` |\n| [numpy](https://github.com/numpy/numpy) | `2.4.4` | `2.5.1` |\n| [zarr](https://github.com/zarr-developers/zarr-python) | `3.1.6` | `3.3.0` |\n| [pydantic-zarr](https://github.com/zarr-developers/pydantic-zarr) | `0.9.2` | `0.10.0` |\n| [ome-zarr-models](https://github.com/ome-zarr-models/ome-zarr-models-py) | `1.6` | `1.7` |\n| [scipy](https://github.com/scipy/scipy) | `1.17.1` | `1.18.0` |\n| [jupyterlab](https://github.com/jupyterlab/jupyterlab) | `4.5.6` | `4.6.2` |\n| [jupytext](https://github.com/jupytext/jupytext) | `1.19.1` | `1.19.5` |\n| [annotated-types](https://github.com/annotated-types/annotated-types) | `0.7.0` | `0.8.0` |\n| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.14.2` |\n| [asttokens](https://github.com/gristlabs/asttokens) | `3.0.1` | `3.0.2` |\n| [beautifulsoup4](https://www.crummy.com/software/BeautifulSoup/bs4/) | `4.14.3` | `4.15.0` |\n| [bleach](https://github.com/mozilla/bleach) | `6.3.0` | `6.4.0` |\n| [certifi](https://github.com/certifi/python-certifi) | `2026.2.25` | `2026.7.22` |\n| [cffi](https://github.com/python-cffi/cffi) | `2.0.0` | `2.1.1` |\n| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.7` | `3.4.9` |\n| [debugpy](https://github.com/microsoft/debugpy) | `1.8.20` | `1.8.21` |\n| [decorator](https://github.com/micheles/decorator) | `5.2.1` | `5.3.1` |\n| [fastjsonschema](https://github.com/horejsek/python-fastjsonschema) | `2.21.2` | `2.22.1` |\n| [fonttools](https://github.com/fonttools/fonttools) | `4.62.1` | `4.63.0` |\n| [idna](https://github.com/kjd/idna) | `3.11` | `3.18` |\n| [imageio](https://github.com/imageio/imageio) | `2.37.3` | `2.37.4` |\n| [ipykernel](https://github.com/ipython/ipykernel) | `7.2.0` | `7.3.0` |\n| [ipython](https://github.com/ipython/ipython) | `9.12.0` | `9.16.1` |\n| [jedi](https://github.com/davidhalter/jedi) | `0.19.2` | `0.20.0` |\n| [json5](https://github.com/dpranke/pyjson5) | `0.14.0` | `0.15.0` |\n| [jupyter-client](https://github.com/jupyter/jupyter_client) | `8.8.0` | `8.9.1` |\n| [jupyter-events](https://github.com/jupyter/jupyter_events) | `0.12.0` | `0.12.1` |\n| [jupyter-server](https://github.com/jupyter-server/jupyter_server) | `2.17.0` | `2.20.0` |\n| [markdown-it-py](https://github.com/executablebooks/markdown-it-py) | `4.0.0` | `4.2.0` |\n| [matplotlib-inline](https://github.com/ipython/matplotlib-inline) | `0.2.1` | `0.2.2` |\n| [mdit-py-plugins](https://github.com/executablebooks/mdit-py-plugins) | `0.5.0` | `0.6.1` |\n| [mistune](https://github.com/lepture/mistune) | `3.2.0` | `3.3.4` |\n| [nbclient](https://github.com/jupyter/nbclient) | `0.10.4` | `0.11.0` |\n| [packaging](https://github.com/pypa/packaging) | `26.0` | `26.2` |\n| [parso](https://github.com/davidhalter/parso) | `0.8.6` | `0.8.7` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` |\n| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.9.6` | `4.11.0` |\n| [prometheus-client](https://github.com/prometheus/client_python) | `0.25.0` | `0.26.0` |\n| [prompt-toolkit](https://github.com/prompt-toolkit/python-prompt-toolkit) | `3.0.52` | `3.0.53` |\n| [pydantic](https://github.com/pydantic/pydantic) | `2.13.0` | `2.13.4` |\n| [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.0` | `2.47.0` |\n| [pywin32](https://github.com/mhammond/pywin32) | `311` | `312` |\n| [pywinpty](https://github.com/andfoy/pywinpty) | `3.0.3` | `3.0.5` |\n| [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` |\n| [rpds-py](https://github.com/crate-py/rpds) | `0.30.0` | `2026.6.3` |\n| [setuptools](https://github.com/pypa/setuptools) | `82.0.1` | `83.0.0` |\n| [soupsieve](https://github.com/facelessuser/soupsieve) | `2.8.3` | `2.9.1` |\n| [tifffile](https://github.com/cgohlke/tifffile) | `2026.4.11` | `2026.7.31` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n| [traitlets](https://github.com/ipython/traitlets) | `5.14.3` | `5.16.1` |\n| [types-python-dateutil](https://github.com/python/typeshed) | `2.9.0.20260408` | `2.9.0.20260716` |\n| [typing-extensions](https://github.com/python/typing_extensions) | `4.15.0` | `4.16.0` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.6.3` | `2.7.0` |\n| [wcwidth](https://github.com/jquast/wcwidth) | `0.6.0` | `0.8.2` |\n\n\nUpdates `imageio[tifffile]` from 2.37.3 to 2.37.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/imageio/imageio/releases\"\u003eimageio[tifffile]'s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.37.4 (2026-07-20)\u003c/h2\u003e\n\u003cp\u003e\u003cem\u003eThis release is published under the BSD-2-Clause License.\u003c/em\u003e\u003c/p\u003e\n\u003ch3\u003eBug\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSet filename parameter of FileNotFoundError exception (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/922\"\u003e#922\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/28c2401839738d39e28e3d7e5b584c6fbe143a2a\"\u003e\u003ccode\u003e28c2401\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDoc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix typos in docstrings and comments (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1193\"\u003e#1193\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/eae520f8a7469dd681fbee77eeee3d3139d1721b\"\u003e\u003ccode\u003eeae520f\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaint\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eBump aiohttp from 3.13.3 to 3.13.4 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1178\"\u003e#1178\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/7853240312fdfa992aa8f9ec6814e282f27460c9\"\u003e\u003ccode\u003e7853240\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump aiohttp from 3.13.4 to 3.14.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1191\"\u003e#1191\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/30c35592dc8836a44e9733a214838fa1530adb07\"\u003e\u003ccode\u003e30c3559\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump black from 26.3.0 to 26.3.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1173\"\u003e#1173\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/a1b083f20d3ed293e9b8609e7ee9b7bd5b09150e\"\u003e\u003ccode\u003ea1b083f\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump gdal from 3.12.2 to 3.13.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1192\"\u003e#1192\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/45fb6942de4035fc379068e1785915267c2e746c\"\u003e\u003ccode\u003e45fb694\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump idna from 3.11 to 3.15 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1189\"\u003e#1189\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/35eefdfb2a1b78bab887d9e7b34f26d1173e78a2\"\u003e\u003ccode\u003e35eefdf\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump pygments from 2.19.2 to 2.20.0 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1177\"\u003e#1177\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/ff0c95bf07a9c50c14bf7ac62a95b465ff7b2ab8\"\u003e\u003ccode\u003eff0c95b\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump requests from 2.32.5 to 2.33.0 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1176\"\u003e#1176\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/8f78220f0e97ddcffbb9c6b0d2ba9612503b81d2\"\u003e\u003ccode\u003e8f78220\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump soupsieve from 2.8.3 to 2.8.4 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1195\"\u003e#1195\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/e032eea65b93801aca1cacad668fcc0f6ffaa93d\"\u003e\u003ccode\u003ee032eea\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump urllib3 from 2.6.3 to 2.7.0 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1184\"\u003e#1184\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/5aef4946ed991ee6f293c74391a582dadfd78640\"\u003e\u003ccode\u003e5aef494\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSet readme content-type in project metadata (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1165\"\u003e#1165\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/9929abb19399080f0fe766f705823fe8d79dd980\"\u003e\u003ccode\u003e9929abb\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eTest\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate CI to support new dependency versions (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1196\"\u003e#1196\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/dfdc909c225662784c7c9469232bbe46ea983501\"\u003e\u003ccode\u003edfdc909\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003cp\u003e\u003cstrong\u003eDetailed Changes\u003c/strong\u003e: \u003ca href=\"https://github.com/imageio/imageio/compare/v2.37.3...v2.37.4\"\u003ev2.37.3...v2.37.4\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/imageio/imageio/blob/master/CHANGELOG.md\"\u003eimageio[tifffile]'s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.37.4 (2026-07-20)\u003c/h2\u003e\n\u003ch3\u003eBug\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSet filename parameter of FileNotFoundError exception\n(\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/922\"\u003e#922\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/28c2401839738d39e28e3d7e5b584c6fbe143a2a\"\u003e\u003ccode\u003e28c2401\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDoc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix typos in docstrings and comments (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1193\"\u003e#1193\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/eae520f8a7469dd681fbee77eeee3d3139d1721b\"\u003e\u003ccode\u003eeae520f\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaint\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eBump aiohttp from 3.13.3 to 3.13.4 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1178\"\u003e#1178\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/7853240312fdfa992aa8f9ec6814e282f27460c9\"\u003e\u003ccode\u003e7853240\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump aiohttp from 3.13.4 to 3.14.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1191\"\u003e#1191\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/30c35592dc8836a44e9733a214838fa1530adb07\"\u003e\u003ccode\u003e30c3559\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump black from 26.3.0 to 26.3.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1173\"\u003e#1173\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/a1b083f20d3ed293e9b8609e7ee9b7bd5b09150e\"\u003e\u003ccode\u003ea1b083f\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump gdal from 3.12.2 to 3.13.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1192\"\u003e#1192\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/45fb6942de4035fc379068e1785915267c2e746c\"\u003e\u003ccode\u003e45fb694\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump idna from 3.11 to 3.15 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1189\"\u003e#1189\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/35eefdfb2a1b78bab887d9e7b34f26d1173e78a2\"\u003e\u003ccode\u003e35eefdf\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump pygments from 2.19.2 to 2.20.0 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1177\"\u003e#1177\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/ff0c95bf07a9c50c14bf7ac62a95b465ff7b2ab8\"\u003e\u003ccode\u003eff0c95b\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump requests from 2.32.5 to 2.33.0 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1176\"\u003e#1176\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/8f78220f0e97ddcffbb9c6b0d2ba9612503b81d2\"\u003e\u003ccode\u003e8f78220\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump soupsieve from 2.8.3 to 2.8.4 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1195\"\u003e#1195\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/e032eea65b93801aca1cacad668fcc0f6ffaa93d\"\u003e\u003ccode\u003ee032eea\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump urllib3 from 2.6.3 to 2.7.0 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1184\"\u003e#1184\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/5aef4946ed991ee6f293c74391a582dadfd78640\"\u003e\u003ccode\u003e5aef494\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSet readme content-type in project metadata\n(\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1165\"\u003e#1165\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/9929abb19399080f0fe766f705823fe8d79dd980\"\u003e\u003ccode\u003e9929abb\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eTest\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate CI to support new dependency versions\n(\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1196\"\u003e#1196\u003c/a\u003e,\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/671d96a5dd9bc94050cc89c4b436e2f7c874283e\"\u003e\u003ccode\u003e671d96a\u003c/code\u003e\u003c/a\u003e REL: Release imageio v2.37.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/28c2401839738d39e28e3d7e5b584c6fbe143a2a\"\u003e\u003ccode\u003e28c2401\u003c/code\u003e\u003c/a\u003e BUG: set filename parameter of FileNotFoundError exception (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/922\"\u003e#922\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/eae520f8a7469dd681fbee77eeee3d3139d1721b\"\u003e\u003ccode\u003eeae520f\u003c/code\u003e\u003c/a\u003e DOC: Fix typos in docstrings and comments (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1193\"\u003e#1193\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/5aef4946ed991ee6f293c74391a582dadfd78640\"\u003e\u003ccode\u003e5aef494\u003c/code\u003e\u003c/a\u003e MAINT: Bump urllib3 from 2.6.3 to 2.7.0 (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1184\"\u003e#1184\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/35eefdfb2a1b78bab887d9e7b34f26d1173e78a2\"\u003e\u003ccode\u003e35eefdf\u003c/code\u003e\u003c/a\u003e MAINT: Bump idna from 3.11 to 3.15 (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1189\"\u003e#1189\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/30c35592dc8836a44e9733a214838fa1530adb07\"\u003e\u003ccode\u003e30c3559\u003c/code\u003e\u003c/a\u003e MAINT: Bump aiohttp from 3.13.4 to 3.14.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1191\"\u003e#1191\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/45fb6942de4035fc379068e1785915267c2e746c\"\u003e\u003ccode\u003e45fb694\u003c/code\u003e\u003c/a\u003e MAINT: Bump gdal from 3.12.2 to 3.13.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1192\"\u003e#1192\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/e032eea65b93801aca1cacad668fcc0f6ffaa93d\"\u003e\u003ccode\u003ee032eea\u003c/code\u003e\u003c/a\u003e MAINT: Bump soupsieve from 2.8.3 to 2.8.4 (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1195\"\u003e#1195\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/dfdc909c225662784c7c9469232bbe46ea983501\"\u003e\u003ccode\u003edfdc909\u003c/code\u003e\u003c/a\u003e TEST: Update CI to support new dependency versions (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1196\"\u003e#1196\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/c7f8249472f63d6b3c0b8cc9fae823714931c36e\"\u003e\u003ccode\u003ec7f8249\u003c/code\u003e\u003c/a\u003e [MAINT] Bump pytest from 9.0.2 to 9.0.3 (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1183\"\u003e#1183\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/imageio/imageio/compare/v2.37.3...v2.37.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `jupyter-book` from 2.1.4 to 2.1.6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jupyter-book/jupyter-book/releases\"\u003ejupyter-book's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.1.6\u003c/h2\u003e\n\u003ch2\u003e2.1.6\u003c/h2\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter-book/jupyter-book/compare/v2.1.5...9d7752b86f7d7c216871bc709d3670dd3b2ebab0\"\u003eFull Changelog\u003c/a\u003e)\u003c/p\u003e\n\u003ch3\u003eMaintenance and upkeep improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump myst-cli to v1.10.1 \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2640\"\u003e#2640\u003c/a\u003e (\u003ca href=\"https://github.com/sbonaretti\"\u003e\u003ccode\u003e@​sbonaretti\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/choldgraf\"\u003e\u003ccode\u003e@​choldgraf\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump the actions group in /.github/workflows with 2 updates \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2628\"\u003e#2628\u003c/a\u003e (\u003ca href=\"https://github.com/bsipocz\"\u003e\u003ccode\u003e@​bsipocz\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDocs: Separate objective and other hosting options in publishing tutorial \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2635\"\u003e#2635\u003c/a\u003e (\u003ca href=\"https://github.com/sbonaretti\"\u003e\u003ccode\u003e@​sbonaretti\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/agoose77\"\u003e\u003ccode\u003e@​agoose77\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eContributors to this release\u003c/h3\u003e\n\u003cp\u003eThe following people contributed discussions, new ideas, code and documentation contributions, and review.\nSee \u003ca href=\"https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports\"\u003eour definition of contributors\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter-book/jupyter-book/graphs/contributors?from=2026-05-02\u0026amp;to=2026-07-05\u0026amp;type=c\"\u003eGitHub contributors page for this release\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/agoose77\"\u003e\u003ccode\u003e@​agoose77\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter-book%2Fjupyter-book+involves%3Aagoose77+updated%3A2026-05-02..2026-07-05\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/bsipocz\"\u003e\u003ccode\u003e@​bsipocz\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter-book%2Fjupyter-book+involves%3Absipocz+updated%3A2026-05-02..2026-07-05\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/choldgraf\"\u003e\u003ccode\u003e@​choldgraf\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter-book%2Fjupyter-book+involves%3Acholdgraf+updated%3A2026-05-02..2026-07-05\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/sbonaretti\"\u003e\u003ccode\u003e@​sbonaretti\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter-book%2Fjupyter-book+involves%3Asbonaretti+updated%3A2026-05-02..2026-07-05\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003ev2.1.5\u003c/h2\u003e\n\u003cp\u003eThis brings in two new releases and several bugfixes, accessibility improvements, and enhancements in mystmd and myst-theme. Release notes for each below:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter-book/mystmd/releases/tag/mystmd%401.9.0\"\u003ehttps://github.com/jupyter-book/mystmd/releases/tag/mystmd%401.9.0\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter-book/myst-theme/releases/tag/myst-to-react%401.3.0\"\u003ehttps://github.com/jupyter-book/myst-theme/releases/tag/myst-to-react%401.3.0\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaintenance and upkeep improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump the actions group in /.github/workflows with 5 updates \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2617\"\u003e#2617\u003c/a\u003e (\u003ca href=\"https://github.com/bsipocz\"\u003e\u003ccode\u003e@​bsipocz\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix docs noxfile and add a footer \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2609\"\u003e#2609\u003c/a\u003e (\u003ca href=\"https://github.com/choldgraf\"\u003e\u003ccode\u003e@​choldgraf\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump the actions group in /.github/workflows with 3 updates \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2608\"\u003e#2608\u003c/a\u003e (\u003ca href=\"https://github.com/bsipocz\"\u003e\u003ccode\u003e@​bsipocz\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePoint to mystmd docs more and move to index pages \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2620\"\u003e#2620\u003c/a\u003e (\u003ca href=\"https://github.com/choldgraf\"\u003e\u003ccode\u003e@​choldgraf\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther merged PRs\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate myst cli \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2621\"\u003e#2621\u003c/a\u003e (\u003ca href=\"https://github.com/choldgraf\"\u003e\u003ccode\u003e@​choldgraf\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eContributors to this release\u003c/h3\u003e\n\u003cp\u003eThe following people contributed discussions, new ideas, code and documentation contributions, and review.\nSee \u003ca href=\"https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports\"\u003eour definition of contributors\u003c/a\u003e.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/jupyter-book/jupyter-book/compare/v2.1.4...v2.1.6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `matplotlib` from 3.10.8 to 3.11.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/matplotlib/matplotlib/releases\"\u003ematplotlib's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eREL: v3.11.1\u003c/h2\u003e\n\u003cp\u003eThis is the first bugfix release of the 3.11.x series.\u003c/p\u003e\n\u003cp\u003eThis release contains several bug-fixes and adjustments:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix tight layout of multiple subplots with \u003ccode\u003esharey=True\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eNoNorm\u003c/code\u003e cursor formatting for \u003ccode\u003euint8\u003c/code\u003e images\u003c/li\u003e\n\u003cli\u003eFix occasional misalignment in reported mouse position (also fix a bug with canvas height)\u003c/li\u003e\n\u003cli\u003eFix clipped Axis labels on 3D plots with tight layout\u003c/li\u003e\n\u003cli\u003eFix inverted Axis on 3D plots\u003c/li\u003e\n\u003cli\u003eFix restoring 'auto' aspect in 3D axes after switching from 'equal'\u003c/li\u003e\n\u003cli\u003eFix missing glyphs when subsetting Type 1 fonts in PDF\u003c/li\u003e\n\u003cli\u003eFix oversized embedding of Type 42 fonts in PDF/PostScript files\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eAs well as several documentation and typing improvements and corrections.\u003c/p\u003e\n\u003ch2\u003eREL: v3.11.0\u003c/h2\u003e\n\u003cp\u003eThe largest change within this release is a complete overhaul of text and font processing. Through the use of \u003ca href=\"https://github.com/HOST-Oman/libraqm/\"\u003elibraqm\u003c/a\u003e, \u003ca href=\"https://harfbuzz.github.io/\"\u003eHarfBuzz\u003c/a\u003e, \u003ca href=\"https://github.com/Tehreer/SheenBidi\"\u003eSheenBidi\u003c/a\u003e, and an updated release of \u003ca href=\"https://freetype.org/\"\u003eFreeType\u003c/a\u003e, all text should now support modern font features, enabling full internationalization in all languages. Not all features of these libraries are supported yet, but we expect this work to enable further improvements in an easier manner.\u003c/p\u003e\n\u003cp\u003eOutside of text handling, there are several improvements to 3D Axes, performance, new accessible colour sequences, flexible figure management, and more. \u003ca href=\"https://matplotlib.org/3.11.0/release/prev_whats_new/whats_new_3.11.0.html\"\u003eSee the release notes for more information\u003c/a\u003e.\u003c/p\u003e\n\u003ch2\u003eREL: v3.11.0rc2\u003c/h2\u003e\n\u003cp\u003eThis is the second release candidate for the meso release 3.11.0.\u003c/p\u003e\n\u003cp\u003eThis release candidate fixes some problems with downstream packages, removes some missed deprecations, and corrects some additional minor bugs.\u003c/p\u003e\n\u003ch2\u003eREL: v3.11.0rc1\u003c/h2\u003e\n\u003cp\u003eAfter an extended development stretch, we are pleased to announce the first release candidate of Matplotlib 3.11.0.\u003c/p\u003e\n\u003cp\u003eThe largest change within this release is a complete overhaul of text and font processing. Through the use of \u003ca href=\"https://github.com/HOST-Oman/libraqm/\"\u003elibraqm\u003c/a\u003e, \u003ca href=\"https://harfbuzz.github.io/\"\u003eHarfBuzz\u003c/a\u003e, \u003ca href=\"https://github.com/Tehreer/SheenBidi\"\u003eSheenBidi\u003c/a\u003e, and an updated release of \u003ca href=\"https://freetype.org/\"\u003eFreeType\u003c/a\u003e, all text should now support modern font features, enabling full internationalization in all languages. Not all features of these libraries are supported yet, but we expect this work to enable further improvements in an easier manner. Due to the update to the font rendering stack, we cannot guarantee that text will be bit-for-bit perfect with previous releases, so if you are using Matplotlib for testing, it may be necessary to introduce/raise a tolerance within your tests.\u003c/p\u003e\n\u003cp\u003eOutside of text handling, there are several improvements to 3D Axes, performance, new accessible colour sequences, flexible figure management, and more. Final release notes are still being curated, but you may browse \u003ca href=\"https://matplotlib.org/3.11.0/release/next_whats_new\"\u003ethe list of new features\u003c/a\u003e, \u003ca href=\"https://matplotlib.org/3.11.0/api/next_api_changes.html\"\u003eAPI changes\u003c/a\u003e, and \u003ca href=\"https://github.com/matplotlib/matplotlib/milestone/96?closed=1https://github.com/matplotlib/matplotlib/milestone/96?closed=1\"\u003eall issues/pull requests on the milestone\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eAs a note for downstream packagers, the font libraries have only been tested against the versions bundled with the wheels. It may be possible to expand the range of requirements, or that a requirement is too broad. Please report any issues you have building against external dependencies.\u003c/p\u003e\n\u003ch2\u003ev3.10.9\u003c/h2\u003e\n\u003cp\u003eThis is a micro release of the v3.10.x series.\nHighlights of this release include:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious minor bug and doc fixes\u003c/li\u003e\n\u003cli\u003eSecurity hardening validation of cyclers - Removing eval usage\u003c/li\u003e\n\u003cli\u003eSecurity hardening in Latex and PS calls - Removing shell escapes\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/3c1757a567c58e41e565313af2d3bcdc52076b43\"\u003e\u003ccode\u003e3c1757a\u003c/code\u003e\u003c/a\u003e REL: v3.11.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/792c6b5fa9cd2567a80fa231af19b7770b8288e4\"\u003e\u003ccode\u003e792c6b5\u003c/code\u003e\u003c/a\u003e DOC: Prepare for 3.11.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/aaff9f613a0886fdec0b4e20d9c5f1db15166d2c\"\u003e\u003ccode\u003eaaff9f6\u003c/code\u003e\u003c/a\u003e Merge branch 'v3.11.0-doc' into v3.11.x\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/d4f4527cce030c81eb699516bdd8c1cbab3a940d\"\u003e\u003ccode\u003ed4f4527\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/matplotlib/matplotlib/issues/32052\"\u003e#32052\u003c/a\u003e from meeseeksmachine/auto-backport-of-pr-32038-on-v...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/6ad4bcf48beaf05b8632e082dd35a1c8960324c8\"\u003e\u003ccode\u003e6ad4bcf\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/matplotlib/matplotlib/issues/32050\"\u003e#32050\u003c/a\u003e from meeseeksmachine/auto-backport-of-pr-31304-on-v...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/7fb74d3476247ee7aa078ff45ec60f25f1a9b535\"\u003e\u003ccode\u003e7fb74d3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/matplotlib/matplotlib/issues/32051\"\u003e#32051\u003c/a\u003e from meeseeksmachine/auto-backport-of-pr-32037-on-v...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/c624aec7de6060e16d708fd70bd2e9302e95d3f3\"\u003e\u003ccode\u003ec624aec\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/matplotlib/matplotlib/issues/32038\"\u003e#32038\u003c/a\u003e: Fix occasional misalignment in reported mouse position (a...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/8eda2b79d27a4255380b97b49dcb61110690c0c1\"\u003e\u003ccode\u003e8eda2b7\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/matplotlib/matplotlib/issues/32037\"\u003e#32037\u003c/a\u003e: Bump the actions group with 3 updates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/a0e7ae5521b59c25ced9c69e8d9aebc1b0bc7c6e\"\u003e\u003ccode\u003ea0e7ae5\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/matplotlib/matplotlib/issues/31304\"\u003e#31304\u003c/a\u003e: Fix restoring 'auto' aspect in 3D axes after switching fr...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/90013231a38de53af9414747a03ce010de2fe3d0\"\u003e\u003ccode\u003e9001323\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/matplotlib/matplotlib/issues/32047\"\u003e#32047\u003c/a\u003e from meeseeksmachine/auto-backport-of-pr-32025-on-v...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/matplotlib/matplotlib/compare/v3.10.8...v3.11.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `numpy` from 2.4.4 to 2.5.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/numpy/numpy/releases\"\u003enumpy's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.1 (July 4, 2026)\u003c/h2\u003e\n\u003ch1\u003eNumPy 2.5.1 Release Notes\u003c/h1\u003e\n\u003cp\u003eThe NumPy 2.5.1 is a patch release that fixes bugs discovered after the 2.5.0\nrelease. The most noticeable is the fix is to the numpy datetime cython API\nwhich should allow downstream to support NumPy versions older than 2.5.\nPreparation for Python 3.15 continues along with typing improvements.\u003c/p\u003e\n\u003cp\u003eThis release supports Python versions 3.12-3.14\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe minimum supported GCC version has been updated from 9.3.0 to 10.3.0\u003c/p\u003e\n\u003cp\u003e(\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31843\"\u003egh-31843\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eContributors\u003c/h2\u003e\n\u003cp\u003eA total of 10 people contributed to this release. People with a \u0026quot;+\u0026quot; by their\nnames contributed a patch for the first time.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdhyan Gupta +\u003c/li\u003e\n\u003cli\u003eAnkit Ahlawat\u003c/li\u003e\n\u003cli\u003eCharles Harris\u003c/li\u003e\n\u003cli\u003eIason Krommydas\u003c/li\u003e\n\u003cli\u003eJoren Hammudoglu\u003c/li\u003e\n\u003cli\u003eKumar Aditya\u003c/li\u003e\n\u003cli\u003eNathan Goldbaum\u003c/li\u003e\n\u003cli\u003eSebastian Berg\u003c/li\u003e\n\u003cli\u003eTies Jan Hefting +\u003c/li\u003e\n\u003cli\u003eVineet Kumar\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ePull requests merged\u003c/h2\u003e\n\u003cp\u003eA total of 20 pull requests were merged for this release.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31707\"\u003e#31707\u003c/a\u003e: MAINT: Prepare 2.5.x for further development\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31721\"\u003e#31721\u003c/a\u003e: CI: fix new \u003ccode\u003ecython-lint\u003c/code\u003e errors (\u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31711\"\u003e#31711\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31723\"\u003e#31723\u003c/a\u003e: MAINT: Update meson to match main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31729\"\u003e#31729\u003c/a\u003e: TST: use setup-sde instead of curl to get SDE binaries (\u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31727\"\u003e#31727\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31829\"\u003e#31829\u003c/a\u003e: BUG: Relax finfo to be easier accessible for all user dtypes...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31831\"\u003e#31831\u003c/a\u003e: TYP: Fix \u003ccode\u003eflatiter.__next__\u003c/code\u003e return type for \u003ccode\u003eobject_\u003c/code\u003e and...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31832\"\u003e#31832\u003c/a\u003e: BUG: avoid deadlocks using NpyString API (\u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31682\"\u003e#31682\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31833\"\u003e#31833\u003c/a\u003e: BUG: fix out array leak in reduceat and accumulate when dtype...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31835\"\u003e#31835\u003c/a\u003e: BUG: fix numpy datetime cython APIs to be compatible with older...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31836\"\u003e#31836\u003c/a\u003e: TYP: Fix incorrect dtype inference of \u003ccode\u003easarray([])\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31732\"\u003e#31732\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31837\"\u003e#31837\u003c/a\u003e: TYP: Fix \u003ccode\u003enp.ma.masked_array\u003c/code\u003e 2.5.0 regression\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31838\"\u003e#31838\u003c/a\u003e: FIX: Refactor error handling in array_setstate to prevent typecode...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31839\"\u003e#31839\u003c/a\u003e: TST: xfail multithreaded BLAS test more generously\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31840\"\u003e#31840\u003c/a\u003e: MAINT: Rename subroutine for crackfortran tests\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/5e1d03ffac5f2c0a9c39bfcaa9fc853b2b83151e\"\u003e\u003ccode\u003e5e1d03f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31863\"\u003e#31863\u003c/a\u003e from charris/prepare-2.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/ad0b66b8bf1faedc727d8a80ec217bdc95a3037e\"\u003e\u003ccode\u003ead0b66b\u003c/code\u003e\u003c/a\u003e REL: Prepare for the NumPy 2.5.1 release.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/9df8516d6c933927b3bb9a7b8fd10f523e627ffd\"\u003e\u003ccode\u003e9df8516\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31858\"\u003e#31858\u003c/a\u003e from charris/backport-31688\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/4dee265afc098a296a62666f6356d4927b67848f\"\u003e\u003ccode\u003e4dee265\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31857\"\u003e#31857\u003c/a\u003e from charris/backport-31775\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/dc8d5530eb0bb3198bfc0538e28d1f284f6f4a80\"\u003e\u003ccode\u003edc8d553\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31856\"\u003e#31856\u003c/a\u003e from charris/backport-31846\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/67cb4a874e7c52d90176ca7343e208dfa3f11d11\"\u003e\u003ccode\u003e67cb4a8\u003c/code\u003e\u003c/a\u003e fix:Signed integer overflow in datetime.c (\u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31688\"\u003e#31688\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/baa2589a94a93b4216159817fe891c83a39eb36d\"\u003e\u003ccode\u003ebaa2589\u003c/code\u003e\u003c/a\u003e TST: Clean up imports, formatting, and assertions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/2fe5ba41f935065305cfb31a561202188953c7e9\"\u003e\u003ccode\u003e2fe5ba4\u003c/code\u003e\u003c/a\u003e TEST: Refactor tests to use np.testing.assert_raises_regex per review\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/bb465819882f84304ecbfd180f00bd748f783134\"\u003e\u003ccode\u003ebb46581\u003c/code\u003e\u003c/a\u003e MAINT: Remove deprecated Python recursion fix\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/8f34214a5e6e813bea56fec2cdc9bc8ac79ff38b\"\u003e\u003ccode\u003e8f34214\u003c/code\u003e\u003c/a\u003e MAINT: Move SeedSequence recursion guard to C-layer and add tests\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/numpy/numpy/compare/v2.4.4...v2.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `zarr` from 3.1.6 to 3.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/zarr-developers/zarr-python/releases\"\u003ezarr's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAllow s3 testing in face of ambient AWS credentials by \u003ca href=\"https://github.com/chuckwondo\"\u003e\u003ccode\u003e@​chuckwondo\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3947\"\u003ezarr-developers/zarr-python#3947\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci: run all of xarray's tests in downstream workflow by \u003ca href=\"https://github.com/maxrjones\"\u003e\u003ccode\u003e@​maxrjones\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3940\"\u003ezarr-developers/zarr-python#3940\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the actions group across 1 directory with 12 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3930\"\u003ezarr-developers/zarr-python#3930\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: update pre-commit hooks by \u003ca href=\"https://github.com/pre-commit-ci\"\u003e\u003ccode\u003e@​pre-commit-ci\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3943\"\u003ezarr-developers/zarr-python#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(zarr-metadata): bump version to 0.1.1 by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3949\"\u003ezarr-developers/zarr-python#3949\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor: simplify internal chunk representation by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3899\"\u003ezarr-developers/zarr-python#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix V3 time types by \u003ca href=\"https://github.com/chuckwondo\"\u003e\u003ccode\u003e@​chuckwondo\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3955\"\u003ezarr-developers/zarr-python#3955\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: fix ability to run mypy via hatch by \u003ca href=\"https://github.com/chuckwondo\"\u003e\u003ccode\u003e@​chuckwondo\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3952\"\u003ezarr-developers/zarr-python#3952\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix minor typos by \u003ca href=\"https://github.com/kabilar\"\u003e\u003ccode\u003e@​kabilar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3957\"\u003ezarr-developers/zarr-python#3957\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the actions group with 5 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3951\"\u003ezarr-developers/zarr-python#3951\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edeprecate blosc enums by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3963\"\u003ezarr-developers/zarr-python#3963\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBUG: Fix empty Group nodes lacking a \u0026quot;consolidated_metadata\u0026quot; field by \u003ca href=\"https://github.com/TomAugspurger\"\u003e\u003ccode\u003e@​TomAugspurger\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3967\"\u003ezarr-developers/zarr-python#3967\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(zarr-metadata): model stored metadata more closely by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3962\"\u003ezarr-developers/zarr-python#3962\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: allow writing to 0-dimensional arrays with sharding by \u003ca href=\"https://github.com/NIK-TIGER-BILL\"\u003e\u003ccode\u003e@​NIK-TIGER-BILL\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3966\"\u003ezarr-developers/zarr-python#3966\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the actions group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3970\"\u003ezarr-developers/zarr-python#3970\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: run mypy from developer environment by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3972\"\u003ezarr-developers/zarr-python#3972\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat:get_ranges by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3925\"\u003ezarr-developers/zarr-python#3925\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: remove warning on fixed length utf32 by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3979\"\u003ezarr-developers/zarr-python#3979\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003emisc(zarr-metadata): typed constants and fixes by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3978\"\u003ezarr-developers/zarr-python#3978\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: cd workflow by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3935\"\u003ezarr-developers/zarr-python#3935\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eperf: cache default ArraySpec for regular chunk grids by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3908\"\u003ezarr-developers/zarr-python#3908\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor(sharding): store chunks_per_shard explicitly in _ShardIndex by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3975\"\u003ezarr-developers/zarr-python#3975\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: update link to developer chat by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3980\"\u003ezarr-developers/zarr-python#3980\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat(zarr-metadata): partial metadata types by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3982\"\u003ezarr-developers/zarr-python#3982\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(zarr-metadata): set up a changelog by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3981\"\u003ezarr-developers/zarr-python#3981\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOptimize partial shard reads by \u003ca href=\"https://github.com/aldenks\"\u003e\u003ccode\u003e@​aldenks\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3004\"\u003ezarr-developers/zarr-python#3004\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDo not install CuPy on darwin by \u003ca href=\"https://github.com/chuckwondo\"\u003e\u003ccode\u003e@​chuckwondo\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3988\"\u003ezarr-developers/zarr-python#3988\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(zarr-metadata): prepare for 0.2.0 release by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3986\"\u003ezarr-developers/zarr-python#3986\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eWiden ChunksLike type alias by \u003ca href=\"https://github.com/chuckwondo\"\u003e\u003ccode\u003e@​chuckwondo\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3990\"\u003ezarr-developers/zarr-python#3990\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: match v* when extracting a zarr version from git tags by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3994\"\u003ezarr-developers/zarr-python#3994\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: subchunk write order by \u003ca href=\"https://github.com/ilan-gold\"\u003e\u003ccode\u003e@​ilan-gold\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3826\"\u003ezarr-developers/zarr-python#3826\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eprune old string dtype class by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3973\"\u003ezarr-developers/zarr-python#3973\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: compare metadata objects by JSON form by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3999\"\u003ezarr-developers/zarr-python#3999\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun doctests via pytest and fix broken doctests. by \u003ca href=\"https://github.com/chuckwondo\"\u003e\u003ccode\u003e@​chuckwondo\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4000\"\u003ezarr-developers/zarr-python#4000\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(FsspecStore): close owned async filesystem on store.close() by \u003ca href=\"https://github.com/josh-ag2\"\u003e\u003ccode\u003e@​josh-ag2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4003\"\u003ezarr-developers/zarr-python#4003\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the actions group across 1 directory with 8 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4014\"\u003ezarr-developers/zarr-python#4014\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: use hatch's \u003ccode\u003edefault\u003c/code\u003e env so the uv installer is inherited by \u003ca href=\"https://github.com/lhoupert\"\u003e\u003ccode\u003e@​lhoupert\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4023\"\u003ezarr-developers/zarr-python#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: update pre-commit hooks by \u003ca href=\"https://github.com/pre-commit-ci\"\u003e\u003ccode\u003e@​pre-commit-ci\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4024\"\u003ezarr-developers/zarr-python#4024\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: test more code snippets in docs by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4018\"\u003ezarr-developers/zarr-python#4018\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump uv from 0.11.14 to 0.11.15 in the uv group across 1 directory by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4019\"\u003ezarr-developers/zarr-python#4019\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor: remove random subchunk ordering by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4011\"\u003ezarr-developers/zarr-python#4011\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: make xarray downstream tests work by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4043\"\u003ezarr-developers/zarr-python#4043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etest: add property tests for block and mask indexing by \u003ca href=\"https://github.com/maxrjones\"\u003e\u003ccode\u003e@​maxrjones\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4054\"\u003ezarr-developers/zarr-python#4054\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor: use backported sentinel type by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4046\"\u003ezarr-developers/zarr-python#4046\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump aiohttp from 3.13.5 to 3.14.0 in the uv group across 1 directory by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4031\"\u003ezarr-developers/zarr-python#4031\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRevert \u0026quot;fix: make xarray downstream tests work\u0026quot; by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4047\"\u003ezarr-developers/zarr-python#4047\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: indexing test cleanup by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4001\"\u003ezarr-developers/zarr-python#4001\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor/consolidated JSON IO routines by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3998\"\u003ezarr-developers/zarr-python#3998\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/zarr-developers/zarr-python/blob/main/docs/release-notes.md\"\u003ezarr's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.3.0 (2026-07-30)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eOptimizes reading multiple chunks from a shard. Serial calls to \u003ccode\u003eStore.get()\u003c/code\u003e\nin the sharding codec have been replaced with a single call to\n\u003ccode\u003eStore.get_ranges()\u003c/code\u003e, which coalesces nearby byte ranges and fetches them\nconcurrently. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3004\"\u003e#3004\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded a \u003ccode\u003esubchunk_write_order\u003c/code\u003e option to \u003ccode\u003eShardingCodec\u003c/code\u003e to control the physical order of subchunks within a shard. Supported values are \u003ccode\u003emorton\u003c/code\u003e, \u003ccode\u003eunordered\u003c/code\u003e, \u003ccode\u003elexicographic\u003c/code\u003e, and \u003ccode\u003ecolexicographic\u003c/code\u003e. \u003ccode\u003eunordered\u003c/code\u003e makes no guarantee about subchunk layout. This setting affects only on-disk layout, not the data read back, and is not persisted in array metadata: it applies per codec instance and is not recovered when reopening a sharded array. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3826\"\u003e#3826\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded \u003ccode\u003eSyncByteGetter\u003c/code\u003e and \u003ccode\u003eSyncByteSetter\u003c/code\u003e runtime-checkable protocols and a \u003ccode\u003eget_ranges_sync\u003c/code\u003e method on the \u003ccode\u003eStore\u003c/code\u003e ABC. These let custom byte getters/setters opt into the synchronous codec pipeline's fast path for in-memory IO, which the sharding codec uses for its inner chunks. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3885\"\u003e#3885\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded \u003ccode\u003eFusedCodecPipeline\u003c/code\u003e, an opt-in codec pipeline that runs codec compute synchronously and in bulk (avoiding the per-chunk async scheduling overhead of the default \u003ccode\u003eBatchedCodecPipeline\u003c/code\u003e), giving large speedups for sharded arrays. The default \u003ccode\u003eBatchedCodecPipeline\u003c/code\u003e is unchanged for standard configurations, so existing code keeps working unless you opt in; enable the new pipeline with \u003ccode\u003ezarr.config.set({\u0026quot;codec_pipeline.path\u0026quot;: \u0026quot;zarr.core.codec_pipeline.FusedCodecPipeline\u0026quot;})\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3885\"\u003e#3885\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd \u003ccode\u003ezarr.abc.store.Store.get_ranges\u003c/code\u003e for concurrent, coalesced multi-range reads from a single key. The method is defined on the \u003ccode\u003eStore\u003c/code\u003e ABC with a default implementation built on \u003ccode\u003eStore.get\u003c/code\u003e, so every store inherits a working version; stores with native multi-range backends (e.g. \u003ccode\u003eFsspecStore\u003c/code\u003e) can override for efficiency. Coalescing knobs (\u003ccode\u003emax_concurrency\u003c/code\u003e, \u003ccode\u003emax_gap_bytes\u003c/code\u003e, \u003ccode\u003emax_coalesced_bytes\u003c/code\u003e) are passed as keyword arguments to \u003ccode\u003eget_ranges\u003c/code\u003e. Failures from underlying fetches surface as a \u003ccode\u003eBaseExceptionGroup\u003c/code\u003e (PEP 654); callers should use \u003ccode\u003eexcept*\u003c/code\u003e to filter for specific exception types such as \u003ccode\u003eFileNotFoundError\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3925\"\u003e#3925\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eTwo new fields on \u003ccode\u003eArrayConfig\u003c/code\u003e control how the sharding codec coalesces partial-shard reads: \u003ccode\u003esharding_coalesce_max_gap_bytes\u003c/code\u003e (default 1 MiB) and \u003ccode\u003esharding_coalesce_max_bytes\u003c/code\u003e (default 16 MiB). When reading multiple chunks from the same shard, nearby byte ranges are merged into a single request to the store if separated by no more than \u003ccode\u003esharding_coalesce_max_gap_bytes\u003c/code\u003e and the merged read stays within \u003ccode\u003esharding_coalesce_max_bytes\u003c/code\u003e. Defaults are seeded from the matching \u003ccode\u003earray.sharding_coalesce_max_gap_bytes\u003c/code\u003e / \u003ccode\u003earray.sharding_coalesce_max_bytes\u003c/code\u003e keys in [\u003ccode\u003ezarr.config\u003c/code\u003e][] at array-creation time, and can be overridden per array by passing \u003ccode\u003econfig={...}\u003c/code\u003e to [\u003ccode\u003ezarr.create_array\u003c/code\u003e][]. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3987\"\u003e#3987\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded \u003ccode\u003eGroup.get_array\u003c/code\u003e, \u003ccode\u003eGroup.get_group\u003c/code\u003e, \u003ccode\u003eAsyncGroup.get_array\u003c/code\u003e, and \u003ccode\u003eAsyncGroup.get_group\u003c/code\u003e: type-safe accessors that return the child array or group at a given path, raising \u003ccode\u003eArrayNotFoundError\u003c/code\u003e / \u003ccode\u003eGroupNotFoundError\u003c/code\u003e if no node exists there, and \u003ccode\u003eContainsGroupError\u003c/code\u003e / \u003ccode\u003eContainsArrayError\u003c/code\u003e if the node is not of the requested kind. Unlike \u003ccode\u003eGroup.__getitem__\u003c/code\u003e, which returns \u003ccode\u003eArray | Group\u003c/code\u003e, these methods have precise return types. Nested paths like \u003ccode\u003e\u0026quot;subgroup/subarray\u0026quot;\u003c/code\u003e are supported. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4128\"\u003e#4128\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003eZipStore\u003c/code\u003e now accepts an open binary file-like object in place of a path, enabling\nzip archives on remote storage (e.g. a file opened with \u003ccode\u003efsspec\u003c/code\u003e or an\n\u003ccode\u003eobstore.ReadableFile\u003c/code\u003e). Operations that require a filesystem location\n(\u003ccode\u003eclear\u003c/code\u003e, \u003ccode\u003emove\u003c/code\u003e) raise \u003ccode\u003eNotImplementedError\u003c/code\u003e for file-object-backed stores. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4187\"\u003e#4187\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBugfixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eStop emitting an \u003ccode\u003eUnstableSpecificationWarning\u003c/code\u003e when serializing the \u003ccode\u003estruct\u003c/code\u003e data type to Zarr V3 metadata. The \u003ccode\u003estruct\u003c/code\u003e data type now has a stable Zarr V3 specification. The legacy \u003ccode\u003estructured\u003c/code\u003e alias and the unspecified \u003ccode\u003enull_terminated_bytes\u003c/code\u003e, \u003ccode\u003eraw_bytes\u003c/code\u003e, and \u003ccode\u003evariable_length_bytes\u003c/code\u003e data types continue to warn. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4100\"\u003e#4100\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix equality comparison of \u003ccode\u003eArrayV2Metadata\u003c/code\u003e and \u003ccode\u003eArrayV3Metadata\u003c/code\u003e objects with a\n\u003ccode\u003eNaN\u003c/code\u003e fill value. Such objects are now compared by their JSON-serialized form, so two\notherwise-identical metadata objects with a \u003ccode\u003eNaN\u003c/code\u003e (or infinite) fill value compare equal. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/2929\"\u003e#2929\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBytesCodec.from_dict\u003c/code\u003e so that \u003ccode\u003eBytesCodec\u003c/code\u003e instances roundtrip to / from\ntheir dict representation. \u003ccode\u003eBytesCodec.from_dict\u003c/code\u003e now interprets a missing\n\u003ccode\u003eendian\u003c/code\u003e configuration as \u003ccode\u003eendian=None\u003c/code\u003e (matching what \u003ccode\u003eBytesCodec.to_dict\u003c/code\u003e\nemits), instead of falling back to the system's native byte order. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3417\"\u003e#3417\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003esave_array\u003c/code\u003e, \u003ccode\u003eGroup.__setitem__\u003c/code\u003e, and \u003ccode\u003eload\u003c/code\u003e for 0-dimensional arrays. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/3469\"\u003e#3469\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed inner-codec spec evolution for sharded arrays. The sharding codec now threads the array spec through its inner codec chain when evolving codecs, so a codec that changes the dtype upstream of \u003ccode\u003eBytesCodec\u003c/code\u003e no longer leaves the inner chain evolved against the wrong spec (which previously failed at decode time). This runs on the default \u003ccode\u003eBatchedCodecPipeline\u003c/code\u003e as well. Standard inner chains (\u003ccode\u003e[BytesCodec]\u003c/code\u003e, \u003ccode\u003e[BytesCodec, ZstdCodec]\u003c/code\u003e, transpose + bytes) are byte-identical to before. Restores the behavior of \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/2179\"\u003e#2179\u003c/a\u003e. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3885\"\u003e#3885\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eMake chunk normalization properly handle \u003ccode\u003e-1\u003c/code\u003e as a compact representation of the\nlength of an entire axis. Reject several previously-accepted but ill-defined\nchunk specifications: \u003ccode\u003echunks=True\u003c/code\u003e (previously silently produced size-1 chunks),\nchunk tuples shorter than the array's number of dimensions (previously padded to\nthe array's shape), and \u003ccode\u003eNone\u003c/code\u003e as a per-dimension chunk size. These all now\nraise informative errors. Also fix chunk handling for 0-length array dimensions,\nand add explicit rejection of 0-length chunks. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3899\"\u003e#3899\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eHandle missing consolidated metadata in leaf Group nodes. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/3954\"\u003e#3954\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eCorrected the JSON type definitions for the \u003ccode\u003enumpy.datetime64\u003c/code\u003e and\n\u003ccode\u003enumpy.timedelta64\u003c/code\u003e data types in Zarr V3 metadata: the \u003ccode\u003econfiguration\u003c/code\u003e object\n(holding \u003ccode\u003eunit\u003c/code\u003e and \u003ccode\u003escale_factor\u003c/code\u003e) is now required, matching the published\nspecifications for these data types. Also updated the specification links in\nthe docstrings to point to the zarr-extensions repository. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3955\"\u003e#3955\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed writing to 0-dimensional arrays that use the sharding codec. Previously\nassigning to a 0-dimensional sharded array raised an error. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3966\"\u003e#3966\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix flaky stateful test bookkeeping when \u003ccode\u003edelete_dir\u003c/code\u003e matches string prefixes instead of true directory descendants. Previously a path such as \u003ccode\u003e6/faNT…\u003c/code\u003e could be incorrectly removed when deleting \u003ccode\u003e6/f\u003c/code\u003e. (See [issue \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/3977\"\u003e#3977\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/3977\"\u003ezarr-developers/zarr-python#3977\u003c/a\u003e).) (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/3977\"\u003e#3977\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eFsspecStore.close()\u003c/code\u003e no longer closes the underlying fsspec filesystem or its\nnetwork session. fsspec caches and shares filesystem instances across callers,\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/53e6dc66b834988912194985a1051ad4db4f0141\"\u003e\u003ccode\u003e53e6dc6\u003c/code\u003e\u003c/a\u003e docs: dev blog, performance examples, and compiled 3.3.0 release notes (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/4191\"\u003e#4191\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/6f52da5b8ce4e28031f4ad6c3287795fec971105\"\u003e\u003ccode\u003e6f52da5\u003c/code\u003e\u003c/a\u003e fix: gate fused sync fast paths on full store sync capability; wrappers forwa...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/57e66d92ed26eb02ca3931f253de052c0a890042\"\u003e\u003ccode\u003e57e66d9\u003c/code\u003e\u003c/a\u003e fix: reject malformed chunk keys in DefaultChunkKeyEncoding (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/4219\"\u003e#4219\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/ec8e70ad86990e4c1bf57478fe13769885e31882\"\u003e\u003ccode\u003eec8e70a\u003c/code\u003e\u003c/a\u003e chore(deps): bump the python-dependencies group across 1 directory with 11 up...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/6f9724cb14686e0737ed144be5d945fe1fbde578\"\u003e\u003ccode\u003e6f9724c\u003c/code\u003e\u003c/a\u003e fix: minor correctness and hygiene fixes from the sync-pipeline audit (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/4205\"\u003e#4205\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/a88f88951e7b1bc19f19adad2fb364158851076a\"\u003e\u003ccode\u003ea88f889\u003c/code\u003e\u003c/a\u003e fix: make ManagedMemoryStore/GpuMemoryStore sync methods parity-safe (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/4204\"\u003e#4204\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/020e5c3494c7bb794da1a94b970c326ddbdbca7a\"\u003e\u003ccode\u003e020e5c3\u003c/code\u003e\u003c/a\u003e docs: fix link checker error and update redirected links; run checker weekly ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/63fc294bec25c41983c1a45f7f03bd6f801a7ff9\"\u003e\u003ccode\u003e63fc294\u003c/code\u003e\u003c/a\u003e chore(zarr-metadata): build 0.4.0 changelog (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/4211\"\u003e#4211\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/69ca264664bd74ba55c594490acdd49cd70b7fe8\"\u003e\u003ccode\u003e69ca264\u003c/code\u003e\u003c/a\u003e docs(zarr-metadata): docs-site polish: repo link, titles, RTD build skips, br...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/b2ece6f82c5281d02a8a4408fb13f791870c65bd\"\u003e\u003ccode\u003eb2ece6f\u003c/code\u003e\u003c/a\u003e docs(zarr-metadata): standalone documentation site; add package justfile (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/4208\"\u003e#4208\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/zarr-developers/zarr-python/compare/v3.1.6...v3.3.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pydantic-zarr` from 0.9.2 to 0.10.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/releases\"\u003epydantic-zarr's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.10.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump minimum supported Python and NumPy by \u003ca href=\"https://github.com/dstansby\"\u003e\u003ccode\u003e@​dstansby\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/pull/145\"\u003ezarr-developers/pydantic-zarr#145\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIgnore warning for using _config from zarr-python by \u003ca href=\"https://github.com/dstansby\"\u003e\u003ccode\u003e@​dstansby\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/pull/156\"\u003ezarr-developers/pydantic-zarr#156\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd dev dependency group by \u003ca href=\"https://github.com/dstansby\"\u003e\u003ccode\u003e@​dstansby\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/pull/155\"\u003ezarr-developers/pydantic-zarr#155\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the actions group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/pull/154\"\u003ezarr-developers/pydantic-zarr#154\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd changelog for 0.10.0 by \u003ca href=\"https://github.com/dstansby\"\u003e\u003ccode\u003e@​dstansby\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/pull/157\"\u003ezarr-developers/pydantic-zarr#157\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAlter cd.yml to use OIDC tokens. by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/pull/153\"\u003ezarr-developers/pydantic-zarr#153\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/compare/v0.9.2...v0.10.0\"\u003ehttps://github.com/zarr-developers/pydantic-zarr/compare/v0.9.2...v0.10.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/blob/main/docs/release-notes.md\"\u003epydantic-zarr's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003epydantic-zarr 0.10.0 (2026-04-16)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe minimum supported Python is now 3.12 and the minimum supported NumPy is now 2.0. (\u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/issues/145\"\u003e#145\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003etype ...\u003c/code\u003e instead of \u003ccode\u003e...: TypeAlias\u003c/code\u003e to declare type aliases. (\u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/issues/145\"\u003e#145\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/21c1b2faf687f2256d6968bc283e9cfbce61fd6b\"\u003e\u003ccode\u003e21c1b2f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/issues/153\"\u003e#153\u003c/a\u003e from d-v-b/chore/trusted-publishing\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/6829aeaada1798e2b963aa27bcadb773ce89e8fa\"\u003e\u003ccode\u003e6829aea\u003c/code\u003e\u003c/a\u003e Remove extra lines\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/11829ad6a246fb05f12b4f9d8a715a060d1bdf72\"\u003e\u003ccode\u003e11829ad\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into chore/trusted-publishing\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/7551b0db960e1f55405ea642d275f8005ab49aa0\"\u003e\u003ccode\u003e7551b0d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/issues/157\"\u003e#157\u003c/a\u003e from dstansby/0.10.0-clog\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/4bfc9ee63229f0d6127154d7bb3a8f3ce9926047\"\u003e\u003ccode\u003e4bfc9ee\u003c/code\u003e\u003c/a\u003e Add changelog for 0.10.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/13b1a2c2091fe06a4e7464cfa6b293b40c736c7a\"\u003e\u003ccode\u003e13b1a2c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/issues/154\"\u003e#154\u003c/a\u003e from zarr-developers/dependabot/github_actions/action...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/6dedb9c75843c01a2bd6bf2868ffd65169939d8f\"\u003e\u003ccode\u003e6dedb9c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/issues/155\"\u003e#155\u003c/a\u003e from dstansby/dev-group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/203455ac996fa6e3cf6c19b86f1b0caf0db02911\"\u003e\u003ccode\u003e203455a\u003c/code\u003e\u003c/a\u003e Bump the actions group across 1 directory with 3 updates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/2e84f4366abc1d9e11581b83233b18989972ef2c\"\u003e\u003ccode\u003e2e84f43\u003c/code\u003e\u003c/a\u003e Add dev dependency group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/b84b0e590274482cd51cc33dc7809fda19a6e639\"\u003e\u003ccode\u003eb84b0e5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/issues/156\"\u003e#156\u003c/a\u003e from dstansby/config-deprecation\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/compare/v0.9.2...v0.10.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ome-zarr-models` from 1.6 to 1.7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ome-zarr-models/ome-zarr-models-py/releases\"\u003eome-zarr-models's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eome-zarr-models 1.7\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRename remote data test files by \u003ca href=\"https://github.com/dstansby\"\u003e\u003ccode\u003e@​dstansby\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ome-zarr-models/ome-zarr-models-py/pull/414\"\u003eome-zarr-models/ome-zarr-models-py#414\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAllow the colors field to be absent by \u003ca href=\"https://github.com/rzlim08\"\u003e\u003ccode\u003e@​rzlim08\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ome-zarr-models/ome-zarr-models-py/pull/416\"\u003eome-zarr-models/ome-zarr-models-py#416\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eChangelog for 1.7 by \u003ca href=\"https://github.com/dstansby\"\u003e\u003ccode\u003e@​dstansby\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ome-zarr-models/ome-zarr-models-py/pull/418\"\u003eome-zarr-models/ome-zarr-models-py#418\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/rzlim08\"\u003e\u003ccode\u003e@​rzlim08\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ome-zarr-models/ome-zarr-models-py/pull/416\"\u003eome-zarr-models/ome-zarr-models-py#416\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ome-zarr-models/ome-zarr-models-py/compare/v1.6...v1.7\"\u003ehttps://github.com/ome-zarr-models/ome-zarr-models-py/compare/v1.6...v1.7\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ome-zarr-models/ome-zarr-models-py/blob/main/docs/changelog.md\"\u003eome-zarr-models's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRequire \u003ccode\u003epydantic\u003c/code\u003e \u0026lt; 2.13, due to new issues in model construction that are not yet resolved.\u003c/li\u003e\n\u003cli\u003eCorrectly allow \u003ccode\u003ecolors\u003c/code\u003e metadata to be not set or \u003ccode\u003enull\u003c/code\u003e inside image-label metadata.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ome-zarr-models/ome-zarr-models-py/commit/b1fd516230e1f9bdd38206f9b3278f5e93b0a81d\"\u003e\u003ccode\u003eb1fd516\u003c/code\u003e\u003c/a\u003e Changelog for 1.7 (\u003ca href=\"https://redirect.github.com/ome-zarr-models/ome-zarr-models-py/issues/418\"\u003e#418\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ome-zarr-models/ome-zarr-models-py/commit/bf2811161751f0553af51c689010e2c7735edc1c\"\u003e\u003ccode\u003ebf28111\u003c/code\u003e\u003c/a\u003e Allow the colors field to be absent (\u003ca href=\"https://redirect.github.com/ome-zarr-models/ome-zarr-models-py/issues/416\"\u003e#416\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ome-zarr-models/ome-zarr-models-py/commit/17052799d779fab1ff5a8dfe7275d0164832c43b\"\u003e\u003ccode\u003e1705279\u003c/code\u003e\u003c/a\u003e Rename remote data test files (\u003ca href=\"https://redirect.github.com/ome-zarr-models/ome-zarr-models-py/issues/414\"\u003e#414\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/ome-zarr-models/ome-zarr-models-py/compare/v1.6...v1.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `scipy` from 1.17.1 to 1.18.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/scipy/scipy/releases\"\u003escipy's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eSciPy 1.18.0 Release Notes\u003c/h1\u003e\n\u003cp\u003eSciPy \u003ccode\u003e1.18.0\u003c/code\u003e is the culmination of \u003ccode\u003e6\u003c/code\u003e months of hard ...\n\n_Description has been truncated_","html_url":"https://github.com/ome-zarr-models/ome-zarr-book/pull/59","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/ome-zarr-models%2Fome-zarr-book/issues/59","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/59/packages"},{"uuid":"5033697250","node_id":"PR_kwDOSvU-qc75N7m8","number":17,"state":"closed","title":"Bump the pip group across 7 directories with 7 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-07-31T22:01:18.000Z","author_association":null,"state_reason":null,"created_at":"2026-07-31T21:59:47.000Z","updated_at":"2026-07-31T22:01:20.000Z","time_to_close":91,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","group_name":"pip","update_count":7,"packages":[{"name":"gitpython","old_version":"3.1.44","new_version":"3.1.54","repository_url":"https://github.com/gitpython-developers/GitPython"},{"name":"pillow","old_version":"11.1.0","new_version":"12.3.0","repository_url":"https://github.com/python-pillow/Pillow"},{"name":"pyasn1","old_version":"0.6.1","new_version":"0.6.4","repository_url":"https://github.com/pyasn1/pyasn1"},{"name":"python-dotenv","old_version":"1.0.1","new_version":"1.2.2","repository_url":"https://github.com/theskumar/python-dotenv"},{"name":"setuptools","old_version":"75.8.0","new_version":"83.0.0","repository_url":"https://github.com/pypa/setuptools"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps the pip group with 6 updates in the /consultant-agent/awesome-llm-apps/advanced_ai_agents/autonomous_game_playing_agent_apps/ai_tic_tac_toe_agent directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.44` | `3.1.54` |\n| [pillow](https://github.com/python-pillow/Pillow) | `11.1.0` | `12.3.0` |\n| [pyasn1](https://github.com/pyasn1/pyasn1) | `0.6.1` | `0.6.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.0.1` | `1.2.2` |\n| [setuptools](https://github.com/pypa/setuptools) | `75.8.0` | `83.0.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.4.2` | `6.5.7` |\n\nBumps the pip group with 1 update in the /consultant-agent/awesome-llm-apps/advanced_ai_agents/multi_agent_apps/agent_teams/multimodal_design_agent_team directory: [pillow](https://github.com/python-pillow/Pillow).\nBumps the pip group with 5 updates in the /consultant-agent/awesome-llm-apps/advanced_ai_agents/multi_agent_apps/ai_news_and_podcast_agents/beifong directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.44` | `3.1.54` |\n| [pillow](https://github.com/python-pillow/Pillow) | `11.2.1` | `12.3.0` |\n| [pyasn1](https://github.com/pyasn1/pyasn1) | `0.6.1` | `0.6.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.0` | `1.2.2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.1` | `3.10.0` |\n\nBumps the pip group with 1 update in the /consultant-agent/awesome-llm-apps/starter_ai_agents/ai_breakup_recovery_agent directory: [pillow](https://github.com/python-pillow/Pillow).\nBumps the pip group with 1 update in the /consultant-agent/awesome-llm-apps/starter_ai_agents/ai_data_visualisation_agent directory: [pillow](https://github.com/python-pillow/Pillow).\nBumps the pip group with 1 update in the /consultant-agent/awesome-llm-apps/starter_ai_agents/ai_medical_imaging_agent directory: [pillow](https://github.com/python-pillow/Pillow).\nBumps the pip group with 1 update in the /da-blog-notebooklm/scripts directory: [python-dotenv](https://github.com/theskumar/python-dotenv).\n\nUpdates `gitpython` from 3.1.44 to 3.1.54\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/gitpython-developers/GitPython/releases\"\u003egitpython's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.1.54 - Security\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eHarden unsafe Git option validation by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2180\"\u003egitpython-developers/GitPython#2180\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54\"\u003ehttps://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e3.1.53 - Security\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat(submodule): add deinit method to Submodule (\u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2014\"\u003e#2014\u003c/a\u003e) by \u003ca href=\"https://github.com/mvanhorn\"\u003e\u003ccode\u003e@​mvanhorn\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2129\"\u003egitpython-developers/GitPython#2129\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etyping: introduce sensible basedpyright defaults by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2174\"\u003egitpython-developers/GitPython#2174\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: make \u003ccode\u003esubmodule.update()\u003c/code\u003e after \u003ccode\u003esubmodule.deinit()\u003c/code\u003e work by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2175\"\u003egitpython-developers/GitPython#2175\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix commit hooks respecting core.hooksPath by \u003ca href=\"https://github.com/Siesta0217\"\u003e\u003ccode\u003e@​Siesta0217\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2159\"\u003egitpython-developers/GitPython#2159\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: validate config section delimiters by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2176\"\u003egitpython-developers/GitPython#2176\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Siesta0217\"\u003e\u003ccode\u003e@​Siesta0217\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2159\"\u003egitpython-developers/GitPython#2159\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.52...3.1.53\"\u003ehttps://github.com/gitpython-developers/GitPython/compare/3.1.52...3.1.53\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e3.1.52 Security\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573\"\u003ehttps://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573\u003c/a\u003e: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSkip cross-drive relative config test on Windows by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2171\"\u003egitpython-developers/GitPython#2171\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: preserve literal clone URLs by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2172\"\u003egitpython-developers/GitPython#2172\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.51...3.1.52\"\u003ehttps://github.com/gitpython-developers/GitPython/compare/3.1.51...3.1.52\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e3.1.51 - Security\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd AI-disclosure and quality requirements to the contribution guidelines by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2143\"\u003egitpython-developers/GitPython#2143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs(cmd): clarify Git.execute() string vs list command argument by \u003ca href=\"https://github.com/mvanhorn\"\u003e\u003ccode\u003e@​mvanhorn\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2144\"\u003egitpython-developers/GitPython#2144\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRewrite Git.execute() command parameter docstring per \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2146\"\u003e#2146\u003c/a\u003e by \u003ca href=\"https://github.com/EliahKagan\"\u003e\u003ccode\u003e@​EliahKagan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2147\"\u003egitpython-developers/GitPython#2147\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument init script behavior with multiple master remotes by \u003ca href=\"https://github.com/EliahKagan\"\u003e\u003ccode\u003e@​EliahKagan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2148\"\u003egitpython-developers/GitPython#2148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump git/ext/gitdb from \u003ccode\u003e335c0f6\u003c/code\u003e to \u003ccode\u003e0a019a2\u003c/code\u003e by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2149\"\u003egitpython-developers/GitPython#2149\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport relative worktree paths (git 2.48+ worktree.useRelativePaths) by \u003ca href=\"https://github.com/elovelan\"\u003e\u003ccode\u003e@​elovelan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2151\"\u003egitpython-developers/GitPython#2151\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDefer xfail condition evaluation with xfail_if_raises context manager by \u003ca href=\"https://github.com/elovelan\"\u003e\u003ccode\u003e@​elovelan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2153\"\u003egitpython-developers/GitPython#2153\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun more submodule tests on Cygwin (fix flaky xfails) by \u003ca href=\"https://github.com/EliahKagan\"\u003e\u003ccode\u003e@​EliahKagan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2154\"\u003egitpython-developers/GitPython#2154\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCut xtrace noise from POSIX-ownership diagnostic steps by \u003ca href=\"https://github.com/EliahKagan\"\u003e\u003ccode\u003e@​EliahKagan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2156\"\u003egitpython-developers/GitPython#2156\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport index diffs against the empty tree by \u003ca href=\"https://github.com/puneetdixit200\"\u003e\u003ccode\u003e@​puneetdixit200\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2155\"\u003egitpython-developers/GitPython#2155\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor: seperate out Progress type by \u003ca href=\"https://github.com/LoeschMaximilian\"\u003e\u003ccode\u003e@​LoeschMaximilian\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2157\"\u003egitpython-developers/GitPython#2157\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ca href=\"https://github.com/astral-sh/ruff-pre-commit\"\u003ehttps://github.com/astral-sh/ruff-pre-commit\u003c/a\u003e from v0.15.12 to 0.15.15 in the pre-commit group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2160\"\u003egitpython-developers/GitPython#2160\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 6 to 7 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2164\"\u003egitpython-developers/GitPython#2164\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump git/ext/gitdb from \u003ccode\u003e0a019a2\u003c/code\u003e to \u003ccode\u003e4950ea9\u003c/code\u003e by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2165\"\u003egitpython-developers/GitPython#2165\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ca href=\"https://github.com/astral-sh/ruff-pre-commit\"\u003ehttps://github.com/astral-sh/ruff-pre-commit\u003c/a\u003e from v0.15.15 to 0.15.20 in the pre-commit group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2166\"\u003egitpython-developers/GitPython#2166\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Commit.is_shallow property; document stats() limitation at shallow boundary by \u003ca href=\"https://github.com/harshitayadavv\"\u003e\u003ccode\u003e@​harshitayadavv\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2167\"\u003egitpython-developers/GitPython#2167\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAllow relative config paths with includes by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2169\"\u003egitpython-developers/GitPython#2169\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReject abbreviated forms of unsafe git options by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2168\"\u003egitpython-developers/GitPython#2168\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/e59d9bab02b095a97e179f47019afee95f4e3c18\"\u003e\u003ccode\u003ee59d9ba\u003c/code\u003e\u003c/a\u003e prepare next release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/a4dc70d4eec15825aac2dfd7484c961f6fc8491b\"\u003e\u003ccode\u003ea4dc70d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2180\"\u003e#2180\u003c/a\u003e from gitpython-developers/single-char-kwarg\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6\"\u003e\u003ccode\u003e1d51b89\u003c/code\u003e\u003c/a\u003e fix: guard diff output options\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97\"\u003e\u003ccode\u003effcb535\u003c/code\u003e\u003c/a\u003e fix: reject unsafe clone templates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453\"\u003e\u003ccode\u003ee8d0fbf\u003c/code\u003e\u003c/a\u003e fix: validate split short-option values\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/faf3c09038b03bc2bdd8545ef34bbf6d7f1cd11f\"\u003e\u003ccode\u003efaf3c09\u003c/code\u003e\u003c/a\u003e prepare for security fix\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/6a5eb6a53407cfd7964447fa417d73a7ab32e700\"\u003e\u003ccode\u003e6a5eb6a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2176\"\u003e#2176\u003c/a\u003e from gitpython-developers/fix-config-injection\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1\"\u003e\u003ccode\u003e1ed1b92\u003c/code\u003e\u003c/a\u003e fix: validate config section delimiters\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/354eb2fc505042d2f4cd913783b689bce6c49fd3\"\u003e\u003ccode\u003e354eb2f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2159\"\u003e#2159\u003c/a\u003e from Siesta0217/fix-core-hooks-path-commit-hooks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/9bc287a2b1eb331b6051d2ba704a603c3e0ddc6f\"\u003e\u003ccode\u003e9bc287a\u003c/code\u003e\u003c/a\u003e Address review feedback about hook resolution\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.44...3.1.54\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pillow` from 11.1.0 to 12.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/python-pillow/Pillow/releases\"\u003epillow's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e12.3.0\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html\"\u003ehttps://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eRemovals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemove non-image ImageCms modes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9697\"\u003e#9697\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDocumentation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd release notes for SBOM and performance improvements \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9747\"\u003e#9747\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd security release notes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9741\"\u003e#9741\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd release notes for Python 3.15 beta wheels \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9696\"\u003e#9696\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eImageFont can also be used with ImageText \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9597\"\u003e#9597\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdditional guidelines for security reports \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9659\"\u003e#9659\u003c/a\u003e [\u003ca href=\"https://github.com/wiredfool\"\u003e\u003ccode\u003e@​wiredfool\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eFixed typo \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9636\"\u003e#9636\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdded CVEs to 12.2.0 release notes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9591\"\u003e#9591\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eRevise development support information in README \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9583\"\u003e#9583\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd INCIDENT_RESPONSE.md \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9555\"\u003e#9555\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd STRIDE threat model to security docs \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9562\"\u003e#9562\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd CVEs to 12.2.0 release notes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9556\"\u003e#9556\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate README with revised security policy \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9553\"\u003e#9553\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate security policy \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9552\"\u003e#9552\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate macOS tested Python versions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9534\"\u003e#9534\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependencies\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate dependency harfbuzz to v14.2.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9720\"\u003e#9720\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency mypy to v2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9653\"\u003e#9653\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency cibuildwheel to v4 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9665\"\u003e#9665\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate github-actions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9655\"\u003e#9655\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency libavif to v1.4.2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9652\"\u003e#9652\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency lcms2 to v2.19.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9651\"\u003e#9651\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency check-jsonschema to v0.37.2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9650\"\u003e#9650\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate google/oss-fuzz digest to d872252 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9614\"\u003e#9614\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency lcms2 to v2.19 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9609\"\u003e#9609\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency libpng to v1.6.58 - autoclosed \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9608\"\u003e#9608\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency harfbuzz to v14 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9610\"\u003e#9610\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency mypy to v1.20.2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9599\"\u003e#9599\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate github-actions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9611\"\u003e#9611\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency cibuildwheel to v3.4.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9607\"\u003e#9607\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eMove dependency versions to single JSON and enable Renovate \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9559\"\u003e#9559\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdated raqm to 0.10.5 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9557\"\u003e#9557\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency cibuildwheel to v3.4.0 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9532\"\u003e#9532\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eTesting\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemove matrix.os from benchmark \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9735\"\u003e#9735\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eRemove references to libavif patch \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9734\"\u003e#9734\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd benchmark tests \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9654\"\u003e#9654\u003c/a\u003e [\u003ca href=\"https://github.com/akx\"\u003e\u003ccode\u003e@​akx\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUse reshape() instead of setting NumPy array shape directly \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9728\"\u003e#9728\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst\"\u003epillow's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog (Pillow)\u003c/h1\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d\"\u003e\u003ccode\u003ebb1d8e8\u003c/code\u003e\u003c/a\u003e 12.3.0 version bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af\"\u003e\u003ccode\u003ee63fc48\u003c/code\u003e\u003c/a\u003e Add release notes for SBOM and performance improvements (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9747\"\u003e#9747\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054\"\u003e\u003ccode\u003e13b701b\u003c/code\u003e\u003c/a\u003e Add release notes for \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9679\"\u003e#9679\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364\"\u003e\u003ccode\u003e5564ca7\u003c/code\u003e\u003c/a\u003e List methods\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b\"\u003e\u003ccode\u003ea0920fd\u003c/code\u003e\u003c/a\u003e Speed up ImageChops operations (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9738\"\u003e#9738\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc\"\u003e\u003ccode\u003e07e9a6c\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.filter()\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9736\"\u003e#9736\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50\"\u003e\u003ccode\u003ea94578c\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.getchannel()\u003c/code\u003e, \u003ccode\u003eImage.merge()\u003c/code\u003e, \u003ccode\u003eImage.putalpha()\u003c/code\u003e and `Image...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb\"\u003e\u003ccode\u003e53e02c4\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.fill()\u003c/code\u003e, \u003ccode\u003eImage.linear_gradient()\u003c/code\u003e and `Image.radial_gradient...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6\"\u003e\u003ccode\u003eaf03747\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.resample()\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9739\"\u003e#9739\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571\"\u003e\u003ccode\u003e5c9ca56\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003ealpha_composite\u003c/code\u003e, \u003ccode\u003ematrix\u003c/code\u003e, \u003ccode\u003enegative\u003c/code\u003e, \u003ccode\u003equantize\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9740\"\u003e#9740\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/python-pillow/Pillow/compare/11.1.0...12.3.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pyasn1` from 0.6.1 to 0.6.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyasn1/pyasn1/releases\"\u003epyasn1's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eRelease 0.6.4\u003c/h2\u003e\n\u003cp\u003eThis is a security release.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.\u003c/li\u003e\n\u003cli\u003eCVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.\u003c/li\u003e\n\u003cli\u003eCVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in \u003ccode\u003eReal.__float__()\u003c/code\u003e for values with large base-10 exponents.\u003c/li\u003e\n\u003cli\u003ePinned PyPI publish GitHub Action to an immutable commit.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eAll changes are noted in the \u003ca href=\"https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst\"\u003eCHANGELOG\u003c/a\u003e.\u003c/p\u003e\n\u003ch2\u003eRelease 0.6.3\u003c/h2\u003e\n\u003cp\u003eIt's a minor release.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded nesting depth limit to ASN.1 decoder to prevent stack overflow from deeply nested structures (CVE-2026-30922).\u003c/li\u003e\n\u003cli\u003eFixed OverflowError from oversized BER length field.\u003c/li\u003e\n\u003cli\u003eFixed DeprecationWarning stacklevel for deprecated attributes.\u003c/li\u003e\n\u003cli\u003eFixed asDateTime incorrect fractional seconds parsing.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eAll changes are noted in the \u003ca href=\"https://github.com/pyasn1/pyasn1/blob/master/CHANGES.rst\"\u003eCHANGELOG\u003c/a\u003e.\u003c/p\u003e\n\u003ch2\u003eRelease 0.6.2\u003c/h2\u003e\n\u003cp\u003eIt's a minor release.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed continuation octet limits in OID/RELATIVE-OID decoder (CVE-2026-23490).\u003c/li\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdded SECURITY.md policy.\u003c/li\u003e\n\u003cli\u003eMigrated to pyproject.toml packaging.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eAll changes are noted in the \u003ca href=\"https://github.com/pyasn1/pyasn1/blob/master/CHANGES.rst\"\u003eCHANGELOG\u003c/a\u003e.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst\"\u003epyasn1's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eRevision 0.6.4, released 08-07-2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time\ncomplexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders.\nA small crafted substrate encoding many arcs could consume\nexcessive CPU. Arcs are now accumulated in linear time; decoded\nvalues are unchanged (thanks for reporting, tynus2)\u003c/li\u003e\n\u003cli\u003eCVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag\nIDs to 20 octets (140 bits), matching the OID arc limit introduced\nin 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume\nexcessive CPU and memory; longer tag IDs are now rejected with\nPyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag\n(thanks for reporting, mikeappsec)\nIDs due to the integer-to-string conversion limit (Python 3.11+)\u003c/li\u003e\n\u003cli\u003eCVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and\nCPU consumption in Real.\u003cstrong\u003efloat\u003c/strong\u003e() for values with large base-10\nexponents. Conversion no longer materializes huge intermediate\nintegers; values too large to represent as a Python float raise\nOverflowError promptly, and prettyPrint() renders them as\n'\u003c!-- raw HTML omitted --\u003e' as before. Also fixed base-10 mantissa normalization\nto use exact integer arithmetic; mantissas larger than 2**53\ncould previously lose precision through float division\n(thanks for reporting, gvozdila)\u003c/li\u003e\n\u003cli\u003ePinned PyPI publish GitHub Action to an immutable commit\n[pr \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/113\"\u003e#113\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/pull/113\"\u003epyasn1/pyasn1#113\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eRevision 0.6.3, released 16-03-2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-30922 (GHSA-jr27-m4p2-rc6r): Added nesting depth\nlimit to ASN.1 decoder to prevent stack overflow from deeply\nnested structures (thanks for reporting, romanticpragmatism)\u003c/li\u003e\n\u003cli\u003eFixed OverflowError from oversized BER length field\n[issue \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/54\"\u003e#54\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/54\"\u003epyasn1/pyasn1#54\u003c/a\u003e)\n[pr \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/100\"\u003e#100\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/pull/100\"\u003epyasn1/pyasn1#100\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed DeprecationWarning stacklevel for deprecated attributes\n[issue \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/86\"\u003e#86\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/86\"\u003epyasn1/pyasn1#86\u003c/a\u003e)\n[pr \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/101\"\u003e#101\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/pull/101\"\u003epyasn1/pyasn1#101\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed asDateTime incorrect fractional seconds parsing\n[issue \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/81\"\u003e#81\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/81\"\u003epyasn1/pyasn1#81\u003c/a\u003e)\n[pr \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/102\"\u003e#102\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/pull/102\"\u003epyasn1/pyasn1#102\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eRevision 0.6.2, released 16-01-2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-23490 (GHSA-63vm-454h-vhhq): Fixed continuation octet limits\nin OID/RELATIVE-OID decoder (thanks to tsigouris007)\u003c/li\u003e\n\u003cli\u003eAdded support for Python 3.14\n[pr \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/97\"\u003e#97\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/pull/97\"\u003epyasn1/pyasn1#97\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/72e4803405816c371ed3b2cb4be181c47f038406\"\u003e\u003ccode\u003e72e4803\u003c/code\u003e\u003c/a\u003e Prepare release 0.6.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/0c19eeb853731db1c717ff125ea001a1e558332d\"\u003e\u003ccode\u003e0c19eeb\u003c/code\u003e\u003c/a\u003e Pin PyPI publish action to immutable commit (\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/113\"\u003e#113\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9\"\u003e\u003ccode\u003e45bdb19\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5\"\u003e\u003ccode\u003e628e36e\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886\"\u003e\u003ccode\u003ee60c691\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/af65c3b92e9deeae50db4de390982dd970d87f98\"\u003e\u003ccode\u003eaf65c3b\u003c/code\u003e\u003c/a\u003e Prepare release 0.6.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/5a49bd1fe93b5b866a1210f6bf0a3924f21572c8\"\u003e\u003ccode\u003e5a49bd1\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/5494ba43f738e700ca9f7c7a69ec5c44908c9a9f\"\u003e\u003ccode\u003e5494ba4\u003c/code\u003e\u003c/a\u003e Fix asDateTime incorrect fractional seconds parsing (\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/102\"\u003e#102\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/71f486e6c32d0f270868aa1b2bb5ceb7d5fd5476\"\u003e\u003ccode\u003e71f486e\u003c/code\u003e\u003c/a\u003e Fix DeprecationWarning stacklevel for deprecated attributes (\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/101\"\u003e#101\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/d7cb42dcaa9a66e18f14c4609c2ed00c5b65f7e8\"\u003e\u003ccode\u003ed7cb42d\u003c/code\u003e\u003c/a\u003e Fix OverflowError from oversized BER length field (\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/100\"\u003e#100\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pyasn1/pyasn1/compare/v0.6.1...v0.6.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `python-dotenv` from 1.0.1 to 1.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/theskumar/python-dotenv/releases\"\u003epython-dotenv's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.2.2\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for Python 3.14, including the free-threaded (3.14t) build. (#)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003edotenv run\u003c/code\u003e command now forwards flags directly to the specified command by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/607\"\u003etheskumar/python-dotenv#607\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved documentation clarity regarding override behavior and the reference page.\u003c/li\u003e\n\u003cli\u003eUpdated PyPy support to version 3.11.\u003c/li\u003e\n\u003cli\u003eDocumentation for FIFO file support.\u003c/li\u003e\n\u003cli\u003eSupport for Python 3.9.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved \u003ccode\u003eset_key\u003c/code\u003e and \u003ccode\u003eunset_key\u003c/code\u003e behavior when interacting with symlinks by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311\"\u003e#790c5\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCorrected the license specifier and added missing Python 3.14 classifiers in package metadata by \u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/590\"\u003etheskumar/python-dotenv#590\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e and \u003ccode\u003edotenv.unset_key\u003c/code\u003e used to follow symlinks in some\nsituations. This is no longer the case. For that behavior to be restored in\nall cases, \u003ccode\u003efollow_symlinks=True\u003c/code\u003e should be used.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the CLI, \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e used to follow symlinks in some situations. This\nis no longer the case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e, \u003ccode\u003edotenv.unset_key\u003c/code\u003e and the CLI commands \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e\nused to reset the file mode of the modified .env file to \u003ccode\u003e0o600\u003c/code\u003e in some\nsituations. This is no longer the case: The original mode of the file is now\npreserved. Is the file needed to be created or wasn't a regular file, mode\n\u003ccode\u003e0o600\u003c/code\u003e is used.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eskip 000 permission tests for root user by \u003ca href=\"https://github.com/burnout-projects\"\u003e\u003ccode\u003e@​burnout-projects\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/561\"\u003etheskumar/python-dotenv#561\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 5 to 6 in the github-actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/593\"\u003etheskumar/python-dotenv#593\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Windows testing to CI by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/604\"\u003etheskumar/python-dotenv#604\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove workflow efficiency with best practices by \u003ca href=\"https://github.com/theskumar\"\u003e\u003ccode\u003e@​theskumar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/609\"\u003etheskumar/python-dotenv#609\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove the use of \u003ccode\u003esh\u003c/code\u003e in tests by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/612\"\u003etheskumar/python-dotenv#612\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/590\"\u003etheskumar/python-dotenv#590\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/burnout-projects\"\u003e\u003ccode\u003e@​burnout-projects\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/561\"\u003etheskumar/python-dotenv#561\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/cpackham-atlnz\"\u003e\u003ccode\u003e@​cpackham-atlnz\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/597\"\u003etheskumar/python-dotenv#597\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2\"\u003ehttps://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.2.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md\"\u003epython-dotenv's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e[1.2.2] - 2026-03-01\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for Python 3.14, including the free-threaded (3.14t) build. (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/588\"\u003e#588\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003edotenv run\u003c/code\u003e command now forwards flags directly to the specified command by [\u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/607\"\u003e#607\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved documentation clarity regarding override behavior and the reference page.\u003c/li\u003e\n\u003cli\u003eUpdated PyPy support to version 3.11.\u003c/li\u003e\n\u003cli\u003eDocumentation for FIFO file support.\u003c/li\u003e\n\u003cli\u003eDropped Support for Python 3.9.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved \u003ccode\u003eset_key\u003c/code\u003e and \u003ccode\u003eunset_key\u003c/code\u003e behavior when interacting with symlinks by [\u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e] in [790c5c0]\u003c/li\u003e\n\u003cli\u003eCorrected the license specifier and added missing Python 3.14 classifiers in package metadata by [\u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/590\"\u003e#590\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e and \u003ccode\u003edotenv.unset_key\u003c/code\u003e used to follow symlinks in some\nsituations. This is no longer the case. For that behavior to be restored in\nall cases, \u003ccode\u003efollow_symlinks=True\u003c/code\u003e should be used.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the CLI, \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e used to follow symlinks in some situations. This\nis no longer the case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e, \u003ccode\u003edotenv.unset_key\u003c/code\u003e and the CLI commands \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e\nused to reset the file mode of the modified .env file to \u003ccode\u003e0o600\u003c/code\u003e in some\nsituations. This is no longer the case: The original mode of the file is now\npreserved. Is the file needed to be created or wasn't a regular file, mode\n\u003ccode\u003e0o600\u003c/code\u003e is used.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.2.1] - 2025-10-26\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMove more config to \u003ccode\u003epyproject.toml\u003c/code\u003e, removed \u003ccode\u003esetup.cfg\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for reading \u003ccode\u003e.env\u003c/code\u003e from FIFOs (Unix) by [\u003ca href=\"https://github.com/sidharth-sudhir\"\u003e\u003ccode\u003e@​sidharth-sudhir\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/586\"\u003e#586\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.2.0] - 2025-10-26\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade build system to use PEP 517 \u0026amp; PEP 518 to use \u003ccode\u003ebuild\u003c/code\u003e and \u003ccode\u003epyproject.toml\u003c/code\u003e by [\u003ca href=\"https://github.com/EpicWink\"\u003e\u003ccode\u003e@​EpicWink\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/583\"\u003e#583\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for Python 3.14 by [\u003ca href=\"https://github.com/23f3001135\"\u003e\u003ccode\u003e@​23f3001135\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/579\"\u003e#579\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for disabling of \u003ccode\u003eload_dotenv()\u003c/code\u003e using \u003ccode\u003ePYTHON_DOTENV_DISABLED\u003c/code\u003e env var. by [\u003ca href=\"https://github.com/matthewfranglen\"\u003e\u003ccode\u003e@​matthewfranglen\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/569\"\u003e#569\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.1.1] - 2025-06-24\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eCLI: Ensure \u003ccode\u003efind_dotenv\u003c/code\u003e work reliably on python 3.13 by [\u003ca href=\"https://github.com/theskumar\"\u003e\u003ccode\u003e@​theskumar\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/563\"\u003e#563\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/36004e0e34be7665ff2b11a8a4005144f76f176d\"\u003e\u003ccode\u003e36004e0\u003c/code\u003e\u003c/a\u003e Bump version: 1.2.1 → 1.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/eb202520e5933c9daf42501e1e42fdb0144002c8\"\u003e\u003ccode\u003eeb20252\u003c/code\u003e\u003c/a\u003e docs: update changelog for v1.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311\"\u003e\u003ccode\u003e790c5c0\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/43340da220fb4ca4f95357bbe21a3c7f8f1278b1\"\u003e\u003ccode\u003e43340da\u003c/code\u003e\u003c/a\u003e Remove the use of \u003ccode\u003esh\u003c/code\u003e in tests (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/612\"\u003e#612\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/09d7cee32459e7abdcb5c9d8122a552589c06a9c\"\u003e\u003ccode\u003e09d7cee\u003c/code\u003e\u003c/a\u003e docs: clarify override behavior and document FIFO support (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/610\"\u003e#610\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/c8de2887c00198c22842c5ae5e92d1747467363c\"\u003e\u003ccode\u003ec8de288\u003c/code\u003e\u003c/a\u003e ci: improve workflow efficiency with best practices (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/609\"\u003e#609\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/7bd9e3dbfedc0983ad7d56d5570013035242bdf4\"\u003e\u003ccode\u003e7bd9e3d\u003c/code\u003e\u003c/a\u003e Add Windows testing to CI (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/604\"\u003e#604\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/1baaf04f336072e0ee324d5df9563ec767f14f81\"\u003e\u003ccode\u003e1baaf04\u003c/code\u003e\u003c/a\u003e Drop Python 3.9 support and update to PyPy 3.11 (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/608\"\u003e#608\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/4a22cf8993804aeede0c20b75bb1a29d3a99e9dc\"\u003e\u003ccode\u003e4a22cf8\u003c/code\u003e\u003c/a\u003e ci: enable testing on Python 3.14t (free-threaded) (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/588\"\u003e#588\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/e2e8e776b42e382ae38b44d3982dd649e7507dd4\"\u003e\u003ccode\u003ee2e8e77\u003c/code\u003e\u003c/a\u003e Fix license specifier (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/597\"\u003e#597\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/theskumar/python-dotenv/compare/v1.0.1...v1.2.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `setuptools` from 75.8.0 to 83.0.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pypa/setuptools/blob/main/NEWS.rst\"\u003esetuptools's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ev83.0.0\u003c/h1\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRequire Python 3.10 or later.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eMANIFEST.in\u003c/code\u003e matching (via \u003ccode\u003eFileList\u003c/code\u003e) is now insensitive to Unicode\nnormalization form. A pattern authored in one form (e.g. NFC, as typically\nsaved by editors) now matches a file whose name is stored on disk in another\n(e.g. NFD, as produced by macOS APFS/HFS+). Previously an \u003ccode\u003eexclude\u003c/code\u003e,\n\u003ccode\u003eglobal-exclude\u003c/code\u003e, \u003ccode\u003erecursive-exclude\u003c/code\u003e, or \u003ccode\u003eprune\u003c/code\u003e rule could silently\nfail to drop a non-ASCII-named file from the source distribution, publishing\nit despite the exclusion -- see GHSA-h35f-9h28-mq5c.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003epypa/distutils#334\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003ev82.0.1\u003c/h1\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix the loading of \u003ccode\u003elauncher manifest.xml\u003c/code\u003e file. (\u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5047\"\u003e#5047\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eReplaced deprecated \u003ccode\u003ejson.__version__\u003c/code\u003e with fixture in tests. (\u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5186\"\u003e#5186\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eImproved Documentation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd advice about how to improve predictability when installing sdists. (\u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5168\"\u003e#5168\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eMisc\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/4941\"\u003e#4941\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5157\"\u003e#5157\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5169\"\u003e#5169\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5175\"\u003e#5175\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003ev82.0.0\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/6519f728c6f23c992df81a5691ef7655184a20eb\"\u003e\u003ccode\u003e6519f72\u003c/code\u003e\u003c/a\u003e Bump version: 82.0.1 → 83.0.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/d1151b125b29a6ee1c7db860f7ee6c365d525b5f\"\u003e\u003ccode\u003ed1151b1\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5250\"\u003e#5250\u003c/a\u003e from pypa/feature/distutils-d7633fbed\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/a2df31e6a741b0fe775969618fe6a3a3d032e900\"\u003e\u003ccode\u003ea2df31e\u003c/code\u003e\u003c/a\u003e Capture removal of dry_run parameter in changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/00144dc3fb6d023fd81cdc26c380a012b084df9b\"\u003e\u003ccode\u003e00144dc\u003c/code\u003e\u003c/a\u003e Moved newsfragment to the release where it occurred.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/a4a5a2b160357be77626aa077ddd1d8ee53be50f\"\u003e\u003ccode\u003ea4a5a2b\u003c/code\u003e\u003c/a\u003e Add news fragment.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/77470c23c35031c9e37d7512694ac5ca52bfcaac\"\u003e\u003ccode\u003e77470c2\u003c/code\u003e\u003c/a\u003e Merge \u003ca href=\"https://github.com/pypa/distutils\"\u003ehttps://github.com/pypa/distutils\u003c/a\u003e into feature/distutils-d7633fbed\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/3c43897420f25a1be1afe6eaa905d056009cc736\"\u003e\u003ccode\u003e3c43897\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5247\"\u003e#5247\u003c/a\u003e from pypa/copilot/fix-pypy-version-issue\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/bb6ea66b4bd01cb35d7c68a1bc61b96d59190269\"\u003e\u003ccode\u003ebb6ea66\u003c/code\u003e\u003c/a\u003e Bump PyPy from 3.10 to 3.11 in CI workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/a2bc3aca2f55eb9b93ea633e58ba68170ce14451\"\u003e\u003ccode\u003ea2bc3ac\u003c/code\u003e\u003c/a\u003e Fix broken intersphinx reference to build's installation docs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/2d6a739c64cfedc65e1f635af7b52340aac8d99b\"\u003e\u003ccode\u003e2d6a739\u003c/code\u003e\u003c/a\u003e Use stacked parametrize decorators instead of itertools.product\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pypa/setuptools/compare/v75.8.0...v83.0.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pillow` from 11.0.0 to 12.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/python-pillow/Pillow/releases\"\u003epillow's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e12.3.0\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html\"\u003ehttps://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eRemovals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemove non-image ImageCms modes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9697\"\u003e#9697\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDocumentation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd release notes for SBOM and performance improvements \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9747\"\u003e#9747\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd security release notes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9741\"\u003e#9741\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd release notes for Python 3.15 beta wheels \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9696\"\u003e#9696\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eImageFont can also be used with ImageText \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9597\"\u003e#9597\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdditional guidelines for security reports \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9659\"\u003e#9659\u003c/a\u003e [\u003ca href=\"https://github.com/wiredfool\"\u003e\u003ccode\u003e@​wiredfool\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eFixed typo \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9636\"\u003e#9636\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdded CVEs to 12.2.0 release notes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9591\"\u003e#9591\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eRevise development support information in README \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9583\"\u003e#9583\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd INCIDENT_RESPONSE.md \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9555\"\u003e#9555\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd STRIDE threat model to security docs \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9562\"\u003e#9562\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd CVEs to 12.2.0 release notes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9556\"\u003e#9556\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate README with revised security policy \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9553\"\u003e#9553\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate security policy \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9552\"\u003e#9552\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate macOS tested Python versions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9534\"\u003e#9534\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependencies\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate dependency harfbuzz to v14.2.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9720\"\u003e#9720\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency mypy to v2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9653\"\u003e#9653\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency cibuildwheel to v4 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9665\"\u003e#9665\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate github-actions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9655\"\u003e#9655\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency libavif to v1.4.2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9652\"\u003e#9652\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency lcms2 to v2.19.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9651\"\u003e#9651\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency check-jsonschema to v0.37.2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9650\"\u003e#9650\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate google/oss-fuzz digest to d872252 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9614\"\u003e#9614\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency lcms2 to v2.19 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9609\"\u003e#9609\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency libpng to v1.6.58 - autoclosed \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9608\"\u003e#9608\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency harfbuzz to v14 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9610\"\u003e#9610\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency mypy to v1.20.2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9599\"\u003e#9599\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate github-actions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9611\"\u003e#9611\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency cibuildwheel to v3.4.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9607\"\u003e#9607\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eMove dependency versions to single JSON and enable Renovate \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9559\"\u003e#9559\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdated raqm to 0.10.5 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9557\"\u003e#9557\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency cibuildwheel to v3.4.0 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9532\"\u003e#9532\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eTesting\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemove matrix.os from benchmark \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9735\"\u003e#9735\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eRemove references to libavif patch \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9734\"\u003e#9734\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd benchmark tests \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9654\"\u003e#9654\u003c/a\u003e [\u003ca href=\"https://github.com/akx\"\u003e\u003ccode\u003e@​akx\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUse reshape() instead of setting NumPy array shape directly \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9728\"\u003e#9728\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst\"\u003epillow's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog (Pillow)\u003c/h1\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d\"\u003e\u003ccode\u003ebb1d8e8\u003c/code\u003e\u003c/a\u003e 12.3.0 version bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af\"\u003e\u003ccode\u003ee63fc48\u003c/code\u003e\u003c/a\u003e Add release notes for SBOM and performance improvements (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9747\"\u003e#9747\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054\"\u003e\u003ccode\u003e13b701b\u003c/code\u003e\u003c/a\u003e Add release notes for \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9679\"\u003e#9679\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364\"\u003e\u003ccode\u003e5564ca7\u003c/code\u003e\u003c/a\u003e List methods\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b\"\u003e\u003ccode\u003ea0920fd\u003c/code\u003e\u003c/a\u003e Speed up ImageChops operations (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9738\"\u003e#9738\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc\"\u003e\u003ccode\u003e07e9a6c\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.filter()\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9736\"\u003e#9736\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50\"\u003e\u003ccode\u003ea94578c\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.getchannel()\u003c/code\u003e, \u003ccode\u003eImage.merge()\u003c/code\u003e, \u003ccode\u003eImage.putalpha()\u003c/code\u003e and `Image...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb\"\u003e\u003ccode\u003e53e02c4\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.fill()\u003c/code\u003e, \u003ccode\u003eImage.linear_gradient()\u003c/code\u003e and `Image.radial_gradient...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6\"\u003e\u003ccode\u003eaf03747\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.resample()\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9739\"\u003e#9739\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571\"\u003e\u003ccode\u003e5c9ca56\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003ealpha_composite\u003c/code\u003e, \u003ccode\u003ematrix\u003c/code\u003e, \u003ccode\u003enegative\u003c/code\u003e, \u003ccode\u003equantize\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9740\"\u003e#9740\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/python-pillow/Pillow/compare/11.1.0...12.3.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `gitpython` from 3.1.44 to 3.1.54\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/gitpython-developers/GitPython/releases\"\u003egitpython's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.1.54 - Security\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eHarden unsafe Git option validation by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2180\"\u003egitpython-developers/GitPython#2180\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54\"\u003ehttps://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e3.1.53 - Security\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat(submodule): add deinit method to Submodule (\u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2014\"\u003e#2014\u003c/a\u003e) by \u003ca href=\"https://github.com/mvanhorn\"\u003e\u003ccode\u003e@​mvanhorn\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2129\"\u003egitpython-developers/GitPython#2129\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etyping: introduce sensible basedpyright defaults by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2174\"\u003egitpython-developers/GitPython#2174\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: make \u003ccode\u003esubmodule.update()\u003c/code\u003e after \u003ccode\u003esubmodule.deinit()\u003c/code\u003e work by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2175\"\u003egitpython-developers/GitPython#2175\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix commit hooks respecting core.hooksPath by \u003ca href=\"https://github.com/Siesta0217\"\u003e\u003ccode\u003e@​Siesta0217\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2159\"\u003egitpython-developers/GitPython#2159\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: validate config section delimiters by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2176\"\u003egitpython-developers/GitPython#2176\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Siesta0217\"\u003e\u003ccode\u003e@​Siesta0217\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2159\"\u003egitpython-developers/GitPython#2159\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.52...3.1.53\"\u003ehttps://github.com/gitpython-developers/GitPython/compare/3.1.52...3.1.53\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e3.1.52 Security\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573\"\u003ehttps://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573\u003c/a\u003e: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSkip cross-drive relative config test on Windows by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2171\"\u003egitpython-developers/GitPython#2171\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: preserve literal clone URLs by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2172\"\u003egitpython-developers/GitPython#2172\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.51...3.1.52\"\u003ehttps://github.com/gitpython-developers/GitPython/compare/3.1.51...3.1.52\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e3.1.51 - Security\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd AI-disclosure and quality requirements to the contribution guidelines by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2143\"\u003egitpython-developers/GitPython#2143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs(cmd): clarify Git.execute() string vs list command argument by \u003ca href=\"https://github.com/mvanhorn\"\u003e\u003ccode\u003e@​mvanhorn\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2144\"\u003egitpython-developers/GitPython#2144\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRewrite Git.execute() command parameter docstring per \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2146\"\u003e#2146\u003c/a\u003e by \u003ca href=\"https://github.com/EliahKagan\"\u003e\u003ccode\u003e@​EliahKagan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2147\"\u003egitpython-developers/GitPython#2147\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument init script behavior with multiple master remotes by \u003ca href=\"https://github.com/EliahKagan\"\u003e\u003ccode\u003e@​EliahKagan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2148\"\u003egitpython-developers/GitPython#2148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump git/ext/gitdb from \u003ccode\u003e335c0f6\u003c/code\u003e to \u003ccode\u003e0a019a2\u003c/code\u003e by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2149\"\u003egitpython-developers/GitPython#2149\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport relative worktree paths (git 2.48+ worktree.useRelativePaths) by \u003ca href=\"https://github.com/elovelan\"\u003e\u003ccode\u003e@​elovelan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2151\"\u003egitpython-developers/GitPython#2151\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDefer xfail condition evaluation with xfail_if_raises context manager by \u003ca href=\"https://github.com/elovelan\"\u003e\u003ccode\u003e@​elovelan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2153\"\u003egitpython-developers/GitPython#2153\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun more submodule tests on Cygwin (fix flaky xfails) by \u003ca href=\"https://github.com/EliahKagan\"\u003e\u003ccode\u003e@​EliahKagan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-devel...\n\n_Description has been truncated_","html_url":"https://github.com/totnormal/skills-3/pull/17","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/totnormal%2Fskills-3/issues/17","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/17/packages"},{"uuid":"4771607092","node_id":"PR_kwDOSG89IM7r9UYq","number":32,"state":"closed","title":"Build(deps): Bump the pip group across 1 directory with 6 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-30T03:21:48.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-29T21:08:59.000Z","updated_at":"2026-06-30T03:21:56.000Z","time_to_close":22369,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Build(deps): Bump","group_name":"pip","update_count":6,"packages":[{"name":"cryptography","old_version":"43.0.0","new_version":"48.0.1","repository_url":"https://github.com/pyca/cryptography"},{"name":"protobuf","old_version":"4.21.12","new_version":"5.29.6","repository_url":"https://github.com/protocolbuffers/protobuf"},{"name":"requests","old_version":"2.32.3","new_version":"2.33.0","repository_url":"https://github.com/psf/requests"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"urllib3","old_version":"2.3.0","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"},{"name":"wheel","old_version":"0.46.1","new_version":"0.46.2","repository_url":"https://github.com/pypa/wheel"}],"path":null,"ecosystem":"pip"},"body":"Bumps the pip group with 6 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [cryptography](https://github.com/pyca/cryptography) | `43.0.0` | `48.0.1` |\n| [protobuf](https://github.com/protocolbuffers/protobuf) | `4.21.12` | `5.29.6` |\n| [requests](https://github.com/psf/requests) | `2.32.3` | `2.33.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.4.2` | `6.5.7` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n| [wheel](https://github.com/pypa/wheel) | `0.46.1` | `0.46.2` |\n\n\nUpdates `cryptography` from 43.0.0 to 48.0.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst\"\u003ecryptography's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e48.0.1 - 2026-06-09\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.\n\u003cp\u003e.. _v48-0-0:\u003c/p\u003e\n\u003cp\u003e48.0.0 - 2026-05-04\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Support for Python 3.8 has been removed.\n\u003ccode\u003ecryptography\u003c/code\u003e now requires Python 3.9 or later.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Loading an X.509 CRL whose inner\n\u003ccode\u003eTBSCertList.signature\u003c/code\u003e algorithm does not match the outer\n\u003ccode\u003esignatureAlgorithm\u003c/code\u003e now raises \u003ccode\u003eValueError\u003c/code\u003e. Previously, such CRLs\nwere parsed successfully and only rejected during signature validation.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded support for :doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mlkem\u003c/code\u003e and\n:doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mldsa\u003c/code\u003e when using OpenSSL 3.5.0 or\nlater, in addition to the existing AWS-LC and BoringSSL support. This means\npost-quantum algorithms are now available to users of our wheels.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eNote:\u003c/strong\u003e Going forward, we do not guarantee that all functionality\nin \u003ccode\u003ecryptography\u003c/code\u003e will be available when building against\nOpenSSL. See :doc:\u003ccode\u003e/statements/state-of-openssl\u003c/code\u003e for more information.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. _v47-0-0:\u003c/p\u003e\n\u003cp\u003e47.0.0 - 2026-04-24\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Support for Python 3.8 is deprecated and will be removed in the next\n  ``cryptography`` release.\n* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves\n  (``SECT*`` classes) has been removed. These curves are rarely used and\n  have additional security considerations that make them undesirable.\n* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.\n  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC\n  continue to be supported.\n* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL \u0026lt; 4.1.\n* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or\n  keys with unsupported explicit curve encodings now raises\n  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of\n  ``ValueError``. This change affects\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,\n  and :meth:`~cryptography.x509.Certificate.public_key` when called on\n  certificates with unsupported public key algorithms.\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt; \n\u003c/code\u003e\u003c/pre\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/de987ce48ccfeb1abca41efa23b2bf73ec704f74\"\u003e\u003ccode\u003ede987ce\u003c/code\u003e\u003c/a\u003e 48.0.1 version bump and changelog (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14996\"\u003e#14996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/8e03e30e3aae01632a697e903e3593c924f0139d\"\u003e\u003ccode\u003e8e03e30\u003c/code\u003e\u003c/a\u003e bump for 48.0.0 release (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14796\"\u003e#14796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/295e0d254ef31ab864730aa41312ec355416ee71\"\u003e\u003ccode\u003e295e0d2\u003c/code\u003e\u003c/a\u003e Add AGENTS.md with CLAUDE.md symlink (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14794\"\u003e#14794\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/104a2de19e268a433e6da92be9cb872dcf0003c8\"\u003e\u003ccode\u003e104a2de\u003c/code\u003e\u003c/a\u003e Bump BoringSSL, OpenSSL, AWS-LC in CI (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14793\"\u003e#14793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/67ec1e51988195e17993d2edef5258b27509b926\"\u003e\u003ccode\u003e67ec1e5\u003c/code\u003e\u003c/a\u003e call check_length early on AesSiv::encrypt (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14792\"\u003e#14792\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/b2da57a0d9e4bfd2b95364299091a18f74127b26\"\u003e\u003ccode\u003eb2da57a\u003c/code\u003e\u003c/a\u003e changelog for mldsa/mlkem for openssl (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14791\"\u003e#14791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/3cf44adee25c368d4a136e072fa9f80465d91eb0\"\u003e\u003ccode\u003e3cf44ad\u003c/code\u003e\u003c/a\u003e ML-KEM OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14781\"\u003e#14781\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e31639666766f846fbab2c605879db0fa64fe83\"\u003e\u003ccode\u003e2e31639\u003c/code\u003e\u003c/a\u003e ML-DSA OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14773\"\u003e#14773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/5affe5a286a986fdf512c4a5cb280d28a96c10e3\"\u003e\u003ccode\u003e5affe5a\u003c/code\u003e\u003c/a\u003e fix rust nightly clippy (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14790\"\u003e#14790\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e73ca448eaf64b6f0d4ffbb794cf96170cef5ec\"\u003e\u003ccode\u003e2e73ca4\u003c/code\u003e\u003c/a\u003e bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pyca/cryptography/compare/43.0.0...48.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `protobuf` from 4.21.12 to 5.29.6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/protocolbuffers/protobuf/releases\"\u003eprotobuf's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eProtocol Buffers v34.0-rc1\u003c/h2\u003e\n\u003ch1\u003eAnnouncements\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eThis version includes breaking changes to: C++, Objective-C, PHP, Python.\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003e[Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Make generator headers private (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/3a2af3510f0d454dbe3e4dc281674b61c4d20b9e\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/3a2af3510f0d454dbe3e4dc281674b61c4d20b9e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/7a7589823d2cfaaf7994b050e98d5d553bc9b1c1\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/7a7589823d2cfaaf7994b050e98d5d553bc9b1c1\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Add [[nodiscard]] to many APIs. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/a70115f33f9af2c4b2202c800b84837e7fe0d738\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/a70115f33f9af2c4b2202c800b84837e7fe0d738\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Make the arena-enabled constructors of \u003ccode\u003eRepeatedField\u003c/code\u003e, \u003ccode\u003eRepeatedPtrField\u003c/code\u003e, and \u003ccode\u003eMap\u003c/code\u003e private. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/ef890c3d0c79398c70e047fe5dd893f460ba2336\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/ef890c3d0c79398c70e047fe5dd893f460ba2336\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Removes proto2::util::MessageDifferencer::AddIgnoreCriteria that takes a raw pointer as an argument in favor of the overload that takes a unique_ptr. Remove macro PROTOBUF_FUTURE_REMOVE_ADD_IGNORE_CRITERIA (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b115358c64127896fed88b8b5ef5d91d86d8cbae\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b115358c64127896fed88b8b5ef5d91d86d8cbae\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated FieldDescriptor::has_optional_keyword() in OSS. Use is_repeated() or has_presence() instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/68346ec9348e932664e58c3ecdcd1478f95233a8\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/68346ec9348e932664e58c3ecdcd1478f95233a8\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove AddUnusedImportTrackFile() and ClearUnusedImportTrackFiles(). Remove PROTOBUF_FUTURE_RENAME_ADD_UNUSED_IMPORT (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/837a2cd1d6c75402b2503ffe7cd8aeaf25868536\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/837a2cd1d6c75402b2503ffe7cd8aeaf25868536\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated FieldDescriptor::is_optional() in OSS. Use (!is_required() \u0026amp;\u0026amp; !is_repeated()) instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/9dbc5d479a8e453921485d8d3de47fb3c005f1af\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/9dbc5d479a8e453921485d8d3de47fb3c005f1af\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] All entity names have length limit (2afb0dc)\u003c/li\u003e\n\u003cli\u003e[ObjC] Remove \u003ccode\u003egenerate_minimal_imports\u003c/code\u003e generation option warning (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/45b1297fdaad5a9436d0e207422168c38dc45ac4\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/45b1297fdaad5a9436d0e207422168c38dc45ac4\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[ObjC] Fix nullability annotations on some \u003ccode\u003eGPB*Dictionary\u003c/code\u003e types. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/ea67d6d26a48478a567c404679e3bb99cf230d50\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/ea67d6d26a48478a567c404679e3bb99cf230d50\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[ObjC] Remove \u003ccode\u003e-[GPBFieldDescriptor optional]\u003c/code\u003e (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/3414dc151eb4dcbdb2ca952e2589993bf7af75c4\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/3414dc151eb4dcbdb2ca952e2589993bf7af75c4\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Other] Remove deprecated flag for enabling MSVC support (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/97c979be6e0907e1051bee62584dac4594e73fa7\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/97c979be6e0907e1051bee62584dac4594e73fa7\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP] Remove deprecated PHP APIs (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/9c45014099a4f7004fab6dd1278de2f4f2a393c5\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/9c45014099a4f7004fab6dd1278de2f4f2a393c5\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP] Remove deprecated PHP APIs FieldDescriptor getLabel, use IsRepeated or isRequired instead. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\u003c/a\u003e, \u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/cd76e675b14d00dda5623b30835d2bc7105fccc6\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/cd76e675b14d00dda5623b30835d2bc7105fccc6\u003c/a\u003e, \u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP]  Add PHP typehints for setters and remove redundant GPBUtil checks (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/pull/25296\"\u003eprotocolbuffers/protobuf#25296\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/aee03b78929c02461a5f9d8e136a2a016359b0cd\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/aee03b78929c02461a5f9d8e136a2a016359b0cd\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP]  support default values for editions/proto2 (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/pull/25161\"\u003eprotocolbuffers/protobuf#25161\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b01099d56350551bae3da88b97bf3027274c9f17\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b01099d56350551bae3da88b97bf3027274c9f17\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Raise errors in OSS when assign bool to int/enum field in Python Proto. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/5b116fe2f14f49dd0cc3b76089983717f211025c\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/5b116fe2f14f49dd0cc3b76089983717f211025c\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove float_format/double_format from python proto text_format (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/e4854a186e0bfa867d5bfa5cd850608a948fd488\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/e4854a186e0bfa867d5bfa5cd850608a948fd488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Raise TypeError when convert non-timedelta to Duration, or convert non-datetime to Timestamp in python proto. (Original code may raise ArributeError) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/00aaca1b4d98954bc2933d7c8a5379ba6088124c\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/00aaca1b4d98954bc2933d7c8a5379ba6088124c\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove float_precision from python proto json_format (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/f027f1fcd52b9d080b7ee79f4024f53cf54e0dc5\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/f027f1fcd52b9d080b7ee79f4024f53cf54e0dc5\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove deprecated FieldDescriptor.label (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/0a8ff55518ea5874478ad5b26515b31d186045a9\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/0a8ff55518ea5874478ad5b26515b31d186045a9\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://protobuf.dev/news/\"\u003eProtobuf News\u003c/a\u003e may include additional announcements or pre-announcements for upcoming changes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://protobuf.dev/support/migration/\"\u003eMigration Guide\u003c/a\u003e may include additional guidance for breaking changes.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eBazel\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eFix: cc_toolchain should prefer protoc when prebuilt flag is flipped. (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/25168\"\u003e#25168\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/8c857c3a1c6a106b0a096f1c9fa504bfaca035a9\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/8c857c3a1c6a106b0a096f1c9fa504bfaca035a9\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBreaking change: Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFeat(bazel): wire up prebuilt protoc toolchain (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/24115\"\u003e#24115\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/cc23698b486e690ea2eb873cc7596a87c74a3ba6\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/cc23698b486e690ea2eb873cc7596a87c74a3ba6\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eMigrate \u003ccode\u003eproto_descriptor_set\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/23369\"\u003e#23369\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/8d4dfdd39a7a242a9ed631a6ab2192c57dd9b9c8\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/8d4dfdd39a7a242a9ed631a6ab2192c57dd9b9c8\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eCompiler\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eRuby codegen: support generation of rbs files (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/15633\"\u003e#15633\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/6ebdf851ba78728f0aa145d38454ed9a316fb08d\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/6ebdf851ba78728f0aa145d38454ed9a316fb08d\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAvoid collision name problems between a message named \u003ccode\u003eXyz\u003c/code\u003e and a direct sibling enum named \u003ccode\u003eXyzView\u003c/code\u003e (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/eba53e8f172b273d679759a72ce4250131ee3df1\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/eba53e8f172b273d679759a72ce4250131ee3df1\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eGeneralizing and implementing ValidateFeatureSupport for both Options and Features during proto parsing (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/ed3c57114d8e2b47cca7697ddaa50c1b3762a6b0\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/ed3c57114d8e2b47cca7697ddaa50c1b3762a6b0\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix a bug with custom features outside of the \u003ccode\u003epb\u003c/code\u003e package. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/872d3ce7a4da00d7dcec33ced20cfe45235935e8\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/872d3ce7a4da00d7dcec33ced20cfe45235935e8\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix import option handling when include_imports isn't set. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/9ef9e80afd9bc8379d578fe67e5ab0738728c04e\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/9ef9e80afd9bc8379d578fe67e5ab0738728c04e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix a bug in STRICT check of namespaced enums to properly check for 'reserved 1 to max' (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/1229d4adba24c0952ab85ce96bc7b7f8a1fe6d0f\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/1229d4adba24c0952ab85ce96bc7b7f8a1fe6d0f\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003ePrevent accidental stripping of \u003ccode\u003edebug_redact\u003c/code\u003e options via import option. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/f58b098bffa7ca4045ef7773b09151a6af5d0c28\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/f58b098bffa7ca4045ef7773b09151a6af5d0c28\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eC++\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eAdd EnumerateEnumValues function. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/397d5d99db274b379d1384814074bf7df39d32f7\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/397d5d99db274b379d1384814074bf7df39d32f7\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/protocolbuffers/protobuf/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.32.3 to 2.33.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/releases\"\u003erequests's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.33.0\u003c/h2\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at \u003ca href=\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e. Give it a try, and report any gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/M0d3v1\"\u003e\u003ccode\u003e@​M0d3v1\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6865\"\u003epsf/requests#6865\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/aminvakil\"\u003e\u003ccode\u003e@​aminvakil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7220\"\u003epsf/requests#7220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/E8Price\"\u003e\u003ccode\u003e@​E8Price\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6960\"\u003epsf/requests#6960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mitre88\"\u003e\u003ccode\u003e@​mitre88\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7244\"\u003epsf/requests#7244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/magsen\"\u003e\u003ccode\u003e@​magsen\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6553\"\u003epsf/requests#6553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Rohan5commit\"\u003e\u003ccode\u003e@​Rohan5commit\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7227\"\u003epsf/requests#7227\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.32.5\u003c/h2\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has created\na new class of issues in Requests that have had negative impact across a number\nof use cases. The Requests team has decided to revert this feature as long term\nmaintenance of it is proving to be unsustainable in its current iteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev2.32.4\u003c/h2\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base that\nuses Requests, please take a look at \u003ca href=\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e. Give it a try, and report\nany gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now extracts\ncontents to a non-deterministic location to prevent malicious file\nreplacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause\nmalformed authentication to be applied to Requests on\nPython 3.11+. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has created\na new class of issues in Requests that have had negative impact across a number\nof use cases. The Requests team has decided to revert this feature as long term\nmaintenance of it is proving to be unsustainable in its current iteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted\nenvironment will retrieve credentials for the wrong hostname/machine from a\nnetrc file.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761\"\u003e\u003ccode\u003ebc04dfd\u003c/code\u003e\u003c/a\u003e v2.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"\u003e\u003ccode\u003e66d21cb\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028\"\u003e\u003ccode\u003e8b9bc8f\u003c/code\u003e\u003c/a\u003e Move badges to top of README (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7293\"\u003e#7293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286\"\u003e\u003ccode\u003ee331a28\u003c/code\u003e\u003c/a\u003e Remove unused extraction call (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7292\"\u003e#7292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29\"\u003e\u003ccode\u003e753fd08\u003c/code\u003e\u003c/a\u003e docs: fix FAQ grammar in httplib2 example\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71\"\u003e\u003ccode\u003e774a0b8\u003c/code\u003e\u003c/a\u003e docs(socks): same block as other sections\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303\"\u003e\u003ccode\u003e9c72a41\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 4.33.0 to 4.34.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be\"\u003e\u003ccode\u003eebf7190\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 4.32.0 to 4.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798\"\u003e\u003ccode\u003e0e4ae38\u003c/code\u003e\u003c/a\u003e docs: exclude Response.is_permanent_redirect from API docs (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7244\"\u003e#7244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a\"\u003e\u003ccode\u003ed568f47\u003c/code\u003e\u003c/a\u003e docs: clarify Quickstart POST example (\u003ca href=\"https://redirect.github.com/psf/requests/issues/6960\"\u003e#6960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/psf/requests/compare/v2.32.3...v2.33.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 2.3.0 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3 is raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects \u003ca href=\"https://opencollective.com/urllib3\"\u003eplease consider contributing financially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been read and decompressed partially. (Reported by \u003ca href=\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or \u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed using the official \u003ca href=\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by \u003ca href=\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca href=\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed data buffered from previous partial reads. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the response after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt=0\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing \u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior of chunked request bodies. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling schemeless URIs were passed to \u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to accept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e, matching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling use with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3 is raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects \u003ca href=\"https://opencollective.com/urllib3\"\u003eplease consider contributing financially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the streaming API were bypassed when HTTP redirects were followed. (CVE-2026-21441 reported by \u003ca href=\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High, GHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours as 6 hours by default. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on Emscripten. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed\nusing the official \u003ccode\u003eBrotli \u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763) \u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720) \u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979) \u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777) \u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636) \u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the\nresponse after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e Release 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e Fix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e Switch to nightly PyPy3.11 in CI for now (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e Avoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when \u003ccode\u003eamt=0\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e Bump dev dependencies (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e Upgrade mypy to version 1.20.2 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e Drop support for EOL PyPy3.10 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e Upgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix warnings (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/urllib3/urllib3/compare/2.3.0...2.7.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `wheel` from 0.46.1 to 0.46.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pypa/wheel/releases\"\u003ewheel's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.46.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRestored the \u003ccode\u003ebdist_wheel\u003c/code\u003e command for compatibility with \u003ccode\u003esetuptools\u003c/code\u003e older than v70.1\u003c/li\u003e\n\u003cli\u003eImporting \u003ccode\u003ewheel.bdist_wheel\u003c/code\u003e now emits a \u003ccode\u003eFutureWarning\u003c/code\u003e instead of a \u003ccode\u003eDeprecationWarning\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel unpack\u003c/code\u003e potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pypa/wheel/blob/main/docs/news.rst\"\u003ewheel's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease Notes\u003c/h1\u003e\n\u003cp\u003e\u003cstrong\u003e0.47.0 (2026-04-22)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded the \u003ccode\u003ewheel info\u003c/code\u003e subcommand to display metadata about wheel files without\nunpacking them (\u003ccode\u003e[#639](https://github.com/pypa/wheel/issues/639) \u0026lt;https://github.com/pypa/wheel/issues/639\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eWheelFile\u003c/code\u003e raising \u003ccode\u003eMissing RECORD file\u003c/code\u003e when the wheel filename contains\nuppercase characters (e.g. \u003ccode\u003eDjango-3.2.5.whl\u003c/code\u003e) but the \u003ccode\u003e.dist-info\u003c/code\u003e directory\ninside uses normalized lowercase naming\n(\u003ccode\u003e[#411](https://github.com/pypa/wheel/issues/411) \u0026lt;https://github.com/pypa/wheel/issues/411\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.46.3 (2026-01-22)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed \u003ccode\u003eImportError: cannot import name '_setuptools_logging' from 'wheel'\u003c/code\u003e when\ninstalled alongside an old version of setuptools and running the \u003ccode\u003ebdist_wheel\u003c/code\u003e\ncommand (\u003ccode\u003e[#676](https://github.com/pypa/wheel/issues/676) \u0026lt;https://github.com/pypa/wheel/issues/676\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.46.2 (2026-01-22)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRestored the \u003ccode\u003ebdist_wheel\u003c/code\u003e command for compatibility with \u003ccode\u003esetuptools\u003c/code\u003e older than\nv70.1\u003c/li\u003e\n\u003cli\u003eImporting \u003ccode\u003ewheel.bdist_wheel\u003c/code\u003e now emits a \u003ccode\u003eFutureWarning\u003c/code\u003e instead of a\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel unpack\u003c/code\u003e potentially altering the permissions of files outside of the\ndestination tree with maliciously crafted wheels (CVE-2026-24049)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.46.1 (2025-04-08)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eTemporarily restored the \u003ccode\u003ewheel.macosx_libfile\u003c/code\u003e module\n(\u003ccode\u003e[#659](https://github.com/pypa/wheel/issues/659) \u0026lt;https://github.com/pypa/wheel/issues/659\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.46.0 (2025-04-03)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.8\u003c/li\u003e\n\u003cli\u003eRemoved the \u003ccode\u003ebdist_wheel\u003c/code\u003e setuptools command implementation and entry point.\nThe \u003ccode\u003ewheel.bdist_wheel\u003c/code\u003e module is now just an alias to\n\u003ccode\u003esetuptools.command.bdist_wheel\u003c/code\u003e, emitting a deprecation warning on import.\u003c/li\u003e\n\u003cli\u003eRemoved vendored \u003ccode\u003epackaging\u003c/code\u003e in favor of a run-time dependency on it\u003c/li\u003e\n\u003cli\u003eMade the \u003ccode\u003ewheel.metadata\u003c/code\u003e module private (with a deprecation warning if it's\nimported\u003c/li\u003e\n\u003cli\u003eMade the \u003ccode\u003ewheel.cli\u003c/code\u003e package private (no deprecation warning)\u003c/li\u003e\n\u003cli\u003eFixed an exception when calling the \u003ccode\u003econvert\u003c/code\u003e command with an empty description\nfield\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.45.1 (2024-11-23)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed pure Python wheels converted from eggs and wininst files having the ABI tag in\nthe file name\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/eba4036ccaca4e2d0c5b5bf3e3be59b2b2877d6b\"\u003e\u003ccode\u003eeba4036\u003c/code\u003e\u003c/a\u003e Updated the version number for v0.46.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/557fb5425036ccca95330b2c8875e54c9f4483cf\"\u003e\u003ccode\u003e557fb54\u003c/code\u003e\u003c/a\u003e Created a new release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef\"\u003e\u003ccode\u003e7a7d2de\u003c/code\u003e\u003c/a\u003e Fixed security issue around wheel unpack (\u003ca href=\"https://redirect.github.com/pypa/wheel/issues/675\"\u003e#675\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/41418fac233d6973ea8798d620df4aa5b3aa1b66\"\u003e\u003ccode\u003e41418fa\u003c/code\u003e\u003c/a\u003e Fixed test failures due to metadata normalization changes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/c1d442bec6c634fcfb89e5d58698dd226685bd14\"\u003e\u003ccode\u003ec1d442b\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/pypa/wheel/issues/674\"\u003e#674\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/0bac8820ec90b1aaa0695d79a56563137b48686d\"\u003e\u003ccode\u003e0bac882\u003c/code\u003e\u003c/a\u003e Update github actions environments (\u003ca href=\"https://redirect.github.com/pypa/wheel/issues/673\"\u003e#673\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/be9f45b4ee1210b2a815d2eefea56b71efd99d63\"\u003e\u003ccode\u003ebe9f45b\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/pypa/wheel/issues/667\"\u003e#667\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/6244f08bb92d7569da6c2fbea23de0846ad34ff3\"\u003e\u003ccode\u003e6244f08\u003c/code\u003e\u003c/a\u003e Update pre-commit ruff legacy alias (\u003ca href=\"https://redirect.github.com/pypa/wheel/issues/668\"\u003e#668\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/15b7577654e8bcd23e009c6bac036b65c11d8d8f\"\u003e\u003ccode\u003e15b7577\u003c/code\u003e\u003c/a\u003e PEP 639 compliance (\u003ca href=\"https://redirect.github.com/pypa/wheel/issues/670\"\u003e#670\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/fc8cb4163e4f48d86092cb2a16076f1b3efcd10f\"\u003e\u003ccode\u003efc8cb41\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;Removed redundant Python version from the publish workflow (\u003ca href=\"https://redirect.github.com/pypa/wheel/issues/666\"\u003e#666\u003c/a\u003e)\u0026quot;\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pypa/wheel/compare/0.46.1...0.46.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/WillianSilva51/Achou-UFC/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/WillianSilva51/Achou-UFC/pull/32","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/WillianSilva51%2FAchou-UFC/issues/32","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/32/packages"},{"uuid":"4707207481","node_id":"PR_kwDOCB7FUc7os9FZ","number":2391,"state":"closed","title":"Bump tornado from 6.5.2 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-06-20T18:50:15.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-20T15:09:24.000Z","updated_at":"2026-06-20T18:50:24.000Z","time_to_close":13251,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.5.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.2 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.5.2\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Materials-Consortia/optimade-python-tools/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/Materials-Consortia/optimade-python-tools/pull/2391","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Materials-Consortia%2Foptimade-python-tools/issues/2391","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2391/packages"},{"uuid":"4697750702","node_id":"PR_kwDOPs0zxs7oOAdU","number":93,"state":"closed","title":"chore(deps): bump the uv group across 48 directories with 3 updates","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-19T22:10:47.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-19T03:46:40.000Z","updated_at":"2026-06-19T22:10:49.000Z","time_to_close":66247,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"uv","update_count":3,"packages":[{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"cryptography","old_version":"45.0.3","new_version":"48.0.1","repository_url":"https://github.com/pyca/cryptography"},{"name":"tornado","old_version":"6.5.1","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"cryptography","old_version":"45.0.6","new_version":"48.0.1","repository_url":"https://github.com/pyca/cryptography"},{"name":"tornado","old_version":"6.5.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"cryptography","old_version":"44.0.2","new_version":"48.0.1","repository_url":"https://github.com/pyca/cryptography"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"starlette","old_version":"0.45.3","new_version":"1.3.1","repository_url":"https://github.com/Kludex/starlette"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"\u003e [!WARNING]\n\u003e Dependabot will stop supporting `python v3.9`!\n\u003e \n\u003e Please upgrade to one of the following versions: `v3.9`, `v3.10`, `v3.11`, `v3.12`, `v3.13`, or `v3.14`.\n\u003e\n\nBumps the uv group with 1 update in the / directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 2 updates in the /llama-index-experimental directory: [cryptography](https://github.com/pyca/cryptography) and [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 2 updates in the /llama-index-finetuning directory: [cryptography](https://github.com/pyca/cryptography) and [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-agent-search-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-amazon-product-extraction directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-arize-phoenix-query-engine directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-auto-merging-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 3 updates in the /llama-index-packs/llama-index-packs-chroma-autoretrieval directory: [cryptography](https://github.com/pyca/cryptography), [tornado](https://github.com/tornadoweb/tornado) and [starlette](https://github.com/Kludex/starlette).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-code-hierarchy directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-cohere-citation-chat directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-deeplake-deepmemory-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-deeplake-multimodal-retrieval directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-dense-x-retrieval directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-diff-private-simple-dataset directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-evaluator-benchmarker directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-fusion-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-fuzzy-citation directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-gmail-openai-agent directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-koda-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-llama-dataset-metadata directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-llama-guard-moderator directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-llava-completion directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-longrag directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-mixture-of-agents directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-multi-tenancy-rag directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-multidoc-autoretrieval directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-nebulagraph-query-engine directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-neo4j-query-engine directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-node-parser-semantic-chunking directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-ollama-query-engine directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-panel-chatbot directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-raft-dataset directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-rag-evaluator directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-ragatouille-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 2 updates in the /llama-index-packs/llama-index-packs-raptor directory: [cryptography](https://github.com/pyca/cryptography) and [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-recursive-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-resume-screener directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-retry-engine-weaviate directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-searchain directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-self-discover directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-self-rag directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-sentence-window-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-snowflake-query-engine directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-stock-market-data-query-engine directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-streamlit-chatbot directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-sub-question-weaviate directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-timescale-vector-autoretrieval directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-trulens-eval-packs directory: [tornado](https://github.com/tornadoweb/tornado).\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `cryptography` from 45.0.3 to 48.0.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst\"\u003ecryptography's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e48.0.1 - 2026-06-09\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.\n\u003cp\u003e.. _v48-0-0:\u003c/p\u003e\n\u003cp\u003e48.0.0 - 2026-05-04\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Support for Python 3.8 has been removed.\n\u003ccode\u003ecryptography\u003c/code\u003e now requires Python 3.9 or later.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Loading an X.509 CRL whose inner\n\u003ccode\u003eTBSCertList.signature\u003c/code\u003e algorithm does not match the outer\n\u003ccode\u003esignatureAlgorithm\u003c/code\u003e now raises \u003ccode\u003eValueError\u003c/code\u003e. Previously, such CRLs\nwere parsed successfully and only rejected during signature validation.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded support for :doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mlkem\u003c/code\u003e and\n:doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mldsa\u003c/code\u003e when using OpenSSL 3.5.0 or\nlater, in addition to the existing AWS-LC and BoringSSL support. This means\npost-quantum algorithms are now available to users of our wheels.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eNote:\u003c/strong\u003e Going forward, we do not guarantee that all functionality\nin \u003ccode\u003ecryptography\u003c/code\u003e will be available when building against\nOpenSSL. See :doc:\u003ccode\u003e/statements/state-of-openssl\u003c/code\u003e for more information.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. _v47-0-0:\u003c/p\u003e\n\u003cp\u003e47.0.0 - 2026-04-24\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Support for Python 3.8 is deprecated and will be removed in the next\n  ``cryptography`` release.\n* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves\n  (``SECT*`` classes) has been removed. These curves are rarely used and\n  have additional security considerations that make them undesirable.\n* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.\n  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC\n  continue to be supported.\n* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL \u0026lt; 4.1.\n* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or\n  keys with unsupported explicit curve encodings now raises\n  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of\n  ``ValueError``. This change affects\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,\n  and :meth:`~cryptography.x509.Certificate.public_key` when called on\n  certificates with unsupported public key algorithms.\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt; \n\u003c/code\u003e\u003c/pre\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/de987ce48ccfeb1abca41efa23b2bf73ec704f74\"\u003e\u003ccode\u003ede987ce\u003c/code\u003e\u003c/a\u003e 48.0.1 version bump and changelog (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14996\"\u003e#14996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/8e03e30e3aae01632a697e903e3593c924f0139d\"\u003e\u003ccode\u003e8e03e30\u003c/code\u003e\u003c/a\u003e bump for 48.0.0 release (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14796\"\u003e#14796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/295e0d254ef31ab864730aa41312ec355416ee71\"\u003e\u003ccode\u003e295e0d2\u003c/code\u003e\u003c/a\u003e Add AGENTS.md with CLAUDE.md symlink (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14794\"\u003e#14794\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/104a2de19e268a433e6da92be9cb872dcf0003c8\"\u003e\u003ccode\u003e104a2de\u003c/code\u003e\u003c/a\u003e Bump BoringSSL, OpenSSL, AWS-LC in CI (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14793\"\u003e#14793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/67ec1e51988195e17993d2edef5258b27509b926\"\u003e\u003ccode\u003e67ec1e5\u003c/code\u003e\u003c/a\u003e call check_length early on AesSiv::encrypt (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14792\"\u003e#14792\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/b2da57a0d9e4bfd2b95364299091a18f74127b26\"\u003e\u003ccode\u003eb2da57a\u003c/code\u003e\u003c/a\u003e changelog for mldsa/mlkem for openssl (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14791\"\u003e#14791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/3cf44adee25c368d4a136e072fa9f80465d91eb0\"\u003e\u003ccode\u003e3cf44ad\u003c/code\u003e\u003c/a\u003e ML-KEM OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14781\"\u003e#14781\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e31639666766f846fbab2c605879db0fa64fe83\"\u003e\u003ccode\u003e2e31639\u003c/code\u003e\u003c/a\u003e ML-DSA OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14773\"\u003e#14773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/5affe5a286a986fdf512c4a5cb280d28a96c10e3\"\u003e\u003ccode\u003e5affe5a\u003c/code\u003e\u003c/a\u003e fix rust nightly clippy (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14790\"\u003e#14790\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e73ca448eaf64b6f0d4ffbb794cf96170cef5ec\"\u003e\u003ccode\u003e2e73ca4\u003c/code\u003e\u003c/a\u003e bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pyca/cryptography/compare/45.0.3...48.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.5.1 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `cryptography` from 45.0.6 to 48.0.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst\"\u003ecryptography's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e48.0.1 - 2026-06-09\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.\n\u003cp\u003e.. _v48-0-0:\u003c/p\u003e\n\u003cp\u003e48.0.0 - 2026-05-04\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Support for Python 3.8 has been removed.\n\u003ccode\u003ecryptography\u003c/code\u003e now requires Python 3.9 or later.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Loading an X.509 CRL whose inner\n\u003ccode\u003eTBSCertList.signature\u003c/code\u003e algorithm does not match the outer\n\u003ccode\u003esignatureAlgorithm\u003c/code\u003e now raises \u003ccode\u003eValueError\u003c/code\u003e. Previously, such CRLs\nwere parsed successfully and only rejected during signature validation.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded support for :doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mlkem\u003c/code\u003e and\n:doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mldsa\u003c/code\u003e when using OpenSSL 3.5.0 or\nlater, in addition to the existing AWS-LC and BoringSSL support. This means\npost-quantum algorithms are now available to users of our wheels.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eNote:\u003c/strong\u003e Going forward, we do not guarantee that all functionality\nin \u003ccode\u003ecryptography\u003c/code\u003e will be available when building against\nOpenSSL. See :doc:\u003ccode\u003e/statements/state-of-openssl\u003c/code\u003e for more information.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. _v47-0-0:\u003c/p\u003e\n\u003cp\u003e47.0.0 - 2026-04-24\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Support for Python 3.8 is deprecated and will be removed in the next\n  ``cryptography`` release.\n* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves\n  (``SECT*`` classes) has been removed. These curves are rarely used and\n  have additional security considerations that make them undesirable.\n* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.\n  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC\n  continue to be supported.\n* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL \u0026lt; 4.1.\n* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or\n  keys with unsupported explicit curve encodings now raises\n  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of\n  ``ValueError``. This change affects\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,\n  and :meth:`~cryptography.x509.Certificate.public_key` when called on\n  certificates with unsupported public key algorithms.\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt; \n\u003c/code\u003e\u003c/pre\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/de987ce48ccfeb1abca41efa23b2bf73ec704f74\"\u003e\u003ccode\u003ede987ce\u003c/code\u003e\u003c/a\u003e 48.0.1 version bump and changelog (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14996\"\u003e#14996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/8e03e30e3aae01632a697e903e3593c924f0139d\"\u003e\u003ccode\u003e8e03e30\u003c/code\u003e\u003c/a\u003e bump for 48.0.0 release (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14796\"\u003e#14796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/295e0d254ef31ab864730aa41312ec355416ee71\"\u003e\u003ccode\u003e295e0d2\u003c/code\u003e\u003c/a\u003e Add AGENTS.md with CLAUDE.md symlink (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14794\"\u003e#14794\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/104a2de19e268a433e6da92be9cb872dcf0003c8\"\u003e\u003ccode\u003e104a2de\u003c/code\u003e\u003c/a\u003e Bump BoringSSL, OpenSSL, AWS-LC in CI (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14793\"\u003e#14793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/67ec1e51988195e17993d2edef5258b27509b926\"\u003e\u003ccode\u003e67ec1e5\u003c/code\u003e\u003c/a\u003e call check_length early on AesSiv::encrypt (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14792\"\u003e#14792\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/b2da57a0d9e4bfd2b95364299091a18f74127b26\"\u003e\u003ccode\u003eb2da57a\u003c/code\u003e\u003c/a\u003e changelog for mldsa/mlkem for openssl (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14791\"\u003e#14791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/3cf44adee25c368d4a136e072fa9f80465d91eb0\"\u003e\u003ccode\u003e3cf44ad\u003c/code\u003e\u003c/a\u003e ML-KEM OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14781\"\u003e#14781\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e31639666766f846fbab2c605879db0fa64fe83\"\u003e\u003ccode\u003e2e31639\u003c/code\u003e\u003c/a\u003e ML-DSA OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14773\"\u003e#14773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/5affe5a286a986fdf512c4a5cb280d28a96c10e3\"\u003e\u003ccode\u003e5affe5a\u003c/code\u003e\u003c/a\u003e fix rust nightly clippy (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14790\"\u003e#14790\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e73ca448eaf64b6f0d4ffbb794cf96170cef5ec\"\u003e\u003ccode\u003e2e73ca4\u003c/code\u003e\u003c/a\u003e bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pyca/cryptography/compare/45.0.3...48.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.5.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `cryptography` from 44.0.2 to 48.0.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst\"\u003ecryptography's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e48.0.1 - 2026-06-09\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.\n\u003cp\u003e.. _v48-0-0:\u003c/p\u003e\n\u003cp\u003e48.0.0 - 2026-05-04\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Support for Python 3.8 has been removed.\n\u003ccode\u003ecryptography\u003c/code\u003e now requires Python 3.9 or later.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Loading an X.509 CRL whose inner\n\u003ccode\u003eTBSCertList.signature\u003c/code\u003e algorithm does not match the outer\n\u003ccode\u003esignatureAlgorithm\u003c/code\u003e now raises \u003ccode\u003eValueError\u003c/code\u003e. Previously, such CRLs\nwere parsed successfully and only rejected during signature validation.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded support for :doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mlkem\u003c/code\u003e and\n:doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mldsa\u003c/code\u003e when using OpenSSL 3.5.0 or\nlater, in addition to the existing AWS-LC and BoringSSL support. This means\npost-quantum algorithms are now available to users of our wheels.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eNote:\u003c/strong\u003e Going forward, we do not guarantee that all functionality\nin \u003ccode\u003ecryptography\u003c/code\u003e will be available when building against\nOpenSSL. See :doc:\u003ccode\u003e/statements/state-of-openssl\u003c/code\u003e for more information.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. _v47-0-0:\u003c/p\u003e\n\u003cp\u003e47.0.0 - 2026-04-24\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Support for Python 3.8 is deprecated and will be removed in the next\n  ``cryptography`` release.\n* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves\n  (``SECT*`` classes) has been removed. These curves are rarely used and\n  have additional security considerations that make them undesirable.\n* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.\n  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC\n  continue to be supported.\n* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL \u0026lt; 4.1.\n* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or\n  keys with unsupported explicit curve encodings now raises\n  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of\n  ``ValueError``. This change affects\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,\n  and :meth:`~cryptography.x509.Certificate.public_key` when called on\n  certificates with unsupported public key algorithms.\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt; \n\u003c/code\u003e\u003c/pre\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/de987ce48ccfeb1abca41efa23b2bf73ec704f74\"\u003e\u003ccode\u003ede987ce\u003c/code\u003e\u003c/a\u003e 48.0.1 version bump and changelog (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14996\"\u003e#14996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/8e03e30e3aae01632a697e903e3593c924f0139d\"\u003e\u003ccode\u003e8e03e30\u003c/code\u003e\u003c/a\u003e bump for 48.0.0 release (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14796\"\u003e#14796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/295e0d254ef31ab864730aa41312ec355416ee71\"\u003e\u003ccode\u003e295e0d2\u003c/code\u003e\u003c/a\u003e Add AGENTS.md with CLAUDE.md symlink (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14794\"\u003e#14794\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/104a2de19e268a433e6da92be9cb872dcf0003c8\"\u003e\u003ccode\u003e104a2de\u003c/code\u003e\u003c/a\u003e Bump BoringSSL, OpenSSL, AWS-LC in CI (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14793\"\u003e#14793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/67ec1e51988195e17993d2edef5258b27509b926\"\u003e\u003ccode\u003e67ec1e5\u003c/code\u003e\u003c/a\u003e call check_length early on AesSiv::encrypt (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14792\"\u003e#14792\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/b2da57a0d9e4bfd2b95364299091a18f74127b26\"\u003e\u003ccode\u003eb2da57a\u003c/code\u003e\u003c/a\u003e changelog for mldsa/mlkem for openssl (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14791\"\u003e#14791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/3cf44adee25c368d4a136e072fa9f80465d91eb0\"\u003e\u003ccode\u003e3cf44ad\u003c/code\u003e\u003c/a\u003e ML-KEM OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14781\"\u003e#14781\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e31639666766f846fbab2c605879db0fa64fe83\"\u003e\u003ccode\u003e2e31639\u003c/code\u003e\u003c/a\u003e ML-DSA OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14773\"\u003e#14773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/5affe5a286a986fdf512c4a5cb280d28a96c10e3\"\u003e\u003ccode\u003e5affe5a\u003c/code\u003e\u003c/a\u003e fix rust nightly clippy (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14790\"\u003e#14790\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e73ca448eaf64b6f0d4ffbb794cf96170cef5ec\"\u003e\u003ccode\u003e2e73ca4\u003c/code\u003e\u003c/a\u003e bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pyca/cryptography/compare/45.0.3...48.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `starlette` from 0.45.3 to 1.3.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/starlette/releases\"\u003estarlette's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 1.3.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUse \u003ccode\u003eStarletteDeprecationWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3119\"\u003eKludex/starlette#3119\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEnforce \u003ccode\u003emax_fields\u003c/code\u003e and \u003ccode\u003emax_part_size\u003c/code\u003e in \u003ccode\u003eFormParser\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3329\"\u003eKludex/starlette#3329\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEnforce \u003ccode\u003eFormParser\u003c/code\u003e limits in parser callbacks by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3331\"\u003eKludex/starlette#3331\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/1.3.0...1.3.1\"\u003ehttps://github.com/Kludex/starlette/compare/1.3.0...1.3.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 1.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eClamp oversized suffix ranges in \u003ccode\u003eFileResponse\u003c/code\u003e by \u003ca href=\"https://github.com/jiyujie2006\"\u003e\u003ccode\u003e@​jiyujie2006\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3307\"\u003eKludex/starlette#3307\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCatch \u003ccode\u003eOSError\u003c/code\u003e alongside \u003ccode\u003eMultiPartException\u003c/code\u003e when closing temp files by \u003ca href=\"https://github.com/N3XT3R1337\"\u003e\u003ccode\u003e@​N3XT3R1337\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3191\"\u003eKludex/starlette#3191\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ehttpx2\u003c/code\u003e to the \u003ccode\u003efull\u003c/code\u003e extra by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3323\"\u003eKludex/starlette#3323\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust testclient typing and warnings by \u003ca href=\"https://github.com/waketzheng\"\u003e\u003ccode\u003e@​waketzheng\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3322\"\u003eKludex/starlette#3322\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix IndexError in URL.replace() on a URL with no authority by \u003ca href=\"https://github.com/LeSingh1\"\u003e\u003ccode\u003e@​LeSingh1\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3317\"\u003eKludex/starlette#3317\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAnnotate URLPath protocol parameter with Literal by \u003ca href=\"https://github.com/Chang-LeHung\"\u003e\u003ccode\u003e@​Chang-LeHung\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3285\"\u003eKludex/starlette#3285\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eavoid collapsing exception groups from user code by \u003ca href=\"https://github.com/graingert\"\u003e\u003ccode\u003e@​graingert\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/2830\"\u003eKludex/starlette#2830\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eremoveprefix\u003c/code\u003e to strip weak ETag indicator in \u003ccode\u003eis_not_modified\u003c/code\u003e by \u003ca href=\"https://github.com/gnosyslambda\"\u003e\u003ccode\u003e@​gnosyslambda\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3193\"\u003eKludex/starlette#3193\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBuild \u003ccode\u003erequest.url\u003c/code\u003e from structured components by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3326\"\u003eKludex/starlette#3326\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jiyujie2006\"\u003e\u003ccode\u003e@​jiyujie2006\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3307\"\u003eKludex/starlette#3307\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/N3XT3R1337\"\u003e\u003ccode\u003e@​N3XT3R1337\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3191\"\u003eKludex/starlette#3191\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/leestana01\"\u003e\u003ccode\u003e@​leestana01\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3319\"\u003eKludex/starlette#3319\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/LeSingh1\"\u003e\u003ccode\u003e@​LeSingh1\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3317\"\u003eKludex/starlette#3317\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/EmmanuelNiyonshuti\"\u003e\u003ccode\u003e@​EmmanuelNiyonshuti\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3204\"\u003eKludex/starlette#3204\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Chang-LeHung\"\u003e\u003ccode\u003e@​Chang-LeHung\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3285\"\u003eKludex/starlette#3285\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gnosyslambda\"\u003e\u003ccode\u003e@​gnosyslambda\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3193\"\u003eKludex/starlette#3193\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/1.2.1...1.3.0\"\u003ehttps://github.com/Kludex/starlette/compare/1.2.1...1.3.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 1.2.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUse \u003ccode\u003ehttpx2\u003c/code\u003e for type checking in the \u003ccode\u003etestclient\u003c/code\u003e module by \u003ca href=\"https://github.com/leifwar\"\u003e\u003ccode\u003e@​leifwar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3304\"\u003eKludex/starlette#3304\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd assert error for requires() when request param is not Request type by \u003ca href=\"https://github.com/KeeganOP\"\u003e\u003ccode\u003e@​KeeganOP\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3298\"\u003eKludex/starlette#3298\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/leifwar\"\u003e\u003ccode\u003e@​leifwar\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3304\"\u003eKludex/starlette#3304\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/diskeu\"\u003e\u003ccode\u003e@​diskeu\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3243\"\u003eKludex/starlette#3243\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/KeeganOP\"\u003e\u003ccode\u003e@​KeeganOP\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3298\"\u003eKludex/starlette#3298\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/1.2.0...1.2.1\"\u003ehttps://github.com/Kludex/starlette/compare/1.2.0...1.2.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 1.2.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSupport httpx2 in the test client by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3291\"\u003eKludex/starlette#3291\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/1.1.0...1.2.0\"\u003ehttps://github.com/Kludex/starlette/compare/1.1.0...1.2.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 1.1.0\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/starlette/blob/main/docs/release-notes.md\"\u003estarlette's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.3.1 (June 12, 2026)\u003c/h2\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce \u003ccode\u003emax_fields\u003c/code\u003e and \u003ccode\u003emax_part_size\u003c/code\u003e in \u003ccode\u003eFormParser\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3329\"\u003e#3329\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eEnforce \u003ccode\u003eFormParser\u003c/code\u003e limits in parser callbacks \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3331\"\u003e#3331\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.3.0 (June 11, 2026)\u003c/h2\u003e\n\u003ch4\u003eAdded\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003ehttpx2\u003c/code\u003e to the \u003ccode\u003efull\u003c/code\u003e extra \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3323\"\u003e#3323\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eAnnotate the \u003ccode\u003eURLPath\u003c/code\u003e \u003ccode\u003eprotocol\u003c/code\u003e parameter with \u003ccode\u003eLiteral\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3285\"\u003e#3285\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eBuild \u003ccode\u003erequest.url\u003c/code\u003e from structured components \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3326\"\u003e#3326\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eClamp oversized suffix ranges in \u003ccode\u003eFileResponse\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3307\"\u003e#3307\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eCatch \u003ccode\u003eOSError\u003c/code\u003e alongside \u003ccode\u003eMultiPartException\u003c/code\u003e when closing temp files \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3191\"\u003e#3191\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eAvoid collapsing exception groups raised from user code \u003ca href=\"https://redirect.github.com/encode/starlette/pull/2830\"\u003e#2830\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eremoveprefix\u003c/code\u003e to strip the weak \u003ccode\u003eETag\u003c/code\u003e indicator in \u003ccode\u003eis_not_modified\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3193\"\u003e#3193\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eIndexError\u003c/code\u003e in \u003ccode\u003eURL.replace()\u003c/code\u003e on a URL with no authority \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3317\"\u003e#3317\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eAdjust \u003ccode\u003etestclient\u003c/code\u003e typing and warnings \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3322\"\u003e#3322\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.2.1 (May 31, 2026)\u003c/h2\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eUse \u003ccode\u003ehttpx2\u003c/code\u003e for type checking in the \u003ccode\u003etestclient\u003c/code\u003e module \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3304\"\u003e#3304\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eAdd assert error for \u003ccode\u003erequires()\u003c/code\u003e when the request parameter is not a \u003ccode\u003eRequest\u003c/code\u003e type \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3298\"\u003e#3298\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.2.0 (May 28, 2026)\u003c/h2\u003e\n\u003ch4\u003eAdded\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eSupport httpx2 in the test client \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3291\"\u003e#3291\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.1.0 (May 23, 2026)\u003c/h2\u003e\n\u003ch4\u003eAdded\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eUse \u003ccode\u003e\u0026quot;application/octet-stream\u0026quot;\u003c/code\u003e as the \u003ccode\u003eFileResponse\u003c/code\u003e media type fallback \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3283\"\u003e#3283\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eOnly dispatch standard HTTP verbs in \u003ccode\u003eHTTPEndpoint\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3286\"\u003e#3286\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eReject absolute paths in \u003ccode\u003eStaticFiles.lookup_path\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3287\"\u003e#3287\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.0.1 (May 21, 2026)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/8ebffd0678570ddd5d5bb11c6f3c3c7fd4682ab9\"\u003e\u003ccode\u003e8ebffd0\u003c/code\u003e\u003c/a\u003e Version 1.3.1 (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3330\"\u003e#3330\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/25b8e179d8d7ed86769c02f648772dd5fb43dc3c\"\u003e\u003ccode\u003e25b8e17\u003c/code\u003e\u003c/a\u003e Enforce \u003ccode\u003eFormParser\u003c/code\u003e limits in parser callbacks (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3331\"\u003e#3331\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/dba1c4babc4f99ad2622bb913d87045775dda735\"\u003e\u003ccode\u003edba1c4b\u003c/code\u003e\u003c/a\u003e Enforce \u003ccode\u003emax_fields\u003c/code\u003e and \u003ccode\u003emax_part_size\u003c/code\u003e in \u003ccode\u003eFormParser\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3329\"\u003e#3329\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/45e51dcf99f3a270b0bcec1aec5410b4345863a9\"\u003e\u003ccode\u003e45e51dc\u003c/code\u003e\u003c/a\u003e Use \u003ccode\u003eStarletteDeprecationWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3119\"\u003e#3119\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/5f8610c386e13de1d80d36efa961e1486a1d2d01\"\u003e\u003ccode\u003e5f8610c\u003c/code\u003e\u003c/a\u003e Version 1.3.0 (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3327\"\u003e#3327\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/167b5850e809f38b27fbfed62d58bf6442855975\"\u003e\u003ccode\u003e167b585\u003c/code\u003e\u003c/a\u003e Build \u003ccode\u003erequest.url\u003c/code\u003e from structured components (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3326\"\u003e#3326\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/37309255b4c1b9c381a2d24a1eaf83100984a16a\"\u003e\u003ccode\u003e3730925\u003c/code\u003e\u003c/a\u003e Use \u003ccode\u003eremoveprefix\u003c/code\u003e to strip weak ETag indicator in \u003ccode\u003eis_not_modified\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3193\"\u003e#3193\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/e6f7ad1ab85efb27ab7910d8007b3f4531f7b083\"\u003e\u003ccode\u003ee6f7ad1\u003c/code\u003e\u003c/a\u003e avoid collapsing exception groups from user code (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/2830\"\u003e#2830\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/115228fcdca0e0ef5bf4a95a40ddce5a9fced428\"\u003e\u003ccode\u003e115228f\u003c/code\u003e\u003c/a\u003e Annotate URLPath protocol parameter with Literal (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3285\"\u003e#3285\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/113f193a34353c9153857028c1074351d22fad07\"\u003e\u003ccode\u003e113f193\u003c/code\u003e\u003c/a\u003e docs: replace inline ASGI server list with link to canonical implemen… (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3204\"\u003e#3204\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/Kludex/starlette/compare/0.45.3...1.3.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object bef...\n\n_Description has been truncated_","html_url":"https://github.com/Domphe/llama_index/pull/93","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Domphe%2Fllama_index/issues/93","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/93/packages"},{"uuid":"4687963483","node_id":"PR_kwDOAgtve87ntwlT","number":665,"state":"open","title":"build(deps): bump tornado from 6.5.6 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-18T00:00:03.000Z","updated_at":"2026-06-18T00:03:30.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps)","packages":[{"name":"tornado","old_version":"6.5.6","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.6 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.6...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.5.6\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/opendatacube/eo-datasets/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/opendatacube/eo-datasets/pull/665","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/opendatacube%2Feo-datasets/issues/665","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/665/packages"},{"uuid":"4686430599","node_id":"PR_kwDOEDBuZM7nozOv","number":105,"state":"open","title":"Bump tornado from 6.5.5 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-17T19:31:15.000Z","updated_at":"2026-06-17T19:31:22.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"\u003e [!WARNING]\n\u003e Dependabot will stop supporting `python v3.9`!\n\u003e \n\u003e Please upgrade to one of the following versions: `v3.9`, `v3.10`, `v3.11`, `v3.12`, `v3.13`, or `v3.14`.\n\u003e\n\nBumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=pip\u0026previous-version=6.5.5\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/kanishkamisra/minicons/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/kanishkamisra/minicons/pull/105","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/kanishkamisra%2Fminicons/issues/105","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/105/packages"},{"uuid":"4685978711","node_id":"PR_kwDOQKwXJM7nnTCd","number":57,"state":"closed","title":"Bump tornado from 6.5.5 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-17T21:17:24.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-17T18:24:06.000Z","updated_at":"2026-06-17T21:17:27.000Z","time_to_close":10398,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.5.5\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/gitinference/jp-tools/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/gitinference/jp-tools/pull/57","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/gitinference%2Fjp-tools/issues/57","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/57/packages"},{"uuid":"4685819327","node_id":"PR_kwDOLo6OQc7nmw85","number":83,"state":"closed","title":"Bump tornado from 6.5.5 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-08-08T17:38:31.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-17T18:01:10.000Z","updated_at":"2026-08-08T17:38:40.000Z","time_to_close":4491441,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.5.5\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/impalah/auth-middleware/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/impalah/auth-middleware/pull/83","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/impalah%2Fauth-middleware/issues/83","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/83/packages"},{"uuid":"4685556238","node_id":"PR_kwDOHX3_rM7nl4K9","number":963,"state":"closed","title":"Bump tornado from 6.5.4 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-29T12:08:47.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-17T17:25:23.000Z","updated_at":"2026-06-29T12:08:57.000Z","time_to_close":1017804,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.5.4","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"\u003e [!WARNING]\n\u003e Dependabot will stop supporting `python v3.9`!\n\u003e \n\u003e Please upgrade to one of the following versions: `v3.9`, `v3.10`, `v3.11`, `v3.12`, `v3.13`, or `v3.14`.\n\u003e\n\nBumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.4 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.4...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.5.4\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/aixplain/aiXplain/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/aixplain/aiXplain/pull/963","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/aixplain%2FaiXplain/issues/963","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/963/packages"},{"uuid":"4683201057","node_id":"PR_kwDOD-2Cwc7neBJw","number":2759,"state":"closed","title":"Bump tornado from 6.4.2 to 6.5.7 in /AI-and-Analytics/Features-and-Functionality/IntelTensorFlow_Transformer_AMX_bfloat16_MixedPrecision","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-17T13:21:10.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-17T12:26:09.000Z","updated_at":"2026-06-17T13:21:19.000Z","time_to_close":3301,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":"/AI-and-Analytics/Features-and-Functionality/IntelTensorFlow_Transformer_AMX_bfloat16_MixedPrecision","ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.4.2 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.4.2\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/oneapi-src/oneAPI-samples/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/oneapi-src/oneAPI-samples/pull/2759","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/oneapi-src%2FoneAPI-samples/issues/2759","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2759/packages"},{"uuid":"4681157851","node_id":"PR_kwDOOndlpM7nXP5d","number":41,"state":"open","title":"chore(deps): bump the pip group across 1 directory with 7 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-17T07:38:30.000Z","updated_at":"2026-06-17T07:39:35.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"pip","update_count":7,"packages":[{"name":"dbt-common","old_version":"1.29.0","new_version":"1.34.2","repository_url":"https://github.com/dbt-labs/dbt-common"},{"name":"deepdiff","old_version":"8.6.1","new_version":"8.6.2","repository_url":"https://github.com/qlustered/deepdiff"},{"name":"idna","old_version":"3.10","new_version":"3.15","repository_url":"https://github.com/kjd/idna"},{"name":"protobuf","old_version":"6.32.0","new_version":"6.33.5","repository_url":"https://github.com/protocolbuffers/protobuf"},{"name":"requests","old_version":"2.32.5","new_version":"2.33.0","repository_url":"https://github.com/psf/requests"},{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"urllib3","old_version":"2.5.0","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"}],"path":null,"ecosystem":"pip"},"body":"Bumps the pip group with 7 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [dbt-common](https://github.com/dbt-labs/dbt-common) | `1.29.0` | `1.34.2` |\n| [deepdiff](https://github.com/qlustered/deepdiff) | `8.6.1` | `8.6.2` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [protobuf](https://github.com/protocolbuffers/protobuf) | `6.32.0` | `6.33.5` |\n| [requests](https://github.com/psf/requests) | `2.32.5` | `2.33.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.5.0` | `2.7.0` |\n\n\nUpdates `dbt-common` from 1.29.0 to 1.34.2\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/dbt-labs/dbt-common/blob/main/CHANGELOG.md\"\u003edbt-common's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003edbt-common Changelog\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eThis file provides a full account of all changes to \u003ccode\u003edbt-common\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eChanges are listed under the (pre)release in which they first appear. Subsequent releases include changes from previous releases.\u003c/li\u003e\n\u003cli\u003e\u0026quot;Breaking changes\u0026quot; listed under a version may require action from end users or external maintainers when upgrading to that version.\u003c/li\u003e\n\u003cli\u003eDo not edit this file directly. This file is auto-generated using \u003ca href=\"https://github.com/miniscruff/changie\"\u003echangie\u003c/a\u003e. For details on how to document a change, see \u003ca href=\"https://github.com/dbt-labs/dbt-common/blob/main/CONTRIBUTING.md#adding-changelog-entry\"\u003ethe contributing guide\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edbt-common 1.38.0 - May 04, 2026\u003c/h2\u003e\n\u003ch3\u003eUnder the Hood\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eExplicitly keep bool serde as a passthrough for mashumaro 3.15+ compat with versions before 3.15 (\u003ca href=\"https://redirect.github.com/dbt-labs/dbt-common/issues/12098\"\u003e#12098\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edbt-common 1.37.5 - April 23, 2026\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdds public helper functions for event deferral functionality (\u003ca href=\"https://redirect.github.com/dbt-labs/dbt-common/issues/12339\"\u003e#12339\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edbt-common 1.37.4 - April 23, 2026\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd event deferral capability to EventManager (\u003ca href=\"https://redirect.github.com/dbt-labs/dbt-common/issues/12339\"\u003e#12339\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edbt-common 1.37.3 - March 02, 2026\u003c/h2\u003e\n\u003ch3\u003eSecurity\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eReplace os.path.commonprefix() with os.path.commonpath() to preventpath traversal via sibling directories with matching prefixes. (\u003ca href=\"https://redirect.github.com/dbt-labs/dbt-common/pull/1\"\u003e#1\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edbt-common 1.37.2 - December 15, 2025\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003erestore config.get behavior to avoid searching in meta (\u003ca href=\"https://redirect.github.com/dbt-labs/dbt-common/issues/337\"\u003e#337\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edbt-common 1.37.1 - December 11, 2025\u003c/h2\u003e\n\u003ch3\u003eDependencies\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump upper bound of isodate to allow for \u003ccode\u003e0.7.x\u003c/code\u003e versions (\u003ca href=\"https://redirect.github.com/dbt-labs/dbt-common/pull/333\"\u003e#333\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edbt-common 1.37.0 - December 10, 2025\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEnable config.get to access keys in \u0026quot;meta\u0026quot; (\u003ca href=\"https://redirect.github.com/dbt-labs/dbt-common/issues/329\"\u003e#329\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/dbt-labs/dbt-common/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `deepdiff` from 8.6.1 to 8.6.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/qlustered/deepdiff/releases\"\u003edeepdiff's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e8.6.2 - Fix (CVE-2025-58367)\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/qlustered/deepdiff/commit/0d07ec21d12b46ef4e489383b363eadc22d990fb\"\u003e\u003ccode\u003e0d07ec2\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/qlustered/deepdiff/commit/791f5aac51b2da7f90375ab204256ef6a6b40206\"\u003e\u003ccode\u003e791f5aa\u003c/code\u003e\u003c/a\u003e updating CVE number\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/qlustered/deepdiff/commit/a6aafea3ba5498aab6f9c77047c54949e7e968ae\"\u003e\u003ccode\u003ea6aafea\u003c/code\u003e\u003c/a\u003e updating docs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/qlustered/deepdiff/commit/a0950abbe6263298bc4bdbc3ebb57edc1af079b4\"\u003e\u003ccode\u003ea0950ab\u003c/code\u003e\u003c/a\u003e Bump version: 8.6.1 → 8.6.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/qlustered/deepdiff/commit/887128abe5e510341cc4a82f6914a82d5ff1b6a7\"\u003e\u003ccode\u003e887128a\u003c/code\u003e\u003c/a\u003e Fix (CVE-2025-58367)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/qlustered/deepdiff/compare/8.6.1...8.6.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 3.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in \u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining and\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e Release 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e Pre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from kjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e Convert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from kjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from StanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from StanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kjd/idna/compare/v3.10...v3.15\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `protobuf` from 6.32.0 to 6.33.5\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/protocolbuffers/protobuf/releases\"\u003eprotobuf's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eProtocol Buffers v34.0-rc1\u003c/h2\u003e\n\u003ch1\u003eAnnouncements\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eThis version includes breaking changes to: C++, Objective-C, PHP, Python.\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003e[Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Make generator headers private (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/3a2af3510f0d454dbe3e4dc281674b61c4d20b9e\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/3a2af3510f0d454dbe3e4dc281674b61c4d20b9e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/7a7589823d2cfaaf7994b050e98d5d553bc9b1c1\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/7a7589823d2cfaaf7994b050e98d5d553bc9b1c1\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Add [[nodiscard]] to many APIs. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/a70115f33f9af2c4b2202c800b84837e7fe0d738\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/a70115f33f9af2c4b2202c800b84837e7fe0d738\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Make the arena-enabled constructors of \u003ccode\u003eRepeatedField\u003c/code\u003e, \u003ccode\u003eRepeatedPtrField\u003c/code\u003e, and \u003ccode\u003eMap\u003c/code\u003e private. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/ef890c3d0c79398c70e047fe5dd893f460ba2336\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/ef890c3d0c79398c70e047fe5dd893f460ba2336\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Removes proto2::util::MessageDifferencer::AddIgnoreCriteria that takes a raw pointer as an argument in favor of the overload that takes a unique_ptr. Remove macro PROTOBUF_FUTURE_REMOVE_ADD_IGNORE_CRITERIA (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b115358c64127896fed88b8b5ef5d91d86d8cbae\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b115358c64127896fed88b8b5ef5d91d86d8cbae\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated FieldDescriptor::has_optional_keyword() in OSS. Use is_repeated() or has_presence() instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/68346ec9348e932664e58c3ecdcd1478f95233a8\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/68346ec9348e932664e58c3ecdcd1478f95233a8\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove AddUnusedImportTrackFile() and ClearUnusedImportTrackFiles(). Remove PROTOBUF_FUTURE_RENAME_ADD_UNUSED_IMPORT (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/837a2cd1d6c75402b2503ffe7cd8aeaf25868536\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/837a2cd1d6c75402b2503ffe7cd8aeaf25868536\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated FieldDescriptor::is_optional() in OSS. Use (!is_required() \u0026amp;\u0026amp; !is_repeated()) instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/9dbc5d479a8e453921485d8d3de47fb3c005f1af\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/9dbc5d479a8e453921485d8d3de47fb3c005f1af\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] All entity names have length limit (2afb0dc)\u003c/li\u003e\n\u003cli\u003e[ObjC] Remove \u003ccode\u003egenerate_minimal_imports\u003c/code\u003e generation option warning (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/45b1297fdaad5a9436d0e207422168c38dc45ac4\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/45b1297fdaad5a9436d0e207422168c38dc45ac4\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[ObjC] Fix nullability annotations on some \u003ccode\u003eGPB*Dictionary\u003c/code\u003e types. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/ea67d6d26a48478a567c404679e3bb99cf230d50\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/ea67d6d26a48478a567c404679e3bb99cf230d50\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[ObjC] Remove \u003ccode\u003e-[GPBFieldDescriptor optional]\u003c/code\u003e (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/3414dc151eb4dcbdb2ca952e2589993bf7af75c4\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/3414dc151eb4dcbdb2ca952e2589993bf7af75c4\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Other] Remove deprecated flag for enabling MSVC support (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/97c979be6e0907e1051bee62584dac4594e73fa7\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/97c979be6e0907e1051bee62584dac4594e73fa7\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP] Remove deprecated PHP APIs (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/9c45014099a4f7004fab6dd1278de2f4f2a393c5\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/9c45014099a4f7004fab6dd1278de2f4f2a393c5\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP] Remove deprecated PHP APIs FieldDescriptor getLabel, use IsRepeated or isRequired instead. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\u003c/a\u003e, \u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/cd76e675b14d00dda5623b30835d2bc7105fccc6\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/cd76e675b14d00dda5623b30835d2bc7105fccc6\u003c/a\u003e, \u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP]  Add PHP typehints for setters and remove redundant GPBUtil checks (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/pull/25296\"\u003eprotocolbuffers/protobuf#25296\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/aee03b78929c02461a5f9d8e136a2a016359b0cd\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/aee03b78929c02461a5f9d8e136a2a016359b0cd\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP]  support default values for editions/proto2 (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/pull/25161\"\u003eprotocolbuffers/protobuf#25161\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b01099d56350551bae3da88b97bf3027274c9f17\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b01099d56350551bae3da88b97bf3027274c9f17\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Raise errors in OSS when assign bool to int/enum field in Python Proto. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/5b116fe2f14f49dd0cc3b76089983717f211025c\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/5b116fe2f14f49dd0cc3b76089983717f211025c\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove float_format/double_format from python proto text_format (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/e4854a186e0bfa867d5bfa5cd850608a948fd488\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/e4854a186e0bfa867d5bfa5cd850608a948fd488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Raise TypeError when convert non-timedelta to Duration, or convert non-datetime to Timestamp in python proto. (Original code may raise ArributeError) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/00aaca1b4d98954bc2933d7c8a5379ba6088124c\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/00aaca1b4d98954bc2933d7c8a5379ba6088124c\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove float_precision from python proto json_format (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/f027f1fcd52b9d080b7ee79f4024f53cf54e0dc5\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/f027f1fcd52b9d080b7ee79f4024f53cf54e0dc5\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove deprecated FieldDescriptor.label (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/0a8ff55518ea5874478ad5b26515b31d186045a9\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/0a8ff55518ea5874478ad5b26515b31d186045a9\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://protobuf.dev/news/\"\u003eProtobuf News\u003c/a\u003e may include additional announcements or pre-announcements for upcoming changes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://protobuf.dev/support/migration/\"\u003eMigration Guide\u003c/a\u003e may include additional guidance for breaking changes.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eBazel\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eFix: cc_toolchain should prefer protoc when prebuilt flag is flipped. (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/25168\"\u003e#25168\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/8c857c3a1c6a106b0a096f1c9fa504bfaca035a9\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/8c857c3a1c6a106b0a096f1c9fa504bfaca035a9\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBreaking change: Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFeat(bazel): wire up prebuilt protoc toolchain (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/24115\"\u003e#24115\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/cc23698b486e690ea2eb873cc7596a87c74a3ba6\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/cc23698b486e690ea2eb873cc7596a87c74a3ba6\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eMigrate \u003ccode\u003eproto_descriptor_set\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/23369\"\u003e#23369\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/8d4dfdd39a7a242a9ed631a6ab2192c57dd9b9c8\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/8d4dfdd39a7a242a9ed631a6ab2192c57dd9b9c8\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eCompiler\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eRuby codegen: support generation of rbs files (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/15633\"\u003e#15633\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/6ebdf851ba78728f0aa145d38454ed9a316fb08d\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/6ebdf851ba78728f0aa145d38454ed9a316fb08d\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAvoid collision name problems between a message named \u003ccode\u003eXyz\u003c/code\u003e and a direct sibling enum named \u003ccode\u003eXyzView\u003c/code\u003e (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/eba53e8f172b273d679759a72ce4250131ee3df1\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/eba53e8f172b273d679759a72ce4250131ee3df1\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eGeneralizing and implementing ValidateFeatureSupport for both Options and Features during proto parsing (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/ed3c57114d8e2b47cca7697ddaa50c1b3762a6b0\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/ed3c57114d8e2b47cca7697ddaa50c1b3762a6b0\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix a bug with custom features outside of the \u003ccode\u003epb\u003c/code\u003e package. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/872d3ce7a4da00d7dcec33ced20cfe45235935e8\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/872d3ce7a4da00d7dcec33ced20cfe45235935e8\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix import option handling when include_imports isn't set. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/9ef9e80afd9bc8379d578fe67e5ab0738728c04e\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/9ef9e80afd9bc8379d578fe67e5ab0738728c04e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix a bug in STRICT check of namespaced enums to properly check for 'reserved 1 to max' (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/1229d4adba24c0952ab85ce96bc7b7f8a1fe6d0f\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/1229d4adba24c0952ab85ce96bc7b7f8a1fe6d0f\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003ePrevent accidental stripping of \u003ccode\u003edebug_redact\u003c/code\u003e options via import option. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/f58b098bffa7ca4045ef7773b09151a6af5d0c28\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/f58b098bffa7ca4045ef7773b09151a6af5d0c28\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eC++\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eAdd EnumerateEnumValues function. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/397d5d99db274b379d1384814074bf7df39d32f7\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/397d5d99db274b379d1384814074bf7df39d32f7\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/protocolbuffers/protobuf/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.32.5 to 2.33.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/releases\"\u003erequests's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.33.0\u003c/h2\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at \u003ca href=\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e. Give it a try, and report any gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/M0d3v1\"\u003e\u003ccode\u003e@​M0d3v1\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6865\"\u003epsf/requests#6865\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/aminvakil\"\u003e\u003ccode\u003e@​aminvakil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7220\"\u003epsf/requests#7220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/E8Price\"\u003e\u003ccode\u003e@​E8Price\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6960\"\u003epsf/requests#6960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mitre88\"\u003e\u003ccode\u003e@​mitre88\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7244\"\u003epsf/requests#7244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/magsen\"\u003e\u003ccode\u003e@​magsen\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6553\"\u003epsf/requests#6553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Rohan5commit\"\u003e\u003ccode\u003e@​Rohan5commit\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7227\"\u003epsf/requests#7227\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base that\nuses Requests, please take a look at \u003ca href=\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e. Give it a try, and report\nany gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now extracts\ncontents to a non-deterministic location to prevent malicious file\nreplacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause\nmalformed authentication to be applied to Requests on\nPython 3.11+. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761\"\u003e\u003ccode\u003ebc04dfd\u003c/code\u003e\u003c/a\u003e v2.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"\u003e\u003ccode\u003e66d21cb\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028\"\u003e\u003ccode\u003e8b9bc8f\u003c/code\u003e\u003c/a\u003e Move badges to top of README (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7293\"\u003e#7293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286\"\u003e\u003ccode\u003ee331a28\u003c/code\u003e\u003c/a\u003e Remove unused extraction call (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7292\"\u003e#7292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29\"\u003e\u003ccode\u003e753fd08\u003c/code\u003e\u003c/a\u003e docs: fix FAQ grammar in httplib2 example\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71\"\u003e\u003ccode\u003e774a0b8\u003c/code\u003e\u003c/a\u003e docs(socks): same block as other sections\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303\"\u003e\u003ccode\u003e9c72a41\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 4.33.0 to 4.34.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be\"\u003e\u003ccode\u003eebf7190\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 4.32.0 to 4.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798\"\u003e\u003ccode\u003e0e4ae38\u003c/code\u003e\u003c/a\u003e docs: exclude Response.is_permanent_redirect from API docs (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7244\"\u003e#7244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a\"\u003e\u003ccode\u003ed568f47\u003c/code\u003e\u003c/a\u003e docs: clarify Quickstart POST example (\u003ca href=\"https://redirect.github.com/psf/requests/issues/6960\"\u003e#6960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/psf/requests/compare/v2.32.5...v2.33.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.5.5 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 2.5.0 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3 is raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects \u003ca href=\"https://opencollective.com/urllib3\"\u003eplease consider contributing financially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been read and decompressed partially. (Reported by \u003ca href=\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or \u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed using the official \u003ca href=\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by \u003ca href=\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca href=\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed data buffered from previous partial reads. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the response after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt=0\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing \u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior of chunked request bodies. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling schemeless URIs were passed to \u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to accept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e, matching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling use with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3 is raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects \u003ca href=\"https://opencollective.com/urllib3\"\u003eplease consider contributing financially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the streaming API were bypassed when HTTP redirects were followed. (CVE-2026-21441 reported by \u003ca href=\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High, GHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours as 6 hours by default. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on Emscripten. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed\nusing the official \u003ccode\u003eBrotli \u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763) \u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720) \u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979) \u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777) \u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636) \u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the\nresponse after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e Release 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e Fix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e Switch to nightly PyPy3.11 in CI for now (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e Avoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when \u003ccode\u003eamt=0\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e Bump dev dependencies (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e Upgrade mypy to version 1.20.2 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e Drop support for EOL PyPy3.10 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e Upgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix warnings (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/urllib3/urllib3/compare/2.5.0...2.7.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/michaelconan/budget-dbt/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/michaelconan/budget-dbt/pull/41","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/michaelconan%2Fbudget-dbt/issues/41","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/41/packages"},{"uuid":"4679325163","node_id":"PR_kwDORUXae87nRPQ_","number":108,"state":"open","title":"Bump tornado from 6.5.5 to 6.5.7 in /examples/workflow_evaluations/simple-agentic-rag","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-17T01:55:13.000Z","updated_at":"2026-06-17T01:56:03.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":"/examples/workflow_evaluations/simple-agentic-rag","ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.5.5\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Sherlock999xxx/tensorzero/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/Sherlock999xxx/tensorzero/pull/108","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Sherlock999xxx%2Ftensorzero/issues/108","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/108/packages"},{"uuid":"4679060733","node_id":"PR_kwDOLQ0XEc7nQX2E","number":32,"state":"open","title":"Bump tornado from 6.4 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-17T00:57:59.000Z","updated_at":"2026-06-17T00:58:06.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.4","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"\u003e [!WARNING]\n\u003e Dependabot will stop supporting `python v3.9`!\n\u003e \n\u003e Please upgrade to one of the following versions: `v3.9`, `v3.10`, `v3.11`, `v3.12`, `v3.13`, or `v3.14`.\n\u003e\n\nBumps [tornado](https://github.com/tornadoweb/tornado) from 6.4 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.0...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=pip\u0026previous-version=6.4\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/google-marketing-solutions/shrinkify/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/google-marketing-solutions/shrinkify/pull/32","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/google-marketing-solutions%2Fshrinkify/issues/32","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/32/packages"},{"uuid":"4677448558","node_id":"PR_kwDOO9HfOc7nLFJm","number":200,"state":"open","title":"Bump tornado from 6.2 to 6.5.7 in /data/datasets/zhihu-kol","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":4,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-16T19:56:16.000Z","updated_at":"2026-06-16T19:59:58.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":"/data/datasets/zhihu-kol","ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.2 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.2.0...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=pip\u0026previous-version=6.2\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ArmorCode-Public-Test/Open-Assistant/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/ArmorCode-Public-Test/Open-Assistant/pull/200","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/ArmorCode-Public-Test%2FOpen-Assistant/issues/200","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/200/packages"},{"uuid":"4676075616","node_id":"PR_kwDODSTwx87nGgCA","number":4702,"state":"closed","title":"build(deps): bump tornado from 6.5.5 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-07-01T21:46:42.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-16T16:30:43.000Z","updated_at":"2026-07-01T21:46:44.000Z","time_to_close":1314959,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps)","packages":[{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e","html_url":"https://github.com/open-telemetry/opentelemetry-python-contrib/pull/4702","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/open-telemetry%2Fopentelemetry-python-contrib/issues/4702","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/4702/packages"},{"uuid":"4672695736","node_id":"PR_kwDOHoXnnc7m7Pq0","number":8,"state":"closed","title":"Bump tornado from 6.2 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-16T12:26:37.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-16T09:04:11.000Z","updated_at":"2026-06-16T12:26:46.000Z","time_to_close":12146,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"\u003e [!WARNING]\n\u003e Dependabot will stop supporting `python v3.9`!\n\u003e \n\u003e Please upgrade to one of the following versions: `v3.9`, `v3.10`, `v3.11`, `v3.12`, `v3.13`, or `v3.14`.\n\u003e\n\nBumps [tornado](https://github.com/tornadoweb/tornado) from 6.2 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.2.0...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.2\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/amacd31/bit-counter/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/amacd31/bit-counter/pull/8","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/amacd31%2Fbit-counter/issues/8","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/8/packages"},{"uuid":"4670352652","node_id":"PR_kwDOQbHgbc7mzr5r","number":31,"state":"closed","title":"chore(deps): bump the pip group across 9 directories with 5 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-06-16T01:59:29.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-16T01:58:27.000Z","updated_at":"2026-06-16T01:59:31.000Z","time_to_close":62,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"pip","update_count":5,"packages":[{"name":"pyarrow","old_version":"16.1.0","new_version":"23.0.1","repository_url":"https://github.com/apache/arrow"},{"name":"pyjwt","old_version":"2.10.1","new_version":"2.13.0","repository_url":"https://github.com/jpadilla/pyjwt"},{"name":"pypdf","old_version":"6.10.2","new_version":"6.12.0","repository_url":"https://github.com/py-pdf/pypdf"},{"name":"torch","old_version":"2.5.1","new_version":"2.12.0","repository_url":"https://github.com/pytorch/pytorch"},{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps the pip group with 5 updates in the /dakota_rl_training/outputs/tinker_qwen30b/wandb/run-20251119_104422-i55d4x26/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.5.1` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /dakota_rl_training/outputs/tinker_qwen4b/wandb/run-20251120_085502-ntfgah7s/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.5.1` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /dakota_rl_training/outputs/tinker_qwen4b/wandb/run-20251120_085815-o69alc9b/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.5.1` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /dakota_rl_training/outputs/tinker_qwen4b/wandb/run-20251120_090142-tbmfb9o0/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.5.1` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /dakota_rl_training/outputs/tinker_smoke/wandb/run-20251118_182158-ymh8qjl6/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.5.1` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /dakota_rl_training/outputs/tinker_smoke/wandb/run-20251118_182714-8xv4ah4h/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.5.1` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /wandb/run-20251105_064731-wq8xuzar/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.8.0` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /wandb/run-20251105_064758-5jy9n26c/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.8.0` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /wandb/run-20251118_210438-u82h659i/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.8.0` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\n\nUpdates `pyarrow` from 16.1.0 to 23.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/apache/arrow/releases\"\u003epyarrow's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Arrow 23.0.1\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/23.0.1.html\"\u003ehttps://arrow.apache.org/release/23.0.1.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.1 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 23.0.1 RC0\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/23.0.0.html\"\u003ehttps://arrow.apache.org/release/23.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 23.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/22.0.0.html\"\u003ehttps://arrow.apache.org/release/22.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0 RC1\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 22.0.0 RC1\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 22.0.0 RC0\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/21.0.0.html\"\u003ehttps://arrow.apache.org/release/21.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC6\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC6\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC5\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC5\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC4\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC4\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC3\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC3\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/20.0.0.html\"\u003ehttps://arrow.apache.org/release/20.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC1\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC1\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC0\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/82a374e5f3de5b744f26591e6cd96de6349c76d9\"\u003e\u003ccode\u003e82a374e\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update versions for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/c1ae37c4a597f466b1806e65a9e011be1060dfc5\"\u003e\u003ccode\u003ec1ae37c\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update .deb/.rpm changelogs for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/8f6e55736f60f1f95aee1e8765c6b75ad9589111\"\u003e\u003ccode\u003e8f6e557\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update CHANGELOG.md for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/4e16a1aeed83a65e6b49556c2fed8e9061cdf980\"\u003e\u003ccode\u003e4e16a1a\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49159\"\u003eGH-49159\u003c/a\u003e: [C++][Gandiva] Detect overflow in repeat() (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49160\"\u003e#49160\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/985621dbfcf3fd2061889e43c50b59825df84f3f\"\u003e\u003ccode\u003e985621d\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/48817\"\u003eGH-48817\u003c/a\u003e [R][C++] Bump C++20 in R build infrastructure (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/48819\"\u003e#48819\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/1bea06ad4e14d75dd97a78a0148cd9cf6f4df0bc\"\u003e\u003ccode\u003e1bea06a\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49024\"\u003eGH-49024\u003c/a\u003e: [CI] Update Debian version in \u003ccode\u003e.env\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49032\"\u003e#49032\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/147bcd6d8f3fef05dd06968d3b60c17721c60334\"\u003e\u003ccode\u003e147bcd6\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49156\"\u003eGH-49156\u003c/a\u003e: [Python] Require GIL for string comparison (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49161\"\u003e#49161\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/e4f922b1621b6c833f583cf26500f115ab5bc483\"\u003e\u003ccode\u003ee4f922b\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49138\"\u003eGH-49138\u003c/a\u003e: [Packaging][Python] Remove nightly cython install from manylinux wh...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/f9376e4721b81bad9fe3fe840926a3283f95ee30\"\u003e\u003ccode\u003ef9376e4\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49003\"\u003eGH-49003\u003c/a\u003e: [C++] Don't consider \u003ccode\u003eout_of_range\u003c/code\u003e an error in float parsing (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49095\"\u003e#49095\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/ab2c0ad6b23d05d5f77fc8a34d5a1c4baaacb0a4\"\u003e\u003ccode\u003eab2c0ad\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49044\"\u003eGH-49044\u003c/a\u003e: [CI][Python] Fix test_download_tzdata_on_windows by adding required...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/apache/arrow/compare/r-16.1.0...apache-arrow-23.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pyjwt` from 2.10.1 to 2.13.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/releases\"\u003epyjwt's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.13.0\u003c/h2\u003e\n\u003ch1\u003ePyJWT 2.13.0 — Security Release\u003c/h1\u003e\n\u003cp\u003eThis release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\"\u003e\u003ccode\u003eGHSA-xgmm-8j9v-c9wx\u003c/code\u003e\u003c/a\u003e — JWK JSON accepted as HMAC secret (algorithm confusion).\u003c/strong\u003e \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in \u003ccode\u003ealgorithms=[…]\u003c/code\u003e and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. \u003cem\u003eReported by \u003ca href=\"https://github.com/aradona91\"\u003e\u003ccode\u003e@​aradona91\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\"\u003e\u003ccode\u003eGHSA-jq35-7prp-9v3f\u003c/code\u003e\u003c/a\u003e — Algorithm allow-list bypass with \u003ccode\u003ePyJWK\u003c/code\u003e / \u003ccode\u003ePyJWKClient\u003c/code\u003e.\u003c/strong\u003e When verifying with a \u003ccode\u003ePyJWK\u003c/code\u003e, the caller's \u003ccode\u003ealgorithms=[…]\u003c/code\u003e allow-list was checked against the token header \u003ccode\u003ealg\u003c/code\u003e as a string only; actual verification used the algorithm bound to the \u003ccode\u003ePyJWK\u003c/code\u003e. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header \u003ccode\u003ealg\u003c/code\u003e to match the \u003ccode\u003ePyJWK\u003c/code\u003e's algorithm before verification. \u003cem\u003eReported by \u003ca href=\"https://github.com/sushi-gif\"\u003e\u003ccode\u003e@​sushi-gif\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\"\u003e\u003ccode\u003eGHSA-w7vc-732c-9m39\u003c/code\u003e\u003c/a\u003e — DoS via base64 decode of unused payload segment when \u003ccode\u003eb64=false\u003c/code\u003e.\u003c/strong\u003e For detached-payload JWS (\u003ccode\u003eb64=false\u003c/code\u003e), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied \u003ccode\u003edetached_payload\u003c/code\u003e. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. \u003cem\u003eReported by \u003ca href=\"https://github.com/thesmartshadow\"\u003e\u003ccode\u003e@​thesmartshadow\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\"\u003e\u003ccode\u003eGHSA-993g-76c3-p5m4\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e accepts non-HTTP(S) URIs.\u003c/strong\u003e \u003ccode\u003ePyJWKClient.fetch_data\u003c/code\u003e passed its URI to \u003ccode\u003eurllib.request.urlopen\u003c/code\u003e, which by default also handles \u003ccode\u003efile://\u003c/code\u003e, \u003ccode\u003eftp://\u003c/code\u003e, and \u003ccode\u003edata:\u003c/code\u003e schemes. An application that fed an attacker-influenced URI into \u003ccode\u003ePyJWKClient\u003c/code\u003e could be coerced into reading local files or reaching other unintended schemes. \u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects any URI whose scheme isn't \u003ccode\u003ehttp\u003c/code\u003e or \u003ccode\u003ehttps\u003c/code\u003e. \u003cem\u003eReported by \u003ca href=\"https://github.com/KEIJOT\"\u003e\u003ccode\u003e@​KEIJOT\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\"\u003e\u003ccode\u003eGHSA-fhv5-28vv-h8m8\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e cache wiped on fetch error.\u003c/strong\u003e A \u003ccode\u003efinally\u003c/code\u003e-block \u003ccode\u003eput(jwk_set=None)\u003c/code\u003e cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. \u003cem\u003eReported by \u003ca href=\"https://github.com/eddieran\"\u003e\u003ccode\u003e@​eddieran\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReject empty HMAC keys outright in \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e with \u003ccode\u003eInvalidKeyError\u003c/code\u003e instead of accepting them with only a warning. Defends against the \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e footgun. \u003cem\u003eThanks to \u003ca href=\"https://github.com/SnailSploit\"\u003e\u003ccode\u003e@​SnailSploit\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"https://github.com/spartan8806\"\u003e\u003ccode\u003e@​spartan8806\u003c/code\u003e\u003c/a\u003e for the reports.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003eForward per-call \u003ccode\u003eoptions\u003c/code\u003e (including \u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e) from \u003ccode\u003ePyJWT.decode\u003c/code\u003e through to \u003ccode\u003ePyJWS._verify_signature\u003c/code\u003e. The option was previously silently dropped between the two layers, so it only took effect when set on the \u003ccode\u003ePyJWT\u003c/code\u003e instance. \u003cem\u003eThanks to \u003ca href=\"https://github.com/WLUB\"\u003e\u003ccode\u003e@​WLUB\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRFC 7797 §3 compliance for \u003ccode\u003eb64=false\u003c/code\u003e:\u003c/strong\u003e the encoder now auto-adds \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e to \u003ccode\u003ecrit\u003c/code\u003e, and the decoder rejects tokens that set \u003ccode\u003eb64=false\u003c/code\u003e without listing it in \u003ccode\u003ecrit\u003c/code\u003e. \u003cem\u003eThanks to \u003ca href=\"https://github.com/MachineLearning-Nerd\"\u003e\u003ccode\u003e@​MachineLearning-Nerd\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eChanged\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups, by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/pull/1152\"\u003e#1152\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eUpgrade notes\u003c/h2\u003e\n\u003cp\u003eMost fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eEmpty HMAC keys now raise.\u003c/strong\u003e If your app passed \u003ccode\u003e\u0026quot;\u0026quot;\u003c/code\u003e or \u003ccode\u003eb\u0026quot;\u0026quot;\u003c/code\u003e as a secret (often via a missing env var, e.g. \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e), \u003ccode\u003eencode\u003c/code\u003e/\u003ccode\u003edecode\u003c/code\u003e will now raise \u003ccode\u003eInvalidKeyError\u003c/code\u003e. This is the intended behavior — fix the configuration.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWK\u003c/code\u003e decoding now requires the token's \u003ccode\u003ealg\u003c/code\u003e to match the JWK's algorithm.\u003c/strong\u003e Previously a mismatch was silently honored if the header \u003ccode\u003ealg\u003c/code\u003e appeared in the allow-list. Tokens that relied on this mismatch will now fail with \u003ccode\u003eInvalidAlgorithmError\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects non-HTTP(S) URIs at construction time.\u003c/strong\u003e Tests or dev environments that fetched JWKS from \u003ccode\u003efile://\u003c/code\u003e URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct \u003ccode\u003ePyJWKSet.from_dict(...)\u003c/code\u003e directly).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eb64=false\u003c/code\u003e tokens are now strictly RFC 7515 / 7797 compliant.\u003c/strong\u003e Tokens with a non-empty compact-form payload segment, or that omit \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e from \u003ccode\u003ecrit\u003c/code\u003e, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e set per-call now takes effect.\u003c/strong\u003e Callers who passed \u003ccode\u003eoptions={\u0026quot;enforce_minimum_key_length\u0026quot;: True}\u003c/code\u003e to \u003ccode\u003ejwt.decode()\u003c/code\u003e previously got no enforcement; they will now get \u003ccode\u003eInvalidKeyError\u003c/code\u003e on undersized keys, as documented.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull changelog:\u003c/strong\u003e \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\"\u003ehttps://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e2.12.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd typing_extensions dependency for Python \u0026lt; 3.11 by \u003ca href=\"https://github.com/jpadilla\"\u003e\u003ccode\u003e@​jpadilla\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/pull/1151\"\u003ejpadilla/pyjwt#1151\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\"\u003ehttps://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e2.12.0\u003c/h2\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eValidate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by \u003ca href=\"https://github.com/dmbs335\"\u003e\u003ccode\u003e@​dmbs335\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f\"\u003eGHSA-752w-5fwx-jx9f\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst\"\u003epyjwt's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ccode\u003ev2.13.0 \u0026lt;https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u0026gt;\u003c/code\u003e__\u003c/h2\u003e\n\u003cp\u003eSecurity\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject JWK JSON documents passed as raw HMAC secrets in\n  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that\n  the existing PEM/SSH guard did not cover. Reported by @aradona91 in\n  `GHSA-xgmm-8j9v-c9wx \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\u0026gt;`__.\n- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during\n  verification so the caller's ``algorithms=[...]`` allow-list cannot be\n  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported\n  by @sushi-gif in `GHSA-jq35-7prp-9v3f \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\u0026gt;`__.\n- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-\n  influenced URIs cannot read local files or reach unintended schemes via\n  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported\n  by @KEIJOT in `GHSA-993g-76c3-p5m4 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\u0026gt;`__.\n- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.\n  The previous ``finally``-block ``put(None)`` pattern cleared the cache\n  on any transient outage, turning one bad JWKS request into application-\n  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\u0026gt;`__.\n- Skip the unconditional base64 decode of the compact-form payload segment\n  when ``b64=false`` is set in the protected header, and require that\n  segment to be empty (RFC 7515 Appendix F detached form). Closes an\n  unauthenticated DoS amplifier. Reported by @thesmartshadow in\n  `GHSA-w7vc-732c-9m39 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\u0026gt;`__.\n\u003cp\u003eFixed\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with\n  ``InvalidKeyError`` instead of accepting them with only a warning.\n  Thanks to @SnailSploit and @spartan8806 for independently flagging the\n  footgun.\n- Forward per-call ``options`` (including ``enforce_minimum_key_length``)\n  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the\n  option actually takes effect when set at the call site rather than only\n  on the ``PyJWT`` instance. Thanks to @WLUB for the report.\n- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds\n  ``\u0026amp;quot;b64\u0026amp;quot;`` to the ``crit`` header parameter, and the decoder rejects\n  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to\n  @MachineLearning-Nerd for the report.\n\nChanged\n\u003c/code\u003e\u003c/pre\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ccode\u003e[#1152](https://github.com/jpadilla/pyjwt/issues/1152) \u0026amp;lt;https://github.com/jpadilla/pyjwt/pull/1152\u0026amp;gt;\u003c/code\u003e__\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ccode\u003ev2.12.1 \u0026amp;lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\u0026amp;gt;\u003c/code\u003e__\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt;\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff\"\u003e\u003ccode\u003e7144e45\u003c/code\u003e\u003c/a\u003e Apply ruff format\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab\"\u003e\u003ccode\u003ed2f4bec\u003c/code\u003e\u003c/a\u003e Restore \u003ccode\u003ecast()\u003c/code\u003e calls with cross-version \u003ccode\u003etype: ignore\u003c/code\u003e for \u003ccode\u003eprepare_key\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774\"\u003e\u003ccode\u003e22f478c\u003c/code\u003e\u003c/a\u003e Remove redundant casts in \u003ccode\u003eRSAAlgorithm.prepare_key\u003c/code\u003e and `ECAlgorithm.prepare...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81\"\u003e\u003ccode\u003e95791b1\u003c/code\u003e\u003c/a\u003e Bundle security fixes and hardening into 2.13.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508\"\u003e\u003ccode\u003edcc27a9\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1155\"\u003e#1155\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a\"\u003e\u003ccode\u003e9d08a9a\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1146\"\u003e#1146\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64\"\u003e\u003ccode\u003eb87c100\u003c/code\u003e\u003c/a\u003e Bump codecov/codecov-action from 5 to 6 (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1154\"\u003e#1154\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812\"\u003e\u003ccode\u003e40e3147\u003c/code\u003e\u003c/a\u003e Migrate development extras to dependency groups (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1152\"\u003e#1152\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/a4e1a3d1218b01c5806420b8f16d9308ac4adc30\"\u003e\u003ccode\u003ea4e1a3d\u003c/code\u003e\u003c/a\u003e Add typing_extensions dependency for Python \u0026lt; 3.11 (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1151\"\u003e#1151\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/bd9700cca7f9258fadcc429c1034e508025931f2\"\u003e\u003ccode\u003ebd9700c\u003c/code\u003e\u003c/a\u003e Use PyJWK algorithm when encoding without explicit algorithm (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1148\"\u003e#1148\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.10.1...2.13.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pypdf` from 6.10.2 to 6.12.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/py-pdf/pypdf/releases\"\u003epypdf's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.12.0, 2026-05-21\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDisallow cross-reference streams with zero-only width values (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3791\"\u003e#3791\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAvoid excessive whitespace in layout mode text extraction (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3790\"\u003e#3790\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImplement SASLprep (RFC 4013) for AES-256 password normalization (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3780\"\u003e#3780\u003c/a\u003e) by \u003ca href=\"https://github.com/adityamoolya\"\u003e\u003ccode\u003e@​adityamoolya\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCID font resource from font file to encode more characters (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3652\"\u003e#3652\u003c/a\u003e) by \u003ca href=\"https://github.com/PJBrs\"\u003e\u003ccode\u003e@​PJBrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance Improvements (PI)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eOptimize retrieval of named destinatinos in reader (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3442\"\u003e#3442\u003c/a\u003e) by \u003ca href=\"https://github.com/larsga\"\u003e\u003ccode\u003e@​larsga\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes (BUG)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix TreeObject.insert_child KeyError on fresh children (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3786\"\u003e#3786\u003c/a\u003e) by \u003ca href=\"https://github.com/Abzaek\"\u003e\u003ccode\u003e@​Abzaek\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAppearanceStream: Also honor user-set font name when not flattening annotations (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3781\"\u003e#3781\u003c/a\u003e) by \u003ca href=\"https://github.com/PJBrs\"\u003e\u003ccode\u003e@​PJBrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation (DOC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBlock encrypting writer in incremental mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3789\"\u003e#3789\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.11.0...6.12.0\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.11.0, 2026-05-09\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eInitialise a Font from an embedded font file (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3704\"\u003e#3704\u003c/a\u003e) by \u003ca href=\"https://github.com/PJBrs\"\u003e\u003ccode\u003e@​PJBrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAllow to fix AES padding length in non-strict mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3742\"\u003e#3742\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDeveloper Experience (DEV)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEnable PyPy testing again (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3752\"\u003e#3752\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAlign mypy Makefile target with strict mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3690\"\u003e#3690\u003c/a\u003e) by \u003ca href=\"https://github.com/costajohnt\"\u003e\u003ccode\u003e@​costajohnt\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.10.2...6.11.0\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md\"\u003epypdf's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.12.0, 2026-05-21\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDisallow cross-reference streams with zero-only width values (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3791\"\u003e#3791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAvoid excessive whitespace in layout mode text extraction (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3790\"\u003e#3790\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImplement SASLprep (RFC 4013) for AES-256 password normalization (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3780\"\u003e#3780\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eCID font resource from font file to encode more characters (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3652\"\u003e#3652\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance Improvements (PI)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eOptimize retrieval of named destinatinos in reader (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3442\"\u003e#3442\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes (BUG)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix TreeObject.insert_child KeyError on fresh children (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3786\"\u003e#3786\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAppearanceStream: Also honor user-set font name when not flattening annotations (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3781\"\u003e#3781\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation (DOC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBlock encrypting writer in incremental mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3789\"\u003e#3789\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.11.0...6.12.0\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.11.0, 2026-05-09\u003c/h2\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eInitialise a Font from an embedded font file (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3704\"\u003e#3704\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAllow to fix AES padding length in non-strict mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3742\"\u003e#3742\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDeveloper Experience (DEV)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEnable PyPy testing again (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3752\"\u003e#3752\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAlign mypy Makefile target with strict mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3690\"\u003e#3690\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.10.2...6.11.0\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/08eb1435ef2e4d1e3d5fe90636c3cee7aa6f4470\"\u003e\u003ccode\u003e08eb143\u003c/code\u003e\u003c/a\u003e REL: 6.12.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70\"\u003e\u003ccode\u003e507d7c9\u003c/code\u003e\u003c/a\u003e SEC: Disallow cross-reference streams with zero-only width values (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3791\"\u003e#3791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/9d2747057c4afc06ccc0fc6244a3915ba6ea6f0b\"\u003e\u003ccode\u003e9d27470\u003c/code\u003e\u003c/a\u003e SEC: Avoid excessive whitespace in layout mode text extraction (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3790\"\u003e#3790\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/0a8e699d33ff1d82fae17b7cfa6d01b822be50b2\"\u003e\u003ccode\u003e0a8e699\u003c/code\u003e\u003c/a\u003e DOC: Block encrypting writer in incremental mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3789\"\u003e#3789\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/541ebd4e6e0c23dd90f5723210b585655d2a9519\"\u003e\u003ccode\u003e541ebd4\u003c/code\u003e\u003c/a\u003e DEV: Update idna from version 3.10 to 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/de405a8d3fc7156140570b03dc1db95f85fe1159\"\u003e\u003ccode\u003ede405a8\u003c/code\u003e\u003c/a\u003e DEV: Update idna from version 3.10 to 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/a2b90f978e97828cb2254fb146d5194727c79171\"\u003e\u003ccode\u003ea2b90f9\u003c/code\u003e\u003c/a\u003e ROB: AppearanceStream: Also honor user-set font name when not flattening anno...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/22bd60f913c0fe3b0354d73911d202dfc1a1acf8\"\u003e\u003ccode\u003e22bd60f\u003c/code\u003e\u003c/a\u003e MAINT: Tiny change of comments (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3787\"\u003e#3787\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/29953925e9ca8ec6f941ae7efbaf2829cbd51b35\"\u003e\u003ccode\u003e2995392\u003c/code\u003e\u003c/a\u003e ENH: Implement SASLprep (RFC 4013) for AES-256 password normalization (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3780\"\u003e#3780\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/e044789d4ad8b6c370f6cee5b563579a2b832784\"\u003e\u003ccode\u003ee044789\u003c/code\u003e\u003c/a\u003e TST: Disable PyPy update checks after image update\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.10.2...6.12.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `torch` from 2.5.1 to 2.12.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/releases\"\u003etorch's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ePyTorch 2.12.0 Release Notes\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#highlights\"\u003eHighlights\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes\"\u003eBackwards Incompatible Changes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#deprecations\"\u003eDeprecations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#new-features\"\u003eNew Features\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#improvements\"\u003eImprovements\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes\"\u003eBug fixes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#performance\"\u003ePerformance\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#documentation\"\u003eDocumentation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#developers\"\u003eDevelopers\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#security\"\u003eSecurity\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eHighlights\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cp\u003eFor more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.\u003c/p\u003e\n\u003ch1\u003eBackwards Incompatible Changes\u003c/h1\u003e\n\u003ch2\u003eBuild Frontend\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eStrengthened SVE compile checks in \u003ccode\u003eFindARM.cmake\u003c/code\u003e, which may reject previously accepted but incorrect SVE configurations (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/pull/176646\"\u003e#176646\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003eSource builds that enable SVE now validate the compiler configuration more strictly. If a build previously passed with an incomplete or mismatched SVE setup, it may now fail during CMake configuration instead of later in compilation. Update the compiler/toolchain flags so they accurately describe the target SVE support, or disable SVE for that build.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdated the minimum CUDA version required to build PyTorch from source to CUDA 12.6 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/pull/178925\"\u003e#178925\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003eBuilding PyTorch from source with CUDA versions older than 12.6 is no longer supported. Users building custom binaries should install CUDA 12.6 or newer and make sure \u003ccode\u003eCUDA_HOME\u003c/code\u003e points to that installation.\u003c/p\u003e\n\u003cp\u003eVersion 2.11:\u003c/p\u003e\n\u003cpre lang=\"bash\"\u003e\u003ccode\u003eCUDA_HOME=/usr/local/cuda-12.4 python setup.py develop\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eVersion 2.12:\u003c/p\u003e\n\u003cpre lang=\"bash\"\u003e\u003ccode\u003eCUDA_HOME=/usr/local/cuda-12.6 python setup.py develop\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eEnforced a C++20 minimum in CMake build files (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/pull/178662\"\u003e#178662\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/0d62256a2b23365f8e1604297eb23a6545102aa8\"\u003e\u003ccode\u003e0d62256\u003c/code\u003e\u003c/a\u003e [release] Dockerfile: skip torchaudio install when CUDA_PATH=cu132 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/183346\"\u003e#183346\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/7661cd9c6b841b62b7f411aa52ec51f05457263b\"\u003e\u003ccode\u003e7661cd9\u003c/code\u003e\u003c/a\u003e [MPS] Fix SDPA wrong output for permuted q/k/v with B \u0026gt; 1 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/181886\"\u003e#181886\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/9da6087ab64ab6a2118686420ca5353c90dd7e1f\"\u003e\u003ccode\u003e9da6087\u003c/code\u003e\u003c/a\u003e Fix stale PYTORCH_RELEASES_CODE_CC dict (fixes \u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/182250\"\u003e#182250\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/182369\"\u003e#182369\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/e4c37cc011d47246ce8ea4b99c9b28fb7f400224\"\u003e\u003ccode\u003ee4c37cc\u003c/code\u003e\u003c/a\u003e Avoid raw stream name collisions in Inductor (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/182178\"\u003e#182178\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/822d047dc8dd8d919f83c3ad5c786e405075d1f0\"\u003e\u003ccode\u003e822d047\u003c/code\u003e\u003c/a\u003e [MPS] Fix bool mask handling in 1-pass SDPA decode kernel (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/182285\"\u003e#182285\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/182311\"\u003e#182311\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/5c5e523cd520e6986006e45be243b3ee927ea546\"\u003e\u003ccode\u003e5c5e523\u003c/code\u003e\u003c/a\u003e Add enable_gqa parameter to SDPA MPS meta registration (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/181550\"\u003e#181550\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/eece52ead16886e5463c3dcee9b04db783cc68d5\"\u003e\u003ccode\u003eeece52e\u003c/code\u003e\u003c/a\u003e [AOTI] Add BC-safe c_shim v2 for _scaled_dot_product_attention_math_for_mps e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/b39330bbe210b9628207e84d8ba2cabb7975fbac\"\u003e\u003ccode\u003eb39330b\u003c/code\u003e\u003c/a\u003e [Inductor] Call latest c_shim version for versioned fallback ops (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/181548\"\u003e#181548\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/06f10d088229a25ac52bd14b6cacc04a4161f6ca\"\u003e\u003ccode\u003e06f10d0\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;[FSDP2] add fqn to communication ops\u0026quot; (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/182100\"\u003e#182100\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/182157\"\u003e#182157\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/449e3393139a1aca9afec120c9a63f98f12d55b0\"\u003e\u003ccode\u003e449e339\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;[Inductor] Improve materialization heuristic for a chain of computaio...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pytorch/pytorch/compare/v2.5.1...v2.12.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.5.5 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pyarrow` from 16.1.0 to 23.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/apache/arrow/releases\"\u003epyarrow's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Arrow 23.0.1\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/23.0.1.html\"\u003ehttps://arrow.apache.org/release/23.0.1.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.1 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 23.0.1 RC0\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/23.0.0.html\"\u003ehttps://arrow.apache.org/release/23.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 23.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/22.0.0.html\"\u003ehttps://arrow.apache.org/release/22.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0 RC1\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 22.0.0 RC1\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 22.0.0 RC0\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/21.0.0.html\"\u003ehttps://arrow.apache.org/release/21.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC6\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC6\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC5\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC5\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC4\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC4\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC3\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC3\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/20.0.0.html\"\u003ehttps://arrow.apache.org/release/20.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC1\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC1\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC0\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/82a374e5f3de5b744f26591e6cd96de6349c76d9\"\u003e\u003ccode\u003e82a374e\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update versions for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/c1ae37c4a597f466b1806e65a9e011be1060dfc5\"\u003e\u003ccode\u003ec1ae37c\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update .deb/.rpm changelogs for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/8f6e55736f60f1f95aee1e8765c6b75ad9589111\"\u003e\u003ccode\u003e8f6e557\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update CHANGELOG.md for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/4e16a1aeed83a65e6b49556c2fed8e9061cdf980\"\u003e\u003ccode\u003e4e16a1a\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49159\"\u003eGH-49159\u003c/a\u003e: [C++][Gandiva] Detect overflow in repeat() (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49160\"\u003e#49160\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/985621dbfcf3fd2061889e43c50b59825df84f3f\"\u003e\u003ccode\u003e985621d\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/48817\"\u003eGH-48817\u003c/a\u003e [R][C++] Bump C++20 in R build infrastructure (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/48819\"\u003e#48819\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/1bea06ad4e14d75dd97a78a0148cd9cf6f4df0bc\"\u003e\u003ccode\u003e1bea06a\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49024\"\u003eGH-49024\u003c/a\u003e: [CI] Update Debian version in \u003ccode\u003e.env\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49032\"\u003e#49032\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/147bcd6d8f3fef05dd06968d3b60c17721c60334\"\u003e\u003ccode\u003e147bcd6\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49156\"\u003eGH-49156\u003c/a\u003e: [Python] Require GIL for string comparison (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49161\"\u003e#49161\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/e4f922b1621b6c833f583cf26500f115ab5bc483\"\u003e\u003ccode\u003ee4f922b\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49138\"\u003eGH-49138\u003c/a\u003e: [Packaging][Python] Remove nightly cython install from manylinux wh...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/f9376e4721b81bad9fe3fe840926a3283f95ee30\"\u003e\u003ccode\u003ef9376e4\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49003\"\u003eGH-49003\u003c/a\u003e: [C++] Don't consider \u003ccode\u003eout_of_range\u003c/code\u003e an error in float parsing (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49095\"\u003e#49095\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/ab2c0ad6b23d05d5f77fc8a34d5a1c4baaacb0a4\"\u003e\u003ccode\u003eab2c0ad\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49044\"\u003eGH-49044\u003c/a\u003e: [CI][Python] Fix test_download_tzdata_on_windows by adding required...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/apache/arrow/compare/r-16.1.0...apache-arrow-23.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pyjwt` from 2.10.1 to 2.13.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/releases\"\u003epyjwt's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.13.0\u003c/h2\u003e\n\u003ch1\u003ePyJWT 2.13.0 — Security Release\u003c/h1\u003e\n\u003cp\u003eThis release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\"\u003e\u003ccode\u003eGHSA-xgmm-8j9v-c9wx\u003c/code\u003e\u003c/a\u003e — JWK JSON accepted as HMAC secret (algorithm confusion).\u003c/strong\u003e \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in \u003ccode\u003ealgorithms=[…]\u003c/code\u003e and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. \u003cem\u003eReported by \u003ca href=\"https://github.com/aradona91\"\u003e\u003ccode\u003e@​aradona91\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\"\u003e\u003ccode\u003eGHSA-jq35-7prp-9v3f\u003c/code\u003e\u003c/a\u003e — Algorithm allow-list bypass with \u003ccode\u003ePyJWK\u003c/code\u003e / \u003ccode\u003ePyJWKClient\u003c/code\u003e.\u003c/strong\u003e When verifying with a \u003ccode\u003ePyJWK\u003c/code\u003e, the caller's \u003ccode\u003ealgorithms=[…]\u003c/code\u003e allow-list was checked against the token header \u003ccode\u003ealg\u003c/code\u003e as a string only; actual verification used the algorithm bound to the \u003ccode\u003ePyJWK\u003c/code\u003e. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header \u003ccode\u003ealg\u003c/code\u003e to match the \u003ccode\u003ePyJWK\u003c/code\u003e's algorithm before verification. \u003cem\u003eReported by \u003ca href=\"https://github.com/sushi-gif\"\u003e\u003ccode\u003e@​sushi-gif\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\"\u003e\u003ccode\u003eGHSA-w7vc-732c-9m39\u003c/code\u003e\u003c/a\u003e — DoS via base64 decode of unused payload segment when \u003ccode\u003eb64=false\u003c/code\u003e.\u003c/strong\u003e For detached-payload JWS (\u003ccode\u003eb64=false\u003c/code\u003e), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied \u003ccode\u003edetached_payload\u003c/code\u003e. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. \u003cem\u003eReported by \u003ca href=\"https://github.com/thesmartshadow\"\u003e\u003ccode\u003e@​thesmartshadow\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\"\u003e\u003ccode\u003eGHSA-993g-76c3-p5m4\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e accepts non-HTTP(S) URIs.\u003c/strong\u003e \u003ccode\u003ePyJWKClient.fetch_data\u003c/code\u003e passed its URI to \u003ccode\u003eurllib.request.urlopen\u003c/code\u003e, which by default also handles \u003ccode\u003efile://\u003c/code\u003e, \u003ccode\u003eftp://\u003c/code\u003e, and \u003ccode\u003edata:\u003c/code\u003e schemes. An application that fed an attacker-influenced URI into \u003ccode\u003ePyJWKClient\u003c/code\u003e could be coerced into reading local files or reaching other unintended schemes. \u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects any URI whose scheme isn't \u003ccode\u003ehttp\u003c/code\u003e or \u003ccode\u003ehttps\u003c/code\u003e. \u003cem\u003eReported by \u003ca href=\"https://github.com/KEIJOT\"\u003e\u003ccode\u003e@​KEIJOT\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\"\u003e\u003ccode\u003eGHSA-fhv5-28vv-h8m8\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e cache wiped on fetch error.\u003c/strong\u003e A \u003ccode\u003efinally\u003c/code\u003e-block \u003ccode\u003eput(jwk_set=None)\u003c/code\u003e cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. \u003cem\u003eReported by \u003ca href=\"https://github.com/eddieran\"\u003e\u003ccode\u003e@​eddieran\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReject empty HMAC keys outright in \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e with \u003ccode\u003eInvalidKeyError\u003c/code\u003e instead of accepting them with only a warning. Defends against the \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e footgun. \u003cem\u003eThanks to \u003ca href=\"https://github.com/SnailSploit\"\u003e\u003ccode\u003e@​SnailSploit\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"https://github.com/spartan8806\"\u003e\u003ccode\u003e@​spartan8806\u003c/code\u003e\u003c/a\u003e for the reports.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003eForward per-call \u003ccode\u003eoptions\u003c/code\u003e (including \u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e) from \u003ccode\u003ePyJWT.decode\u003c/code\u003e through to \u003ccode\u003ePyJWS._verify_signature\u003c/code\u003e. The option was previously silently dropped between the two layers, so it only took effect when set on the \u003ccode\u003ePyJWT\u003c/code\u003e instance. \u003cem\u003eThanks to \u003ca href=\"https://github.com/WLUB\"\u003e\u003ccode\u003e@​WLUB\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRFC 7797 §3 compliance for \u003ccode\u003eb64=false\u003c/code\u003e:\u003c/strong\u003e the encoder now auto-adds \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e to \u003ccode\u003ecrit\u003c/code\u003e, and the decoder rejects tokens that set \u003ccode\u003eb64=false\u003c/code\u003e without listing it in \u003ccode\u003ecrit\u003c/code\u003e. \u003cem\u003eThanks to \u003ca href=\"https://github.com/MachineLearning-Nerd\"\u003e\u003ccode\u003e@​MachineLearning-Nerd\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eChanged\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups, by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/pull/1152\"\u003e#1152\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eUpgrade notes\u003c/h2\u003e\n\u003cp\u003eMost fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eEmpty HMAC keys now raise.\u003c/strong\u003e If your app passed \u003ccode\u003e\u0026quot;\u0026quot;\u003c/code\u003e or \u003ccode\u003eb\u0026quot;\u0026quot;\u003c/code\u003e as a secret (often via a missing env var, e.g. \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e), \u003ccode\u003eencode\u003c/code\u003e/\u003ccode\u003edecode\u003c/code\u003e will now raise \u003ccode\u003eInvalidKeyError\u003c/code\u003e. This is the intended behavior — fix the configuration.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWK\u003c/code\u003e decoding now requires the token's \u003ccode\u003ealg\u003c/code\u003e to match the JWK's algorithm.\u003c/strong\u003e Previously a mismatch was silently honored if the header \u003ccode\u003ealg\u003c/code\u003e appeared in the allow-list. Tokens that relied on this mismatch will now fail with \u003ccode\u003eInvalidAlgorithmError\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects non-HTTP(S) URIs at construction time.\u003c/strong\u003e Tests or dev environments that fetched JWKS from \u003ccode\u003efile://\u003c/code\u003e URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct \u003ccode\u003ePyJWKSet.from_dict(...)\u003c/code\u003e directly).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eb64=false\u003c/code\u003e tokens are now strictly RFC 7515 / 7797 compliant.\u003c/strong\u003e Tokens with a non-empty compact-form payload segment, or that omit \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e from \u003ccode\u003ecrit\u003c/code\u003e, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e set per-call now takes effect.\u003c/strong\u003e Callers who passed \u003ccode\u003eoptions={\u0026quot;enforce_minimum_key_length\u0026quot;: True}\u003c/code\u003e to \u003ccode\u003ejwt.decode()\u003c/code\u003e previously got no enforcement; they will now get \u003ccode\u003eInvalidKeyError\u003c/code\u003e on undersized keys, as documented.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull changelog:\u003c/strong\u003e \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\"\u003ehttps://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e2.12.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd typing_extensions dependency for Python \u0026lt; 3.11 by \u003ca href=\"https://github.com/jpadilla\"\u003e\u003ccode\u003e@​jpadilla\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/pull/1151\"\u003ejpadilla/pyjwt#1151\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\"\u003ehttps://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e2.12.0\u003c/h2\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eValidate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by \u003ca href=\"https://github.com/dmbs335\"\u003e\u003ccode\u003e@​dmbs335\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f\"\u003eGHSA-752w-5fwx-jx9f\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst\"\u003epyjwt's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ccode\u003ev2.13.0 \u0026lt;https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u0026gt;\u003c/code\u003e__\u003c/h2\u003e\n\u003cp\u003eSecurity\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject JWK JSON documents passed as raw HMAC secrets in\n  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that\n  the existing PEM/SSH guard did not cover. Reported by @aradona91 in\n  `GHSA-xgmm-8j9v-c9wx \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\u0026gt;`__.\n- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during\n  verification so the caller's ``algorithms=[...]`` allow-list cannot be\n  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported\n  by @sushi-gif in `GHSA-jq35-7prp-9v3f \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\u0026gt;`__.\n- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-\n  influenced URIs cannot read local files or reach unintended schemes via\n  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported\n  by @KEIJOT in `GHSA-993g-76c3-p5m4 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\u0026gt;`__.\n- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.\n  The previous ``finally``-block ``put(None)`` pattern cleared the cache\n  on any transient outage, turning one bad JWKS request into application-\n  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\u0026gt;`__.\n- Skip the unconditional base64 decode of the compact-form payload segment\n  when ``b64=false`` is set in the protected header, and require that\n  segment to be empty (RFC 7515 Appendix F detached form). Closes an\n  unauthenticated DoS amplifier. Reported by @thesmartshadow in\n  `GHSA-w7vc-732c-9m39 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\u0026gt;`__.\n\u003cp\u003eFixed\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with\n  ``InvalidKeyError`` instead of accepting them with only a warning.\n  Thanks to @SnailSploit and @spartan8806 for independently flagging the\n  footgun.\n- Forward per-call ``options`` (including ``enforce_minimum_key_length``)\n  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the\n  option actually takes effect when set at the call site rather than only\n  on the ``PyJWT`` instance. Thanks to @WLUB for the report.\n- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds\n  ``\u0026amp;quot;b64\u0026amp;quot;`` to the ``crit`` header parameter, and the decoder rejects\n  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to\n  @MachineLearning-Nerd for the report.\n\nChanged\n\u003c/code\u003e\u003c/pre\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ccode\u003e[#1152](https://github.com/jpadilla/pyjwt/issues/1152) \u0026amp;lt;https://github.com/jpadilla/pyjwt/pull/1152\u0026amp;gt;\u003c/code\u003e__\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ccode\u003ev2.12.1 \u0026amp;lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\u0026amp;gt;\u003c/code\u003e__\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt;\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff\"\u003e\u003ccode\u003e7144e45\u003c/code\u003e\u003c/a\u003e Apply ruff format\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab\"\u003e\u003ccode\u003ed2f4bec\u003c/code\u003e\u003c/a\u003e Restore \u003ccode\u003ecast()\u003c/code\u003e calls with cross-version \u003ccode\u003etype: ignore\u003c/code\u003e for \u003ccode\u003eprepare_key\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774\"\u003e\u003ccode\u003e22f478c\u003c/code\u003e\u003c/a\u003e Remove redundant casts in \u003ccode\u003eRSAAlgorithm.prepare_key\u003c/code\u003e and `ECAlgorithm.prepare...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81\"\u003e\u003ccode\u003e95791b1\u003c/code\u003e\u003c/a\u003e Bundle security fixes and hardening into 2.13.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508\"\u003e\u003ccode\u003edcc27a9\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1155\"\u003e#1155\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a\"\u003e\u003ccode\u003e9d08a9a\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1146\"\u003e#1146\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64\"\u003e\u003ccode\u003eb87c100\u003c/code\u003e\u003c/a\u003e Bump codecov/codecov-action from 5 to 6 (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1154\"\u003e#1154\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812\"\u003e\u003ccode\u003e40e3147\u003c/code\u003e\u003c/a\u003e Migrate development extras to dependency groups (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1152\"\u003e#1152\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/a4e1a3d1218b01c5806420b8f16d9308ac4adc30\"\u003e\u003ccode\u003ea4e1a3d\u003c/code\u003e\u003c/a\u003e Add typing_extensions dependency for Python \u0026lt; 3.11 (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1151\"\u003e#1151\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/bd9700cca7f9258fadcc429c1034e508025931f2\"\u003e\u003ccode\u003ebd9700c\u003c/code\u003e\u003c/a\u003e Use PyJWK algorithm when encoding without explicit algorithm (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1148\"\u003e#1148\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.10.1...2.13.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pypdf` from 6.10.2 to 6.12.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/py-pdf/pypdf/releases\"\u003epypdf's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.12.0, 2026-05-21\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDisallow cross-reference streams with zero-only width values (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3791\"\u003e#3791\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAvoid excessive whitespace in layout mode text extraction (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3790\"\u003e#3790\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImplement SASLprep (RFC 4013) for AES-256 password normalization (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3780\"\u003e#3780\u003c/a\u003e) by \u003ca href=\"https://github.com/adityamoolya\"\u003e\u003ccode\u003e@​adityamoolya\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCID font resource from font file to encode more characters (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3652\"\u003e#3652\u003c/a\u003e) by \u003ca href=\"https://github.com/PJBrs\"\u003e\u003ccode\u003e@​PJBrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance Improvements (PI)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eOptimize retrieval of named destinatinos in reader (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3442\"\u003e#3442\u003c/a\u003e) by \u003ca href=\"https://github.com/larsga\"\u003e\u003ccode\u003e@​larsga\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes (BUG)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix TreeObject.insert_child KeyError on fresh children (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3786\"\u003e#3786\u003c/a\u003e) by \u003ca href=\"https://github.com/Abzaek\"\u003e\u003ccode\u003e@​Abzaek\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAppearanceStream: Also honor user-set font name when not flattening annotations (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3781\"\u003e#3781\u003c/a\u003e) by \u003ca href=\"https://github.com/PJBrs\"\u003e\u003ccode\u003e@​PJBrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation (DOC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBlock encrypting writer in incremental mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3789\"\u003e#3789\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.11.0...6.12.0\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.11.0, 2026-05-09\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eInitialise a Font from an embedded font file (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3704\"\u003e#3704\u003c/a\u003e) by \u003ca href=\"https://github.com/PJBrs\"\u003e\u003ccode\u003e@​PJBrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAllow to fix AES padding length in non-strict mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3742\"\u003e#3742\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDeveloper Experience (DEV)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEnable PyPy testing again (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3752\"\u003e#3752\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAlign mypy Makefile target with strict mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3690\"\u003e#3690\u003c/a\u003e) by \u003ca href=\"https://github.com/costajohnt\"\u003e\u003ccode\u003e@​costajohnt\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.10.2...6.11.0\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md\"\u003epypdf's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.12.0, 2026-05-21\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDisallow cross-reference streams with zero-only width values (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3791\"\u003e#3791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAvoid excessive whitespace in layout mode text extraction (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3790\"\u003e#3790\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImplement SASLprep (RFC 4013) for AES-256 password normalization (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3780\"\u003e#3780\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eCID font resource from font file to encode more characters (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3652\"\u003e#3652\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance Improvements (PI)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eOptimize retrieval of named destinatinos in reader (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3442\"\u003e#3442\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes (BUG)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix TreeObject.insert_child KeyError on fresh children (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3786\"\u003e#3786\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAppearanceStream: Also honor user-set font name when not flattening annotations (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3781\"\u003e#3781\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation (DOC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBlock encrypting writer in incremental mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3789\"\u003e#3789\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.11.0...6...\n\n_Description has been truncated_","html_url":"https://github.com/HarleyCoops/Qwen3-RailroadEngineer1959-RL/pull/31","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/HarleyCoops%2FQwen3-RailroadEngineer1959-RL/issues/31","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/31/packages"},{"uuid":"4669093683","node_id":"PR_kwDOK45rdc7mvloO","number":2010,"state":"closed","title":"MAINT: Bump tornado from 6.5.6 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-17T01:06:29.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-15T21:36:45.000Z","updated_at":"2026-06-17T01:06:31.000Z","time_to_close":98984,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"MAINT: Bump","packages":[{"name":"tornado","old_version":"6.5.6","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.6 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.6...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.5.6\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/PyRIT/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/microsoft/PyRIT/pull/2010","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/microsoft%2FPyRIT/issues/2010","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2010/packages"},{"uuid":"4666863201","node_id":"PR_kwDOMdpTR87moIlq","number":318,"state":"closed","title":"Bump tornado from 6.5.5 to 6.5.6 in /workshops/Building_Generative_AI_applications/notebooks/app","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-17T01:11:47.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-15T16:15:39.000Z","updated_at":"2026-06-17T01:11:49.000Z","time_to_close":118568,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.5.5","new_version":"6.5.6","repository_url":"https://github.com/tornadoweb/tornado"}],"path":"/workshops/Building_Generative_AI_applications/notebooks/app","ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.6.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac\"\u003e\u003ccode\u003e96dc88c\u003c/code\u003e\u003c/a\u003e speedups: validate mask length\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/ff808b33adc52d89a549376a5e3628e92abbc8ff\"\u003e\u003ccode\u003eff808b3\u003c/code\u003e\u003c/a\u003e http1connection: Enforce max_body_size in _GzipMessageDelegate\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/ede4e37f93c1edbc0bf749e9a57c9db2501cd54b\"\u003e\u003ccode\u003eede4e37\u003c/code\u003e\u003c/a\u003e auth: Correctly parse check_authentication response\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/1c178bef88bbd29907eb94a2a649a4a6675681de\"\u003e\u003ccode\u003e1c178be\u003c/code\u003e\u003c/a\u003e Remove obsolete curl force_timeout workaround\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/c99d55bb6cc0c9da2c6696545ed4ee1d20b7fcf0\"\u003e\u003ccode\u003ec99d55b\u003c/code\u003e\u003c/a\u003e Replace deprecated pycurl IOCTLFUNCTION callback with SEEKFUNCTION\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/27614316ef8ad125fe18725cf96e384560ba0e14\"\u003e\u003ccode\u003e2761431\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3587\"\u003e#3587\u003c/a\u003e from bdarnell/fix-link\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=pip\u0026previous-version=6.5.5\u0026new-version=6.5.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/aws-samples/amazon-neptune-generative-ai-samples/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/aws-samples/amazon-neptune-generative-ai-samples/pull/318","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-samples%2Famazon-neptune-generative-ai-samples/issues/318","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/318/packages"}],"issue_packages":[{"old_version":"6.5.5","new_version":"6.5.7","update_type":"patch","path":null,"pr_created_at":"2026-08-07T15:37:43.000Z","version_change":"6.5.5 → 6.5.7","issue":{"uuid":"5091679351","node_id":"PR_kwDOQOaeec78HDh6","number":59,"state":"closed","title":"Bump the all group across 1 directory with 57 updates","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-08-07T15:42:01.000Z","author_association":null,"state_reason":null,"created_at":"2026-08-07T15:37:43.000Z","updated_at":"2026-08-07T15:42:03.000Z","time_to_close":258,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","group_name":"all","update_count":57,"packages":[{"name":"imageio","old_version":"2.37.3","new_version":"2.37.4","repository_url":"https://github.com/imageio/imageio"},{"name":"jupyter-book","old_version":"2.1.4","new_version":"2.1.6","repository_url":"https://github.com/jupyter-book/jupyter-book"},{"name":"matplotlib","old_version":"3.10.8","new_version":"3.11.1","repository_url":"https://github.com/matplotlib/matplotlib"},{"name":"numpy","old_version":"2.4.4","new_version":"2.5.1","repository_url":"https://github.com/numpy/numpy"},{"name":"zarr","old_version":"3.1.6","new_version":"3.3.0","repository_url":"https://github.com/zarr-developers/zarr-python"},{"name":"pydantic-zarr","old_version":"0.9.2","new_version":"0.10.0","repository_url":"https://github.com/zarr-developers/pydantic-zarr"},{"name":"ome-zarr-models","old_version":"1.6","new_version":"1.7","repository_url":"https://github.com/ome-zarr-models/ome-zarr-models-py"},{"name":"scipy","old_version":"1.17.1","new_version":"1.18.0","repository_url":"https://github.com/scipy/scipy"},{"name":"jupyterlab","old_version":"4.5.6","new_version":"4.6.2","repository_url":"https://github.com/jupyterlab/jupyterlab"},{"name":"jupytext","old_version":"1.19.1","new_version":"1.19.5","repository_url":"https://github.com/jupytext/jupytext"},{"name":"annotated-types","old_version":"0.7.0","new_version":"0.8.0","repository_url":"https://github.com/annotated-types/annotated-types"},{"name":"anyio","old_version":"4.13.0","new_version":"4.14.2","repository_url":"https://github.com/agronholm/anyio"},{"name":"asttokens","old_version":"3.0.1","new_version":"3.0.2","repository_url":"https://github.com/gristlabs/asttokens"},{"name":"beautifulsoup4","old_version":"4.14.3","new_version":"4.15.0"},{"name":"bleach","old_version":"6.3.0","new_version":"6.4.0","repository_url":"https://github.com/mozilla/bleach"},{"name":"certifi","old_version":"2026.2.25","new_version":"2026.7.22","repository_url":"https://github.com/certifi/python-certifi"},{"name":"cffi","old_version":"2.0.0","new_version":"2.1.1","repository_url":"https://github.com/python-cffi/cffi"},{"name":"charset-normalizer","old_version":"3.4.7","new_version":"3.4.9","repository_url":"https://github.com/jawah/charset_normalizer"},{"name":"debugpy","old_version":"1.8.20","new_version":"1.8.21","repository_url":"https://github.com/microsoft/debugpy"},{"name":"decorator","old_version":"5.2.1","new_version":"5.3.1","repository_url":"https://github.com/micheles/decorator"},{"name":"fastjsonschema","old_version":"2.21.2","new_version":"2.22.1","repository_url":"https://github.com/horejsek/python-fastjsonschema"},{"name":"fonttools","old_version":"4.62.1","new_version":"4.63.0","repository_url":"https://github.com/fonttools/fonttools"},{"name":"idna","old_version":"3.11","new_version":"3.18","repository_url":"https://github.com/kjd/idna"},{"name":"imageio","old_version":"2.37.3","new_version":"2.37.4","repository_url":"https://github.com/imageio/imageio"},{"name":"ipykernel","old_version":"7.2.0","new_version":"7.3.0","repository_url":"https://github.com/ipython/ipykernel"},{"name":"ipython","old_version":"9.12.0","new_version":"9.16.1","repository_url":"https://github.com/ipython/ipython"},{"name":"jedi","old_version":"0.19.2","new_version":"0.20.0","repository_url":"https://github.com/davidhalter/jedi"},{"name":"json5","old_version":"0.14.0","new_version":"0.15.0","repository_url":"https://github.com/dpranke/pyjson5"},{"name":"jupyter-client","old_version":"8.8.0","new_version":"8.9.1","repository_url":"https://github.com/jupyter/jupyter_client"},{"name":"jupyter-events","old_version":"0.12.0","new_version":"0.12.1","repository_url":"https://github.com/jupyter/jupyter_events"},{"name":"jupyter-server","old_version":"2.17.0","new_version":"2.20.0","repository_url":"https://github.com/jupyter-server/jupyter_server"},{"name":"markdown-it-py","old_version":"4.0.0","new_version":"4.2.0","repository_url":"https://github.com/executablebooks/markdown-it-py"},{"name":"matplotlib-inline","old_version":"0.2.1","new_version":"0.2.2","repository_url":"https://github.com/ipython/matplotlib-inline"},{"name":"mdit-py-plugins","old_version":"0.5.0","new_version":"0.6.1","repository_url":"https://github.com/executablebooks/mdit-py-plugins"},{"name":"mistune","old_version":"3.2.0","new_version":"3.3.4","repository_url":"https://github.com/lepture/mistune"},{"name":"nbclient","old_version":"0.10.4","new_version":"0.11.0","repository_url":"https://github.com/jupyter/nbclient"},{"name":"packaging","old_version":"26.0","new_version":"26.2","repository_url":"https://github.com/pypa/packaging"},{"name":"parso","old_version":"0.8.6","new_version":"0.8.7","repository_url":"https://github.com/davidhalter/parso"},{"name":"pillow","old_version":"12.2.0","new_version":"12.3.0","repository_url":"https://github.com/python-pillow/Pillow"},{"name":"platformdirs","old_version":"4.9.6","new_version":"4.11.0","repository_url":"https://github.com/tox-dev/platformdirs"},{"name":"prometheus-client","old_version":"0.25.0","new_version":"0.26.0","repository_url":"https://github.com/prometheus/client_python"},{"name":"prompt-toolkit","old_version":"3.0.52","new_version":"3.0.53","repository_url":"https://github.com/prompt-toolkit/python-prompt-toolkit"},{"name":"pydantic","old_version":"2.13.0","new_version":"2.13.4","repository_url":"https://github.com/pydantic/pydantic"},{"name":"pydantic-core","old_version":"2.46.0","new_version":"2.47.0","repository_url":"https://github.com/pydantic/pydantic"},{"name":"pywin32","old_version":"311","new_version":"312","repository_url":"https://github.com/mhammond/pywin32"},{"name":"pywinpty","old_version":"3.0.3","new_version":"3.0.5","repository_url":"https://github.com/andfoy/pywinpty"},{"name":"requests","old_version":"2.33.1","new_version":"2.34.2","repository_url":"https://github.com/psf/requests"},{"name":"rpds-py","old_version":"0.30.0","new_version":"2026.6.3","repository_url":"https://github.com/crate-py/rpds"},{"name":"setuptools","old_version":"82.0.1","new_version":"83.0.0","repository_url":"https://github.com/pypa/setuptools"},{"name":"soupsieve","old_version":"2.8.3","new_version":"2.9.1","repository_url":"https://github.com/facelessuser/soupsieve"},{"name":"tifffile","old_version":"2026.4.11","new_version":"2026.7.31","repository_url":"https://github.com/cgohlke/tifffile"},{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"traitlets","old_version":"5.14.3","new_version":"5.16.1","repository_url":"https://github.com/ipython/traitlets"},{"name":"types-python-dateutil","old_version":"2.9.0.20260408","new_version":"2.9.0.20260716","repository_url":"https://github.com/python/typeshed"},{"name":"typing-extensions","old_version":"4.15.0","new_version":"4.16.0","repository_url":"https://github.com/python/typing_extensions"},{"name":"urllib3","old_version":"2.6.3","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"},{"name":"wcwidth","old_version":"0.6.0","new_version":"0.8.2","repository_url":"https://github.com/jquast/wcwidth"}],"path":null,"ecosystem":"pip"},"body":"Bumps the all group with 57 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [imageio[tifffile]](https://github.com/imageio/imageio) | `2.37.3` | `2.37.4` |\n| [jupyter-book](https://github.com/jupyter-book/jupyter-book) | `2.1.4` | `2.1.6` |\n| [matplotlib](https://github.com/matplotlib/matplotlib) | `3.10.8` | `3.11.1` |\n| [numpy](https://github.com/numpy/numpy) | `2.4.4` | `2.5.1` |\n| [zarr](https://github.com/zarr-developers/zarr-python) | `3.1.6` | `3.3.0` |\n| [pydantic-zarr](https://github.com/zarr-developers/pydantic-zarr) | `0.9.2` | `0.10.0` |\n| [ome-zarr-models](https://github.com/ome-zarr-models/ome-zarr-models-py) | `1.6` | `1.7` |\n| [scipy](https://github.com/scipy/scipy) | `1.17.1` | `1.18.0` |\n| [jupyterlab](https://github.com/jupyterlab/jupyterlab) | `4.5.6` | `4.6.2` |\n| [jupytext](https://github.com/jupytext/jupytext) | `1.19.1` | `1.19.5` |\n| [annotated-types](https://github.com/annotated-types/annotated-types) | `0.7.0` | `0.8.0` |\n| [anyio](https://github.com/agronholm/anyio) | `4.13.0` | `4.14.2` |\n| [asttokens](https://github.com/gristlabs/asttokens) | `3.0.1` | `3.0.2` |\n| [beautifulsoup4](https://www.crummy.com/software/BeautifulSoup/bs4/) | `4.14.3` | `4.15.0` |\n| [bleach](https://github.com/mozilla/bleach) | `6.3.0` | `6.4.0` |\n| [certifi](https://github.com/certifi/python-certifi) | `2026.2.25` | `2026.7.22` |\n| [cffi](https://github.com/python-cffi/cffi) | `2.0.0` | `2.1.1` |\n| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.7` | `3.4.9` |\n| [debugpy](https://github.com/microsoft/debugpy) | `1.8.20` | `1.8.21` |\n| [decorator](https://github.com/micheles/decorator) | `5.2.1` | `5.3.1` |\n| [fastjsonschema](https://github.com/horejsek/python-fastjsonschema) | `2.21.2` | `2.22.1` |\n| [fonttools](https://github.com/fonttools/fonttools) | `4.62.1` | `4.63.0` |\n| [idna](https://github.com/kjd/idna) | `3.11` | `3.18` |\n| [imageio](https://github.com/imageio/imageio) | `2.37.3` | `2.37.4` |\n| [ipykernel](https://github.com/ipython/ipykernel) | `7.2.0` | `7.3.0` |\n| [ipython](https://github.com/ipython/ipython) | `9.12.0` | `9.16.1` |\n| [jedi](https://github.com/davidhalter/jedi) | `0.19.2` | `0.20.0` |\n| [json5](https://github.com/dpranke/pyjson5) | `0.14.0` | `0.15.0` |\n| [jupyter-client](https://github.com/jupyter/jupyter_client) | `8.8.0` | `8.9.1` |\n| [jupyter-events](https://github.com/jupyter/jupyter_events) | `0.12.0` | `0.12.1` |\n| [jupyter-server](https://github.com/jupyter-server/jupyter_server) | `2.17.0` | `2.20.0` |\n| [markdown-it-py](https://github.com/executablebooks/markdown-it-py) | `4.0.0` | `4.2.0` |\n| [matplotlib-inline](https://github.com/ipython/matplotlib-inline) | `0.2.1` | `0.2.2` |\n| [mdit-py-plugins](https://github.com/executablebooks/mdit-py-plugins) | `0.5.0` | `0.6.1` |\n| [mistune](https://github.com/lepture/mistune) | `3.2.0` | `3.3.4` |\n| [nbclient](https://github.com/jupyter/nbclient) | `0.10.4` | `0.11.0` |\n| [packaging](https://github.com/pypa/packaging) | `26.0` | `26.2` |\n| [parso](https://github.com/davidhalter/parso) | `0.8.6` | `0.8.7` |\n| [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` |\n| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.9.6` | `4.11.0` |\n| [prometheus-client](https://github.com/prometheus/client_python) | `0.25.0` | `0.26.0` |\n| [prompt-toolkit](https://github.com/prompt-toolkit/python-prompt-toolkit) | `3.0.52` | `3.0.53` |\n| [pydantic](https://github.com/pydantic/pydantic) | `2.13.0` | `2.13.4` |\n| [pydantic-core](https://github.com/pydantic/pydantic) | `2.46.0` | `2.47.0` |\n| [pywin32](https://github.com/mhammond/pywin32) | `311` | `312` |\n| [pywinpty](https://github.com/andfoy/pywinpty) | `3.0.3` | `3.0.5` |\n| [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` |\n| [rpds-py](https://github.com/crate-py/rpds) | `0.30.0` | `2026.6.3` |\n| [setuptools](https://github.com/pypa/setuptools) | `82.0.1` | `83.0.0` |\n| [soupsieve](https://github.com/facelessuser/soupsieve) | `2.8.3` | `2.9.1` |\n| [tifffile](https://github.com/cgohlke/tifffile) | `2026.4.11` | `2026.7.31` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n| [traitlets](https://github.com/ipython/traitlets) | `5.14.3` | `5.16.1` |\n| [types-python-dateutil](https://github.com/python/typeshed) | `2.9.0.20260408` | `2.9.0.20260716` |\n| [typing-extensions](https://github.com/python/typing_extensions) | `4.15.0` | `4.16.0` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.6.3` | `2.7.0` |\n| [wcwidth](https://github.com/jquast/wcwidth) | `0.6.0` | `0.8.2` |\n\n\nUpdates `imageio[tifffile]` from 2.37.3 to 2.37.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/imageio/imageio/releases\"\u003eimageio[tifffile]'s releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.37.4 (2026-07-20)\u003c/h2\u003e\n\u003cp\u003e\u003cem\u003eThis release is published under the BSD-2-Clause License.\u003c/em\u003e\u003c/p\u003e\n\u003ch3\u003eBug\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSet filename parameter of FileNotFoundError exception (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/922\"\u003e#922\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/28c2401839738d39e28e3d7e5b584c6fbe143a2a\"\u003e\u003ccode\u003e28c2401\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDoc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix typos in docstrings and comments (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1193\"\u003e#1193\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/eae520f8a7469dd681fbee77eeee3d3139d1721b\"\u003e\u003ccode\u003eeae520f\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaint\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eBump aiohttp from 3.13.3 to 3.13.4 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1178\"\u003e#1178\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/7853240312fdfa992aa8f9ec6814e282f27460c9\"\u003e\u003ccode\u003e7853240\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump aiohttp from 3.13.4 to 3.14.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1191\"\u003e#1191\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/30c35592dc8836a44e9733a214838fa1530adb07\"\u003e\u003ccode\u003e30c3559\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump black from 26.3.0 to 26.3.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1173\"\u003e#1173\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/a1b083f20d3ed293e9b8609e7ee9b7bd5b09150e\"\u003e\u003ccode\u003ea1b083f\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump gdal from 3.12.2 to 3.13.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1192\"\u003e#1192\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/45fb6942de4035fc379068e1785915267c2e746c\"\u003e\u003ccode\u003e45fb694\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump idna from 3.11 to 3.15 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1189\"\u003e#1189\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/35eefdfb2a1b78bab887d9e7b34f26d1173e78a2\"\u003e\u003ccode\u003e35eefdf\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump pygments from 2.19.2 to 2.20.0 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1177\"\u003e#1177\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/ff0c95bf07a9c50c14bf7ac62a95b465ff7b2ab8\"\u003e\u003ccode\u003eff0c95b\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump requests from 2.32.5 to 2.33.0 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1176\"\u003e#1176\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/8f78220f0e97ddcffbb9c6b0d2ba9612503b81d2\"\u003e\u003ccode\u003e8f78220\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump soupsieve from 2.8.3 to 2.8.4 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1195\"\u003e#1195\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/e032eea65b93801aca1cacad668fcc0f6ffaa93d\"\u003e\u003ccode\u003ee032eea\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump urllib3 from 2.6.3 to 2.7.0 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1184\"\u003e#1184\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/5aef4946ed991ee6f293c74391a582dadfd78640\"\u003e\u003ccode\u003e5aef494\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSet readme content-type in project metadata (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1165\"\u003e#1165\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/9929abb19399080f0fe766f705823fe8d79dd980\"\u003e\u003ccode\u003e9929abb\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eTest\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate CI to support new dependency versions (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1196\"\u003e#1196\u003c/a\u003e, \u003ca href=\"https://github.com/imageio/imageio/commit/dfdc909c225662784c7c9469232bbe46ea983501\"\u003e\u003ccode\u003edfdc909\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003cp\u003e\u003cstrong\u003eDetailed Changes\u003c/strong\u003e: \u003ca href=\"https://github.com/imageio/imageio/compare/v2.37.3...v2.37.4\"\u003ev2.37.3...v2.37.4\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/imageio/imageio/blob/master/CHANGELOG.md\"\u003eimageio[tifffile]'s changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.37.4 (2026-07-20)\u003c/h2\u003e\n\u003ch3\u003eBug\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSet filename parameter of FileNotFoundError exception\n(\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/922\"\u003e#922\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/28c2401839738d39e28e3d7e5b584c6fbe143a2a\"\u003e\u003ccode\u003e28c2401\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDoc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix typos in docstrings and comments (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1193\"\u003e#1193\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/eae520f8a7469dd681fbee77eeee3d3139d1721b\"\u003e\u003ccode\u003eeae520f\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaint\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eBump aiohttp from 3.13.3 to 3.13.4 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1178\"\u003e#1178\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/7853240312fdfa992aa8f9ec6814e282f27460c9\"\u003e\u003ccode\u003e7853240\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump aiohttp from 3.13.4 to 3.14.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1191\"\u003e#1191\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/30c35592dc8836a44e9733a214838fa1530adb07\"\u003e\u003ccode\u003e30c3559\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump black from 26.3.0 to 26.3.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1173\"\u003e#1173\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/a1b083f20d3ed293e9b8609e7ee9b7bd5b09150e\"\u003e\u003ccode\u003ea1b083f\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump gdal from 3.12.2 to 3.13.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1192\"\u003e#1192\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/45fb6942de4035fc379068e1785915267c2e746c\"\u003e\u003ccode\u003e45fb694\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump idna from 3.11 to 3.15 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1189\"\u003e#1189\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/35eefdfb2a1b78bab887d9e7b34f26d1173e78a2\"\u003e\u003ccode\u003e35eefdf\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump pygments from 2.19.2 to 2.20.0 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1177\"\u003e#1177\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/ff0c95bf07a9c50c14bf7ac62a95b465ff7b2ab8\"\u003e\u003ccode\u003eff0c95b\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump requests from 2.32.5 to 2.33.0 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1176\"\u003e#1176\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/8f78220f0e97ddcffbb9c6b0d2ba9612503b81d2\"\u003e\u003ccode\u003e8f78220\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump soupsieve from 2.8.3 to 2.8.4 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1195\"\u003e#1195\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/e032eea65b93801aca1cacad668fcc0f6ffaa93d\"\u003e\u003ccode\u003ee032eea\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eBump urllib3 from 2.6.3 to 2.7.0 (\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1184\"\u003e#1184\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/5aef4946ed991ee6f293c74391a582dadfd78640\"\u003e\u003ccode\u003e5aef494\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eSet readme content-type in project metadata\n(\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1165\"\u003e#1165\u003c/a\u003e,\n\u003ca href=\"https://github.com/imageio/imageio/commit/9929abb19399080f0fe766f705823fe8d79dd980\"\u003e\u003ccode\u003e9929abb\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eTest\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate CI to support new dependency versions\n(\u003ca href=\"https://redirect.github.com/imageio/imageio/pull/1196\"\u003e#1196\u003c/a\u003e,\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/671d96a5dd9bc94050cc89c4b436e2f7c874283e\"\u003e\u003ccode\u003e671d96a\u003c/code\u003e\u003c/a\u003e REL: Release imageio v2.37.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/28c2401839738d39e28e3d7e5b584c6fbe143a2a\"\u003e\u003ccode\u003e28c2401\u003c/code\u003e\u003c/a\u003e BUG: set filename parameter of FileNotFoundError exception (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/922\"\u003e#922\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/eae520f8a7469dd681fbee77eeee3d3139d1721b\"\u003e\u003ccode\u003eeae520f\u003c/code\u003e\u003c/a\u003e DOC: Fix typos in docstrings and comments (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1193\"\u003e#1193\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/5aef4946ed991ee6f293c74391a582dadfd78640\"\u003e\u003ccode\u003e5aef494\u003c/code\u003e\u003c/a\u003e MAINT: Bump urllib3 from 2.6.3 to 2.7.0 (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1184\"\u003e#1184\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/35eefdfb2a1b78bab887d9e7b34f26d1173e78a2\"\u003e\u003ccode\u003e35eefdf\u003c/code\u003e\u003c/a\u003e MAINT: Bump idna from 3.11 to 3.15 (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1189\"\u003e#1189\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/30c35592dc8836a44e9733a214838fa1530adb07\"\u003e\u003ccode\u003e30c3559\u003c/code\u003e\u003c/a\u003e MAINT: Bump aiohttp from 3.13.4 to 3.14.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1191\"\u003e#1191\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/45fb6942de4035fc379068e1785915267c2e746c\"\u003e\u003ccode\u003e45fb694\u003c/code\u003e\u003c/a\u003e MAINT: Bump gdal from 3.12.2 to 3.13.1 (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1192\"\u003e#1192\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/e032eea65b93801aca1cacad668fcc0f6ffaa93d\"\u003e\u003ccode\u003ee032eea\u003c/code\u003e\u003c/a\u003e MAINT: Bump soupsieve from 2.8.3 to 2.8.4 (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1195\"\u003e#1195\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/dfdc909c225662784c7c9469232bbe46ea983501\"\u003e\u003ccode\u003edfdc909\u003c/code\u003e\u003c/a\u003e TEST: Update CI to support new dependency versions (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1196\"\u003e#1196\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/imageio/imageio/commit/c7f8249472f63d6b3c0b8cc9fae823714931c36e\"\u003e\u003ccode\u003ec7f8249\u003c/code\u003e\u003c/a\u003e [MAINT] Bump pytest from 9.0.2 to 9.0.3 (\u003ca href=\"https://redirect.github.com/imageio/imageio/issues/1183\"\u003e#1183\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/imageio/imageio/compare/v2.37.3...v2.37.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `jupyter-book` from 2.1.4 to 2.1.6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jupyter-book/jupyter-book/releases\"\u003ejupyter-book's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.1.6\u003c/h2\u003e\n\u003ch2\u003e2.1.6\u003c/h2\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter-book/jupyter-book/compare/v2.1.5...9d7752b86f7d7c216871bc709d3670dd3b2ebab0\"\u003eFull Changelog\u003c/a\u003e)\u003c/p\u003e\n\u003ch3\u003eMaintenance and upkeep improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump myst-cli to v1.10.1 \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2640\"\u003e#2640\u003c/a\u003e (\u003ca href=\"https://github.com/sbonaretti\"\u003e\u003ccode\u003e@​sbonaretti\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/choldgraf\"\u003e\u003ccode\u003e@​choldgraf\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump the actions group in /.github/workflows with 2 updates \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2628\"\u003e#2628\u003c/a\u003e (\u003ca href=\"https://github.com/bsipocz\"\u003e\u003ccode\u003e@​bsipocz\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDocs: Separate objective and other hosting options in publishing tutorial \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2635\"\u003e#2635\u003c/a\u003e (\u003ca href=\"https://github.com/sbonaretti\"\u003e\u003ccode\u003e@​sbonaretti\u003c/code\u003e\u003c/a\u003e, \u003ca href=\"https://github.com/agoose77\"\u003e\u003ccode\u003e@​agoose77\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eContributors to this release\u003c/h3\u003e\n\u003cp\u003eThe following people contributed discussions, new ideas, code and documentation contributions, and review.\nSee \u003ca href=\"https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports\"\u003eour definition of contributors\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003e(\u003ca href=\"https://github.com/jupyter-book/jupyter-book/graphs/contributors?from=2026-05-02\u0026amp;to=2026-07-05\u0026amp;type=c\"\u003eGitHub contributors page for this release\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/agoose77\"\u003e\u003ccode\u003e@​agoose77\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter-book%2Fjupyter-book+involves%3Aagoose77+updated%3A2026-05-02..2026-07-05\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/bsipocz\"\u003e\u003ccode\u003e@​bsipocz\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter-book%2Fjupyter-book+involves%3Absipocz+updated%3A2026-05-02..2026-07-05\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/choldgraf\"\u003e\u003ccode\u003e@​choldgraf\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter-book%2Fjupyter-book+involves%3Acholdgraf+updated%3A2026-05-02..2026-07-05\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e) | \u003ca href=\"https://github.com/sbonaretti\"\u003e\u003ccode\u003e@​sbonaretti\u003c/code\u003e\u003c/a\u003e (\u003ca href=\"https://github.com/search?q=repo%3Ajupyter-book%2Fjupyter-book+involves%3Asbonaretti+updated%3A2026-05-02..2026-07-05\u0026amp;type=Issues\"\u003eactivity\u003c/a\u003e)\u003c/p\u003e\n\u003ch2\u003ev2.1.5\u003c/h2\u003e\n\u003cp\u003eThis brings in two new releases and several bugfixes, accessibility improvements, and enhancements in mystmd and myst-theme. Release notes for each below:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter-book/mystmd/releases/tag/mystmd%401.9.0\"\u003ehttps://github.com/jupyter-book/mystmd/releases/tag/mystmd%401.9.0\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jupyter-book/myst-theme/releases/tag/myst-to-react%401.3.0\"\u003ehttps://github.com/jupyter-book/myst-theme/releases/tag/myst-to-react%401.3.0\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMaintenance and upkeep improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump the actions group in /.github/workflows with 5 updates \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2617\"\u003e#2617\u003c/a\u003e (\u003ca href=\"https://github.com/bsipocz\"\u003e\u003ccode\u003e@​bsipocz\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix docs noxfile and add a footer \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2609\"\u003e#2609\u003c/a\u003e (\u003ca href=\"https://github.com/choldgraf\"\u003e\u003ccode\u003e@​choldgraf\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBump the actions group in /.github/workflows with 3 updates \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2608\"\u003e#2608\u003c/a\u003e (\u003ca href=\"https://github.com/bsipocz\"\u003e\u003ccode\u003e@​bsipocz\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation improvements\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003ePoint to mystmd docs more and move to index pages \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2620\"\u003e#2620\u003c/a\u003e (\u003ca href=\"https://github.com/choldgraf\"\u003e\u003ccode\u003e@​choldgraf\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eOther merged PRs\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate myst cli \u003ca href=\"https://redirect.github.com/jupyter-book/jupyter-book/pull/2621\"\u003e#2621\u003c/a\u003e (\u003ca href=\"https://github.com/choldgraf\"\u003e\u003ccode\u003e@​choldgraf\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eContributors to this release\u003c/h3\u003e\n\u003cp\u003eThe following people contributed discussions, new ideas, code and documentation contributions, and review.\nSee \u003ca href=\"https://github-activity.readthedocs.io/en/latest/use/#how-does-this-tool-define-contributions-in-the-reports\"\u003eour definition of contributors\u003c/a\u003e.\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/jupyter-book/jupyter-book/compare/v2.1.4...v2.1.6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `matplotlib` from 3.10.8 to 3.11.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/matplotlib/matplotlib/releases\"\u003ematplotlib's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eREL: v3.11.1\u003c/h2\u003e\n\u003cp\u003eThis is the first bugfix release of the 3.11.x series.\u003c/p\u003e\n\u003cp\u003eThis release contains several bug-fixes and adjustments:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFix tight layout of multiple subplots with \u003ccode\u003esharey=True\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eNoNorm\u003c/code\u003e cursor formatting for \u003ccode\u003euint8\u003c/code\u003e images\u003c/li\u003e\n\u003cli\u003eFix occasional misalignment in reported mouse position (also fix a bug with canvas height)\u003c/li\u003e\n\u003cli\u003eFix clipped Axis labels on 3D plots with tight layout\u003c/li\u003e\n\u003cli\u003eFix inverted Axis on 3D plots\u003c/li\u003e\n\u003cli\u003eFix restoring 'auto' aspect in 3D axes after switching from 'equal'\u003c/li\u003e\n\u003cli\u003eFix missing glyphs when subsetting Type 1 fonts in PDF\u003c/li\u003e\n\u003cli\u003eFix oversized embedding of Type 42 fonts in PDF/PostScript files\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eAs well as several documentation and typing improvements and corrections.\u003c/p\u003e\n\u003ch2\u003eREL: v3.11.0\u003c/h2\u003e\n\u003cp\u003eThe largest change within this release is a complete overhaul of text and font processing. Through the use of \u003ca href=\"https://github.com/HOST-Oman/libraqm/\"\u003elibraqm\u003c/a\u003e, \u003ca href=\"https://harfbuzz.github.io/\"\u003eHarfBuzz\u003c/a\u003e, \u003ca href=\"https://github.com/Tehreer/SheenBidi\"\u003eSheenBidi\u003c/a\u003e, and an updated release of \u003ca href=\"https://freetype.org/\"\u003eFreeType\u003c/a\u003e, all text should now support modern font features, enabling full internationalization in all languages. Not all features of these libraries are supported yet, but we expect this work to enable further improvements in an easier manner.\u003c/p\u003e\n\u003cp\u003eOutside of text handling, there are several improvements to 3D Axes, performance, new accessible colour sequences, flexible figure management, and more. \u003ca href=\"https://matplotlib.org/3.11.0/release/prev_whats_new/whats_new_3.11.0.html\"\u003eSee the release notes for more information\u003c/a\u003e.\u003c/p\u003e\n\u003ch2\u003eREL: v3.11.0rc2\u003c/h2\u003e\n\u003cp\u003eThis is the second release candidate for the meso release 3.11.0.\u003c/p\u003e\n\u003cp\u003eThis release candidate fixes some problems with downstream packages, removes some missed deprecations, and corrects some additional minor bugs.\u003c/p\u003e\n\u003ch2\u003eREL: v3.11.0rc1\u003c/h2\u003e\n\u003cp\u003eAfter an extended development stretch, we are pleased to announce the first release candidate of Matplotlib 3.11.0.\u003c/p\u003e\n\u003cp\u003eThe largest change within this release is a complete overhaul of text and font processing. Through the use of \u003ca href=\"https://github.com/HOST-Oman/libraqm/\"\u003elibraqm\u003c/a\u003e, \u003ca href=\"https://harfbuzz.github.io/\"\u003eHarfBuzz\u003c/a\u003e, \u003ca href=\"https://github.com/Tehreer/SheenBidi\"\u003eSheenBidi\u003c/a\u003e, and an updated release of \u003ca href=\"https://freetype.org/\"\u003eFreeType\u003c/a\u003e, all text should now support modern font features, enabling full internationalization in all languages. Not all features of these libraries are supported yet, but we expect this work to enable further improvements in an easier manner. Due to the update to the font rendering stack, we cannot guarantee that text will be bit-for-bit perfect with previous releases, so if you are using Matplotlib for testing, it may be necessary to introduce/raise a tolerance within your tests.\u003c/p\u003e\n\u003cp\u003eOutside of text handling, there are several improvements to 3D Axes, performance, new accessible colour sequences, flexible figure management, and more. Final release notes are still being curated, but you may browse \u003ca href=\"https://matplotlib.org/3.11.0/release/next_whats_new\"\u003ethe list of new features\u003c/a\u003e, \u003ca href=\"https://matplotlib.org/3.11.0/api/next_api_changes.html\"\u003eAPI changes\u003c/a\u003e, and \u003ca href=\"https://github.com/matplotlib/matplotlib/milestone/96?closed=1https://github.com/matplotlib/matplotlib/milestone/96?closed=1\"\u003eall issues/pull requests on the milestone\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eAs a note for downstream packagers, the font libraries have only been tested against the versions bundled with the wheels. It may be possible to expand the range of requirements, or that a requirement is too broad. Please report any issues you have building against external dependencies.\u003c/p\u003e\n\u003ch2\u003ev3.10.9\u003c/h2\u003e\n\u003cp\u003eThis is a micro release of the v3.10.x series.\nHighlights of this release include:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious minor bug and doc fixes\u003c/li\u003e\n\u003cli\u003eSecurity hardening validation of cyclers - Removing eval usage\u003c/li\u003e\n\u003cli\u003eSecurity hardening in Latex and PS calls - Removing shell escapes\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/3c1757a567c58e41e565313af2d3bcdc52076b43\"\u003e\u003ccode\u003e3c1757a\u003c/code\u003e\u003c/a\u003e REL: v3.11.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/792c6b5fa9cd2567a80fa231af19b7770b8288e4\"\u003e\u003ccode\u003e792c6b5\u003c/code\u003e\u003c/a\u003e DOC: Prepare for 3.11.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/aaff9f613a0886fdec0b4e20d9c5f1db15166d2c\"\u003e\u003ccode\u003eaaff9f6\u003c/code\u003e\u003c/a\u003e Merge branch 'v3.11.0-doc' into v3.11.x\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/d4f4527cce030c81eb699516bdd8c1cbab3a940d\"\u003e\u003ccode\u003ed4f4527\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/matplotlib/matplotlib/issues/32052\"\u003e#32052\u003c/a\u003e from meeseeksmachine/auto-backport-of-pr-32038-on-v...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/6ad4bcf48beaf05b8632e082dd35a1c8960324c8\"\u003e\u003ccode\u003e6ad4bcf\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/matplotlib/matplotlib/issues/32050\"\u003e#32050\u003c/a\u003e from meeseeksmachine/auto-backport-of-pr-31304-on-v...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/7fb74d3476247ee7aa078ff45ec60f25f1a9b535\"\u003e\u003ccode\u003e7fb74d3\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/matplotlib/matplotlib/issues/32051\"\u003e#32051\u003c/a\u003e from meeseeksmachine/auto-backport-of-pr-32037-on-v...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/c624aec7de6060e16d708fd70bd2e9302e95d3f3\"\u003e\u003ccode\u003ec624aec\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/matplotlib/matplotlib/issues/32038\"\u003e#32038\u003c/a\u003e: Fix occasional misalignment in reported mouse position (a...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/8eda2b79d27a4255380b97b49dcb61110690c0c1\"\u003e\u003ccode\u003e8eda2b7\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/matplotlib/matplotlib/issues/32037\"\u003e#32037\u003c/a\u003e: Bump the actions group with 3 updates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/a0e7ae5521b59c25ced9c69e8d9aebc1b0bc7c6e\"\u003e\u003ccode\u003ea0e7ae5\u003c/code\u003e\u003c/a\u003e Backport PR \u003ca href=\"https://redirect.github.com/matplotlib/matplotlib/issues/31304\"\u003e#31304\u003c/a\u003e: Fix restoring 'auto' aspect in 3D axes after switching fr...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/matplotlib/matplotlib/commit/90013231a38de53af9414747a03ce010de2fe3d0\"\u003e\u003ccode\u003e9001323\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/matplotlib/matplotlib/issues/32047\"\u003e#32047\u003c/a\u003e from meeseeksmachine/auto-backport-of-pr-32025-on-v...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/matplotlib/matplotlib/compare/v3.10.8...v3.11.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `numpy` from 2.4.4 to 2.5.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/numpy/numpy/releases\"\u003enumpy's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.5.1 (July 4, 2026)\u003c/h2\u003e\n\u003ch1\u003eNumPy 2.5.1 Release Notes\u003c/h1\u003e\n\u003cp\u003eThe NumPy 2.5.1 is a patch release that fixes bugs discovered after the 2.5.0\nrelease. The most noticeable is the fix is to the numpy datetime cython API\nwhich should allow downstream to support NumPy versions older than 2.5.\nPreparation for Python 3.15 continues along with typing improvements.\u003c/p\u003e\n\u003cp\u003eThis release supports Python versions 3.12-3.14\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eThe minimum supported GCC version has been updated from 9.3.0 to 10.3.0\u003c/p\u003e\n\u003cp\u003e(\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31843\"\u003egh-31843\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eContributors\u003c/h2\u003e\n\u003cp\u003eA total of 10 people contributed to this release. People with a \u0026quot;+\u0026quot; by their\nnames contributed a patch for the first time.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdhyan Gupta +\u003c/li\u003e\n\u003cli\u003eAnkit Ahlawat\u003c/li\u003e\n\u003cli\u003eCharles Harris\u003c/li\u003e\n\u003cli\u003eIason Krommydas\u003c/li\u003e\n\u003cli\u003eJoren Hammudoglu\u003c/li\u003e\n\u003cli\u003eKumar Aditya\u003c/li\u003e\n\u003cli\u003eNathan Goldbaum\u003c/li\u003e\n\u003cli\u003eSebastian Berg\u003c/li\u003e\n\u003cli\u003eTies Jan Hefting +\u003c/li\u003e\n\u003cli\u003eVineet Kumar\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ePull requests merged\u003c/h2\u003e\n\u003cp\u003eA total of 20 pull requests were merged for this release.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31707\"\u003e#31707\u003c/a\u003e: MAINT: Prepare 2.5.x for further development\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31721\"\u003e#31721\u003c/a\u003e: CI: fix new \u003ccode\u003ecython-lint\u003c/code\u003e errors (\u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31711\"\u003e#31711\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31723\"\u003e#31723\u003c/a\u003e: MAINT: Update meson to match main\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31729\"\u003e#31729\u003c/a\u003e: TST: use setup-sde instead of curl to get SDE binaries (\u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31727\"\u003e#31727\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31829\"\u003e#31829\u003c/a\u003e: BUG: Relax finfo to be easier accessible for all user dtypes...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31831\"\u003e#31831\u003c/a\u003e: TYP: Fix \u003ccode\u003eflatiter.__next__\u003c/code\u003e return type for \u003ccode\u003eobject_\u003c/code\u003e and...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31832\"\u003e#31832\u003c/a\u003e: BUG: avoid deadlocks using NpyString API (\u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31682\"\u003e#31682\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31833\"\u003e#31833\u003c/a\u003e: BUG: fix out array leak in reduceat and accumulate when dtype...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31835\"\u003e#31835\u003c/a\u003e: BUG: fix numpy datetime cython APIs to be compatible with older...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31836\"\u003e#31836\u003c/a\u003e: TYP: Fix incorrect dtype inference of \u003ccode\u003easarray([])\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31732\"\u003e#31732\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31837\"\u003e#31837\u003c/a\u003e: TYP: Fix \u003ccode\u003enp.ma.masked_array\u003c/code\u003e 2.5.0 regression\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31838\"\u003e#31838\u003c/a\u003e: FIX: Refactor error handling in array_setstate to prevent typecode...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31839\"\u003e#31839\u003c/a\u003e: TST: xfail multithreaded BLAS test more generously\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/numpy/numpy/pull/31840\"\u003e#31840\u003c/a\u003e: MAINT: Rename subroutine for crackfortran tests\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/5e1d03ffac5f2c0a9c39bfcaa9fc853b2b83151e\"\u003e\u003ccode\u003e5e1d03f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31863\"\u003e#31863\u003c/a\u003e from charris/prepare-2.5.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/ad0b66b8bf1faedc727d8a80ec217bdc95a3037e\"\u003e\u003ccode\u003ead0b66b\u003c/code\u003e\u003c/a\u003e REL: Prepare for the NumPy 2.5.1 release.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/9df8516d6c933927b3bb9a7b8fd10f523e627ffd\"\u003e\u003ccode\u003e9df8516\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31858\"\u003e#31858\u003c/a\u003e from charris/backport-31688\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/4dee265afc098a296a62666f6356d4927b67848f\"\u003e\u003ccode\u003e4dee265\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31857\"\u003e#31857\u003c/a\u003e from charris/backport-31775\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/dc8d5530eb0bb3198bfc0538e28d1f284f6f4a80\"\u003e\u003ccode\u003edc8d553\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31856\"\u003e#31856\u003c/a\u003e from charris/backport-31846\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/67cb4a874e7c52d90176ca7343e208dfa3f11d11\"\u003e\u003ccode\u003e67cb4a8\u003c/code\u003e\u003c/a\u003e fix:Signed integer overflow in datetime.c (\u003ca href=\"https://redirect.github.com/numpy/numpy/issues/31688\"\u003e#31688\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/baa2589a94a93b4216159817fe891c83a39eb36d\"\u003e\u003ccode\u003ebaa2589\u003c/code\u003e\u003c/a\u003e TST: Clean up imports, formatting, and assertions\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/2fe5ba41f935065305cfb31a561202188953c7e9\"\u003e\u003ccode\u003e2fe5ba4\u003c/code\u003e\u003c/a\u003e TEST: Refactor tests to use np.testing.assert_raises_regex per review\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/bb465819882f84304ecbfd180f00bd748f783134\"\u003e\u003ccode\u003ebb46581\u003c/code\u003e\u003c/a\u003e MAINT: Remove deprecated Python recursion fix\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/numpy/numpy/commit/8f34214a5e6e813bea56fec2cdc9bc8ac79ff38b\"\u003e\u003ccode\u003e8f34214\u003c/code\u003e\u003c/a\u003e MAINT: Move SeedSequence recursion guard to C-layer and add tests\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/numpy/numpy/compare/v2.4.4...v2.5.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `zarr` from 3.1.6 to 3.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/zarr-developers/zarr-python/releases\"\u003ezarr's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev3.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAllow s3 testing in face of ambient AWS credentials by \u003ca href=\"https://github.com/chuckwondo\"\u003e\u003ccode\u003e@​chuckwondo\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3947\"\u003ezarr-developers/zarr-python#3947\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eci: run all of xarray's tests in downstream workflow by \u003ca href=\"https://github.com/maxrjones\"\u003e\u003ccode\u003e@​maxrjones\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3940\"\u003ezarr-developers/zarr-python#3940\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the actions group across 1 directory with 12 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3930\"\u003ezarr-developers/zarr-python#3930\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: update pre-commit hooks by \u003ca href=\"https://github.com/pre-commit-ci\"\u003e\u003ccode\u003e@​pre-commit-ci\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3943\"\u003ezarr-developers/zarr-python#3943\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(zarr-metadata): bump version to 0.1.1 by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3949\"\u003ezarr-developers/zarr-python#3949\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor: simplify internal chunk representation by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3899\"\u003ezarr-developers/zarr-python#3899\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix V3 time types by \u003ca href=\"https://github.com/chuckwondo\"\u003e\u003ccode\u003e@​chuckwondo\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3955\"\u003ezarr-developers/zarr-python#3955\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: fix ability to run mypy via hatch by \u003ca href=\"https://github.com/chuckwondo\"\u003e\u003ccode\u003e@​chuckwondo\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3952\"\u003ezarr-developers/zarr-python#3952\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix minor typos by \u003ca href=\"https://github.com/kabilar\"\u003e\u003ccode\u003e@​kabilar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3957\"\u003ezarr-developers/zarr-python#3957\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the actions group with 5 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3951\"\u003ezarr-developers/zarr-python#3951\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edeprecate blosc enums by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3963\"\u003ezarr-developers/zarr-python#3963\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBUG: Fix empty Group nodes lacking a \u0026quot;consolidated_metadata\u0026quot; field by \u003ca href=\"https://github.com/TomAugspurger\"\u003e\u003ccode\u003e@​TomAugspurger\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3967\"\u003ezarr-developers/zarr-python#3967\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(zarr-metadata): model stored metadata more closely by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3962\"\u003ezarr-developers/zarr-python#3962\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: allow writing to 0-dimensional arrays with sharding by \u003ca href=\"https://github.com/NIK-TIGER-BILL\"\u003e\u003ccode\u003e@​NIK-TIGER-BILL\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3966\"\u003ezarr-developers/zarr-python#3966\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the actions group with 2 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3970\"\u003ezarr-developers/zarr-python#3970\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: run mypy from developer environment by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3972\"\u003ezarr-developers/zarr-python#3972\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat:get_ranges by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3925\"\u003ezarr-developers/zarr-python#3925\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: remove warning on fixed length utf32 by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3979\"\u003ezarr-developers/zarr-python#3979\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003emisc(zarr-metadata): typed constants and fixes by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3978\"\u003ezarr-developers/zarr-python#3978\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: cd workflow by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3935\"\u003ezarr-developers/zarr-python#3935\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eperf: cache default ArraySpec for regular chunk grids by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3908\"\u003ezarr-developers/zarr-python#3908\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor(sharding): store chunks_per_shard explicitly in _ShardIndex by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3975\"\u003ezarr-developers/zarr-python#3975\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: update link to developer chat by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3980\"\u003ezarr-developers/zarr-python#3980\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat(zarr-metadata): partial metadata types by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3982\"\u003ezarr-developers/zarr-python#3982\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(zarr-metadata): set up a changelog by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3981\"\u003ezarr-developers/zarr-python#3981\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eOptimize partial shard reads by \u003ca href=\"https://github.com/aldenks\"\u003e\u003ccode\u003e@​aldenks\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3004\"\u003ezarr-developers/zarr-python#3004\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDo not install CuPy on darwin by \u003ca href=\"https://github.com/chuckwondo\"\u003e\u003ccode\u003e@​chuckwondo\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3988\"\u003ezarr-developers/zarr-python#3988\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(zarr-metadata): prepare for 0.2.0 release by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3986\"\u003ezarr-developers/zarr-python#3986\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eWiden ChunksLike type alias by \u003ca href=\"https://github.com/chuckwondo\"\u003e\u003ccode\u003e@​chuckwondo\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3990\"\u003ezarr-developers/zarr-python#3990\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: match v* when extracting a zarr version from git tags by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3994\"\u003ezarr-developers/zarr-python#3994\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efeat: subchunk write order by \u003ca href=\"https://github.com/ilan-gold\"\u003e\u003ccode\u003e@​ilan-gold\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3826\"\u003ezarr-developers/zarr-python#3826\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eprune old string dtype class by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3973\"\u003ezarr-developers/zarr-python#3973\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: compare metadata objects by JSON form by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3999\"\u003ezarr-developers/zarr-python#3999\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun doctests via pytest and fix broken doctests. by \u003ca href=\"https://github.com/chuckwondo\"\u003e\u003ccode\u003e@​chuckwondo\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4000\"\u003ezarr-developers/zarr-python#4000\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix(FsspecStore): close owned async filesystem on store.close() by \u003ca href=\"https://github.com/josh-ag2\"\u003e\u003ccode\u003e@​josh-ag2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4003\"\u003ezarr-developers/zarr-python#4003\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump the actions group across 1 directory with 8 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4014\"\u003ezarr-developers/zarr-python#4014\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: use hatch's \u003ccode\u003edefault\u003c/code\u003e env so the uv installer is inherited by \u003ca href=\"https://github.com/lhoupert\"\u003e\u003ccode\u003e@​lhoupert\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4023\"\u003ezarr-developers/zarr-python#4023\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: update pre-commit hooks by \u003ca href=\"https://github.com/pre-commit-ci\"\u003e\u003ccode\u003e@​pre-commit-ci\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4024\"\u003ezarr-developers/zarr-python#4024\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs: test more code snippets in docs by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4018\"\u003ezarr-developers/zarr-python#4018\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps-dev): bump uv from 0.11.14 to 0.11.15 in the uv group across 1 directory by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4019\"\u003ezarr-developers/zarr-python#4019\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor: remove random subchunk ordering by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4011\"\u003ezarr-developers/zarr-python#4011\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: make xarray downstream tests work by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4043\"\u003ezarr-developers/zarr-python#4043\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etest: add property tests for block and mask indexing by \u003ca href=\"https://github.com/maxrjones\"\u003e\u003ccode\u003e@​maxrjones\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4054\"\u003ezarr-developers/zarr-python#4054\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor: use backported sentinel type by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4046\"\u003ezarr-developers/zarr-python#4046\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore(deps): bump aiohttp from 3.13.5 to 3.14.0 in the uv group across 1 directory by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4031\"\u003ezarr-developers/zarr-python#4031\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRevert \u0026quot;fix: make xarray downstream tests work\u0026quot; by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4047\"\u003ezarr-developers/zarr-python#4047\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003echore: indexing test cleanup by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4001\"\u003ezarr-developers/zarr-python#4001\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor/consolidated JSON IO routines by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3998\"\u003ezarr-developers/zarr-python#3998\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/zarr-developers/zarr-python/blob/main/docs/release-notes.md\"\u003ezarr's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.3.0 (2026-07-30)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eOptimizes reading multiple chunks from a shard. Serial calls to \u003ccode\u003eStore.get()\u003c/code\u003e\nin the sharding codec have been replaced with a single call to\n\u003ccode\u003eStore.get_ranges()\u003c/code\u003e, which coalesces nearby byte ranges and fetches them\nconcurrently. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3004\"\u003e#3004\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded a \u003ccode\u003esubchunk_write_order\u003c/code\u003e option to \u003ccode\u003eShardingCodec\u003c/code\u003e to control the physical order of subchunks within a shard. Supported values are \u003ccode\u003emorton\u003c/code\u003e, \u003ccode\u003eunordered\u003c/code\u003e, \u003ccode\u003elexicographic\u003c/code\u003e, and \u003ccode\u003ecolexicographic\u003c/code\u003e. \u003ccode\u003eunordered\u003c/code\u003e makes no guarantee about subchunk layout. This setting affects only on-disk layout, not the data read back, and is not persisted in array metadata: it applies per codec instance and is not recovered when reopening a sharded array. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3826\"\u003e#3826\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded \u003ccode\u003eSyncByteGetter\u003c/code\u003e and \u003ccode\u003eSyncByteSetter\u003c/code\u003e runtime-checkable protocols and a \u003ccode\u003eget_ranges_sync\u003c/code\u003e method on the \u003ccode\u003eStore\u003c/code\u003e ABC. These let custom byte getters/setters opt into the synchronous codec pipeline's fast path for in-memory IO, which the sharding codec uses for its inner chunks. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3885\"\u003e#3885\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded \u003ccode\u003eFusedCodecPipeline\u003c/code\u003e, an opt-in codec pipeline that runs codec compute synchronously and in bulk (avoiding the per-chunk async scheduling overhead of the default \u003ccode\u003eBatchedCodecPipeline\u003c/code\u003e), giving large speedups for sharded arrays. The default \u003ccode\u003eBatchedCodecPipeline\u003c/code\u003e is unchanged for standard configurations, so existing code keeps working unless you opt in; enable the new pipeline with \u003ccode\u003ezarr.config.set({\u0026quot;codec_pipeline.path\u0026quot;: \u0026quot;zarr.core.codec_pipeline.FusedCodecPipeline\u0026quot;})\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3885\"\u003e#3885\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdd \u003ccode\u003ezarr.abc.store.Store.get_ranges\u003c/code\u003e for concurrent, coalesced multi-range reads from a single key. The method is defined on the \u003ccode\u003eStore\u003c/code\u003e ABC with a default implementation built on \u003ccode\u003eStore.get\u003c/code\u003e, so every store inherits a working version; stores with native multi-range backends (e.g. \u003ccode\u003eFsspecStore\u003c/code\u003e) can override for efficiency. Coalescing knobs (\u003ccode\u003emax_concurrency\u003c/code\u003e, \u003ccode\u003emax_gap_bytes\u003c/code\u003e, \u003ccode\u003emax_coalesced_bytes\u003c/code\u003e) are passed as keyword arguments to \u003ccode\u003eget_ranges\u003c/code\u003e. Failures from underlying fetches surface as a \u003ccode\u003eBaseExceptionGroup\u003c/code\u003e (PEP 654); callers should use \u003ccode\u003eexcept*\u003c/code\u003e to filter for specific exception types such as \u003ccode\u003eFileNotFoundError\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3925\"\u003e#3925\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eTwo new fields on \u003ccode\u003eArrayConfig\u003c/code\u003e control how the sharding codec coalesces partial-shard reads: \u003ccode\u003esharding_coalesce_max_gap_bytes\u003c/code\u003e (default 1 MiB) and \u003ccode\u003esharding_coalesce_max_bytes\u003c/code\u003e (default 16 MiB). When reading multiple chunks from the same shard, nearby byte ranges are merged into a single request to the store if separated by no more than \u003ccode\u003esharding_coalesce_max_gap_bytes\u003c/code\u003e and the merged read stays within \u003ccode\u003esharding_coalesce_max_bytes\u003c/code\u003e. Defaults are seeded from the matching \u003ccode\u003earray.sharding_coalesce_max_gap_bytes\u003c/code\u003e / \u003ccode\u003earray.sharding_coalesce_max_bytes\u003c/code\u003e keys in [\u003ccode\u003ezarr.config\u003c/code\u003e][] at array-creation time, and can be overridden per array by passing \u003ccode\u003econfig={...}\u003c/code\u003e to [\u003ccode\u003ezarr.create_array\u003c/code\u003e][]. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3987\"\u003e#3987\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded \u003ccode\u003eGroup.get_array\u003c/code\u003e, \u003ccode\u003eGroup.get_group\u003c/code\u003e, \u003ccode\u003eAsyncGroup.get_array\u003c/code\u003e, and \u003ccode\u003eAsyncGroup.get_group\u003c/code\u003e: type-safe accessors that return the child array or group at a given path, raising \u003ccode\u003eArrayNotFoundError\u003c/code\u003e / \u003ccode\u003eGroupNotFoundError\u003c/code\u003e if no node exists there, and \u003ccode\u003eContainsGroupError\u003c/code\u003e / \u003ccode\u003eContainsArrayError\u003c/code\u003e if the node is not of the requested kind. Unlike \u003ccode\u003eGroup.__getitem__\u003c/code\u003e, which returns \u003ccode\u003eArray | Group\u003c/code\u003e, these methods have precise return types. Nested paths like \u003ccode\u003e\u0026quot;subgroup/subarray\u0026quot;\u003c/code\u003e are supported. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4128\"\u003e#4128\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003eZipStore\u003c/code\u003e now accepts an open binary file-like object in place of a path, enabling\nzip archives on remote storage (e.g. a file opened with \u003ccode\u003efsspec\u003c/code\u003e or an\n\u003ccode\u003eobstore.ReadableFile\u003c/code\u003e). Operations that require a filesystem location\n(\u003ccode\u003eclear\u003c/code\u003e, \u003ccode\u003emove\u003c/code\u003e) raise \u003ccode\u003eNotImplementedError\u003c/code\u003e for file-object-backed stores. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4187\"\u003e#4187\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBugfixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eStop emitting an \u003ccode\u003eUnstableSpecificationWarning\u003c/code\u003e when serializing the \u003ccode\u003estruct\u003c/code\u003e data type to Zarr V3 metadata. The \u003ccode\u003estruct\u003c/code\u003e data type now has a stable Zarr V3 specification. The legacy \u003ccode\u003estructured\u003c/code\u003e alias and the unspecified \u003ccode\u003enull_terminated_bytes\u003c/code\u003e, \u003ccode\u003eraw_bytes\u003c/code\u003e, and \u003ccode\u003evariable_length_bytes\u003c/code\u003e data types continue to warn. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/4100\"\u003e#4100\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix equality comparison of \u003ccode\u003eArrayV2Metadata\u003c/code\u003e and \u003ccode\u003eArrayV3Metadata\u003c/code\u003e objects with a\n\u003ccode\u003eNaN\u003c/code\u003e fill value. Such objects are now compared by their JSON-serialized form, so two\notherwise-identical metadata objects with a \u003ccode\u003eNaN\u003c/code\u003e (or infinite) fill value compare equal. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/2929\"\u003e#2929\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBytesCodec.from_dict\u003c/code\u003e so that \u003ccode\u003eBytesCodec\u003c/code\u003e instances roundtrip to / from\ntheir dict representation. \u003ccode\u003eBytesCodec.from_dict\u003c/code\u003e now interprets a missing\n\u003ccode\u003eendian\u003c/code\u003e configuration as \u003ccode\u003eendian=None\u003c/code\u003e (matching what \u003ccode\u003eBytesCodec.to_dict\u003c/code\u003e\nemits), instead of falling back to the system's native byte order. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3417\"\u003e#3417\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003esave_array\u003c/code\u003e, \u003ccode\u003eGroup.__setitem__\u003c/code\u003e, and \u003ccode\u003eload\u003c/code\u003e for 0-dimensional arrays. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/3469\"\u003e#3469\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed inner-codec spec evolution for sharded arrays. The sharding codec now threads the array spec through its inner codec chain when evolving codecs, so a codec that changes the dtype upstream of \u003ccode\u003eBytesCodec\u003c/code\u003e no longer leaves the inner chain evolved against the wrong spec (which previously failed at decode time). This runs on the default \u003ccode\u003eBatchedCodecPipeline\u003c/code\u003e as well. Standard inner chains (\u003ccode\u003e[BytesCodec]\u003c/code\u003e, \u003ccode\u003e[BytesCodec, ZstdCodec]\u003c/code\u003e, transpose + bytes) are byte-identical to before. Restores the behavior of \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/2179\"\u003e#2179\u003c/a\u003e. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3885\"\u003e#3885\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eMake chunk normalization properly handle \u003ccode\u003e-1\u003c/code\u003e as a compact representation of the\nlength of an entire axis. Reject several previously-accepted but ill-defined\nchunk specifications: \u003ccode\u003echunks=True\u003c/code\u003e (previously silently produced size-1 chunks),\nchunk tuples shorter than the array's number of dimensions (previously padded to\nthe array's shape), and \u003ccode\u003eNone\u003c/code\u003e as a per-dimension chunk size. These all now\nraise informative errors. Also fix chunk handling for 0-length array dimensions,\nand add explicit rejection of 0-length chunks. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3899\"\u003e#3899\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eHandle missing consolidated metadata in leaf Group nodes. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/3954\"\u003e#3954\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eCorrected the JSON type definitions for the \u003ccode\u003enumpy.datetime64\u003c/code\u003e and\n\u003ccode\u003enumpy.timedelta64\u003c/code\u003e data types in Zarr V3 metadata: the \u003ccode\u003econfiguration\u003c/code\u003e object\n(holding \u003ccode\u003eunit\u003c/code\u003e and \u003ccode\u003escale_factor\u003c/code\u003e) is now required, matching the published\nspecifications for these data types. Also updated the specification links in\nthe docstrings to point to the zarr-extensions repository. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3955\"\u003e#3955\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed writing to 0-dimensional arrays that use the sharding codec. Previously\nassigning to a 0-dimensional sharded array raised an error. (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/pull/3966\"\u003e#3966\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix flaky stateful test bookkeeping when \u003ccode\u003edelete_dir\u003c/code\u003e matches string prefixes instead of true directory descendants. Previously a path such as \u003ccode\u003e6/faNT…\u003c/code\u003e could be incorrectly removed when deleting \u003ccode\u003e6/f\u003c/code\u003e. (See [issue \u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/3977\"\u003e#3977\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/3977\"\u003ezarr-developers/zarr-python#3977\u003c/a\u003e).) (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/3977\"\u003e#3977\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ccode\u003eFsspecStore.close()\u003c/code\u003e no longer closes the underlying fsspec filesystem or its\nnetwork session. fsspec caches and shares filesystem instances across callers,\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/53e6dc66b834988912194985a1051ad4db4f0141\"\u003e\u003ccode\u003e53e6dc6\u003c/code\u003e\u003c/a\u003e docs: dev blog, performance examples, and compiled 3.3.0 release notes (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/4191\"\u003e#4191\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/6f52da5b8ce4e28031f4ad6c3287795fec971105\"\u003e\u003ccode\u003e6f52da5\u003c/code\u003e\u003c/a\u003e fix: gate fused sync fast paths on full store sync capability; wrappers forwa...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/57e66d92ed26eb02ca3931f253de052c0a890042\"\u003e\u003ccode\u003e57e66d9\u003c/code\u003e\u003c/a\u003e fix: reject malformed chunk keys in DefaultChunkKeyEncoding (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/4219\"\u003e#4219\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/ec8e70ad86990e4c1bf57478fe13769885e31882\"\u003e\u003ccode\u003eec8e70a\u003c/code\u003e\u003c/a\u003e chore(deps): bump the python-dependencies group across 1 directory with 11 up...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/6f9724cb14686e0737ed144be5d945fe1fbde578\"\u003e\u003ccode\u003e6f9724c\u003c/code\u003e\u003c/a\u003e fix: minor correctness and hygiene fixes from the sync-pipeline audit (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/4205\"\u003e#4205\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/a88f88951e7b1bc19f19adad2fb364158851076a\"\u003e\u003ccode\u003ea88f889\u003c/code\u003e\u003c/a\u003e fix: make ManagedMemoryStore/GpuMemoryStore sync methods parity-safe (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/4204\"\u003e#4204\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/020e5c3494c7bb794da1a94b970c326ddbdbca7a\"\u003e\u003ccode\u003e020e5c3\u003c/code\u003e\u003c/a\u003e docs: fix link checker error and update redirected links; run checker weekly ...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/63fc294bec25c41983c1a45f7f03bd6f801a7ff9\"\u003e\u003ccode\u003e63fc294\u003c/code\u003e\u003c/a\u003e chore(zarr-metadata): build 0.4.0 changelog (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/4211\"\u003e#4211\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/69ca264664bd74ba55c594490acdd49cd70b7fe8\"\u003e\u003ccode\u003e69ca264\u003c/code\u003e\u003c/a\u003e docs(zarr-metadata): docs-site polish: repo link, titles, RTD build skips, br...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/zarr-python/commit/b2ece6f82c5281d02a8a4408fb13f791870c65bd\"\u003e\u003ccode\u003eb2ece6f\u003c/code\u003e\u003c/a\u003e docs(zarr-metadata): standalone documentation site; add package justfile (\u003ca href=\"https://redirect.github.com/zarr-developers/zarr-python/issues/4208\"\u003e#4208\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/zarr-developers/zarr-python/compare/v3.1.6...v3.3.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pydantic-zarr` from 0.9.2 to 0.10.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/releases\"\u003epydantic-zarr's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev0.10.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eBump minimum supported Python and NumPy by \u003ca href=\"https://github.com/dstansby\"\u003e\u003ccode\u003e@​dstansby\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/pull/145\"\u003ezarr-developers/pydantic-zarr#145\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eIgnore warning for using _config from zarr-python by \u003ca href=\"https://github.com/dstansby\"\u003e\u003ccode\u003e@​dstansby\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/pull/156\"\u003ezarr-developers/pydantic-zarr#156\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd dev dependency group by \u003ca href=\"https://github.com/dstansby\"\u003e\u003ccode\u003e@​dstansby\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/pull/155\"\u003ezarr-developers/pydantic-zarr#155\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump the actions group across 1 directory with 3 updates by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/pull/154\"\u003ezarr-developers/pydantic-zarr#154\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd changelog for 0.10.0 by \u003ca href=\"https://github.com/dstansby\"\u003e\u003ccode\u003e@​dstansby\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/pull/157\"\u003ezarr-developers/pydantic-zarr#157\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAlter cd.yml to use OIDC tokens. by \u003ca href=\"https://github.com/d-v-b\"\u003e\u003ccode\u003e@​d-v-b\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/pull/153\"\u003ezarr-developers/pydantic-zarr#153\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/compare/v0.9.2...v0.10.0\"\u003ehttps://github.com/zarr-developers/pydantic-zarr/compare/v0.9.2...v0.10.0\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/blob/main/docs/release-notes.md\"\u003epydantic-zarr's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003epydantic-zarr 0.10.0 (2026-04-16)\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe minimum supported Python is now 3.12 and the minimum supported NumPy is now 2.0. (\u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/issues/145\"\u003e#145\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003etype ...\u003c/code\u003e instead of \u003ccode\u003e...: TypeAlias\u003c/code\u003e to declare type aliases. (\u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/issues/145\"\u003e#145\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/21c1b2faf687f2256d6968bc283e9cfbce61fd6b\"\u003e\u003ccode\u003e21c1b2f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/issues/153\"\u003e#153\u003c/a\u003e from d-v-b/chore/trusted-publishing\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/6829aeaada1798e2b963aa27bcadb773ce89e8fa\"\u003e\u003ccode\u003e6829aea\u003c/code\u003e\u003c/a\u003e Remove extra lines\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/11829ad6a246fb05f12b4f9d8a715a060d1bdf72\"\u003e\u003ccode\u003e11829ad\u003c/code\u003e\u003c/a\u003e Merge branch 'main' into chore/trusted-publishing\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/7551b0db960e1f55405ea642d275f8005ab49aa0\"\u003e\u003ccode\u003e7551b0d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/issues/157\"\u003e#157\u003c/a\u003e from dstansby/0.10.0-clog\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/4bfc9ee63229f0d6127154d7bb3a8f3ce9926047\"\u003e\u003ccode\u003e4bfc9ee\u003c/code\u003e\u003c/a\u003e Add changelog for 0.10.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/13b1a2c2091fe06a4e7464cfa6b293b40c736c7a\"\u003e\u003ccode\u003e13b1a2c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/issues/154\"\u003e#154\u003c/a\u003e from zarr-developers/dependabot/github_actions/action...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/6dedb9c75843c01a2bd6bf2868ffd65169939d8f\"\u003e\u003ccode\u003e6dedb9c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/issues/155\"\u003e#155\u003c/a\u003e from dstansby/dev-group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/203455ac996fa6e3cf6c19b86f1b0caf0db02911\"\u003e\u003ccode\u003e203455a\u003c/code\u003e\u003c/a\u003e Bump the actions group across 1 directory with 3 updates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/2e84f4366abc1d9e11581b83233b18989972ef2c\"\u003e\u003ccode\u003e2e84f43\u003c/code\u003e\u003c/a\u003e Add dev dependency group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/commit/b84b0e590274482cd51cc33dc7809fda19a6e639\"\u003e\u003ccode\u003eb84b0e5\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/zarr-developers/pydantic-zarr/issues/156\"\u003e#156\u003c/a\u003e from dstansby/config-deprecation\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/zarr-developers/pydantic-zarr/compare/v0.9.2...v0.10.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `ome-zarr-models` from 1.6 to 1.7\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ome-zarr-models/ome-zarr-models-py/releases\"\u003eome-zarr-models's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eome-zarr-models 1.7\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRename remote data test files by \u003ca href=\"https://github.com/dstansby\"\u003e\u003ccode\u003e@​dstansby\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ome-zarr-models/ome-zarr-models-py/pull/414\"\u003eome-zarr-models/ome-zarr-models-py#414\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAllow the colors field to be absent by \u003ca href=\"https://github.com/rzlim08\"\u003e\u003ccode\u003e@​rzlim08\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ome-zarr-models/ome-zarr-models-py/pull/416\"\u003eome-zarr-models/ome-zarr-models-py#416\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eChangelog for 1.7 by \u003ca href=\"https://github.com/dstansby\"\u003e\u003ccode\u003e@​dstansby\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/ome-zarr-models/ome-zarr-models-py/pull/418\"\u003eome-zarr-models/ome-zarr-models-py#418\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/rzlim08\"\u003e\u003ccode\u003e@​rzlim08\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/ome-zarr-models/ome-zarr-models-py/pull/416\"\u003eome-zarr-models/ome-zarr-models-py#416\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/ome-zarr-models/ome-zarr-models-py/compare/v1.6...v1.7\"\u003ehttps://github.com/ome-zarr-models/ome-zarr-models-py/compare/v1.6...v1.7\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/ome-zarr-models/ome-zarr-models-py/blob/main/docs/changelog.md\"\u003eome-zarr-models's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.7\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRequire \u003ccode\u003epydantic\u003c/code\u003e \u0026lt; 2.13, due to new issues in model construction that are not yet resolved.\u003c/li\u003e\n\u003cli\u003eCorrectly allow \u003ccode\u003ecolors\u003c/code\u003e metadata to be not set or \u003ccode\u003enull\u003c/code\u003e inside image-label metadata.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ome-zarr-models/ome-zarr-models-py/commit/b1fd516230e1f9bdd38206f9b3278f5e93b0a81d\"\u003e\u003ccode\u003eb1fd516\u003c/code\u003e\u003c/a\u003e Changelog for 1.7 (\u003ca href=\"https://redirect.github.com/ome-zarr-models/ome-zarr-models-py/issues/418\"\u003e#418\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ome-zarr-models/ome-zarr-models-py/commit/bf2811161751f0553af51c689010e2c7735edc1c\"\u003e\u003ccode\u003ebf28111\u003c/code\u003e\u003c/a\u003e Allow the colors field to be absent (\u003ca href=\"https://redirect.github.com/ome-zarr-models/ome-zarr-models-py/issues/416\"\u003e#416\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/ome-zarr-models/ome-zarr-models-py/commit/17052799d779fab1ff5a8dfe7275d0164832c43b\"\u003e\u003ccode\u003e1705279\u003c/code\u003e\u003c/a\u003e Rename remote data test files (\u003ca href=\"https://redirect.github.com/ome-zarr-models/ome-zarr-models-py/issues/414\"\u003e#414\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/ome-zarr-models/ome-zarr-models-py/compare/v1.6...v1.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `scipy` from 1.17.1 to 1.18.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/scipy/scipy/releases\"\u003escipy's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eSciPy 1.18.0 Release Notes\u003c/h1\u003e\n\u003cp\u003eSciPy \u003ccode\u003e1.18.0\u003c/code\u003e is the culmination of \u003ccode\u003e6\u003c/code\u003e months of hard ...\n\n_Description has been truncated_","html_url":"https://github.com/ome-zarr-models/ome-zarr-book/pull/59","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/ome-zarr-models%2Fome-zarr-book/issues/59","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/59/packages"}},{"old_version":"6.4.2","new_version":"6.5.7","update_type":"minor","path":null,"pr_created_at":"2026-07-31T21:59:47.000Z","version_change":"6.4.2 → 6.5.7","issue":{"uuid":"5033697250","node_id":"PR_kwDOSvU-qc75N7m8","number":17,"state":"closed","title":"Bump the pip group across 7 directories with 7 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-07-31T22:01:18.000Z","author_association":null,"state_reason":null,"created_at":"2026-07-31T21:59:47.000Z","updated_at":"2026-07-31T22:01:20.000Z","time_to_close":91,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","group_name":"pip","update_count":7,"packages":[{"name":"gitpython","old_version":"3.1.44","new_version":"3.1.54","repository_url":"https://github.com/gitpython-developers/GitPython"},{"name":"pillow","old_version":"11.1.0","new_version":"12.3.0","repository_url":"https://github.com/python-pillow/Pillow"},{"name":"pyasn1","old_version":"0.6.1","new_version":"0.6.4","repository_url":"https://github.com/pyasn1/pyasn1"},{"name":"python-dotenv","old_version":"1.0.1","new_version":"1.2.2","repository_url":"https://github.com/theskumar/python-dotenv"},{"name":"setuptools","old_version":"75.8.0","new_version":"83.0.0","repository_url":"https://github.com/pypa/setuptools"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps the pip group with 6 updates in the /consultant-agent/awesome-llm-apps/advanced_ai_agents/autonomous_game_playing_agent_apps/ai_tic_tac_toe_agent directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.44` | `3.1.54` |\n| [pillow](https://github.com/python-pillow/Pillow) | `11.1.0` | `12.3.0` |\n| [pyasn1](https://github.com/pyasn1/pyasn1) | `0.6.1` | `0.6.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.0.1` | `1.2.2` |\n| [setuptools](https://github.com/pypa/setuptools) | `75.8.0` | `83.0.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.4.2` | `6.5.7` |\n\nBumps the pip group with 1 update in the /consultant-agent/awesome-llm-apps/advanced_ai_agents/multi_agent_apps/agent_teams/multimodal_design_agent_team directory: [pillow](https://github.com/python-pillow/Pillow).\nBumps the pip group with 5 updates in the /consultant-agent/awesome-llm-apps/advanced_ai_agents/multi_agent_apps/ai_news_and_podcast_agents/beifong directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [gitpython](https://github.com/gitpython-developers/GitPython) | `3.1.44` | `3.1.54` |\n| [pillow](https://github.com/python-pillow/Pillow) | `11.2.1` | `12.3.0` |\n| [pyasn1](https://github.com/pyasn1/pyasn1) | `0.6.1` | `0.6.4` |\n| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.1.0` | `1.2.2` |\n| [nltk](https://github.com/nltk/nltk) | `3.9.1` | `3.10.0` |\n\nBumps the pip group with 1 update in the /consultant-agent/awesome-llm-apps/starter_ai_agents/ai_breakup_recovery_agent directory: [pillow](https://github.com/python-pillow/Pillow).\nBumps the pip group with 1 update in the /consultant-agent/awesome-llm-apps/starter_ai_agents/ai_data_visualisation_agent directory: [pillow](https://github.com/python-pillow/Pillow).\nBumps the pip group with 1 update in the /consultant-agent/awesome-llm-apps/starter_ai_agents/ai_medical_imaging_agent directory: [pillow](https://github.com/python-pillow/Pillow).\nBumps the pip group with 1 update in the /da-blog-notebooklm/scripts directory: [python-dotenv](https://github.com/theskumar/python-dotenv).\n\nUpdates `gitpython` from 3.1.44 to 3.1.54\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/gitpython-developers/GitPython/releases\"\u003egitpython's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.1.54 - Security\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eHarden unsafe Git option validation by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2180\"\u003egitpython-developers/GitPython#2180\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54\"\u003ehttps://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e3.1.53 - Security\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat(submodule): add deinit method to Submodule (\u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2014\"\u003e#2014\u003c/a\u003e) by \u003ca href=\"https://github.com/mvanhorn\"\u003e\u003ccode\u003e@​mvanhorn\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2129\"\u003egitpython-developers/GitPython#2129\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etyping: introduce sensible basedpyright defaults by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2174\"\u003egitpython-developers/GitPython#2174\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: make \u003ccode\u003esubmodule.update()\u003c/code\u003e after \u003ccode\u003esubmodule.deinit()\u003c/code\u003e work by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2175\"\u003egitpython-developers/GitPython#2175\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix commit hooks respecting core.hooksPath by \u003ca href=\"https://github.com/Siesta0217\"\u003e\u003ccode\u003e@​Siesta0217\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2159\"\u003egitpython-developers/GitPython#2159\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: validate config section delimiters by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2176\"\u003egitpython-developers/GitPython#2176\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Siesta0217\"\u003e\u003ccode\u003e@​Siesta0217\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2159\"\u003egitpython-developers/GitPython#2159\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.52...3.1.53\"\u003ehttps://github.com/gitpython-developers/GitPython/compare/3.1.52...3.1.53\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e3.1.52 Security\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573\"\u003ehttps://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573\u003c/a\u003e: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSkip cross-drive relative config test on Windows by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2171\"\u003egitpython-developers/GitPython#2171\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: preserve literal clone URLs by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2172\"\u003egitpython-developers/GitPython#2172\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.51...3.1.52\"\u003ehttps://github.com/gitpython-developers/GitPython/compare/3.1.51...3.1.52\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e3.1.51 - Security\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd AI-disclosure and quality requirements to the contribution guidelines by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2143\"\u003egitpython-developers/GitPython#2143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs(cmd): clarify Git.execute() string vs list command argument by \u003ca href=\"https://github.com/mvanhorn\"\u003e\u003ccode\u003e@​mvanhorn\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2144\"\u003egitpython-developers/GitPython#2144\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRewrite Git.execute() command parameter docstring per \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2146\"\u003e#2146\u003c/a\u003e by \u003ca href=\"https://github.com/EliahKagan\"\u003e\u003ccode\u003e@​EliahKagan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2147\"\u003egitpython-developers/GitPython#2147\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument init script behavior with multiple master remotes by \u003ca href=\"https://github.com/EliahKagan\"\u003e\u003ccode\u003e@​EliahKagan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2148\"\u003egitpython-developers/GitPython#2148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump git/ext/gitdb from \u003ccode\u003e335c0f6\u003c/code\u003e to \u003ccode\u003e0a019a2\u003c/code\u003e by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2149\"\u003egitpython-developers/GitPython#2149\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport relative worktree paths (git 2.48+ worktree.useRelativePaths) by \u003ca href=\"https://github.com/elovelan\"\u003e\u003ccode\u003e@​elovelan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2151\"\u003egitpython-developers/GitPython#2151\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDefer xfail condition evaluation with xfail_if_raises context manager by \u003ca href=\"https://github.com/elovelan\"\u003e\u003ccode\u003e@​elovelan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2153\"\u003egitpython-developers/GitPython#2153\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun more submodule tests on Cygwin (fix flaky xfails) by \u003ca href=\"https://github.com/EliahKagan\"\u003e\u003ccode\u003e@​EliahKagan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2154\"\u003egitpython-developers/GitPython#2154\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCut xtrace noise from POSIX-ownership diagnostic steps by \u003ca href=\"https://github.com/EliahKagan\"\u003e\u003ccode\u003e@​EliahKagan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2156\"\u003egitpython-developers/GitPython#2156\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport index diffs against the empty tree by \u003ca href=\"https://github.com/puneetdixit200\"\u003e\u003ccode\u003e@​puneetdixit200\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2155\"\u003egitpython-developers/GitPython#2155\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003erefactor: seperate out Progress type by \u003ca href=\"https://github.com/LoeschMaximilian\"\u003e\u003ccode\u003e@​LoeschMaximilian\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2157\"\u003egitpython-developers/GitPython#2157\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ca href=\"https://github.com/astral-sh/ruff-pre-commit\"\u003ehttps://github.com/astral-sh/ruff-pre-commit\u003c/a\u003e from v0.15.12 to 0.15.15 in the pre-commit group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2160\"\u003egitpython-developers/GitPython#2160\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 6 to 7 by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2164\"\u003egitpython-developers/GitPython#2164\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump git/ext/gitdb from \u003ccode\u003e0a019a2\u003c/code\u003e to \u003ccode\u003e4950ea9\u003c/code\u003e by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2165\"\u003egitpython-developers/GitPython#2165\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump \u003ca href=\"https://github.com/astral-sh/ruff-pre-commit\"\u003ehttps://github.com/astral-sh/ruff-pre-commit\u003c/a\u003e from v0.15.15 to 0.15.20 in the pre-commit group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2166\"\u003egitpython-developers/GitPython#2166\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Commit.is_shallow property; document stats() limitation at shallow boundary by \u003ca href=\"https://github.com/harshitayadavv\"\u003e\u003ccode\u003e@​harshitayadavv\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2167\"\u003egitpython-developers/GitPython#2167\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAllow relative config paths with includes by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2169\"\u003egitpython-developers/GitPython#2169\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eReject abbreviated forms of unsafe git options by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2168\"\u003egitpython-developers/GitPython#2168\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/e59d9bab02b095a97e179f47019afee95f4e3c18\"\u003e\u003ccode\u003ee59d9ba\u003c/code\u003e\u003c/a\u003e prepare next release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/a4dc70d4eec15825aac2dfd7484c961f6fc8491b\"\u003e\u003ccode\u003ea4dc70d\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2180\"\u003e#2180\u003c/a\u003e from gitpython-developers/single-char-kwarg\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/1d51b891d7f236044a6aa17498ec682b63dad6e6\"\u003e\u003ccode\u003e1d51b89\u003c/code\u003e\u003c/a\u003e fix: guard diff output options\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/ffcb5359e87619f4fe4a70a4aff5f08c5580ba97\"\u003e\u003ccode\u003effcb535\u003c/code\u003e\u003c/a\u003e fix: reject unsafe clone templates\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/e8d0fbf774d1f6baa3b481adfe48bd262e43b453\"\u003e\u003ccode\u003ee8d0fbf\u003c/code\u003e\u003c/a\u003e fix: validate split short-option values\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/faf3c09038b03bc2bdd8545ef34bbf6d7f1cd11f\"\u003e\u003ccode\u003efaf3c09\u003c/code\u003e\u003c/a\u003e prepare for security fix\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/6a5eb6a53407cfd7964447fa417d73a7ab32e700\"\u003e\u003ccode\u003e6a5eb6a\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2176\"\u003e#2176\u003c/a\u003e from gitpython-developers/fix-config-injection\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/1ed1b924f4e2d2ee7bab296df77b978af21853f1\"\u003e\u003ccode\u003e1ed1b92\u003c/code\u003e\u003c/a\u003e fix: validate config section delimiters\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/354eb2fc505042d2f4cd913783b689bce6c49fd3\"\u003e\u003ccode\u003e354eb2f\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2159\"\u003e#2159\u003c/a\u003e from Siesta0217/fix-core-hooks-path-commit-hooks\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/commit/9bc287a2b1eb331b6051d2ba704a603c3e0ddc6f\"\u003e\u003ccode\u003e9bc287a\u003c/code\u003e\u003c/a\u003e Address review feedback about hook resolution\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.44...3.1.54\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pillow` from 11.1.0 to 12.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/python-pillow/Pillow/releases\"\u003epillow's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e12.3.0\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html\"\u003ehttps://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eRemovals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemove non-image ImageCms modes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9697\"\u003e#9697\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDocumentation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd release notes for SBOM and performance improvements \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9747\"\u003e#9747\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd security release notes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9741\"\u003e#9741\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd release notes for Python 3.15 beta wheels \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9696\"\u003e#9696\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eImageFont can also be used with ImageText \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9597\"\u003e#9597\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdditional guidelines for security reports \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9659\"\u003e#9659\u003c/a\u003e [\u003ca href=\"https://github.com/wiredfool\"\u003e\u003ccode\u003e@​wiredfool\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eFixed typo \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9636\"\u003e#9636\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdded CVEs to 12.2.0 release notes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9591\"\u003e#9591\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eRevise development support information in README \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9583\"\u003e#9583\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd INCIDENT_RESPONSE.md \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9555\"\u003e#9555\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd STRIDE threat model to security docs \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9562\"\u003e#9562\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd CVEs to 12.2.0 release notes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9556\"\u003e#9556\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate README with revised security policy \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9553\"\u003e#9553\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate security policy \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9552\"\u003e#9552\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate macOS tested Python versions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9534\"\u003e#9534\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependencies\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate dependency harfbuzz to v14.2.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9720\"\u003e#9720\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency mypy to v2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9653\"\u003e#9653\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency cibuildwheel to v4 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9665\"\u003e#9665\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate github-actions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9655\"\u003e#9655\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency libavif to v1.4.2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9652\"\u003e#9652\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency lcms2 to v2.19.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9651\"\u003e#9651\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency check-jsonschema to v0.37.2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9650\"\u003e#9650\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate google/oss-fuzz digest to d872252 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9614\"\u003e#9614\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency lcms2 to v2.19 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9609\"\u003e#9609\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency libpng to v1.6.58 - autoclosed \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9608\"\u003e#9608\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency harfbuzz to v14 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9610\"\u003e#9610\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency mypy to v1.20.2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9599\"\u003e#9599\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate github-actions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9611\"\u003e#9611\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency cibuildwheel to v3.4.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9607\"\u003e#9607\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eMove dependency versions to single JSON and enable Renovate \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9559\"\u003e#9559\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdated raqm to 0.10.5 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9557\"\u003e#9557\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency cibuildwheel to v3.4.0 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9532\"\u003e#9532\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eTesting\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemove matrix.os from benchmark \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9735\"\u003e#9735\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eRemove references to libavif patch \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9734\"\u003e#9734\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd benchmark tests \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9654\"\u003e#9654\u003c/a\u003e [\u003ca href=\"https://github.com/akx\"\u003e\u003ccode\u003e@​akx\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUse reshape() instead of setting NumPy array shape directly \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9728\"\u003e#9728\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst\"\u003epillow's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog (Pillow)\u003c/h1\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d\"\u003e\u003ccode\u003ebb1d8e8\u003c/code\u003e\u003c/a\u003e 12.3.0 version bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af\"\u003e\u003ccode\u003ee63fc48\u003c/code\u003e\u003c/a\u003e Add release notes for SBOM and performance improvements (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9747\"\u003e#9747\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054\"\u003e\u003ccode\u003e13b701b\u003c/code\u003e\u003c/a\u003e Add release notes for \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9679\"\u003e#9679\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364\"\u003e\u003ccode\u003e5564ca7\u003c/code\u003e\u003c/a\u003e List methods\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b\"\u003e\u003ccode\u003ea0920fd\u003c/code\u003e\u003c/a\u003e Speed up ImageChops operations (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9738\"\u003e#9738\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc\"\u003e\u003ccode\u003e07e9a6c\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.filter()\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9736\"\u003e#9736\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50\"\u003e\u003ccode\u003ea94578c\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.getchannel()\u003c/code\u003e, \u003ccode\u003eImage.merge()\u003c/code\u003e, \u003ccode\u003eImage.putalpha()\u003c/code\u003e and `Image...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb\"\u003e\u003ccode\u003e53e02c4\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.fill()\u003c/code\u003e, \u003ccode\u003eImage.linear_gradient()\u003c/code\u003e and `Image.radial_gradient...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6\"\u003e\u003ccode\u003eaf03747\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.resample()\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9739\"\u003e#9739\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571\"\u003e\u003ccode\u003e5c9ca56\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003ealpha_composite\u003c/code\u003e, \u003ccode\u003ematrix\u003c/code\u003e, \u003ccode\u003enegative\u003c/code\u003e, \u003ccode\u003equantize\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9740\"\u003e#9740\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/python-pillow/Pillow/compare/11.1.0...12.3.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pyasn1` from 0.6.1 to 0.6.4\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyasn1/pyasn1/releases\"\u003epyasn1's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eRelease 0.6.4\u003c/h2\u003e\n\u003cp\u003eThis is a security release.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time complexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders. A small crafted substrate encoding many arcs could consume excessive CPU.\u003c/li\u003e\n\u003cli\u003eCVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag IDs to 20 octets (140 bits). Unbounded tag IDs allowed a crafted substrate to consume excessive CPU and memory.\u003c/li\u003e\n\u003cli\u003eCVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and CPU consumption in \u003ccode\u003eReal.__float__()\u003c/code\u003e for values with large base-10 exponents.\u003c/li\u003e\n\u003cli\u003ePinned PyPI publish GitHub Action to an immutable commit.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eAll changes are noted in the \u003ca href=\"https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst\"\u003eCHANGELOG\u003c/a\u003e.\u003c/p\u003e\n\u003ch2\u003eRelease 0.6.3\u003c/h2\u003e\n\u003cp\u003eIt's a minor release.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded nesting depth limit to ASN.1 decoder to prevent stack overflow from deeply nested structures (CVE-2026-30922).\u003c/li\u003e\n\u003cli\u003eFixed OverflowError from oversized BER length field.\u003c/li\u003e\n\u003cli\u003eFixed DeprecationWarning stacklevel for deprecated attributes.\u003c/li\u003e\n\u003cli\u003eFixed asDateTime incorrect fractional seconds parsing.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eAll changes are noted in the \u003ca href=\"https://github.com/pyasn1/pyasn1/blob/master/CHANGES.rst\"\u003eCHANGELOG\u003c/a\u003e.\u003c/p\u003e\n\u003ch2\u003eRelease 0.6.2\u003c/h2\u003e\n\u003cp\u003eIt's a minor release.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed continuation octet limits in OID/RELATIVE-OID decoder (CVE-2026-23490).\u003c/li\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdded SECURITY.md policy.\u003c/li\u003e\n\u003cli\u003eMigrated to pyproject.toml packaging.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eAll changes are noted in the \u003ca href=\"https://github.com/pyasn1/pyasn1/blob/master/CHANGES.rst\"\u003eCHANGELOG\u003c/a\u003e.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyasn1/pyasn1/blob/main/CHANGES.rst\"\u003epyasn1's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eRevision 0.6.4, released 08-07-2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-59885 (GHSA-8ppf-4f7h-5ppj): Fixed quadratic time\ncomplexity in the OBJECT IDENTIFIER and RELATIVE-OID decoders.\nA small crafted substrate encoding many arcs could consume\nexcessive CPU. Arcs are now accumulated in linear time; decoded\nvalues are unchanged (thanks for reporting, tynus2)\u003c/li\u003e\n\u003cli\u003eCVE-2026-59884 (GHSA-m4p7-r5rc-7g4j): Limited BER long-form tag\nIDs to 20 octets (140 bits), matching the OID arc limit introduced\nin 0.6.2. Unbounded tag IDs allowed a crafted substrate to consume\nexcessive CPU and memory; longer tag IDs are now rejected with\nPyAsn1Error. Also fixed Tag and TagSet repr() failing on huge tag\n(thanks for reporting, mikeappsec)\nIDs due to the integer-to-string conversion limit (Python 3.11+)\u003c/li\u003e\n\u003cli\u003eCVE-2026-59886 (GHSA-hm4w-wwcw-mr6r): Fixed excessive memory and\nCPU consumption in Real.\u003cstrong\u003efloat\u003c/strong\u003e() for values with large base-10\nexponents. Conversion no longer materializes huge intermediate\nintegers; values too large to represent as a Python float raise\nOverflowError promptly, and prettyPrint() renders them as\n'\u003c!-- raw HTML omitted --\u003e' as before. Also fixed base-10 mantissa normalization\nto use exact integer arithmetic; mantissas larger than 2**53\ncould previously lose precision through float division\n(thanks for reporting, gvozdila)\u003c/li\u003e\n\u003cli\u003ePinned PyPI publish GitHub Action to an immutable commit\n[pr \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/113\"\u003e#113\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/pull/113\"\u003epyasn1/pyasn1#113\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eRevision 0.6.3, released 16-03-2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-30922 (GHSA-jr27-m4p2-rc6r): Added nesting depth\nlimit to ASN.1 decoder to prevent stack overflow from deeply\nnested structures (thanks for reporting, romanticpragmatism)\u003c/li\u003e\n\u003cli\u003eFixed OverflowError from oversized BER length field\n[issue \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/54\"\u003e#54\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/54\"\u003epyasn1/pyasn1#54\u003c/a\u003e)\n[pr \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/100\"\u003e#100\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/pull/100\"\u003epyasn1/pyasn1#100\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed DeprecationWarning stacklevel for deprecated attributes\n[issue \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/86\"\u003e#86\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/86\"\u003epyasn1/pyasn1#86\u003c/a\u003e)\n[pr \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/101\"\u003e#101\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/pull/101\"\u003epyasn1/pyasn1#101\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed asDateTime incorrect fractional seconds parsing\n[issue \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/81\"\u003e#81\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/81\"\u003epyasn1/pyasn1#81\u003c/a\u003e)\n[pr \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/102\"\u003e#102\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/pull/102\"\u003epyasn1/pyasn1#102\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eRevision 0.6.2, released 16-01-2026\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-23490 (GHSA-63vm-454h-vhhq): Fixed continuation octet limits\nin OID/RELATIVE-OID decoder (thanks to tsigouris007)\u003c/li\u003e\n\u003cli\u003eAdded support for Python 3.14\n[pr \u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/97\"\u003e#97\u003c/a\u003e](\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/pull/97\"\u003epyasn1/pyasn1#97\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/72e4803405816c371ed3b2cb4be181c47f038406\"\u003e\u003ccode\u003e72e4803\u003c/code\u003e\u003c/a\u003e Prepare release 0.6.4\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/0c19eeb853731db1c717ff125ea001a1e558332d\"\u003e\u003ccode\u003e0c19eeb\u003c/code\u003e\u003c/a\u003e Pin PyPI publish action to immutable commit (\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/113\"\u003e#113\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/45bdb19eb7df4b3780fe9c912c63e99bffc39dd9\"\u003e\u003ccode\u003e45bdb19\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/628e36ecbb5277a3f01572ce418ef54271b165a5\"\u003e\u003ccode\u003e628e36e\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/e60c691cb91addb8fcefa2f537e85ede6fb1e886\"\u003e\u003ccode\u003ee60c691\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/af65c3b92e9deeae50db4de390982dd970d87f98\"\u003e\u003ccode\u003eaf65c3b\u003c/code\u003e\u003c/a\u003e Prepare release 0.6.3\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/5a49bd1fe93b5b866a1210f6bf0a3924f21572c8\"\u003e\u003ccode\u003e5a49bd1\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/5494ba43f738e700ca9f7c7a69ec5c44908c9a9f\"\u003e\u003ccode\u003e5494ba4\u003c/code\u003e\u003c/a\u003e Fix asDateTime incorrect fractional seconds parsing (\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/102\"\u003e#102\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/71f486e6c32d0f270868aa1b2bb5ceb7d5fd5476\"\u003e\u003ccode\u003e71f486e\u003c/code\u003e\u003c/a\u003e Fix DeprecationWarning stacklevel for deprecated attributes (\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/101\"\u003e#101\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyasn1/pyasn1/commit/d7cb42dcaa9a66e18f14c4609c2ed00c5b65f7e8\"\u003e\u003ccode\u003ed7cb42d\u003c/code\u003e\u003c/a\u003e Fix OverflowError from oversized BER length field (\u003ca href=\"https://redirect.github.com/pyasn1/pyasn1/issues/100\"\u003e#100\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pyasn1/pyasn1/compare/v0.6.1...v0.6.4\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `python-dotenv` from 1.0.1 to 1.2.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/theskumar/python-dotenv/releases\"\u003epython-dotenv's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev1.2.2\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for Python 3.14, including the free-threaded (3.14t) build. (#)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003edotenv run\u003c/code\u003e command now forwards flags directly to the specified command by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/607\"\u003etheskumar/python-dotenv#607\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved documentation clarity regarding override behavior and the reference page.\u003c/li\u003e\n\u003cli\u003eUpdated PyPy support to version 3.11.\u003c/li\u003e\n\u003cli\u003eDocumentation for FIFO file support.\u003c/li\u003e\n\u003cli\u003eSupport for Python 3.9.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved \u003ccode\u003eset_key\u003c/code\u003e and \u003ccode\u003eunset_key\u003c/code\u003e behavior when interacting with symlinks by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311\"\u003e#790c5\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCorrected the license specifier and added missing Python 3.14 classifiers in package metadata by \u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/590\"\u003etheskumar/python-dotenv#590\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e and \u003ccode\u003edotenv.unset_key\u003c/code\u003e used to follow symlinks in some\nsituations. This is no longer the case. For that behavior to be restored in\nall cases, \u003ccode\u003efollow_symlinks=True\u003c/code\u003e should be used.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the CLI, \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e used to follow symlinks in some situations. This\nis no longer the case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e, \u003ccode\u003edotenv.unset_key\u003c/code\u003e and the CLI commands \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e\nused to reset the file mode of the modified .env file to \u003ccode\u003e0o600\u003c/code\u003e in some\nsituations. This is no longer the case: The original mode of the file is now\npreserved. Is the file needed to be created or wasn't a regular file, mode\n\u003ccode\u003e0o600\u003c/code\u003e is used.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eMisc\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eskip 000 permission tests for root user by \u003ca href=\"https://github.com/burnout-projects\"\u003e\u003ccode\u003e@​burnout-projects\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/561\"\u003etheskumar/python-dotenv#561\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump actions/checkout from 5 to 6 in the github-actions group by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/593\"\u003etheskumar/python-dotenv#593\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd Windows testing to CI by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/604\"\u003etheskumar/python-dotenv#604\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImprove workflow efficiency with best practices by \u003ca href=\"https://github.com/theskumar\"\u003e\u003ccode\u003e@​theskumar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/609\"\u003etheskumar/python-dotenv#609\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRemove the use of \u003ccode\u003esh\u003c/code\u003e in tests by \u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/612\"\u003etheskumar/python-dotenv#612\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/590\"\u003etheskumar/python-dotenv#590\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/burnout-projects\"\u003e\u003ccode\u003e@​burnout-projects\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/561\"\u003etheskumar/python-dotenv#561\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/cpackham-atlnz\"\u003e\u003ccode\u003e@​cpackham-atlnz\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/pull/597\"\u003etheskumar/python-dotenv#597\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2\"\u003ehttps://github.com/theskumar/python-dotenv/compare/v1.2.1...v1.2.2\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev1.2.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md\"\u003epython-dotenv's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e[1.2.2] - 2026-03-01\u003c/h2\u003e\n\u003ch3\u003eAdded\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eSupport for Python 3.14, including the free-threaded (3.14t) build. (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/588\"\u003e#588\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eChanged\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eThe \u003ccode\u003edotenv run\u003c/code\u003e command now forwards flags directly to the specified command by [\u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/607\"\u003e#607\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eImproved documentation clarity regarding override behavior and the reference page.\u003c/li\u003e\n\u003cli\u003eUpdated PyPy support to version 3.11.\u003c/li\u003e\n\u003cli\u003eDocumentation for FIFO file support.\u003c/li\u003e\n\u003cli\u003eDropped Support for Python 3.9.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImproved \u003ccode\u003eset_key\u003c/code\u003e and \u003ccode\u003eunset_key\u003c/code\u003e behavior when interacting with symlinks by [\u003ca href=\"https://github.com/bbc2\"\u003e\u003ccode\u003e@​bbc2\u003c/code\u003e\u003c/a\u003e] in [790c5c0]\u003c/li\u003e\n\u003cli\u003eCorrected the license specifier and added missing Python 3.14 classifiers in package metadata by [\u003ca href=\"https://github.com/JYOuyang\"\u003e\u003ccode\u003e@​JYOuyang\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/590\"\u003e#590\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBreaking Changes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e and \u003ccode\u003edotenv.unset_key\u003c/code\u003e used to follow symlinks in some\nsituations. This is no longer the case. For that behavior to be restored in\nall cases, \u003ccode\u003efollow_symlinks=True\u003c/code\u003e should be used.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eIn the CLI, \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e used to follow symlinks in some situations. This\nis no longer the case.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003ccode\u003edotenv.set_key\u003c/code\u003e, \u003ccode\u003edotenv.unset_key\u003c/code\u003e and the CLI commands \u003ccode\u003eset\u003c/code\u003e and \u003ccode\u003eunset\u003c/code\u003e\nused to reset the file mode of the modified .env file to \u003ccode\u003e0o600\u003c/code\u003e in some\nsituations. This is no longer the case: The original mode of the file is now\npreserved. Is the file needed to be created or wasn't a regular file, mode\n\u003ccode\u003e0o600\u003c/code\u003e is used.\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.2.1] - 2025-10-26\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMove more config to \u003ccode\u003epyproject.toml\u003c/code\u003e, removed \u003ccode\u003esetup.cfg\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for reading \u003ccode\u003e.env\u003c/code\u003e from FIFOs (Unix) by [\u003ca href=\"https://github.com/sidharth-sudhir\"\u003e\u003ccode\u003e@​sidharth-sudhir\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/586\"\u003e#586\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.2.0] - 2025-10-26\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade build system to use PEP 517 \u0026amp; PEP 518 to use \u003ccode\u003ebuild\u003c/code\u003e and \u003ccode\u003epyproject.toml\u003c/code\u003e by [\u003ca href=\"https://github.com/EpicWink\"\u003e\u003ccode\u003e@​EpicWink\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/583\"\u003e#583\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for Python 3.14 by [\u003ca href=\"https://github.com/23f3001135\"\u003e\u003ccode\u003e@​23f3001135\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/579\"\u003e#579\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd support for disabling of \u003ccode\u003eload_dotenv()\u003c/code\u003e using \u003ccode\u003ePYTHON_DOTENV_DISABLED\u003c/code\u003e env var. by [\u003ca href=\"https://github.com/matthewfranglen\"\u003e\u003ccode\u003e@​matthewfranglen\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/569\"\u003e#569\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e[1.1.1] - 2025-06-24\u003c/h2\u003e\n\u003ch3\u003eFixed\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eCLI: Ensure \u003ccode\u003efind_dotenv\u003c/code\u003e work reliably on python 3.13 by [\u003ca href=\"https://github.com/theskumar\"\u003e\u003ccode\u003e@​theskumar\u003c/code\u003e\u003c/a\u003e] in \u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/563\"\u003e#563\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/36004e0e34be7665ff2b11a8a4005144f76f176d\"\u003e\u003ccode\u003e36004e0\u003c/code\u003e\u003c/a\u003e Bump version: 1.2.1 → 1.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/eb202520e5933c9daf42501e1e42fdb0144002c8\"\u003e\u003ccode\u003eeb20252\u003c/code\u003e\u003c/a\u003e docs: update changelog for v1.2.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/790c5c02991100aa1bf41ee5330aca75edc51311\"\u003e\u003ccode\u003e790c5c0\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/43340da220fb4ca4f95357bbe21a3c7f8f1278b1\"\u003e\u003ccode\u003e43340da\u003c/code\u003e\u003c/a\u003e Remove the use of \u003ccode\u003esh\u003c/code\u003e in tests (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/612\"\u003e#612\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/09d7cee32459e7abdcb5c9d8122a552589c06a9c\"\u003e\u003ccode\u003e09d7cee\u003c/code\u003e\u003c/a\u003e docs: clarify override behavior and document FIFO support (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/610\"\u003e#610\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/c8de2887c00198c22842c5ae5e92d1747467363c\"\u003e\u003ccode\u003ec8de288\u003c/code\u003e\u003c/a\u003e ci: improve workflow efficiency with best practices (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/609\"\u003e#609\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/7bd9e3dbfedc0983ad7d56d5570013035242bdf4\"\u003e\u003ccode\u003e7bd9e3d\u003c/code\u003e\u003c/a\u003e Add Windows testing to CI (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/604\"\u003e#604\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/1baaf04f336072e0ee324d5df9563ec767f14f81\"\u003e\u003ccode\u003e1baaf04\u003c/code\u003e\u003c/a\u003e Drop Python 3.9 support and update to PyPy 3.11 (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/608\"\u003e#608\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/4a22cf8993804aeede0c20b75bb1a29d3a99e9dc\"\u003e\u003ccode\u003e4a22cf8\u003c/code\u003e\u003c/a\u003e ci: enable testing on Python 3.14t (free-threaded) (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/588\"\u003e#588\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/theskumar/python-dotenv/commit/e2e8e776b42e382ae38b44d3982dd649e7507dd4\"\u003e\u003ccode\u003ee2e8e77\u003c/code\u003e\u003c/a\u003e Fix license specifier (\u003ca href=\"https://redirect.github.com/theskumar/python-dotenv/issues/597\"\u003e#597\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/theskumar/python-dotenv/compare/v1.0.1...v1.2.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `setuptools` from 75.8.0 to 83.0.0\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pypa/setuptools/blob/main/NEWS.rst\"\u003esetuptools's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ev83.0.0\u003c/h1\u003e\n\u003ch2\u003eFeatures\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRequire Python 3.10 or later.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003eMANIFEST.in\u003c/code\u003e matching (via \u003ccode\u003eFileList\u003c/code\u003e) is now insensitive to Unicode\nnormalization form. A pattern authored in one form (e.g. NFC, as typically\nsaved by editors) now matches a file whose name is stored on disk in another\n(e.g. NFD, as produced by macOS APFS/HFS+). Previously an \u003ccode\u003eexclude\u003c/code\u003e,\n\u003ccode\u003eglobal-exclude\u003c/code\u003e, \u003ccode\u003erecursive-exclude\u003c/code\u003e, or \u003ccode\u003eprune\u003c/code\u003e rule could silently\nfail to drop a non-ASCII-named file from the source distribution, publishing\nit despite the exclusion -- see GHSA-h35f-9h28-mq5c.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ccode\u003epypa/distutils#334\u003c/code\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003ev82.0.1\u003c/h1\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFix the loading of \u003ccode\u003elauncher manifest.xml\u003c/code\u003e file. (\u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5047\"\u003e#5047\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eReplaced deprecated \u003ccode\u003ejson.__version__\u003c/code\u003e with fixture in tests. (\u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5186\"\u003e#5186\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eImproved Documentation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd advice about how to improve predictability when installing sdists. (\u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5168\"\u003e#5168\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eMisc\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/4941\"\u003e#4941\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5157\"\u003e#5157\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5169\"\u003e#5169\u003c/a\u003e, \u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5175\"\u003e#5175\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003ev82.0.0\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/6519f728c6f23c992df81a5691ef7655184a20eb\"\u003e\u003ccode\u003e6519f72\u003c/code\u003e\u003c/a\u003e Bump version: 82.0.1 → 83.0.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/d1151b125b29a6ee1c7db860f7ee6c365d525b5f\"\u003e\u003ccode\u003ed1151b1\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5250\"\u003e#5250\u003c/a\u003e from pypa/feature/distutils-d7633fbed\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/a2df31e6a741b0fe775969618fe6a3a3d032e900\"\u003e\u003ccode\u003ea2df31e\u003c/code\u003e\u003c/a\u003e Capture removal of dry_run parameter in changelog.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/00144dc3fb6d023fd81cdc26c380a012b084df9b\"\u003e\u003ccode\u003e00144dc\u003c/code\u003e\u003c/a\u003e Moved newsfragment to the release where it occurred.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/a4a5a2b160357be77626aa077ddd1d8ee53be50f\"\u003e\u003ccode\u003ea4a5a2b\u003c/code\u003e\u003c/a\u003e Add news fragment.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/77470c23c35031c9e37d7512694ac5ca52bfcaac\"\u003e\u003ccode\u003e77470c2\u003c/code\u003e\u003c/a\u003e Merge \u003ca href=\"https://github.com/pypa/distutils\"\u003ehttps://github.com/pypa/distutils\u003c/a\u003e into feature/distutils-d7633fbed\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/3c43897420f25a1be1afe6eaa905d056009cc736\"\u003e\u003ccode\u003e3c43897\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/pypa/setuptools/issues/5247\"\u003e#5247\u003c/a\u003e from pypa/copilot/fix-pypy-version-issue\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/bb6ea66b4bd01cb35d7c68a1bc61b96d59190269\"\u003e\u003ccode\u003ebb6ea66\u003c/code\u003e\u003c/a\u003e Bump PyPy from 3.10 to 3.11 in CI workflow\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/a2bc3aca2f55eb9b93ea633e58ba68170ce14451\"\u003e\u003ccode\u003ea2bc3ac\u003c/code\u003e\u003c/a\u003e Fix broken intersphinx reference to build's installation docs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/setuptools/commit/2d6a739c64cfedc65e1f635af7b52340aac8d99b\"\u003e\u003ccode\u003e2d6a739\u003c/code\u003e\u003c/a\u003e Use stacked parametrize decorators instead of itertools.product\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pypa/setuptools/compare/v75.8.0...v83.0.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pillow` from 11.0.0 to 12.3.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/python-pillow/Pillow/releases\"\u003epillow's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e12.3.0\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html\"\u003ehttps://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eRemovals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemove non-image ImageCms modes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9697\"\u003e#9697\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDocumentation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd release notes for SBOM and performance improvements \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9747\"\u003e#9747\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd security release notes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9741\"\u003e#9741\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd release notes for Python 3.15 beta wheels \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9696\"\u003e#9696\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eImageFont can also be used with ImageText \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9597\"\u003e#9597\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdditional guidelines for security reports \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9659\"\u003e#9659\u003c/a\u003e [\u003ca href=\"https://github.com/wiredfool\"\u003e\u003ccode\u003e@​wiredfool\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eFixed typo \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9636\"\u003e#9636\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdded CVEs to 12.2.0 release notes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9591\"\u003e#9591\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eRevise development support information in README \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9583\"\u003e#9583\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd INCIDENT_RESPONSE.md \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9555\"\u003e#9555\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd STRIDE threat model to security docs \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9562\"\u003e#9562\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd CVEs to 12.2.0 release notes \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9556\"\u003e#9556\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate README with revised security policy \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9553\"\u003e#9553\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate security policy \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9552\"\u003e#9552\u003c/a\u003e [\u003ca href=\"https://github.com/aclark4life\"\u003e\u003ccode\u003e@​aclark4life\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate macOS tested Python versions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9534\"\u003e#9534\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDependencies\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate dependency harfbuzz to v14.2.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9720\"\u003e#9720\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency mypy to v2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9653\"\u003e#9653\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency cibuildwheel to v4 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9665\"\u003e#9665\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate github-actions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9655\"\u003e#9655\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency libavif to v1.4.2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9652\"\u003e#9652\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency lcms2 to v2.19.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9651\"\u003e#9651\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency check-jsonschema to v0.37.2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9650\"\u003e#9650\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate google/oss-fuzz digest to d872252 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9614\"\u003e#9614\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency lcms2 to v2.19 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9609\"\u003e#9609\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency libpng to v1.6.58 - autoclosed \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9608\"\u003e#9608\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency harfbuzz to v14 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9610\"\u003e#9610\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency mypy to v1.20.2 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9599\"\u003e#9599\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate github-actions \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9611\"\u003e#9611\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency cibuildwheel to v3.4.1 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9607\"\u003e#9607\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eMove dependency versions to single JSON and enable Renovate \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9559\"\u003e#9559\u003c/a\u003e [\u003ca href=\"https://github.com/hugovk\"\u003e\u003ccode\u003e@​hugovk\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdated raqm to 0.10.5 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9557\"\u003e#9557\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUpdate dependency cibuildwheel to v3.4.0 \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9532\"\u003e#9532\u003c/a\u003e [@\u003ca href=\"https://github.com/apps/renovate\"\u003erenovate[bot]\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eTesting\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemove matrix.os from benchmark \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9735\"\u003e#9735\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eRemove references to libavif patch \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9734\"\u003e#9734\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eAdd benchmark tests \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9654\"\u003e#9654\u003c/a\u003e [\u003ca href=\"https://github.com/akx\"\u003e\u003ccode\u003e@​akx\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003cli\u003eUse reshape() instead of setting NumPy array shape directly \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9728\"\u003e#9728\u003c/a\u003e [\u003ca href=\"https://github.com/radarhere\"\u003e\u003ccode\u003e@​radarhere\u003c/code\u003e\u003c/a\u003e]\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst\"\u003epillow's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eChangelog (Pillow)\u003c/h1\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/bb1d8e8ab8d29048624d96e3ee53cecf7c13d13d\"\u003e\u003ccode\u003ebb1d8e8\u003c/code\u003e\u003c/a\u003e 12.3.0 version bump\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/e63fc481dc2e07e21d5403deafb8f1ed98a513af\"\u003e\u003ccode\u003ee63fc48\u003c/code\u003e\u003c/a\u003e Add release notes for SBOM and performance improvements (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9747\"\u003e#9747\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/13b701bbab291eec4bc87ea17ba06c94e5fe3054\"\u003e\u003ccode\u003e13b701b\u003c/code\u003e\u003c/a\u003e Add release notes for \u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9679\"\u003e#9679\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/5564ca72fcd59d040e270af5dcf17a0d7161c364\"\u003e\u003ccode\u003e5564ca7\u003c/code\u003e\u003c/a\u003e List methods\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/a0920fd384f800b5d0ba3dd29ecdeae4f1d4043b\"\u003e\u003ccode\u003ea0920fd\u003c/code\u003e\u003c/a\u003e Speed up ImageChops operations (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9738\"\u003e#9738\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/07e9a6cd5336dc6cf8cae9165cd70cdd2b3e42fc\"\u003e\u003ccode\u003e07e9a6c\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.filter()\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9736\"\u003e#9736\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/a94578cf9649ea13e426cf7fb2b71b39ffc0dd50\"\u003e\u003ccode\u003ea94578c\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.getchannel()\u003c/code\u003e, \u003ccode\u003eImage.merge()\u003c/code\u003e, \u003ccode\u003eImage.putalpha()\u003c/code\u003e and `Image...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/53e02c43c919d149b2a154a5180079f9df18fbbb\"\u003e\u003ccode\u003e53e02c4\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.fill()\u003c/code\u003e, \u003ccode\u003eImage.linear_gradient()\u003c/code\u003e and `Image.radial_gradient...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/af037475be8634ba739744243164ba9e2c8346a6\"\u003e\u003ccode\u003eaf03747\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003eImage.resample()\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9739\"\u003e#9739\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/python-pillow/Pillow/commit/5c9ca56c3e5fba52b647809fbb0986c87e73a571\"\u003e\u003ccode\u003e5c9ca56\u003c/code\u003e\u003c/a\u003e Speed up \u003ccode\u003ealpha_composite\u003c/code\u003e, \u003ccode\u003ematrix\u003c/code\u003e, \u003ccode\u003enegative\u003c/code\u003e, \u003ccode\u003equantize\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/python-pillow/Pillow/issues/9740\"\u003e#9740\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/python-pillow/Pillow/compare/11.1.0...12.3.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `gitpython` from 3.1.44 to 3.1.54\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/gitpython-developers/GitPython/releases\"\u003egitpython's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.1.54 - Security\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eHarden unsafe Git option validation by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2180\"\u003egitpython-developers/GitPython#2180\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54\"\u003ehttps://github.com/gitpython-developers/GitPython/compare/3.1.53...3.1.54\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e3.1.53 - Security\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003efeat(submodule): add deinit method to Submodule (\u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2014\"\u003e#2014\u003c/a\u003e) by \u003ca href=\"https://github.com/mvanhorn\"\u003e\u003ccode\u003e@​mvanhorn\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2129\"\u003egitpython-developers/GitPython#2129\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003etyping: introduce sensible basedpyright defaults by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2174\"\u003egitpython-developers/GitPython#2174\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: make \u003ccode\u003esubmodule.update()\u003c/code\u003e after \u003ccode\u003esubmodule.deinit()\u003c/code\u003e work by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2175\"\u003egitpython-developers/GitPython#2175\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix commit hooks respecting core.hooksPath by \u003ca href=\"https://github.com/Siesta0217\"\u003e\u003ccode\u003e@​Siesta0217\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2159\"\u003egitpython-developers/GitPython#2159\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: validate config section delimiters by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2176\"\u003egitpython-developers/GitPython#2176\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Siesta0217\"\u003e\u003ccode\u003e@​Siesta0217\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2159\"\u003egitpython-developers/GitPython#2159\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.52...3.1.53\"\u003ehttps://github.com/gitpython-developers/GitPython/compare/3.1.52...3.1.53\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e3.1.52 Security\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573\"\u003ehttps://github.com/gitpython-developers/GitPython/security/advisories/GHSA-rwj8-pgh3-r573\u003c/a\u003e: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL\u003c/p\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSkip cross-drive relative config test on Windows by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2171\"\u003egitpython-developers/GitPython#2171\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003efix: preserve literal clone URLs by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2172\"\u003egitpython-developers/GitPython#2172\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/gitpython-developers/GitPython/compare/3.1.51...3.1.52\"\u003ehttps://github.com/gitpython-developers/GitPython/compare/3.1.51...3.1.52\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e3.1.51 - Security\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd AI-disclosure and quality requirements to the contribution guidelines by \u003ca href=\"https://github.com/Byron\"\u003e\u003ccode\u003e@​Byron\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2143\"\u003egitpython-developers/GitPython#2143\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003edocs(cmd): clarify Git.execute() string vs list command argument by \u003ca href=\"https://github.com/mvanhorn\"\u003e\u003ccode\u003e@​mvanhorn\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2144\"\u003egitpython-developers/GitPython#2144\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRewrite Git.execute() command parameter docstring per \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/issues/2146\"\u003e#2146\u003c/a\u003e by \u003ca href=\"https://github.com/EliahKagan\"\u003e\u003ccode\u003e@​EliahKagan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2147\"\u003egitpython-developers/GitPython#2147\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDocument init script behavior with multiple master remotes by \u003ca href=\"https://github.com/EliahKagan\"\u003e\u003ccode\u003e@​EliahKagan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2148\"\u003egitpython-developers/GitPython#2148\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBump git/ext/gitdb from \u003ccode\u003e335c0f6\u003c/code\u003e to \u003ccode\u003e0a019a2\u003c/code\u003e by \u003ca href=\"https://github.com/dependabot\"\u003e\u003ccode\u003e@​dependabot\u003c/code\u003e\u003c/a\u003e[bot] in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2149\"\u003egitpython-developers/GitPython#2149\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eSupport relative worktree paths (git 2.48+ worktree.useRelativePaths) by \u003ca href=\"https://github.com/elovelan\"\u003e\u003ccode\u003e@​elovelan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2151\"\u003egitpython-developers/GitPython#2151\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eDefer xfail condition evaluation with xfail_if_raises context manager by \u003ca href=\"https://github.com/elovelan\"\u003e\u003ccode\u003e@​elovelan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-developers/GitPython/pull/2153\"\u003egitpython-developers/GitPython#2153\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eRun more submodule tests on Cygwin (fix flaky xfails) by \u003ca href=\"https://github.com/EliahKagan\"\u003e\u003ccode\u003e@​EliahKagan\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/gitpython-devel...\n\n_Description has been truncated_","html_url":"https://github.com/totnormal/skills-3/pull/17","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/totnormal%2Fskills-3/issues/17","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/17/packages"}},{"old_version":"6.4.2","new_version":"6.5.7","update_type":"minor","path":null,"pr_created_at":"2026-06-29T21:08:59.000Z","version_change":"6.4.2 → 6.5.7","issue":{"uuid":"4771607092","node_id":"PR_kwDOSG89IM7r9UYq","number":32,"state":"closed","title":"Build(deps): Bump the pip group across 1 directory with 6 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-30T03:21:48.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-29T21:08:59.000Z","updated_at":"2026-06-30T03:21:56.000Z","time_to_close":22369,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Build(deps): Bump","group_name":"pip","update_count":6,"packages":[{"name":"cryptography","old_version":"43.0.0","new_version":"48.0.1","repository_url":"https://github.com/pyca/cryptography"},{"name":"protobuf","old_version":"4.21.12","new_version":"5.29.6","repository_url":"https://github.com/protocolbuffers/protobuf"},{"name":"requests","old_version":"2.32.3","new_version":"2.33.0","repository_url":"https://github.com/psf/requests"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"urllib3","old_version":"2.3.0","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"},{"name":"wheel","old_version":"0.46.1","new_version":"0.46.2","repository_url":"https://github.com/pypa/wheel"}],"path":null,"ecosystem":"pip"},"body":"Bumps the pip group with 6 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [cryptography](https://github.com/pyca/cryptography) | `43.0.0` | `48.0.1` |\n| [protobuf](https://github.com/protocolbuffers/protobuf) | `4.21.12` | `5.29.6` |\n| [requests](https://github.com/psf/requests) | `2.32.3` | `2.33.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.4.2` | `6.5.7` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |\n| [wheel](https://github.com/pypa/wheel) | `0.46.1` | `0.46.2` |\n\n\nUpdates `cryptography` from 43.0.0 to 48.0.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst\"\u003ecryptography's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e48.0.1 - 2026-06-09\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.\n\u003cp\u003e.. _v48-0-0:\u003c/p\u003e\n\u003cp\u003e48.0.0 - 2026-05-04\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Support for Python 3.8 has been removed.\n\u003ccode\u003ecryptography\u003c/code\u003e now requires Python 3.9 or later.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Loading an X.509 CRL whose inner\n\u003ccode\u003eTBSCertList.signature\u003c/code\u003e algorithm does not match the outer\n\u003ccode\u003esignatureAlgorithm\u003c/code\u003e now raises \u003ccode\u003eValueError\u003c/code\u003e. Previously, such CRLs\nwere parsed successfully and only rejected during signature validation.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded support for :doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mlkem\u003c/code\u003e and\n:doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mldsa\u003c/code\u003e when using OpenSSL 3.5.0 or\nlater, in addition to the existing AWS-LC and BoringSSL support. This means\npost-quantum algorithms are now available to users of our wheels.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eNote:\u003c/strong\u003e Going forward, we do not guarantee that all functionality\nin \u003ccode\u003ecryptography\u003c/code\u003e will be available when building against\nOpenSSL. See :doc:\u003ccode\u003e/statements/state-of-openssl\u003c/code\u003e for more information.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. _v47-0-0:\u003c/p\u003e\n\u003cp\u003e47.0.0 - 2026-04-24\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Support for Python 3.8 is deprecated and will be removed in the next\n  ``cryptography`` release.\n* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves\n  (``SECT*`` classes) has been removed. These curves are rarely used and\n  have additional security considerations that make them undesirable.\n* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.\n  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC\n  continue to be supported.\n* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL \u0026lt; 4.1.\n* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or\n  keys with unsupported explicit curve encodings now raises\n  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of\n  ``ValueError``. This change affects\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,\n  and :meth:`~cryptography.x509.Certificate.public_key` when called on\n  certificates with unsupported public key algorithms.\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt; \n\u003c/code\u003e\u003c/pre\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/de987ce48ccfeb1abca41efa23b2bf73ec704f74\"\u003e\u003ccode\u003ede987ce\u003c/code\u003e\u003c/a\u003e 48.0.1 version bump and changelog (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14996\"\u003e#14996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/8e03e30e3aae01632a697e903e3593c924f0139d\"\u003e\u003ccode\u003e8e03e30\u003c/code\u003e\u003c/a\u003e bump for 48.0.0 release (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14796\"\u003e#14796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/295e0d254ef31ab864730aa41312ec355416ee71\"\u003e\u003ccode\u003e295e0d2\u003c/code\u003e\u003c/a\u003e Add AGENTS.md with CLAUDE.md symlink (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14794\"\u003e#14794\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/104a2de19e268a433e6da92be9cb872dcf0003c8\"\u003e\u003ccode\u003e104a2de\u003c/code\u003e\u003c/a\u003e Bump BoringSSL, OpenSSL, AWS-LC in CI (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14793\"\u003e#14793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/67ec1e51988195e17993d2edef5258b27509b926\"\u003e\u003ccode\u003e67ec1e5\u003c/code\u003e\u003c/a\u003e call check_length early on AesSiv::encrypt (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14792\"\u003e#14792\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/b2da57a0d9e4bfd2b95364299091a18f74127b26\"\u003e\u003ccode\u003eb2da57a\u003c/code\u003e\u003c/a\u003e changelog for mldsa/mlkem for openssl (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14791\"\u003e#14791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/3cf44adee25c368d4a136e072fa9f80465d91eb0\"\u003e\u003ccode\u003e3cf44ad\u003c/code\u003e\u003c/a\u003e ML-KEM OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14781\"\u003e#14781\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e31639666766f846fbab2c605879db0fa64fe83\"\u003e\u003ccode\u003e2e31639\u003c/code\u003e\u003c/a\u003e ML-DSA OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14773\"\u003e#14773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/5affe5a286a986fdf512c4a5cb280d28a96c10e3\"\u003e\u003ccode\u003e5affe5a\u003c/code\u003e\u003c/a\u003e fix rust nightly clippy (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14790\"\u003e#14790\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e73ca448eaf64b6f0d4ffbb794cf96170cef5ec\"\u003e\u003ccode\u003e2e73ca4\u003c/code\u003e\u003c/a\u003e bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pyca/cryptography/compare/43.0.0...48.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `protobuf` from 4.21.12 to 5.29.6\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/protocolbuffers/protobuf/releases\"\u003eprotobuf's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eProtocol Buffers v34.0-rc1\u003c/h2\u003e\n\u003ch1\u003eAnnouncements\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eThis version includes breaking changes to: C++, Objective-C, PHP, Python.\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003e[Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Make generator headers private (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/3a2af3510f0d454dbe3e4dc281674b61c4d20b9e\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/3a2af3510f0d454dbe3e4dc281674b61c4d20b9e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/7a7589823d2cfaaf7994b050e98d5d553bc9b1c1\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/7a7589823d2cfaaf7994b050e98d5d553bc9b1c1\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Add [[nodiscard]] to many APIs. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/a70115f33f9af2c4b2202c800b84837e7fe0d738\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/a70115f33f9af2c4b2202c800b84837e7fe0d738\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Make the arena-enabled constructors of \u003ccode\u003eRepeatedField\u003c/code\u003e, \u003ccode\u003eRepeatedPtrField\u003c/code\u003e, and \u003ccode\u003eMap\u003c/code\u003e private. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/ef890c3d0c79398c70e047fe5dd893f460ba2336\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/ef890c3d0c79398c70e047fe5dd893f460ba2336\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Removes proto2::util::MessageDifferencer::AddIgnoreCriteria that takes a raw pointer as an argument in favor of the overload that takes a unique_ptr. Remove macro PROTOBUF_FUTURE_REMOVE_ADD_IGNORE_CRITERIA (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b115358c64127896fed88b8b5ef5d91d86d8cbae\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b115358c64127896fed88b8b5ef5d91d86d8cbae\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated FieldDescriptor::has_optional_keyword() in OSS. Use is_repeated() or has_presence() instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/68346ec9348e932664e58c3ecdcd1478f95233a8\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/68346ec9348e932664e58c3ecdcd1478f95233a8\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove AddUnusedImportTrackFile() and ClearUnusedImportTrackFiles(). Remove PROTOBUF_FUTURE_RENAME_ADD_UNUSED_IMPORT (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/837a2cd1d6c75402b2503ffe7cd8aeaf25868536\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/837a2cd1d6c75402b2503ffe7cd8aeaf25868536\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated FieldDescriptor::is_optional() in OSS. Use (!is_required() \u0026amp;\u0026amp; !is_repeated()) instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/9dbc5d479a8e453921485d8d3de47fb3c005f1af\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/9dbc5d479a8e453921485d8d3de47fb3c005f1af\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] All entity names have length limit (2afb0dc)\u003c/li\u003e\n\u003cli\u003e[ObjC] Remove \u003ccode\u003egenerate_minimal_imports\u003c/code\u003e generation option warning (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/45b1297fdaad5a9436d0e207422168c38dc45ac4\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/45b1297fdaad5a9436d0e207422168c38dc45ac4\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[ObjC] Fix nullability annotations on some \u003ccode\u003eGPB*Dictionary\u003c/code\u003e types. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/ea67d6d26a48478a567c404679e3bb99cf230d50\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/ea67d6d26a48478a567c404679e3bb99cf230d50\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[ObjC] Remove \u003ccode\u003e-[GPBFieldDescriptor optional]\u003c/code\u003e (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/3414dc151eb4dcbdb2ca952e2589993bf7af75c4\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/3414dc151eb4dcbdb2ca952e2589993bf7af75c4\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Other] Remove deprecated flag for enabling MSVC support (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/97c979be6e0907e1051bee62584dac4594e73fa7\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/97c979be6e0907e1051bee62584dac4594e73fa7\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP] Remove deprecated PHP APIs (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/9c45014099a4f7004fab6dd1278de2f4f2a393c5\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/9c45014099a4f7004fab6dd1278de2f4f2a393c5\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP] Remove deprecated PHP APIs FieldDescriptor getLabel, use IsRepeated or isRequired instead. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\u003c/a\u003e, \u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/cd76e675b14d00dda5623b30835d2bc7105fccc6\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/cd76e675b14d00dda5623b30835d2bc7105fccc6\u003c/a\u003e, \u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP]  Add PHP typehints for setters and remove redundant GPBUtil checks (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/pull/25296\"\u003eprotocolbuffers/protobuf#25296\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/aee03b78929c02461a5f9d8e136a2a016359b0cd\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/aee03b78929c02461a5f9d8e136a2a016359b0cd\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP]  support default values for editions/proto2 (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/pull/25161\"\u003eprotocolbuffers/protobuf#25161\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b01099d56350551bae3da88b97bf3027274c9f17\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b01099d56350551bae3da88b97bf3027274c9f17\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Raise errors in OSS when assign bool to int/enum field in Python Proto. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/5b116fe2f14f49dd0cc3b76089983717f211025c\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/5b116fe2f14f49dd0cc3b76089983717f211025c\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove float_format/double_format from python proto text_format (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/e4854a186e0bfa867d5bfa5cd850608a948fd488\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/e4854a186e0bfa867d5bfa5cd850608a948fd488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Raise TypeError when convert non-timedelta to Duration, or convert non-datetime to Timestamp in python proto. (Original code may raise ArributeError) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/00aaca1b4d98954bc2933d7c8a5379ba6088124c\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/00aaca1b4d98954bc2933d7c8a5379ba6088124c\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove float_precision from python proto json_format (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/f027f1fcd52b9d080b7ee79f4024f53cf54e0dc5\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/f027f1fcd52b9d080b7ee79f4024f53cf54e0dc5\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove deprecated FieldDescriptor.label (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/0a8ff55518ea5874478ad5b26515b31d186045a9\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/0a8ff55518ea5874478ad5b26515b31d186045a9\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://protobuf.dev/news/\"\u003eProtobuf News\u003c/a\u003e may include additional announcements or pre-announcements for upcoming changes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://protobuf.dev/support/migration/\"\u003eMigration Guide\u003c/a\u003e may include additional guidance for breaking changes.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eBazel\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eFix: cc_toolchain should prefer protoc when prebuilt flag is flipped. (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/25168\"\u003e#25168\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/8c857c3a1c6a106b0a096f1c9fa504bfaca035a9\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/8c857c3a1c6a106b0a096f1c9fa504bfaca035a9\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBreaking change: Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFeat(bazel): wire up prebuilt protoc toolchain (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/24115\"\u003e#24115\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/cc23698b486e690ea2eb873cc7596a87c74a3ba6\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/cc23698b486e690ea2eb873cc7596a87c74a3ba6\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eMigrate \u003ccode\u003eproto_descriptor_set\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/23369\"\u003e#23369\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/8d4dfdd39a7a242a9ed631a6ab2192c57dd9b9c8\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/8d4dfdd39a7a242a9ed631a6ab2192c57dd9b9c8\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eCompiler\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eRuby codegen: support generation of rbs files (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/15633\"\u003e#15633\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/6ebdf851ba78728f0aa145d38454ed9a316fb08d\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/6ebdf851ba78728f0aa145d38454ed9a316fb08d\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAvoid collision name problems between a message named \u003ccode\u003eXyz\u003c/code\u003e and a direct sibling enum named \u003ccode\u003eXyzView\u003c/code\u003e (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/eba53e8f172b273d679759a72ce4250131ee3df1\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/eba53e8f172b273d679759a72ce4250131ee3df1\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eGeneralizing and implementing ValidateFeatureSupport for both Options and Features during proto parsing (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/ed3c57114d8e2b47cca7697ddaa50c1b3762a6b0\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/ed3c57114d8e2b47cca7697ddaa50c1b3762a6b0\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix a bug with custom features outside of the \u003ccode\u003epb\u003c/code\u003e package. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/872d3ce7a4da00d7dcec33ced20cfe45235935e8\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/872d3ce7a4da00d7dcec33ced20cfe45235935e8\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix import option handling when include_imports isn't set. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/9ef9e80afd9bc8379d578fe67e5ab0738728c04e\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/9ef9e80afd9bc8379d578fe67e5ab0738728c04e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix a bug in STRICT check of namespaced enums to properly check for 'reserved 1 to max' (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/1229d4adba24c0952ab85ce96bc7b7f8a1fe6d0f\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/1229d4adba24c0952ab85ce96bc7b7f8a1fe6d0f\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003ePrevent accidental stripping of \u003ccode\u003edebug_redact\u003c/code\u003e options via import option. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/f58b098bffa7ca4045ef7773b09151a6af5d0c28\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/f58b098bffa7ca4045ef7773b09151a6af5d0c28\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eC++\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eAdd EnumerateEnumValues function. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/397d5d99db274b379d1384814074bf7df39d32f7\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/397d5d99db274b379d1384814074bf7df39d32f7\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/protocolbuffers/protobuf/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.32.3 to 2.33.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/releases\"\u003erequests's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.33.0\u003c/h2\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at \u003ca href=\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e. Give it a try, and report any gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/M0d3v1\"\u003e\u003ccode\u003e@​M0d3v1\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6865\"\u003epsf/requests#6865\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/aminvakil\"\u003e\u003ccode\u003e@​aminvakil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7220\"\u003epsf/requests#7220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/E8Price\"\u003e\u003ccode\u003e@​E8Price\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6960\"\u003epsf/requests#6960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mitre88\"\u003e\u003ccode\u003e@​mitre88\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7244\"\u003epsf/requests#7244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/magsen\"\u003e\u003ccode\u003e@​magsen\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6553\"\u003epsf/requests#6553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Rohan5commit\"\u003e\u003ccode\u003e@​Rohan5commit\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7227\"\u003epsf/requests#7227\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003ev2.32.5\u003c/h2\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has created\na new class of issues in Requests that have had negative impact across a number\nof use cases. The Requests team has decided to revert this feature as long term\nmaintenance of it is proving to be unsustainable in its current iteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003ev2.32.4\u003c/h2\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base that\nuses Requests, please take a look at \u003ca href=\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e. Give it a try, and report\nany gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now extracts\ncontents to a non-deterministic location to prevent malicious file\nreplacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause\nmalformed authentication to be applied to Requests on\nPython 3.11+. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.5 (2025-08-18)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eThe SSLContext caching feature originally introduced in 2.32.0 has created\na new class of issues in Requests that have had negative impact across a number\nof use cases. The Requests team has decided to revert this feature as long term\nmaintenance of it is proving to be unsustainable in its current iteration.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded support for Python 3.14.\u003c/li\u003e\n\u003cli\u003eDropped support for Python 3.8 following its end of support.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.32.4 (2025-06-10)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted\nenvironment will retrieve credentials for the wrong hostname/machine from a\nnetrc file.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761\"\u003e\u003ccode\u003ebc04dfd\u003c/code\u003e\u003c/a\u003e v2.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"\u003e\u003ccode\u003e66d21cb\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028\"\u003e\u003ccode\u003e8b9bc8f\u003c/code\u003e\u003c/a\u003e Move badges to top of README (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7293\"\u003e#7293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286\"\u003e\u003ccode\u003ee331a28\u003c/code\u003e\u003c/a\u003e Remove unused extraction call (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7292\"\u003e#7292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29\"\u003e\u003ccode\u003e753fd08\u003c/code\u003e\u003c/a\u003e docs: fix FAQ grammar in httplib2 example\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71\"\u003e\u003ccode\u003e774a0b8\u003c/code\u003e\u003c/a\u003e docs(socks): same block as other sections\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303\"\u003e\u003ccode\u003e9c72a41\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 4.33.0 to 4.34.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be\"\u003e\u003ccode\u003eebf7190\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 4.32.0 to 4.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798\"\u003e\u003ccode\u003e0e4ae38\u003c/code\u003e\u003c/a\u003e docs: exclude Response.is_permanent_redirect from API docs (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7244\"\u003e#7244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a\"\u003e\u003ccode\u003ed568f47\u003c/code\u003e\u003c/a\u003e docs: clarify Quickstart POST example (\u003ca href=\"https://redirect.github.com/psf/requests/issues/6960\"\u003e#6960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/psf/requests/compare/v2.32.3...v2.33.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 2.3.0 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3 is raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects \u003ca href=\"https://opencollective.com/urllib3\"\u003eplease consider contributing financially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been read and decompressed partially. (Reported by \u003ca href=\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or \u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed using the official \u003ca href=\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by \u003ca href=\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca href=\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed data buffered from previous partial reads. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the response after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt=0\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing \u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior of chunked request bodies. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling schemeless URIs were passed to \u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to accept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e, matching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling use with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3 is raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects \u003ca href=\"https://opencollective.com/urllib3\"\u003eplease consider contributing financially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the streaming API were bypassed when HTTP redirects were followed. (CVE-2026-21441 reported by \u003ca href=\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High, GHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours as 6 hours by default. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on Emscripten. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed\nusing the official \u003ccode\u003eBrotli \u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763) \u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720) \u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979) \u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777) \u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636) \u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the\nresponse after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e Release 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e Fix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e Switch to nightly PyPy3.11 in CI for now (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e Avoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when \u003ccode\u003eamt=0\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e Bump dev dependencies (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e Upgrade mypy to version 1.20.2 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e Drop support for EOL PyPy3.10 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e Upgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix warnings (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/urllib3/urllib3/compare/2.3.0...2.7.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `wheel` from 0.46.1 to 0.46.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pypa/wheel/releases\"\u003ewheel's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e0.46.2\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRestored the \u003ccode\u003ebdist_wheel\u003c/code\u003e command for compatibility with \u003ccode\u003esetuptools\u003c/code\u003e older than v70.1\u003c/li\u003e\n\u003cli\u003eImporting \u003ccode\u003ewheel.bdist_wheel\u003c/code\u003e now emits a \u003ccode\u003eFutureWarning\u003c/code\u003e instead of a \u003ccode\u003eDeprecationWarning\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel unpack\u003c/code\u003e potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pypa/wheel/blob/main/docs/news.rst\"\u003ewheel's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease Notes\u003c/h1\u003e\n\u003cp\u003e\u003cstrong\u003e0.47.0 (2026-04-22)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eAdded the \u003ccode\u003ewheel info\u003c/code\u003e subcommand to display metadata about wheel files without\nunpacking them (\u003ccode\u003e[#639](https://github.com/pypa/wheel/issues/639) \u0026lt;https://github.com/pypa/wheel/issues/639\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eWheelFile\u003c/code\u003e raising \u003ccode\u003eMissing RECORD file\u003c/code\u003e when the wheel filename contains\nuppercase characters (e.g. \u003ccode\u003eDjango-3.2.5.whl\u003c/code\u003e) but the \u003ccode\u003e.dist-info\u003c/code\u003e directory\ninside uses normalized lowercase naming\n(\u003ccode\u003e[#411](https://github.com/pypa/wheel/issues/411) \u0026lt;https://github.com/pypa/wheel/issues/411\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.46.3 (2026-01-22)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed \u003ccode\u003eImportError: cannot import name '_setuptools_logging' from 'wheel'\u003c/code\u003e when\ninstalled alongside an old version of setuptools and running the \u003ccode\u003ebdist_wheel\u003c/code\u003e\ncommand (\u003ccode\u003e[#676](https://github.com/pypa/wheel/issues/676) \u0026lt;https://github.com/pypa/wheel/issues/676\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.46.2 (2026-01-22)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eRestored the \u003ccode\u003ebdist_wheel\u003c/code\u003e command for compatibility with \u003ccode\u003esetuptools\u003c/code\u003e older than\nv70.1\u003c/li\u003e\n\u003cli\u003eImporting \u003ccode\u003ewheel.bdist_wheel\u003c/code\u003e now emits a \u003ccode\u003eFutureWarning\u003c/code\u003e instead of a\n\u003ccode\u003eDeprecationWarning\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003ewheel unpack\u003c/code\u003e potentially altering the permissions of files outside of the\ndestination tree with maliciously crafted wheels (CVE-2026-24049)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.46.1 (2025-04-08)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eTemporarily restored the \u003ccode\u003ewheel.macosx_libfile\u003c/code\u003e module\n(\u003ccode\u003e[#659](https://github.com/pypa/wheel/issues/659) \u0026lt;https://github.com/pypa/wheel/issues/659\u0026gt;\u003c/code\u003e_)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.46.0 (2025-04-03)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.8\u003c/li\u003e\n\u003cli\u003eRemoved the \u003ccode\u003ebdist_wheel\u003c/code\u003e setuptools command implementation and entry point.\nThe \u003ccode\u003ewheel.bdist_wheel\u003c/code\u003e module is now just an alias to\n\u003ccode\u003esetuptools.command.bdist_wheel\u003c/code\u003e, emitting a deprecation warning on import.\u003c/li\u003e\n\u003cli\u003eRemoved vendored \u003ccode\u003epackaging\u003c/code\u003e in favor of a run-time dependency on it\u003c/li\u003e\n\u003cli\u003eMade the \u003ccode\u003ewheel.metadata\u003c/code\u003e module private (with a deprecation warning if it's\nimported\u003c/li\u003e\n\u003cli\u003eMade the \u003ccode\u003ewheel.cli\u003c/code\u003e package private (no deprecation warning)\u003c/li\u003e\n\u003cli\u003eFixed an exception when calling the \u003ccode\u003econvert\u003c/code\u003e command with an empty description\nfield\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003e0.45.1 (2024-11-23)\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed pure Python wheels converted from eggs and wininst files having the ABI tag in\nthe file name\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/eba4036ccaca4e2d0c5b5bf3e3be59b2b2877d6b\"\u003e\u003ccode\u003eeba4036\u003c/code\u003e\u003c/a\u003e Updated the version number for v0.46.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/557fb5425036ccca95330b2c8875e54c9f4483cf\"\u003e\u003ccode\u003e557fb54\u003c/code\u003e\u003c/a\u003e Created a new release\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/7a7d2de96b22a9adf9208afcc9547e1001569fef\"\u003e\u003ccode\u003e7a7d2de\u003c/code\u003e\u003c/a\u003e Fixed security issue around wheel unpack (\u003ca href=\"https://redirect.github.com/pypa/wheel/issues/675\"\u003e#675\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/41418fac233d6973ea8798d620df4aa5b3aa1b66\"\u003e\u003ccode\u003e41418fa\u003c/code\u003e\u003c/a\u003e Fixed test failures due to metadata normalization changes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/c1d442bec6c634fcfb89e5d58698dd226685bd14\"\u003e\u003ccode\u003ec1d442b\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/pypa/wheel/issues/674\"\u003e#674\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/0bac8820ec90b1aaa0695d79a56563137b48686d\"\u003e\u003ccode\u003e0bac882\u003c/code\u003e\u003c/a\u003e Update github actions environments (\u003ca href=\"https://redirect.github.com/pypa/wheel/issues/673\"\u003e#673\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/be9f45b4ee1210b2a815d2eefea56b71efd99d63\"\u003e\u003ccode\u003ebe9f45b\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/pypa/wheel/issues/667\"\u003e#667\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/6244f08bb92d7569da6c2fbea23de0846ad34ff3\"\u003e\u003ccode\u003e6244f08\u003c/code\u003e\u003c/a\u003e Update pre-commit ruff legacy alias (\u003ca href=\"https://redirect.github.com/pypa/wheel/issues/668\"\u003e#668\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/15b7577654e8bcd23e009c6bac036b65c11d8d8f\"\u003e\u003ccode\u003e15b7577\u003c/code\u003e\u003c/a\u003e PEP 639 compliance (\u003ca href=\"https://redirect.github.com/pypa/wheel/issues/670\"\u003e#670\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pypa/wheel/commit/fc8cb4163e4f48d86092cb2a16076f1b3efcd10f\"\u003e\u003ccode\u003efc8cb41\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;Removed redundant Python version from the publish workflow (\u003ca href=\"https://redirect.github.com/pypa/wheel/issues/666\"\u003e#666\u003c/a\u003e)\u0026quot;\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pypa/wheel/compare/0.46.1...0.46.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/WillianSilva51/Achou-UFC/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/WillianSilva51/Achou-UFC/pull/32","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/WillianSilva51%2FAchou-UFC/issues/32","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/32/packages"}},{"old_version":"6.5.2","new_version":"6.5.7","update_type":"patch","path":null,"pr_created_at":"2026-06-20T15:09:24.000Z","version_change":"6.5.2 → 6.5.7","issue":{"uuid":"4707207481","node_id":"PR_kwDOCB7FUc7os9FZ","number":2391,"state":"closed","title":"Bump tornado from 6.5.2 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-06-20T18:50:15.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-20T15:09:24.000Z","updated_at":"2026-06-20T18:50:24.000Z","time_to_close":13251,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.5.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.2 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.5.2\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Materials-Consortia/optimade-python-tools/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/Materials-Consortia/optimade-python-tools/pull/2391","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Materials-Consortia%2Foptimade-python-tools/issues/2391","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2391/packages"}},{"old_version":"6.4.2","new_version":"6.5.7","update_type":"minor","path":null,"pr_created_at":"2026-06-19T03:46:40.000Z","version_change":"6.4.2 → 6.5.7","issue":{"uuid":"4697750702","node_id":"PR_kwDOPs0zxs7oOAdU","number":93,"state":"closed","title":"chore(deps): bump the uv group across 48 directories with 3 updates","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-19T22:10:47.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-19T03:46:40.000Z","updated_at":"2026-06-19T22:10:49.000Z","time_to_close":66247,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"uv","update_count":3,"packages":[{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"cryptography","old_version":"45.0.3","new_version":"48.0.1","repository_url":"https://github.com/pyca/cryptography"},{"name":"tornado","old_version":"6.5.1","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"cryptography","old_version":"45.0.6","new_version":"48.0.1","repository_url":"https://github.com/pyca/cryptography"},{"name":"tornado","old_version":"6.5.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"cryptography","old_version":"44.0.2","new_version":"48.0.1","repository_url":"https://github.com/pyca/cryptography"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"starlette","old_version":"0.45.3","new_version":"1.3.1","repository_url":"https://github.com/Kludex/starlette"},{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"\u003e [!WARNING]\n\u003e Dependabot will stop supporting `python v3.9`!\n\u003e \n\u003e Please upgrade to one of the following versions: `v3.9`, `v3.10`, `v3.11`, `v3.12`, `v3.13`, or `v3.14`.\n\u003e\n\nBumps the uv group with 1 update in the / directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 2 updates in the /llama-index-experimental directory: [cryptography](https://github.com/pyca/cryptography) and [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 2 updates in the /llama-index-finetuning directory: [cryptography](https://github.com/pyca/cryptography) and [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-agent-search-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-amazon-product-extraction directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-arize-phoenix-query-engine directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-auto-merging-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 3 updates in the /llama-index-packs/llama-index-packs-chroma-autoretrieval directory: [cryptography](https://github.com/pyca/cryptography), [tornado](https://github.com/tornadoweb/tornado) and [starlette](https://github.com/Kludex/starlette).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-code-hierarchy directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-cohere-citation-chat directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-deeplake-deepmemory-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-deeplake-multimodal-retrieval directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-dense-x-retrieval directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-diff-private-simple-dataset directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-evaluator-benchmarker directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-fusion-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-fuzzy-citation directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-gmail-openai-agent directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-koda-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-llama-dataset-metadata directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-llama-guard-moderator directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-llava-completion directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-longrag directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-mixture-of-agents directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-multi-tenancy-rag directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-multidoc-autoretrieval directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-nebulagraph-query-engine directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-neo4j-query-engine directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-node-parser-semantic-chunking directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-ollama-query-engine directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-panel-chatbot directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-raft-dataset directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-rag-evaluator directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-ragatouille-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 2 updates in the /llama-index-packs/llama-index-packs-raptor directory: [cryptography](https://github.com/pyca/cryptography) and [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-recursive-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-resume-screener directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-retry-engine-weaviate directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-searchain directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-self-discover directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-self-rag directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-sentence-window-retriever directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-snowflake-query-engine directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-stock-market-data-query-engine directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-streamlit-chatbot directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-sub-question-weaviate directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-timescale-vector-autoretrieval directory: [tornado](https://github.com/tornadoweb/tornado).\nBumps the uv group with 1 update in the /llama-index-packs/llama-index-packs-trulens-eval-packs directory: [tornado](https://github.com/tornadoweb/tornado).\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `cryptography` from 45.0.3 to 48.0.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst\"\u003ecryptography's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e48.0.1 - 2026-06-09\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.\n\u003cp\u003e.. _v48-0-0:\u003c/p\u003e\n\u003cp\u003e48.0.0 - 2026-05-04\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Support for Python 3.8 has been removed.\n\u003ccode\u003ecryptography\u003c/code\u003e now requires Python 3.9 or later.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Loading an X.509 CRL whose inner\n\u003ccode\u003eTBSCertList.signature\u003c/code\u003e algorithm does not match the outer\n\u003ccode\u003esignatureAlgorithm\u003c/code\u003e now raises \u003ccode\u003eValueError\u003c/code\u003e. Previously, such CRLs\nwere parsed successfully and only rejected during signature validation.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded support for :doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mlkem\u003c/code\u003e and\n:doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mldsa\u003c/code\u003e when using OpenSSL 3.5.0 or\nlater, in addition to the existing AWS-LC and BoringSSL support. This means\npost-quantum algorithms are now available to users of our wheels.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eNote:\u003c/strong\u003e Going forward, we do not guarantee that all functionality\nin \u003ccode\u003ecryptography\u003c/code\u003e will be available when building against\nOpenSSL. See :doc:\u003ccode\u003e/statements/state-of-openssl\u003c/code\u003e for more information.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. _v47-0-0:\u003c/p\u003e\n\u003cp\u003e47.0.0 - 2026-04-24\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Support for Python 3.8 is deprecated and will be removed in the next\n  ``cryptography`` release.\n* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves\n  (``SECT*`` classes) has been removed. These curves are rarely used and\n  have additional security considerations that make them undesirable.\n* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.\n  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC\n  continue to be supported.\n* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL \u0026lt; 4.1.\n* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or\n  keys with unsupported explicit curve encodings now raises\n  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of\n  ``ValueError``. This change affects\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,\n  and :meth:`~cryptography.x509.Certificate.public_key` when called on\n  certificates with unsupported public key algorithms.\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt; \n\u003c/code\u003e\u003c/pre\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/de987ce48ccfeb1abca41efa23b2bf73ec704f74\"\u003e\u003ccode\u003ede987ce\u003c/code\u003e\u003c/a\u003e 48.0.1 version bump and changelog (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14996\"\u003e#14996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/8e03e30e3aae01632a697e903e3593c924f0139d\"\u003e\u003ccode\u003e8e03e30\u003c/code\u003e\u003c/a\u003e bump for 48.0.0 release (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14796\"\u003e#14796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/295e0d254ef31ab864730aa41312ec355416ee71\"\u003e\u003ccode\u003e295e0d2\u003c/code\u003e\u003c/a\u003e Add AGENTS.md with CLAUDE.md symlink (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14794\"\u003e#14794\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/104a2de19e268a433e6da92be9cb872dcf0003c8\"\u003e\u003ccode\u003e104a2de\u003c/code\u003e\u003c/a\u003e Bump BoringSSL, OpenSSL, AWS-LC in CI (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14793\"\u003e#14793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/67ec1e51988195e17993d2edef5258b27509b926\"\u003e\u003ccode\u003e67ec1e5\u003c/code\u003e\u003c/a\u003e call check_length early on AesSiv::encrypt (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14792\"\u003e#14792\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/b2da57a0d9e4bfd2b95364299091a18f74127b26\"\u003e\u003ccode\u003eb2da57a\u003c/code\u003e\u003c/a\u003e changelog for mldsa/mlkem for openssl (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14791\"\u003e#14791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/3cf44adee25c368d4a136e072fa9f80465d91eb0\"\u003e\u003ccode\u003e3cf44ad\u003c/code\u003e\u003c/a\u003e ML-KEM OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14781\"\u003e#14781\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e31639666766f846fbab2c605879db0fa64fe83\"\u003e\u003ccode\u003e2e31639\u003c/code\u003e\u003c/a\u003e ML-DSA OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14773\"\u003e#14773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/5affe5a286a986fdf512c4a5cb280d28a96c10e3\"\u003e\u003ccode\u003e5affe5a\u003c/code\u003e\u003c/a\u003e fix rust nightly clippy (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14790\"\u003e#14790\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e73ca448eaf64b6f0d4ffbb794cf96170cef5ec\"\u003e\u003ccode\u003e2e73ca4\u003c/code\u003e\u003c/a\u003e bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pyca/cryptography/compare/45.0.3...48.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.5.1 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `cryptography` from 45.0.6 to 48.0.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst\"\u003ecryptography's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e48.0.1 - 2026-06-09\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.\n\u003cp\u003e.. _v48-0-0:\u003c/p\u003e\n\u003cp\u003e48.0.0 - 2026-05-04\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Support for Python 3.8 has been removed.\n\u003ccode\u003ecryptography\u003c/code\u003e now requires Python 3.9 or later.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Loading an X.509 CRL whose inner\n\u003ccode\u003eTBSCertList.signature\u003c/code\u003e algorithm does not match the outer\n\u003ccode\u003esignatureAlgorithm\u003c/code\u003e now raises \u003ccode\u003eValueError\u003c/code\u003e. Previously, such CRLs\nwere parsed successfully and only rejected during signature validation.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded support for :doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mlkem\u003c/code\u003e and\n:doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mldsa\u003c/code\u003e when using OpenSSL 3.5.0 or\nlater, in addition to the existing AWS-LC and BoringSSL support. This means\npost-quantum algorithms are now available to users of our wheels.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eNote:\u003c/strong\u003e Going forward, we do not guarantee that all functionality\nin \u003ccode\u003ecryptography\u003c/code\u003e will be available when building against\nOpenSSL. See :doc:\u003ccode\u003e/statements/state-of-openssl\u003c/code\u003e for more information.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. _v47-0-0:\u003c/p\u003e\n\u003cp\u003e47.0.0 - 2026-04-24\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Support for Python 3.8 is deprecated and will be removed in the next\n  ``cryptography`` release.\n* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves\n  (``SECT*`` classes) has been removed. These curves are rarely used and\n  have additional security considerations that make them undesirable.\n* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.\n  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC\n  continue to be supported.\n* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL \u0026lt; 4.1.\n* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or\n  keys with unsupported explicit curve encodings now raises\n  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of\n  ``ValueError``. This change affects\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,\n  and :meth:`~cryptography.x509.Certificate.public_key` when called on\n  certificates with unsupported public key algorithms.\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt; \n\u003c/code\u003e\u003c/pre\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/de987ce48ccfeb1abca41efa23b2bf73ec704f74\"\u003e\u003ccode\u003ede987ce\u003c/code\u003e\u003c/a\u003e 48.0.1 version bump and changelog (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14996\"\u003e#14996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/8e03e30e3aae01632a697e903e3593c924f0139d\"\u003e\u003ccode\u003e8e03e30\u003c/code\u003e\u003c/a\u003e bump for 48.0.0 release (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14796\"\u003e#14796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/295e0d254ef31ab864730aa41312ec355416ee71\"\u003e\u003ccode\u003e295e0d2\u003c/code\u003e\u003c/a\u003e Add AGENTS.md with CLAUDE.md symlink (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14794\"\u003e#14794\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/104a2de19e268a433e6da92be9cb872dcf0003c8\"\u003e\u003ccode\u003e104a2de\u003c/code\u003e\u003c/a\u003e Bump BoringSSL, OpenSSL, AWS-LC in CI (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14793\"\u003e#14793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/67ec1e51988195e17993d2edef5258b27509b926\"\u003e\u003ccode\u003e67ec1e5\u003c/code\u003e\u003c/a\u003e call check_length early on AesSiv::encrypt (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14792\"\u003e#14792\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/b2da57a0d9e4bfd2b95364299091a18f74127b26\"\u003e\u003ccode\u003eb2da57a\u003c/code\u003e\u003c/a\u003e changelog for mldsa/mlkem for openssl (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14791\"\u003e#14791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/3cf44adee25c368d4a136e072fa9f80465d91eb0\"\u003e\u003ccode\u003e3cf44ad\u003c/code\u003e\u003c/a\u003e ML-KEM OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14781\"\u003e#14781\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e31639666766f846fbab2c605879db0fa64fe83\"\u003e\u003ccode\u003e2e31639\u003c/code\u003e\u003c/a\u003e ML-DSA OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14773\"\u003e#14773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/5affe5a286a986fdf512c4a5cb280d28a96c10e3\"\u003e\u003ccode\u003e5affe5a\u003c/code\u003e\u003c/a\u003e fix rust nightly clippy (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14790\"\u003e#14790\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e73ca448eaf64b6f0d4ffbb794cf96170cef5ec\"\u003e\u003ccode\u003e2e73ca4\u003c/code\u003e\u003c/a\u003e bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pyca/cryptography/compare/45.0.3...48.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.5.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `cryptography` from 44.0.2 to 48.0.1\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst\"\u003ecryptography's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e48.0.1 - 2026-06-09\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.1.\n\u003cp\u003e.. _v48-0-0:\u003c/p\u003e\n\u003cp\u003e48.0.0 - 2026-05-04\u003cbr /\u003e\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Support for Python 3.8 has been removed.\n\u003ccode\u003ecryptography\u003c/code\u003e now requires Python 3.9 or later.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003eBACKWARDS INCOMPATIBLE:\u003c/strong\u003e Loading an X.509 CRL whose inner\n\u003ccode\u003eTBSCertList.signature\u003c/code\u003e algorithm does not match the outer\n\u003ccode\u003esignatureAlgorithm\u003c/code\u003e now raises \u003ccode\u003eValueError\u003c/code\u003e. Previously, such CRLs\nwere parsed successfully and only rejected during signature validation.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eAdded support for :doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mlkem\u003c/code\u003e and\n:doc:\u003ccode\u003e/hazmat/primitives/asymmetric/mldsa\u003c/code\u003e when using OpenSSL 3.5.0 or\nlater, in addition to the existing AWS-LC and BoringSSL support. This means\npost-quantum algorithms are now available to users of our wheels.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eNote:\u003c/strong\u003e Going forward, we do not guarantee that all functionality\nin \u003ccode\u003ecryptography\u003c/code\u003e will be available when building against\nOpenSSL. See :doc:\u003ccode\u003e/statements/state-of-openssl\u003c/code\u003e for more information.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e.. _v47-0-0:\u003c/p\u003e\n\u003cp\u003e47.0.0 - 2026-04-24\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n* Support for Python 3.8 is deprecated and will be removed in the next\n  ``cryptography`` release.\n* **BACKWARDS INCOMPATIBLE:** Support for binary elliptic curves\n  (``SECT*`` classes) has been removed. These curves are rarely used and\n  have additional security considerations that make them undesirable.\n* **BACKWARDS INCOMPATIBLE:** Support for OpenSSL 1.1.x has been removed.\n  OpenSSL 3.0.0 or later is now required. LibreSSL, BoringSSL, and AWS-LC\n  continue to be supported.\n* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL \u0026lt; 4.1.\n* **BACKWARDS INCOMPATIBLE:** Loading keys with unsupported algorithms or\n  keys with unsupported explicit curve encodings now raises\n  :class:`~cryptography.exceptions.UnsupportedAlgorithm` instead of\n  ``ValueError``. This change affects\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_private_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_pem_public_key`,\n  :func:`~cryptography.hazmat.primitives.serialization.load_der_public_key`,\n  and :meth:`~cryptography.x509.Certificate.public_key` when called on\n  certificates with unsupported public key algorithms.\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt; \n\u003c/code\u003e\u003c/pre\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/de987ce48ccfeb1abca41efa23b2bf73ec704f74\"\u003e\u003ccode\u003ede987ce\u003c/code\u003e\u003c/a\u003e 48.0.1 version bump and changelog (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14996\"\u003e#14996\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/8e03e30e3aae01632a697e903e3593c924f0139d\"\u003e\u003ccode\u003e8e03e30\u003c/code\u003e\u003c/a\u003e bump for 48.0.0 release (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14796\"\u003e#14796\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/295e0d254ef31ab864730aa41312ec355416ee71\"\u003e\u003ccode\u003e295e0d2\u003c/code\u003e\u003c/a\u003e Add AGENTS.md with CLAUDE.md symlink (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14794\"\u003e#14794\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/104a2de19e268a433e6da92be9cb872dcf0003c8\"\u003e\u003ccode\u003e104a2de\u003c/code\u003e\u003c/a\u003e Bump BoringSSL, OpenSSL, AWS-LC in CI (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14793\"\u003e#14793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/67ec1e51988195e17993d2edef5258b27509b926\"\u003e\u003ccode\u003e67ec1e5\u003c/code\u003e\u003c/a\u003e call check_length early on AesSiv::encrypt (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14792\"\u003e#14792\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/b2da57a0d9e4bfd2b95364299091a18f74127b26\"\u003e\u003ccode\u003eb2da57a\u003c/code\u003e\u003c/a\u003e changelog for mldsa/mlkem for openssl (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14791\"\u003e#14791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/3cf44adee25c368d4a136e072fa9f80465d91eb0\"\u003e\u003ccode\u003e3cf44ad\u003c/code\u003e\u003c/a\u003e ML-KEM OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14781\"\u003e#14781\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e31639666766f846fbab2c605879db0fa64fe83\"\u003e\u003ccode\u003e2e31639\u003c/code\u003e\u003c/a\u003e ML-DSA OpenSSL support (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14773\"\u003e#14773\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/5affe5a286a986fdf512c4a5cb280d28a96c10e3\"\u003e\u003ccode\u003e5affe5a\u003c/code\u003e\u003c/a\u003e fix rust nightly clippy (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/14790\"\u003e#14790\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pyca/cryptography/commit/2e73ca448eaf64b6f0d4ffbb794cf96170cef5ec\"\u003e\u003ccode\u003e2e73ca4\u003c/code\u003e\u003c/a\u003e bump rust-openssl dep and update EcPoint::mul_generator to mul_generator2 (\u003ca href=\"https://redirect.github.com/pyca/cryptography/issues/1\"\u003e#1\u003c/a\u003e...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pyca/cryptography/compare/45.0.3...48.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `starlette` from 0.45.3 to 1.3.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/starlette/releases\"\u003estarlette's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 1.3.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUse \u003ccode\u003eStarletteDeprecationWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3119\"\u003eKludex/starlette#3119\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEnforce \u003ccode\u003emax_fields\u003c/code\u003e and \u003ccode\u003emax_part_size\u003c/code\u003e in \u003ccode\u003eFormParser\u003c/code\u003e by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3329\"\u003eKludex/starlette#3329\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eEnforce \u003ccode\u003eFormParser\u003c/code\u003e limits in parser callbacks by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3331\"\u003eKludex/starlette#3331\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/1.3.0...1.3.1\"\u003ehttps://github.com/Kludex/starlette/compare/1.3.0...1.3.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 1.3.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eClamp oversized suffix ranges in \u003ccode\u003eFileResponse\u003c/code\u003e by \u003ca href=\"https://github.com/jiyujie2006\"\u003e\u003ccode\u003e@​jiyujie2006\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3307\"\u003eKludex/starlette#3307\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCatch \u003ccode\u003eOSError\u003c/code\u003e alongside \u003ccode\u003eMultiPartException\u003c/code\u003e when closing temp files by \u003ca href=\"https://github.com/N3XT3R1337\"\u003e\u003ccode\u003e@​N3XT3R1337\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3191\"\u003eKludex/starlette#3191\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd \u003ccode\u003ehttpx2\u003c/code\u003e to the \u003ccode\u003efull\u003c/code\u003e extra by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3323\"\u003eKludex/starlette#3323\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdjust testclient typing and warnings by \u003ca href=\"https://github.com/waketzheng\"\u003e\u003ccode\u003e@​waketzheng\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3322\"\u003eKludex/starlette#3322\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eFix IndexError in URL.replace() on a URL with no authority by \u003ca href=\"https://github.com/LeSingh1\"\u003e\u003ccode\u003e@​LeSingh1\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3317\"\u003eKludex/starlette#3317\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAnnotate URLPath protocol parameter with Literal by \u003ca href=\"https://github.com/Chang-LeHung\"\u003e\u003ccode\u003e@​Chang-LeHung\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3285\"\u003eKludex/starlette#3285\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eavoid collapsing exception groups from user code by \u003ca href=\"https://github.com/graingert\"\u003e\u003ccode\u003e@​graingert\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/2830\"\u003eKludex/starlette#2830\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eremoveprefix\u003c/code\u003e to strip weak ETag indicator in \u003ccode\u003eis_not_modified\u003c/code\u003e by \u003ca href=\"https://github.com/gnosyslambda\"\u003e\u003ccode\u003e@​gnosyslambda\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3193\"\u003eKludex/starlette#3193\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eBuild \u003ccode\u003erequest.url\u003c/code\u003e from structured components by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3326\"\u003eKludex/starlette#3326\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jiyujie2006\"\u003e\u003ccode\u003e@​jiyujie2006\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3307\"\u003eKludex/starlette#3307\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/N3XT3R1337\"\u003e\u003ccode\u003e@​N3XT3R1337\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3191\"\u003eKludex/starlette#3191\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/leestana01\"\u003e\u003ccode\u003e@​leestana01\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3319\"\u003eKludex/starlette#3319\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/LeSingh1\"\u003e\u003ccode\u003e@​LeSingh1\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3317\"\u003eKludex/starlette#3317\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/EmmanuelNiyonshuti\"\u003e\u003ccode\u003e@​EmmanuelNiyonshuti\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3204\"\u003eKludex/starlette#3204\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Chang-LeHung\"\u003e\u003ccode\u003e@​Chang-LeHung\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3285\"\u003eKludex/starlette#3285\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/gnosyslambda\"\u003e\u003ccode\u003e@​gnosyslambda\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3193\"\u003eKludex/starlette#3193\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/1.2.1...1.3.0\"\u003ehttps://github.com/Kludex/starlette/compare/1.2.1...1.3.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 1.2.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUse \u003ccode\u003ehttpx2\u003c/code\u003e for type checking in the \u003ccode\u003etestclient\u003c/code\u003e module by \u003ca href=\"https://github.com/leifwar\"\u003e\u003ccode\u003e@​leifwar\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3304\"\u003eKludex/starlette#3304\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAdd assert error for requires() when request param is not Request type by \u003ca href=\"https://github.com/KeeganOP\"\u003e\u003ccode\u003e@​KeeganOP\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3298\"\u003eKludex/starlette#3298\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/leifwar\"\u003e\u003ccode\u003e@​leifwar\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3304\"\u003eKludex/starlette#3304\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/diskeu\"\u003e\u003ccode\u003e@​diskeu\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3243\"\u003eKludex/starlette#3243\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/KeeganOP\"\u003e\u003ccode\u003e@​KeeganOP\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3298\"\u003eKludex/starlette#3298\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/1.2.0...1.2.1\"\u003ehttps://github.com/Kludex/starlette/compare/1.2.0...1.2.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 1.2.0\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eSupport httpx2 in the test client by \u003ca href=\"https://github.com/Kludex\"\u003e\u003ccode\u003e@​Kludex\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/Kludex/starlette/pull/3291\"\u003eKludex/starlette#3291\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/Kludex/starlette/compare/1.1.0...1.2.0\"\u003ehttps://github.com/Kludex/starlette/compare/1.1.0...1.2.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 1.1.0\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/Kludex/starlette/blob/main/docs/release-notes.md\"\u003estarlette's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e1.3.1 (June 12, 2026)\u003c/h2\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce \u003ccode\u003emax_fields\u003c/code\u003e and \u003ccode\u003emax_part_size\u003c/code\u003e in \u003ccode\u003eFormParser\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3329\"\u003e#3329\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eEnforce \u003ccode\u003eFormParser\u003c/code\u003e limits in parser callbacks \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3331\"\u003e#3331\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.3.0 (June 11, 2026)\u003c/h2\u003e\n\u003ch4\u003eAdded\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eAdd \u003ccode\u003ehttpx2\u003c/code\u003e to the \u003ccode\u003efull\u003c/code\u003e extra \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3323\"\u003e#3323\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eAnnotate the \u003ccode\u003eURLPath\u003c/code\u003e \u003ccode\u003eprotocol\u003c/code\u003e parameter with \u003ccode\u003eLiteral\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3285\"\u003e#3285\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eBuild \u003ccode\u003erequest.url\u003c/code\u003e from structured components \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3326\"\u003e#3326\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eClamp oversized suffix ranges in \u003ccode\u003eFileResponse\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3307\"\u003e#3307\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eCatch \u003ccode\u003eOSError\u003c/code\u003e alongside \u003ccode\u003eMultiPartException\u003c/code\u003e when closing temp files \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3191\"\u003e#3191\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eAvoid collapsing exception groups raised from user code \u003ca href=\"https://redirect.github.com/encode/starlette/pull/2830\"\u003e#2830\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eremoveprefix\u003c/code\u003e to strip the weak \u003ccode\u003eETag\u003c/code\u003e indicator in \u003ccode\u003eis_not_modified\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3193\"\u003e#3193\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eFix \u003ccode\u003eIndexError\u003c/code\u003e in \u003ccode\u003eURL.replace()\u003c/code\u003e on a URL with no authority \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3317\"\u003e#3317\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eAdjust \u003ccode\u003etestclient\u003c/code\u003e typing and warnings \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3322\"\u003e#3322\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.2.1 (May 31, 2026)\u003c/h2\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eUse \u003ccode\u003ehttpx2\u003c/code\u003e for type checking in the \u003ccode\u003etestclient\u003c/code\u003e module \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3304\"\u003e#3304\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eAdd assert error for \u003ccode\u003erequires()\u003c/code\u003e when the request parameter is not a \u003ccode\u003eRequest\u003c/code\u003e type \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3298\"\u003e#3298\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.2.0 (May 28, 2026)\u003c/h2\u003e\n\u003ch4\u003eAdded\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eSupport httpx2 in the test client \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3291\"\u003e#3291\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.1.0 (May 23, 2026)\u003c/h2\u003e\n\u003ch4\u003eAdded\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eUse \u003ccode\u003e\u0026quot;application/octet-stream\u0026quot;\u003c/code\u003e as the \u003ccode\u003eFileResponse\u003c/code\u003e media type fallback \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3283\"\u003e#3283\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch4\u003eFixed\u003c/h4\u003e\n\u003cul\u003e\n\u003cli\u003eOnly dispatch standard HTTP verbs in \u003ccode\u003eHTTPEndpoint\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3286\"\u003e#3286\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eReject absolute paths in \u003ccode\u003eStaticFiles.lookup_path\u003c/code\u003e \u003ca href=\"https://redirect.github.com/encode/starlette/pull/3287\"\u003e#3287\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e1.0.1 (May 21, 2026)\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/8ebffd0678570ddd5d5bb11c6f3c3c7fd4682ab9\"\u003e\u003ccode\u003e8ebffd0\u003c/code\u003e\u003c/a\u003e Version 1.3.1 (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3330\"\u003e#3330\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/25b8e179d8d7ed86769c02f648772dd5fb43dc3c\"\u003e\u003ccode\u003e25b8e17\u003c/code\u003e\u003c/a\u003e Enforce \u003ccode\u003eFormParser\u003c/code\u003e limits in parser callbacks (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3331\"\u003e#3331\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/dba1c4babc4f99ad2622bb913d87045775dda735\"\u003e\u003ccode\u003edba1c4b\u003c/code\u003e\u003c/a\u003e Enforce \u003ccode\u003emax_fields\u003c/code\u003e and \u003ccode\u003emax_part_size\u003c/code\u003e in \u003ccode\u003eFormParser\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3329\"\u003e#3329\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/45e51dcf99f3a270b0bcec1aec5410b4345863a9\"\u003e\u003ccode\u003e45e51dc\u003c/code\u003e\u003c/a\u003e Use \u003ccode\u003eStarletteDeprecationWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3119\"\u003e#3119\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/5f8610c386e13de1d80d36efa961e1486a1d2d01\"\u003e\u003ccode\u003e5f8610c\u003c/code\u003e\u003c/a\u003e Version 1.3.0 (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3327\"\u003e#3327\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/167b5850e809f38b27fbfed62d58bf6442855975\"\u003e\u003ccode\u003e167b585\u003c/code\u003e\u003c/a\u003e Build \u003ccode\u003erequest.url\u003c/code\u003e from structured components (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3326\"\u003e#3326\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/37309255b4c1b9c381a2d24a1eaf83100984a16a\"\u003e\u003ccode\u003e3730925\u003c/code\u003e\u003c/a\u003e Use \u003ccode\u003eremoveprefix\u003c/code\u003e to strip weak ETag indicator in \u003ccode\u003eis_not_modified\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3193\"\u003e#3193\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/e6f7ad1ab85efb27ab7910d8007b3f4531f7b083\"\u003e\u003ccode\u003ee6f7ad1\u003c/code\u003e\u003c/a\u003e avoid collapsing exception groups from user code (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/2830\"\u003e#2830\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/115228fcdca0e0ef5bf4a95a40ddce5a9fced428\"\u003e\u003ccode\u003e115228f\u003c/code\u003e\u003c/a\u003e Annotate URLPath protocol parameter with Literal (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3285\"\u003e#3285\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Kludex/starlette/commit/113f193a34353c9153857028c1074351d22fad07\"\u003e\u003ccode\u003e113f193\u003c/code\u003e\u003c/a\u003e docs: replace inline ASGI server list with link to canonical implemen… (\u003ca href=\"https://redirect.github.com/Kludex/starlette/issues/3204\"\u003e#3204\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/Kludex/starlette/compare/0.45.3...1.3.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.4.2 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object bef...\n\n_Description has been truncated_","html_url":"https://github.com/Domphe/llama_index/pull/93","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Domphe%2Fllama_index/issues/93","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/93/packages"}},{"old_version":"6.5.6","new_version":"6.5.7","update_type":"patch","path":null,"pr_created_at":"2026-06-18T00:00:03.000Z","version_change":"6.5.6 → 6.5.7","issue":{"uuid":"4687963483","node_id":"PR_kwDOAgtve87ntwlT","number":665,"state":"open","title":"build(deps): bump tornado from 6.5.6 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-18T00:00:03.000Z","updated_at":"2026-06-18T00:03:30.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps)","packages":[{"name":"tornado","old_version":"6.5.6","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.6 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.6...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.5.6\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/opendatacube/eo-datasets/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/opendatacube/eo-datasets/pull/665","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/opendatacube%2Feo-datasets/issues/665","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/665/packages"}},{"old_version":"6.5.5","new_version":"6.5.7","update_type":"patch","path":null,"pr_created_at":"2026-06-17T19:31:15.000Z","version_change":"6.5.5 → 6.5.7","issue":{"uuid":"4686430599","node_id":"PR_kwDOEDBuZM7nozOv","number":105,"state":"open","title":"Bump tornado from 6.5.5 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-17T19:31:15.000Z","updated_at":"2026-06-17T19:31:22.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"\u003e [!WARNING]\n\u003e Dependabot will stop supporting `python v3.9`!\n\u003e \n\u003e Please upgrade to one of the following versions: `v3.9`, `v3.10`, `v3.11`, `v3.12`, `v3.13`, or `v3.14`.\n\u003e\n\nBumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=pip\u0026previous-version=6.5.5\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/kanishkamisra/minicons/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/kanishkamisra/minicons/pull/105","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/kanishkamisra%2Fminicons/issues/105","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/105/packages"}},{"old_version":"6.5.5","new_version":"6.5.7","update_type":"patch","path":null,"pr_created_at":"2026-06-17T18:24:06.000Z","version_change":"6.5.5 → 6.5.7","issue":{"uuid":"4685978711","node_id":"PR_kwDOQKwXJM7nnTCd","number":57,"state":"closed","title":"Bump tornado from 6.5.5 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-17T21:17:24.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-17T18:24:06.000Z","updated_at":"2026-06-17T21:17:27.000Z","time_to_close":10398,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.5.5\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/gitinference/jp-tools/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/gitinference/jp-tools/pull/57","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/gitinference%2Fjp-tools/issues/57","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/57/packages"}},{"old_version":"6.5.5","new_version":"6.5.7","update_type":"patch","path":null,"pr_created_at":"2026-06-17T18:01:10.000Z","version_change":"6.5.5 → 6.5.7","issue":{"uuid":"4685819327","node_id":"PR_kwDOLo6OQc7nmw85","number":83,"state":"closed","title":"Bump tornado from 6.5.5 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-08-08T17:38:31.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-17T18:01:10.000Z","updated_at":"2026-08-08T17:38:40.000Z","time_to_close":4491441,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.5.5\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/impalah/auth-middleware/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/impalah/auth-middleware/pull/83","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/impalah%2Fauth-middleware/issues/83","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/83/packages"}},{"old_version":"6.5.4","new_version":"6.5.7","update_type":"patch","path":null,"pr_created_at":"2026-06-17T17:25:23.000Z","version_change":"6.5.4 → 6.5.7","issue":{"uuid":"4685556238","node_id":"PR_kwDOHX3_rM7nl4K9","number":963,"state":"closed","title":"Bump tornado from 6.5.4 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-29T12:08:47.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-17T17:25:23.000Z","updated_at":"2026-06-29T12:08:57.000Z","time_to_close":1017804,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.5.4","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"\u003e [!WARNING]\n\u003e Dependabot will stop supporting `python v3.9`!\n\u003e \n\u003e Please upgrade to one of the following versions: `v3.9`, `v3.10`, `v3.11`, `v3.12`, `v3.13`, or `v3.14`.\n\u003e\n\nBumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.4 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.4...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.5.4\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/aixplain/aiXplain/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/aixplain/aiXplain/pull/963","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/aixplain%2FaiXplain/issues/963","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/963/packages"}},{"old_version":"6.4.2","new_version":"6.5.7","update_type":"minor","path":"/AI-and-Analytics/Features-and-Functionality/IntelTensorFlow_Transformer_AMX_bfloat16_MixedPrecision","pr_created_at":"2026-06-17T12:26:09.000Z","version_change":"6.4.2 → 6.5.7","issue":{"uuid":"4683201057","node_id":"PR_kwDOD-2Cwc7neBJw","number":2759,"state":"closed","title":"Bump tornado from 6.4.2 to 6.5.7 in /AI-and-Analytics/Features-and-Functionality/IntelTensorFlow_Transformer_AMX_bfloat16_MixedPrecision","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-17T13:21:10.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-17T12:26:09.000Z","updated_at":"2026-06-17T13:21:19.000Z","time_to_close":3301,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.4.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":"/AI-and-Analytics/Features-and-Functionality/IntelTensorFlow_Transformer_AMX_bfloat16_MixedPrecision","ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.4.2 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.2...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.4.2\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/oneapi-src/oneAPI-samples/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/oneapi-src/oneAPI-samples/pull/2759","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/oneapi-src%2FoneAPI-samples/issues/2759","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2759/packages"}},{"old_version":"6.5.5","new_version":"6.5.7","update_type":"patch","path":null,"pr_created_at":"2026-06-17T07:38:30.000Z","version_change":"6.5.5 → 6.5.7","issue":{"uuid":"4681157851","node_id":"PR_kwDOOndlpM7nXP5d","number":41,"state":"open","title":"chore(deps): bump the pip group across 1 directory with 7 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-17T07:38:30.000Z","updated_at":"2026-06-17T07:39:35.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"pip","update_count":7,"packages":[{"name":"dbt-common","old_version":"1.29.0","new_version":"1.34.2","repository_url":"https://github.com/dbt-labs/dbt-common"},{"name":"deepdiff","old_version":"8.6.1","new_version":"8.6.2","repository_url":"https://github.com/qlustered/deepdiff"},{"name":"idna","old_version":"3.10","new_version":"3.15","repository_url":"https://github.com/kjd/idna"},{"name":"protobuf","old_version":"6.32.0","new_version":"6.33.5","repository_url":"https://github.com/protocolbuffers/protobuf"},{"name":"requests","old_version":"2.32.5","new_version":"2.33.0","repository_url":"https://github.com/psf/requests"},{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"},{"name":"urllib3","old_version":"2.5.0","new_version":"2.7.0","repository_url":"https://github.com/urllib3/urllib3"}],"path":null,"ecosystem":"pip"},"body":"Bumps the pip group with 7 updates in the / directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [dbt-common](https://github.com/dbt-labs/dbt-common) | `1.29.0` | `1.34.2` |\n| [deepdiff](https://github.com/qlustered/deepdiff) | `8.6.1` | `8.6.2` |\n| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |\n| [protobuf](https://github.com/protocolbuffers/protobuf) | `6.32.0` | `6.33.5` |\n| [requests](https://github.com/psf/requests) | `2.32.5` | `2.33.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n| [urllib3](https://github.com/urllib3/urllib3) | `2.5.0` | `2.7.0` |\n\n\nUpdates `dbt-common` from 1.29.0 to 1.34.2\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/dbt-labs/dbt-common/blob/main/CHANGELOG.md\"\u003edbt-common's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003edbt-common Changelog\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eThis file provides a full account of all changes to \u003ccode\u003edbt-common\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003eChanges are listed under the (pre)release in which they first appear. Subsequent releases include changes from previous releases.\u003c/li\u003e\n\u003cli\u003e\u0026quot;Breaking changes\u0026quot; listed under a version may require action from end users or external maintainers when upgrading to that version.\u003c/li\u003e\n\u003cli\u003eDo not edit this file directly. This file is auto-generated using \u003ca href=\"https://github.com/miniscruff/changie\"\u003echangie\u003c/a\u003e. For details on how to document a change, see \u003ca href=\"https://github.com/dbt-labs/dbt-common/blob/main/CONTRIBUTING.md#adding-changelog-entry\"\u003ethe contributing guide\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edbt-common 1.38.0 - May 04, 2026\u003c/h2\u003e\n\u003ch3\u003eUnder the Hood\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eExplicitly keep bool serde as a passthrough for mashumaro 3.15+ compat with versions before 3.15 (\u003ca href=\"https://redirect.github.com/dbt-labs/dbt-common/issues/12098\"\u003e#12098\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edbt-common 1.37.5 - April 23, 2026\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdds public helper functions for event deferral functionality (\u003ca href=\"https://redirect.github.com/dbt-labs/dbt-common/issues/12339\"\u003e#12339\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edbt-common 1.37.4 - April 23, 2026\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAdd event deferral capability to EventManager (\u003ca href=\"https://redirect.github.com/dbt-labs/dbt-common/issues/12339\"\u003e#12339\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edbt-common 1.37.3 - March 02, 2026\u003c/h2\u003e\n\u003ch3\u003eSecurity\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eReplace os.path.commonprefix() with os.path.commonpath() to preventpath traversal via sibling directories with matching prefixes. (\u003ca href=\"https://redirect.github.com/dbt-labs/dbt-common/pull/1\"\u003e#1\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edbt-common 1.37.2 - December 15, 2025\u003c/h2\u003e\n\u003ch3\u003eFixes\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003erestore config.get behavior to avoid searching in meta (\u003ca href=\"https://redirect.github.com/dbt-labs/dbt-common/issues/337\"\u003e#337\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edbt-common 1.37.1 - December 11, 2025\u003c/h2\u003e\n\u003ch3\u003eDependencies\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBump upper bound of isodate to allow for \u003ccode\u003e0.7.x\u003c/code\u003e versions (\u003ca href=\"https://redirect.github.com/dbt-labs/dbt-common/pull/333\"\u003e#333\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003edbt-common 1.37.0 - December 10, 2025\u003c/h2\u003e\n\u003ch3\u003eFeatures\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEnable config.get to access keys in \u0026quot;meta\u0026quot; (\u003ca href=\"https://redirect.github.com/dbt-labs/dbt-common/issues/329\"\u003e#329\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/dbt-labs/dbt-common/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `deepdiff` from 8.6.1 to 8.6.2\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/qlustered/deepdiff/releases\"\u003edeepdiff's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003cp\u003e8.6.2 - Fix (CVE-2025-58367)\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/qlustered/deepdiff/commit/0d07ec21d12b46ef4e489383b363eadc22d990fb\"\u003e\u003ccode\u003e0d07ec2\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/qlustered/deepdiff/commit/791f5aac51b2da7f90375ab204256ef6a6b40206\"\u003e\u003ccode\u003e791f5aa\u003c/code\u003e\u003c/a\u003e updating CVE number\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/qlustered/deepdiff/commit/a6aafea3ba5498aab6f9c77047c54949e7e968ae\"\u003e\u003ccode\u003ea6aafea\u003c/code\u003e\u003c/a\u003e updating docs\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/qlustered/deepdiff/commit/a0950abbe6263298bc4bdbc3ebb57edc1af079b4\"\u003e\u003ccode\u003ea0950ab\u003c/code\u003e\u003c/a\u003e Bump version: 8.6.1 → 8.6.2\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/qlustered/deepdiff/commit/887128abe5e510341cc4a82f6914a82d5ff1b6a7\"\u003e\u003ccode\u003e887128a\u003c/code\u003e\u003c/a\u003e Fix (CVE-2025-58367)\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/qlustered/deepdiff/compare/8.6.1...8.6.2\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `idna` from 3.10 to 3.15\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/kjd/idna/blob/master/HISTORY.md\"\u003eidna's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e3.15 (2026-05-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eEnforce DNS-length cap on individual labels early in \u003ccode\u003echeck_label\u003c/code\u003e,\nshort-circuiting contextual-rule processing for oversized input\nwhile staying compatible with UTS 46 usage.\u003c/li\u003e\n\u003cli\u003eTidy core helpers: hoist bidi category sets to module-level\nfrozensets (avoiding per-codepoint list construction), simplify\nlength checks, and reuse the shared \u003ccode\u003e_unicode_dots_re\u003c/code\u003e from\n\u003ccode\u003eidna.core\u003c/code\u003e in the codec module.\u003c/li\u003e\n\u003cli\u003eUse \u003ccode\u003eraise ... from err\u003c/code\u003e for proper exception chaining and\nswitch internal string formatting to f-strings.\u003c/li\u003e\n\u003cli\u003eAllow \u003ccode\u003eflit_core\u003c/code\u003e 4.x in the build backend.\u003c/li\u003e\n\u003cli\u003eExpand the ruff lint set (flake8-bugbear, flake8-simplify,\npyupgrade, perflint) and apply the surfaced fixes; pin lint CI\nto Python 3.14.\u003c/li\u003e\n\u003cli\u003eAdd Dependabot configuration for GitHub Actions.\u003c/li\u003e\n\u003cli\u003eConvert README and HISTORY from reStructuredText to Markdown.\u003c/li\u003e\n\u003cli\u003eReference CVE-2026-45409 for the 3.14 advisory in place of the\ninitial GHSA identifier.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Felix Yan, Stan Ulbrych, and metsw24-max for\ncontributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.14 (2026-05-10)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eRemoved opportunity to process long inputs into quadratic\ntime by rejecting oversize inputs up-front. Closes a bypass\nof the CVE-2024-3651 mitigation. [CVE-2026-45409]\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Stan Ulbrych for reporting the issue.\u003c/p\u003e\n\u003ch2\u003e3.13 (2026-04-22)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eCorrect classification error for codepoint U+A7F1\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e3.12 (2026-04-21)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 17.0.0.\u003c/li\u003e\n\u003cli\u003eIssue a deprecation warning for the transitional argument.\u003c/li\u003e\n\u003cli\u003eAdded lazy-loading to provide some performance improvements.\u003c/li\u003e\n\u003cli\u003eRemoved vestiges of code related to Python 2 support, including\nsegmentation of data structures specific to Jython.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThanks to Rodrigo Nogueira for contributions to this release.\u003c/p\u003e\n\u003ch2\u003e3.11 (2025-10-12)\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to Unicode 16.0.0, including significant changes to UTS46\nprocessing. As a result of Unicode ending support for it, transitional\nprocessing no longer has an effect and returns the same result.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/af30a092e158181d0b35ac66dfa813788126bdd8\"\u003e\u003ccode\u003eaf30a09\u003c/code\u003e\u003c/a\u003e Release 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/30314d4628744ca14cf2b5820564e5127a9f86f2\"\u003e\u003ccode\u003e30314d4\u003c/code\u003e\u003c/a\u003e Pre-release 3.15rc0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/05d4b219aa9eddc47371fcbd2000f0301016f3e9\"\u003e\u003ccode\u003e05d4b21\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/237\"\u003e#237\u003c/a\u003e from kjd/convert-docs-to-markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/2987fdba1962bbb2358399e0084ba062b98a0bee\"\u003e\u003ccode\u003e2987fdb\u003c/code\u003e\u003c/a\u003e Convert README and HISTORY from reStructuredText to Markdown\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/59fa8002d514bf4a5ce7b58f67b9ec587d53fa9c\"\u003e\u003ccode\u003e59fa800\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/236\"\u003e#236\u003c/a\u003e from kjd/dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/def69834ced5d4b3c50439d8b99c4c856ec19ca2\"\u003e\u003ccode\u003edef6983\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/bbd8004a797185d8c56bb555cd5c88fde05e0631\"\u003e\u003ccode\u003ebbd8004\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/234\"\u003e#234\u003c/a\u003e from StanFromIreland/patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/edd07c05024344a6ccb517414ccb36683aee99fc\"\u003e\u003ccode\u003eedd07c0\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/5557db030c11bdec50d62aa5f631d705d33ba123\"\u003e\u003ccode\u003e5557db0\u003c/code\u003e\u003c/a\u003e Merge branch 'master' into patch-1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/kjd/idna/commit/f11746cf4981d25123ef7830d3ee60f07de8ae3d\"\u003e\u003ccode\u003ef11746c\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/kjd/idna/issues/235\"\u003e#235\u003c/a\u003e from StanFromIreland/patch-2\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/kjd/idna/compare/v3.10...v3.15\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `protobuf` from 6.32.0 to 6.33.5\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/protocolbuffers/protobuf/releases\"\u003eprotobuf's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eProtocol Buffers v34.0-rc1\u003c/h2\u003e\n\u003ch1\u003eAnnouncements\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eThis version includes breaking changes to: C++, Objective-C, PHP, Python.\u003c/strong\u003e\u003c/li\u003e\n\u003cli\u003e[Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Make generator headers private (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/3a2af3510f0d454dbe3e4dc281674b61c4d20b9e\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/3a2af3510f0d454dbe3e4dc281674b61c4d20b9e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/7a7589823d2cfaaf7994b050e98d5d553bc9b1c1\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/7a7589823d2cfaaf7994b050e98d5d553bc9b1c1\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Add [[nodiscard]] to many APIs. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/a70115f33f9af2c4b2202c800b84837e7fe0d738\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/a70115f33f9af2c4b2202c800b84837e7fe0d738\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Make the arena-enabled constructors of \u003ccode\u003eRepeatedField\u003c/code\u003e, \u003ccode\u003eRepeatedPtrField\u003c/code\u003e, and \u003ccode\u003eMap\u003c/code\u003e private. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/ef890c3d0c79398c70e047fe5dd893f460ba2336\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/ef890c3d0c79398c70e047fe5dd893f460ba2336\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Removes proto2::util::MessageDifferencer::AddIgnoreCriteria that takes a raw pointer as an argument in favor of the overload that takes a unique_ptr. Remove macro PROTOBUF_FUTURE_REMOVE_ADD_IGNORE_CRITERIA (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b115358c64127896fed88b8b5ef5d91d86d8cbae\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b115358c64127896fed88b8b5ef5d91d86d8cbae\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated FieldDescriptor::has_optional_keyword() in OSS. Use is_repeated() or has_presence() instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/68346ec9348e932664e58c3ecdcd1478f95233a8\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/68346ec9348e932664e58c3ecdcd1478f95233a8\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove AddUnusedImportTrackFile() and ClearUnusedImportTrackFiles(). Remove PROTOBUF_FUTURE_RENAME_ADD_UNUSED_IMPORT (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/837a2cd1d6c75402b2503ffe7cd8aeaf25868536\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/837a2cd1d6c75402b2503ffe7cd8aeaf25868536\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated FieldDescriptor::is_optional() in OSS. Use (!is_required() \u0026amp;\u0026amp; !is_repeated()) instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/9dbc5d479a8e453921485d8d3de47fb3c005f1af\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/9dbc5d479a8e453921485d8d3de47fb3c005f1af\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[C++] All entity names have length limit (2afb0dc)\u003c/li\u003e\n\u003cli\u003e[ObjC] Remove \u003ccode\u003egenerate_minimal_imports\u003c/code\u003e generation option warning (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/45b1297fdaad5a9436d0e207422168c38dc45ac4\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/45b1297fdaad5a9436d0e207422168c38dc45ac4\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[ObjC] Fix nullability annotations on some \u003ccode\u003eGPB*Dictionary\u003c/code\u003e types. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/ea67d6d26a48478a567c404679e3bb99cf230d50\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/ea67d6d26a48478a567c404679e3bb99cf230d50\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[ObjC] Remove \u003ccode\u003e-[GPBFieldDescriptor optional]\u003c/code\u003e (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/3414dc151eb4dcbdb2ca952e2589993bf7af75c4\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/3414dc151eb4dcbdb2ca952e2589993bf7af75c4\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Other] Remove deprecated flag for enabling MSVC support (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/97c979be6e0907e1051bee62584dac4594e73fa7\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/97c979be6e0907e1051bee62584dac4594e73fa7\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP] Remove deprecated PHP APIs (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/9c45014099a4f7004fab6dd1278de2f4f2a393c5\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/9c45014099a4f7004fab6dd1278de2f4f2a393c5\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP] Remove deprecated PHP APIs FieldDescriptor getLabel, use IsRepeated or isRequired instead. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\u003c/a\u003e, \u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/cd76e675b14d00dda5623b30835d2bc7105fccc6\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/cd76e675b14d00dda5623b30835d2bc7105fccc6\u003c/a\u003e, \u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/42081219920c6fad17ba6ddd1e28d111bcfb3345\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP]  Add PHP typehints for setters and remove redundant GPBUtil checks (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/pull/25296\"\u003eprotocolbuffers/protobuf#25296\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/aee03b78929c02461a5f9d8e136a2a016359b0cd\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/aee03b78929c02461a5f9d8e136a2a016359b0cd\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[PHP]  support default values for editions/proto2 (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/pull/25161\"\u003eprotocolbuffers/protobuf#25161\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b01099d56350551bae3da88b97bf3027274c9f17\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b01099d56350551bae3da88b97bf3027274c9f17\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Raise errors in OSS when assign bool to int/enum field in Python Proto. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/5b116fe2f14f49dd0cc3b76089983717f211025c\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/5b116fe2f14f49dd0cc3b76089983717f211025c\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove float_format/double_format from python proto text_format (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/e4854a186e0bfa867d5bfa5cd850608a948fd488\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/e4854a186e0bfa867d5bfa5cd850608a948fd488\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Raise TypeError when convert non-timedelta to Duration, or convert non-datetime to Timestamp in python proto. (Original code may raise ArributeError) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/00aaca1b4d98954bc2933d7c8a5379ba6088124c\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/00aaca1b4d98954bc2933d7c8a5379ba6088124c\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove float_precision from python proto json_format (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/f027f1fcd52b9d080b7ee79f4024f53cf54e0dc5\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/f027f1fcd52b9d080b7ee79f4024f53cf54e0dc5\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/b76faa921fdd244f374c7be0bddd4050fc42c292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove deprecated FieldDescriptor.label (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/0a8ff55518ea5874478ad5b26515b31d186045a9\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/0a8ff55518ea5874478ad5b26515b31d186045a9\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e[Python] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/c301c2ca286327a21c50c0c4cd877afc9c655b00\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://protobuf.dev/news/\"\u003eProtobuf News\u003c/a\u003e may include additional announcements or pre-announcements for upcoming changes.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://protobuf.dev/support/migration/\"\u003eMigration Guide\u003c/a\u003e may include additional guidance for breaking changes.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eBazel\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eFix: cc_toolchain should prefer protoc when prebuilt flag is flipped. (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/25168\"\u003e#25168\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/8c857c3a1c6a106b0a096f1c9fa504bfaca035a9\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/8c857c3a1c6a106b0a096f1c9fa504bfaca035a9\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBreaking change: Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/0a5c2f6b633c1e5259f566cb42d30fe347b8aadb\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFeat(bazel): wire up prebuilt protoc toolchain (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/24115\"\u003e#24115\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/cc23698b486e690ea2eb873cc7596a87c74a3ba6\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/cc23698b486e690ea2eb873cc7596a87c74a3ba6\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eMigrate \u003ccode\u003eproto_descriptor_set\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/23369\"\u003e#23369\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/8d4dfdd39a7a242a9ed631a6ab2192c57dd9b9c8\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/8d4dfdd39a7a242a9ed631a6ab2192c57dd9b9c8\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eCompiler\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eRuby codegen: support generation of rbs files (\u003ca href=\"https://redirect.github.com/protocolbuffers/protobuf/issues/15633\"\u003e#15633\u003c/a\u003e) (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/6ebdf851ba78728f0aa145d38454ed9a316fb08d\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/6ebdf851ba78728f0aa145d38454ed9a316fb08d\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAvoid collision name problems between a message named \u003ccode\u003eXyz\u003c/code\u003e and a direct sibling enum named \u003ccode\u003eXyzView\u003c/code\u003e (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/eba53e8f172b273d679759a72ce4250131ee3df1\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/eba53e8f172b273d679759a72ce4250131ee3df1\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eGeneralizing and implementing ValidateFeatureSupport for both Options and Features during proto parsing (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/ed3c57114d8e2b47cca7697ddaa50c1b3762a6b0\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/ed3c57114d8e2b47cca7697ddaa50c1b3762a6b0\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix a bug with custom features outside of the \u003ccode\u003epb\u003c/code\u003e package. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/872d3ce7a4da00d7dcec33ced20cfe45235935e8\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/872d3ce7a4da00d7dcec33ced20cfe45235935e8\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix import option handling when include_imports isn't set. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/9ef9e80afd9bc8379d578fe67e5ab0738728c04e\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/9ef9e80afd9bc8379d578fe67e5ab0738728c04e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFix a bug in STRICT check of namespaced enums to properly check for 'reserved 1 to max' (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/1229d4adba24c0952ab85ce96bc7b7f8a1fe6d0f\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/1229d4adba24c0952ab85ce96bc7b7f8a1fe6d0f\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003ePrevent accidental stripping of \u003ccode\u003edebug_redact\u003c/code\u003e options via import option. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/f58b098bffa7ca4045ef7773b09151a6af5d0c28\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/f58b098bffa7ca4045ef7773b09151a6af5d0c28\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eC++\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003eAdd EnumerateEnumValues function. (\u003ca href=\"https://github.com/protocolbuffers/protobuf/commit/397d5d99db274b379d1384814074bf7df39d32f7\"\u003ehttps://github.com/protocolbuffers/protobuf/commit/397d5d99db274b379d1384814074bf7df39d32f7\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/protocolbuffers/protobuf/commits\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `requests` from 2.32.5 to 2.33.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/releases\"\u003erequests's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003ev2.33.0\u003c/h2\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at \u003ca href=\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e. Give it a try, and report any gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eNew Contributors\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/M0d3v1\"\u003e\u003ccode\u003e@​M0d3v1\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6865\"\u003epsf/requests#6865\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/aminvakil\"\u003e\u003ccode\u003e@​aminvakil\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7220\"\u003epsf/requests#7220\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/E8Price\"\u003e\u003ccode\u003e@​E8Price\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6960\"\u003epsf/requests#6960\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/mitre88\"\u003e\u003ccode\u003e@​mitre88\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7244\"\u003epsf/requests#7244\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/magsen\"\u003e\u003ccode\u003e@​magsen\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/6553\"\u003epsf/requests#6553\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/Rohan5commit\"\u003e\u003ccode\u003e@​Rohan5commit\u003c/code\u003e\u003c/a\u003e made their first contribution in \u003ca href=\"https://redirect.github.com/psf/requests/pull/7227\"\u003epsf/requests#7227\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\"\u003ehttps://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/psf/requests/blob/main/HISTORY.md\"\u003erequests's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.33.0 (2026-03-25)\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eAnnouncements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e📣 Requests is adding inline types. If you have a typed code base that\nuses Requests, please take a look at \u003ca href=\"https://redirect.github.com/psf/requests/issues/7271\"\u003e#7271\u003c/a\u003e. Give it a try, and report\nany gaps or feedback you may have in the issue. 📣\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eSecurity\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eCVE-2026-25645 \u003ccode\u003erequests.utils.extract_zipped_paths\u003c/code\u003e now extracts\ncontents to a non-deterministic location to prevent malicious file\nreplacement. This does not affect default usage of Requests, only\napplications calling the utility function directly.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImprovements\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eMigrated to a PEP 517 build system using setuptools. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7012\"\u003e#7012\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eBugfixes\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eFixed an issue where an empty netrc entry could cause\nmalformed authentication to be applied to Requests on\nPython 3.11+. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7205\"\u003e#7205\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDeprecations\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eDropped support for Python 3.9 following its end of support. (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7196\"\u003e#7196\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eDocumentation\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eVarious typo fixes and doc improvements.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/bc04dfd6dad4cb02cd92f5daa81eb562d280a761\"\u003e\u003ccode\u003ebc04dfd\u003c/code\u003e\u003c/a\u003e v2.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/66d21cb07bd6255b1280291c4fafb71803cdb3b7\"\u003e\u003ccode\u003e66d21cb\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/8b9bc8fc0f63be84602387913c4b689f19efd028\"\u003e\u003ccode\u003e8b9bc8f\u003c/code\u003e\u003c/a\u003e Move badges to top of README (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7293\"\u003e#7293\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/e331a288f369973f5de0ec8901c94cae4fa87286\"\u003e\u003ccode\u003ee331a28\u003c/code\u003e\u003c/a\u003e Remove unused extraction call (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7292\"\u003e#7292\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/753fd08c5eacce0aa0df73fe47e49525c67e0a29\"\u003e\u003ccode\u003e753fd08\u003c/code\u003e\u003c/a\u003e docs: fix FAQ grammar in httplib2 example\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/774a0b837a194ee885d4fdd9ca947900cc3daf71\"\u003e\u003ccode\u003e774a0b8\u003c/code\u003e\u003c/a\u003e docs(socks): same block as other sections\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/9c72a41bec8597f948c9d8caa5dc3f12273b3303\"\u003e\u003ccode\u003e9c72a41\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 4.33.0 to 4.34.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/ebf71906798ec82f34e07d3168f8b8aecaf8a3be\"\u003e\u003ccode\u003eebf7190\u003c/code\u003e\u003c/a\u003e Bump github/codeql-action from 4.32.0 to 4.33.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/0e4ae38f0c93d4f92a96c774bd52c069d12a4798\"\u003e\u003ccode\u003e0e4ae38\u003c/code\u003e\u003c/a\u003e docs: exclude Response.is_permanent_redirect from API docs (\u003ca href=\"https://redirect.github.com/psf/requests/issues/7244\"\u003e#7244\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/psf/requests/commit/d568f47278492e630cc990a259047c67991d007a\"\u003e\u003ccode\u003ed568f47\u003c/code\u003e\u003c/a\u003e docs: clarify Quickstart POST example (\u003ca href=\"https://redirect.github.com/psf/requests/issues/6960\"\u003e#6960\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/psf/requests/compare/v2.32.5...v2.33.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.5.5 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `urllib3` from 2.5.0 to 2.7.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/releases\"\u003eurllib3's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.7.0\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3 is raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects \u003ca href=\"https://opencollective.com/urllib3\"\u003eplease consider contributing financially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been read and decompressed partially. (Reported by \u003ca href=\"https://github.com/Cycloctane\"\u003e\u003ccode\u003e@​Cycloctane\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or \u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed using the official \u003ca href=\"https://pypi.org/project/brotli/\"\u003eBrotli\u003c/a\u003e library. (Reported by \u003ca href=\"https://github.com/kimkou2024\"\u003e\u003ccode\u003e@​kimkou2024\u003c/code\u003e\u003c/a\u003e)\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee GHSA-mf9v-mfxr-j63j for details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip sensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by \u003ca href=\"https://github.com/christos-spearbit\"\u003e\u003ccode\u003e@​christos-spearbit\u003c/code\u003e\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3763\"\u003eurllib3/urllib3#3763\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3720\"\u003eurllib3/urllib3#3720\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003eurllib3/urllib3#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3777\"\u003eurllib3/urllib3#3777\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed data buffered from previous partial reads. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3636\"\u003eurllib3/urllib3#3636\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the response after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4967\"\u003eurllib3/urllib3#4967\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eHTTPResponse.stream()\u003c/code\u003e and \u003ccode\u003eHTTPResponse.read_chunked()\u003c/code\u003e to handle \u003ccode\u003eamt=0\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3793\"\u003eurllib3/urllib3#3793\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eUpdated \u003ccode\u003e_TYPE_BODY\u003c/code\u003e type alias to include missing \u003ccode\u003eIterable[str]\u003c/code\u003e, matching the documented and runtime behavior of chunked request bodies. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3798\"\u003eurllib3/urllib3#3798\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eLocationParseError\u003c/code\u003e when paths resembling schemeless URIs were passed to \u003ccode\u003eHTTPConnectionPool.urlopen()\u003c/code\u003e. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3352\"\u003eurllib3/urllib3#3352\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eBaseHTTPResponse.readinto()\u003c/code\u003e type annotation to accept \u003ccode\u003ememoryview\u003c/code\u003e in addition to \u003ccode\u003ebytearray\u003c/code\u003e, matching the \u003ccode\u003eio.RawIOBase.readinto\u003c/code\u003e contract and enabling use with \u003ccode\u003eio.BufferedReader\u003c/code\u003e without type errors. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3764\"\u003eurllib3/urllib3#3764\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.3\u003c/h2\u003e\n\u003ch2\u003e🚀 urllib3 is fundraising for HTTP/2 support\u003c/h2\u003e\n\u003cp\u003e\u003ca href=\"https://sethmlarson.dev/urllib3-is-fundraising-for-http2-support\"\u003eurllib3 is raising ~$40,000 USD\u003c/a\u003e to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects \u003ca href=\"https://opencollective.com/urllib3\"\u003eplease consider contributing financially\u003c/a\u003e to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.\u003c/p\u003e\n\u003cp\u003eThank you for your support.\u003c/p\u003e\n\u003ch2\u003eChanges\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a security issue where decompression-bomb safeguards of the streaming API were bypassed when HTTP redirects were followed. (CVE-2026-21441 reported by \u003ca href=\"https://github.com/D47A\"\u003e\u003ccode\u003e@​D47A\u003c/code\u003e\u003c/a\u003e, 8.9 High, GHSA-38jv-5279-wg99)\u003c/li\u003e\n\u003cli\u003eStarted treating \u003ccode\u003eRetry-After\u003c/code\u003e times greater than 6 hours as 6 hours by default. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3743\"\u003eurllib3/urllib3#3743\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eFixed \u003ccode\u003eurllib3.connection.VerifiedHTTPSConnection\u003c/code\u003e on Emscripten. (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/3752\"\u003eurllib3/urllib3#3752\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003e2.6.2\u003c/h2\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst\"\u003eurllib3's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003e2.7.0 (2026-05-07)\u003c/h1\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cp\u003eAddressed high-severity security issues.\nImpact was limited to specific use cases detailed in the accompanying\nadvisories; overall user exposure was estimated to be marginal.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eDecompression-bomb safeguards of the streaming API were bypassed:\u003c/p\u003e\n\u003col\u003e\n\u003cli\u003eWhen \u003ccode\u003eHTTPResponse.drain_conn()\u003c/code\u003e was called after the response had been\nread and decompressed partially.\u003c/li\u003e\n\u003cli\u003eDuring the second \u003ccode\u003eHTTPResponse.read(amt=N)\u003c/code\u003e or\n\u003ccode\u003eHTTPResponse.stream(amt=N)\u003c/code\u003e call when the response was decompressed\nusing the official \u003ccode\u003eBrotli \u0026lt;https://pypi.org/project/brotli/\u0026gt;\u003c/code\u003e__ library.\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003eSee \u003ccode\u003eGHSA-mf9v-mfxr-j63j \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j\u0026gt;\u003c/code\u003e__\nfor details.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eHTTP pools created using \u003ccode\u003eProxyManager.connection_from_url\u003c/code\u003e did not strip\nsensitive headers specified in \u003ccode\u003eRetry.remove_headers_on_redirect\u003c/code\u003e when\nredirecting to a different host.\n(\u003ccode\u003eGHSA-qccp-gfcp-xxvc \u0026lt;https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc\u0026gt;\u003c/code\u003e__)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eDeprecations and Removals\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUsed \u003ccode\u003eFutureWarning\u003c/code\u003e instead of \u003ccode\u003eDeprecationWarning\u003c/code\u003e for better\nvisibility of existing deprecation notices. Rescheduled the removal of\ndeprecated features to version 3.0.\n(\u003ccode\u003e[#3763](https://github.com/urllib3/urllib3/issues/3763) \u0026lt;https://github.com/urllib3/urllib3/issues/3763\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life Python 3.9.\n(\u003ccode\u003e[#3720](https://github.com/urllib3/urllib3/issues/3720) \u0026lt;https://github.com/urllib3/urllib3/issues/3720\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eRemoved support for end-of-life PyPy3.10.\n(\u003ccode\u003e[#4979](https://github.com/urllib3/urllib3/issues/4979) \u0026lt;https://github.com/urllib3/urllib3/issues/4979\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eBumped the minimum supported pyOpenSSL version to 19.0.0.\n(\u003ccode\u003e[#3777](https://github.com/urllib3/urllib3/issues/3777) \u0026lt;https://github.com/urllib3/urllib3/issues/3777\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eBugfixes\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read(amt=None)\u003c/code\u003e was ignoring decompressed\ndata buffered from previous partial reads.\n(\u003ccode\u003e[#3636](https://github.com/urllib3/urllib3/issues/3636) \u0026lt;https://github.com/urllib3/urllib3/issues/3636\u0026gt;\u003c/code\u003e__)\u003c/li\u003e\n\u003cli\u003eFixed a bug where \u003ccode\u003eHTTPResponse.read()\u003c/code\u003e could cache only part of the\nresponse after a partial read when \u003ccode\u003ecache_content=True\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/9a950b92d999f906b6020bb2d1076ee56cddd5d2\"\u003e\u003ccode\u003e9a950b9\u003c/code\u003e\u003c/a\u003e Release 2.7.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/5ec0de499b9166ca71c65ab04f2a7e4eb0d66fcc\"\u003e\u003ccode\u003e5ec0de4\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2bdcc44d1e163fb5cc48a8662425e35e15adfe6a\"\u003e\u003ccode\u003e2bdcc44\u003c/code\u003e\u003c/a\u003e Merge commit from fork\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/f45b0df09d8620ac6ed0491eb9362c8c87b7bc2c\"\u003e\u003ccode\u003ef45b0df\u003c/code\u003e\u003c/a\u003e Fix a misleading example for \u003ccode\u003eProxyManager\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4970\"\u003e#4970\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/577193ca029872384f82c133449e0935f6d8a64b\"\u003e\u003ccode\u003e577193c\u003c/code\u003e\u003c/a\u003e Switch to nightly PyPy3.11 in CI for now (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4984\"\u003e#4984\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/e90af45bb006c3a452a3a21644a2681523f5c7fc\"\u003e\u003ccode\u003ee90af45\u003c/code\u003e\u003c/a\u003e Avoid infinite loop in \u003ccode\u003eHTTPResponse.read_chunked\u003c/code\u003e when \u003ccode\u003eamt=0\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4974\"\u003e#4974\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/67ed74fdaec6659a6534621ec8e3aaaa6f976210\"\u003e\u003ccode\u003e67ed74f\u003c/code\u003e\u003c/a\u003e Bump dev dependencies (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4972\"\u003e#4972\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/3abd481097b54d87b574ac7ea593c3f40938a84d\"\u003e\u003ccode\u003e3abd481\u003c/code\u003e\u003c/a\u003e Upgrade mypy to version 1.20.2 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4978\"\u003e#4978\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2b8725dfcac4f21d4d93cc0cc3a64a33af08f890\"\u003e\u003ccode\u003e2b8725d\u003c/code\u003e\u003c/a\u003e Drop support for EOL PyPy3.10 (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4979\"\u003e#4979\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/urllib3/urllib3/commit/2944b2a0a6c573f5548a39cfd17196f98ee21b33\"\u003e\u003ccode\u003e2944b2a\u003c/code\u003e\u003c/a\u003e Upgrade \u003ccode\u003esetup-chrome\u003c/code\u003e and \u003ccode\u003esetup-firefox\u003c/code\u003e to fix warnings (\u003ca href=\"https://redirect.github.com/urllib3/urllib3/issues/4973\"\u003e#4973\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/urllib3/urllib3/compare/2.5.0...2.7.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore \u003cdependency name\u003e major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)\n- `@dependabot ignore \u003cdependency name\u003e` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)\n- `@dependabot unignore \u003cdependency name\u003e` will remove all of the ignore conditions of the specified dependency\n- `@dependabot unignore \u003cdependency name\u003e \u003cignore condition\u003e` will remove the ignore condition of the specified dependency and ignore conditions\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/michaelconan/budget-dbt/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/michaelconan/budget-dbt/pull/41","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/michaelconan%2Fbudget-dbt/issues/41","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/41/packages"}},{"old_version":"6.5.5","new_version":"6.5.7","update_type":"patch","path":"/examples/workflow_evaluations/simple-agentic-rag","pr_created_at":"2026-06-17T01:55:13.000Z","version_change":"6.5.5 → 6.5.7","issue":{"uuid":"4679325163","node_id":"PR_kwDORUXae87nRPQ_","number":108,"state":"open","title":"Bump tornado from 6.5.5 to 6.5.7 in /examples/workflow_evaluations/simple-agentic-rag","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-17T01:55:13.000Z","updated_at":"2026-06-17T01:56:03.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":"/examples/workflow_evaluations/simple-agentic-rag","ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.5.5\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/Sherlock999xxx/tensorzero/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/Sherlock999xxx/tensorzero/pull/108","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/Sherlock999xxx%2Ftensorzero/issues/108","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/108/packages"}},{"old_version":"6.4","new_version":"6.5.7","update_type":null,"path":null,"pr_created_at":"2026-06-17T00:57:59.000Z","version_change":"6.4 → 6.5.7","issue":{"uuid":"4679060733","node_id":"PR_kwDOLQ0XEc7nQX2E","number":32,"state":"open","title":"Bump tornado from 6.4 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":3,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-17T00:57:59.000Z","updated_at":"2026-06-17T00:58:06.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.4","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"\u003e [!WARNING]\n\u003e Dependabot will stop supporting `python v3.9`!\n\u003e \n\u003e Please upgrade to one of the following versions: `v3.9`, `v3.10`, `v3.11`, `v3.12`, `v3.13`, or `v3.14`.\n\u003e\n\nBumps [tornado](https://github.com/tornadoweb/tornado) from 6.4 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.4.0...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=pip\u0026previous-version=6.4\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/google-marketing-solutions/shrinkify/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/google-marketing-solutions/shrinkify/pull/32","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/google-marketing-solutions%2Fshrinkify/issues/32","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/32/packages"}},{"old_version":"6.2","new_version":"6.5.7","update_type":null,"path":"/data/datasets/zhihu-kol","pr_created_at":"2026-06-16T19:56:16.000Z","version_change":"6.2 → 6.5.7","issue":{"uuid":"4677448558","node_id":"PR_kwDOO9HfOc7nLFJm","number":200,"state":"open","title":"Bump tornado from 6.2 to 6.5.7 in /data/datasets/zhihu-kol","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":4,"pull_request":true,"closed_at":null,"author_association":null,"state_reason":null,"created_at":"2026-06-16T19:56:16.000Z","updated_at":"2026-06-16T19:59:58.000Z","time_to_close":null,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":"/data/datasets/zhihu-kol","ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.2 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.2.0...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=pip\u0026previous-version=6.2\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/ArmorCode-Public-Test/Open-Assistant/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/ArmorCode-Public-Test/Open-Assistant/pull/200","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/ArmorCode-Public-Test%2FOpen-Assistant/issues/200","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/200/packages"}},{"old_version":"6.5.5","new_version":"6.5.7","update_type":"patch","path":null,"pr_created_at":"2026-06-16T16:30:43.000Z","version_change":"6.5.5 → 6.5.7","issue":{"uuid":"4676075616","node_id":"PR_kwDODSTwx87nGgCA","number":4702,"state":"closed","title":"build(deps): bump tornado from 6.5.5 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-07-01T21:46:42.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-16T16:30:43.000Z","updated_at":"2026-07-01T21:46:44.000Z","time_to_close":1314959,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"build(deps)","packages":[{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e","html_url":"https://github.com/open-telemetry/opentelemetry-python-contrib/pull/4702","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/open-telemetry%2Fopentelemetry-python-contrib/issues/4702","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/4702/packages"}},{"old_version":"6.2","new_version":"6.5.7","update_type":null,"path":null,"pr_created_at":"2026-06-16T09:04:11.000Z","version_change":"6.2 → 6.5.7","issue":{"uuid":"4672695736","node_id":"PR_kwDOHoXnnc7m7Pq0","number":8,"state":"closed","title":"Bump tornado from 6.2 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-16T12:26:37.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-16T09:04:11.000Z","updated_at":"2026-06-16T12:26:46.000Z","time_to_close":12146,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.2","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"\u003e [!WARNING]\n\u003e Dependabot will stop supporting `python v3.9`!\n\u003e \n\u003e Please upgrade to one of the following versions: `v3.9`, `v3.10`, `v3.11`, `v3.12`, `v3.13`, or `v3.14`.\n\u003e\n\nBumps [tornado](https://github.com/tornadoweb/tornado) from 6.2 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.2.0...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.2\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/amacd31/bit-counter/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/amacd31/bit-counter/pull/8","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/amacd31%2Fbit-counter/issues/8","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/8/packages"}},{"old_version":"6.5.5","new_version":"6.5.7","update_type":"patch","path":null,"pr_created_at":"2026-06-16T01:58:27.000Z","version_change":"6.5.5 → 6.5.7","issue":{"uuid":"4670352652","node_id":"PR_kwDOQbHgbc7mzr5r","number":31,"state":"closed","title":"chore(deps): bump the pip group across 9 directories with 5 updates","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":2,"pull_request":true,"closed_at":"2026-06-16T01:59:29.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-16T01:58:27.000Z","updated_at":"2026-06-16T01:59:31.000Z","time_to_close":62,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"chore(deps): bump","group_name":"pip","update_count":5,"packages":[{"name":"pyarrow","old_version":"16.1.0","new_version":"23.0.1","repository_url":"https://github.com/apache/arrow"},{"name":"pyjwt","old_version":"2.10.1","new_version":"2.13.0","repository_url":"https://github.com/jpadilla/pyjwt"},{"name":"pypdf","old_version":"6.10.2","new_version":"6.12.0","repository_url":"https://github.com/py-pdf/pypdf"},{"name":"torch","old_version":"2.5.1","new_version":"2.12.0","repository_url":"https://github.com/pytorch/pytorch"},{"name":"tornado","old_version":"6.5.5","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps the pip group with 5 updates in the /dakota_rl_training/outputs/tinker_qwen30b/wandb/run-20251119_104422-i55d4x26/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.5.1` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /dakota_rl_training/outputs/tinker_qwen4b/wandb/run-20251120_085502-ntfgah7s/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.5.1` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /dakota_rl_training/outputs/tinker_qwen4b/wandb/run-20251120_085815-o69alc9b/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.5.1` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /dakota_rl_training/outputs/tinker_qwen4b/wandb/run-20251120_090142-tbmfb9o0/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.5.1` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /dakota_rl_training/outputs/tinker_smoke/wandb/run-20251118_182158-ymh8qjl6/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.5.1` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /dakota_rl_training/outputs/tinker_smoke/wandb/run-20251118_182714-8xv4ah4h/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.5.1` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /wandb/run-20251105_064731-wq8xuzar/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.8.0` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /wandb/run-20251105_064758-5jy9n26c/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.8.0` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\nBumps the pip group with 5 updates in the /wandb/run-20251118_210438-u82h659i/files directory:\n\n| Package | From | To |\n| --- | --- | --- |\n| [pyarrow](https://github.com/apache/arrow) | `16.1.0` | `23.0.1` |\n| [pyjwt](https://github.com/jpadilla/pyjwt) | `2.10.1` | `2.13.0` |\n| [pypdf](https://github.com/py-pdf/pypdf) | `6.10.2` | `6.12.0` |\n| [torch](https://github.com/pytorch/pytorch) | `2.8.0` | `2.12.0` |\n| [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` |\n\n\nUpdates `pyarrow` from 16.1.0 to 23.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/apache/arrow/releases\"\u003epyarrow's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Arrow 23.0.1\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/23.0.1.html\"\u003ehttps://arrow.apache.org/release/23.0.1.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.1 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 23.0.1 RC0\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/23.0.0.html\"\u003ehttps://arrow.apache.org/release/23.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 23.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/22.0.0.html\"\u003ehttps://arrow.apache.org/release/22.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0 RC1\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 22.0.0 RC1\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 22.0.0 RC0\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/21.0.0.html\"\u003ehttps://arrow.apache.org/release/21.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC6\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC6\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC5\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC5\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC4\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC4\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC3\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC3\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/20.0.0.html\"\u003ehttps://arrow.apache.org/release/20.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC1\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC1\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC0\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/82a374e5f3de5b744f26591e6cd96de6349c76d9\"\u003e\u003ccode\u003e82a374e\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update versions for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/c1ae37c4a597f466b1806e65a9e011be1060dfc5\"\u003e\u003ccode\u003ec1ae37c\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update .deb/.rpm changelogs for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/8f6e55736f60f1f95aee1e8765c6b75ad9589111\"\u003e\u003ccode\u003e8f6e557\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update CHANGELOG.md for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/4e16a1aeed83a65e6b49556c2fed8e9061cdf980\"\u003e\u003ccode\u003e4e16a1a\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49159\"\u003eGH-49159\u003c/a\u003e: [C++][Gandiva] Detect overflow in repeat() (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49160\"\u003e#49160\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/985621dbfcf3fd2061889e43c50b59825df84f3f\"\u003e\u003ccode\u003e985621d\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/48817\"\u003eGH-48817\u003c/a\u003e [R][C++] Bump C++20 in R build infrastructure (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/48819\"\u003e#48819\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/1bea06ad4e14d75dd97a78a0148cd9cf6f4df0bc\"\u003e\u003ccode\u003e1bea06a\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49024\"\u003eGH-49024\u003c/a\u003e: [CI] Update Debian version in \u003ccode\u003e.env\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49032\"\u003e#49032\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/147bcd6d8f3fef05dd06968d3b60c17721c60334\"\u003e\u003ccode\u003e147bcd6\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49156\"\u003eGH-49156\u003c/a\u003e: [Python] Require GIL for string comparison (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49161\"\u003e#49161\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/e4f922b1621b6c833f583cf26500f115ab5bc483\"\u003e\u003ccode\u003ee4f922b\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49138\"\u003eGH-49138\u003c/a\u003e: [Packaging][Python] Remove nightly cython install from manylinux wh...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/f9376e4721b81bad9fe3fe840926a3283f95ee30\"\u003e\u003ccode\u003ef9376e4\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49003\"\u003eGH-49003\u003c/a\u003e: [C++] Don't consider \u003ccode\u003eout_of_range\u003c/code\u003e an error in float parsing (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49095\"\u003e#49095\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/ab2c0ad6b23d05d5f77fc8a34d5a1c4baaacb0a4\"\u003e\u003ccode\u003eab2c0ad\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49044\"\u003eGH-49044\u003c/a\u003e: [CI][Python] Fix test_download_tzdata_on_windows by adding required...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/apache/arrow/compare/r-16.1.0...apache-arrow-23.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pyjwt` from 2.10.1 to 2.13.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/releases\"\u003epyjwt's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.13.0\u003c/h2\u003e\n\u003ch1\u003ePyJWT 2.13.0 — Security Release\u003c/h1\u003e\n\u003cp\u003eThis release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\"\u003e\u003ccode\u003eGHSA-xgmm-8j9v-c9wx\u003c/code\u003e\u003c/a\u003e — JWK JSON accepted as HMAC secret (algorithm confusion).\u003c/strong\u003e \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in \u003ccode\u003ealgorithms=[…]\u003c/code\u003e and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. \u003cem\u003eReported by \u003ca href=\"https://github.com/aradona91\"\u003e\u003ccode\u003e@​aradona91\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\"\u003e\u003ccode\u003eGHSA-jq35-7prp-9v3f\u003c/code\u003e\u003c/a\u003e — Algorithm allow-list bypass with \u003ccode\u003ePyJWK\u003c/code\u003e / \u003ccode\u003ePyJWKClient\u003c/code\u003e.\u003c/strong\u003e When verifying with a \u003ccode\u003ePyJWK\u003c/code\u003e, the caller's \u003ccode\u003ealgorithms=[…]\u003c/code\u003e allow-list was checked against the token header \u003ccode\u003ealg\u003c/code\u003e as a string only; actual verification used the algorithm bound to the \u003ccode\u003ePyJWK\u003c/code\u003e. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header \u003ccode\u003ealg\u003c/code\u003e to match the \u003ccode\u003ePyJWK\u003c/code\u003e's algorithm before verification. \u003cem\u003eReported by \u003ca href=\"https://github.com/sushi-gif\"\u003e\u003ccode\u003e@​sushi-gif\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\"\u003e\u003ccode\u003eGHSA-w7vc-732c-9m39\u003c/code\u003e\u003c/a\u003e — DoS via base64 decode of unused payload segment when \u003ccode\u003eb64=false\u003c/code\u003e.\u003c/strong\u003e For detached-payload JWS (\u003ccode\u003eb64=false\u003c/code\u003e), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied \u003ccode\u003edetached_payload\u003c/code\u003e. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. \u003cem\u003eReported by \u003ca href=\"https://github.com/thesmartshadow\"\u003e\u003ccode\u003e@​thesmartshadow\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\"\u003e\u003ccode\u003eGHSA-993g-76c3-p5m4\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e accepts non-HTTP(S) URIs.\u003c/strong\u003e \u003ccode\u003ePyJWKClient.fetch_data\u003c/code\u003e passed its URI to \u003ccode\u003eurllib.request.urlopen\u003c/code\u003e, which by default also handles \u003ccode\u003efile://\u003c/code\u003e, \u003ccode\u003eftp://\u003c/code\u003e, and \u003ccode\u003edata:\u003c/code\u003e schemes. An application that fed an attacker-influenced URI into \u003ccode\u003ePyJWKClient\u003c/code\u003e could be coerced into reading local files or reaching other unintended schemes. \u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects any URI whose scheme isn't \u003ccode\u003ehttp\u003c/code\u003e or \u003ccode\u003ehttps\u003c/code\u003e. \u003cem\u003eReported by \u003ca href=\"https://github.com/KEIJOT\"\u003e\u003ccode\u003e@​KEIJOT\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\"\u003e\u003ccode\u003eGHSA-fhv5-28vv-h8m8\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e cache wiped on fetch error.\u003c/strong\u003e A \u003ccode\u003efinally\u003c/code\u003e-block \u003ccode\u003eput(jwk_set=None)\u003c/code\u003e cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. \u003cem\u003eReported by \u003ca href=\"https://github.com/eddieran\"\u003e\u003ccode\u003e@​eddieran\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReject empty HMAC keys outright in \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e with \u003ccode\u003eInvalidKeyError\u003c/code\u003e instead of accepting them with only a warning. Defends against the \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e footgun. \u003cem\u003eThanks to \u003ca href=\"https://github.com/SnailSploit\"\u003e\u003ccode\u003e@​SnailSploit\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"https://github.com/spartan8806\"\u003e\u003ccode\u003e@​spartan8806\u003c/code\u003e\u003c/a\u003e for the reports.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003eForward per-call \u003ccode\u003eoptions\u003c/code\u003e (including \u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e) from \u003ccode\u003ePyJWT.decode\u003c/code\u003e through to \u003ccode\u003ePyJWS._verify_signature\u003c/code\u003e. The option was previously silently dropped between the two layers, so it only took effect when set on the \u003ccode\u003ePyJWT\u003c/code\u003e instance. \u003cem\u003eThanks to \u003ca href=\"https://github.com/WLUB\"\u003e\u003ccode\u003e@​WLUB\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRFC 7797 §3 compliance for \u003ccode\u003eb64=false\u003c/code\u003e:\u003c/strong\u003e the encoder now auto-adds \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e to \u003ccode\u003ecrit\u003c/code\u003e, and the decoder rejects tokens that set \u003ccode\u003eb64=false\u003c/code\u003e without listing it in \u003ccode\u003ecrit\u003c/code\u003e. \u003cem\u003eThanks to \u003ca href=\"https://github.com/MachineLearning-Nerd\"\u003e\u003ccode\u003e@​MachineLearning-Nerd\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eChanged\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups, by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/pull/1152\"\u003e#1152\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eUpgrade notes\u003c/h2\u003e\n\u003cp\u003eMost fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eEmpty HMAC keys now raise.\u003c/strong\u003e If your app passed \u003ccode\u003e\u0026quot;\u0026quot;\u003c/code\u003e or \u003ccode\u003eb\u0026quot;\u0026quot;\u003c/code\u003e as a secret (often via a missing env var, e.g. \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e), \u003ccode\u003eencode\u003c/code\u003e/\u003ccode\u003edecode\u003c/code\u003e will now raise \u003ccode\u003eInvalidKeyError\u003c/code\u003e. This is the intended behavior — fix the configuration.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWK\u003c/code\u003e decoding now requires the token's \u003ccode\u003ealg\u003c/code\u003e to match the JWK's algorithm.\u003c/strong\u003e Previously a mismatch was silently honored if the header \u003ccode\u003ealg\u003c/code\u003e appeared in the allow-list. Tokens that relied on this mismatch will now fail with \u003ccode\u003eInvalidAlgorithmError\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects non-HTTP(S) URIs at construction time.\u003c/strong\u003e Tests or dev environments that fetched JWKS from \u003ccode\u003efile://\u003c/code\u003e URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct \u003ccode\u003ePyJWKSet.from_dict(...)\u003c/code\u003e directly).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eb64=false\u003c/code\u003e tokens are now strictly RFC 7515 / 7797 compliant.\u003c/strong\u003e Tokens with a non-empty compact-form payload segment, or that omit \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e from \u003ccode\u003ecrit\u003c/code\u003e, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e set per-call now takes effect.\u003c/strong\u003e Callers who passed \u003ccode\u003eoptions={\u0026quot;enforce_minimum_key_length\u0026quot;: True}\u003c/code\u003e to \u003ccode\u003ejwt.decode()\u003c/code\u003e previously got no enforcement; they will now get \u003ccode\u003eInvalidKeyError\u003c/code\u003e on undersized keys, as documented.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull changelog:\u003c/strong\u003e \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\"\u003ehttps://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e2.12.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd typing_extensions dependency for Python \u0026lt; 3.11 by \u003ca href=\"https://github.com/jpadilla\"\u003e\u003ccode\u003e@​jpadilla\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/pull/1151\"\u003ejpadilla/pyjwt#1151\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\"\u003ehttps://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e2.12.0\u003c/h2\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eValidate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by \u003ca href=\"https://github.com/dmbs335\"\u003e\u003ccode\u003e@​dmbs335\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f\"\u003eGHSA-752w-5fwx-jx9f\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst\"\u003epyjwt's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ccode\u003ev2.13.0 \u0026lt;https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u0026gt;\u003c/code\u003e__\u003c/h2\u003e\n\u003cp\u003eSecurity\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject JWK JSON documents passed as raw HMAC secrets in\n  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that\n  the existing PEM/SSH guard did not cover. Reported by @aradona91 in\n  `GHSA-xgmm-8j9v-c9wx \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\u0026gt;`__.\n- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during\n  verification so the caller's ``algorithms=[...]`` allow-list cannot be\n  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported\n  by @sushi-gif in `GHSA-jq35-7prp-9v3f \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\u0026gt;`__.\n- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-\n  influenced URIs cannot read local files or reach unintended schemes via\n  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported\n  by @KEIJOT in `GHSA-993g-76c3-p5m4 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\u0026gt;`__.\n- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.\n  The previous ``finally``-block ``put(None)`` pattern cleared the cache\n  on any transient outage, turning one bad JWKS request into application-\n  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\u0026gt;`__.\n- Skip the unconditional base64 decode of the compact-form payload segment\n  when ``b64=false`` is set in the protected header, and require that\n  segment to be empty (RFC 7515 Appendix F detached form). Closes an\n  unauthenticated DoS amplifier. Reported by @thesmartshadow in\n  `GHSA-w7vc-732c-9m39 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\u0026gt;`__.\n\u003cp\u003eFixed\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with\n  ``InvalidKeyError`` instead of accepting them with only a warning.\n  Thanks to @SnailSploit and @spartan8806 for independently flagging the\n  footgun.\n- Forward per-call ``options`` (including ``enforce_minimum_key_length``)\n  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the\n  option actually takes effect when set at the call site rather than only\n  on the ``PyJWT`` instance. Thanks to @WLUB for the report.\n- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds\n  ``\u0026amp;quot;b64\u0026amp;quot;`` to the ``crit`` header parameter, and the decoder rejects\n  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to\n  @MachineLearning-Nerd for the report.\n\nChanged\n\u003c/code\u003e\u003c/pre\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ccode\u003e[#1152](https://github.com/jpadilla/pyjwt/issues/1152) \u0026amp;lt;https://github.com/jpadilla/pyjwt/pull/1152\u0026amp;gt;\u003c/code\u003e__\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ccode\u003ev2.12.1 \u0026amp;lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\u0026amp;gt;\u003c/code\u003e__\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt;\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff\"\u003e\u003ccode\u003e7144e45\u003c/code\u003e\u003c/a\u003e Apply ruff format\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab\"\u003e\u003ccode\u003ed2f4bec\u003c/code\u003e\u003c/a\u003e Restore \u003ccode\u003ecast()\u003c/code\u003e calls with cross-version \u003ccode\u003etype: ignore\u003c/code\u003e for \u003ccode\u003eprepare_key\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774\"\u003e\u003ccode\u003e22f478c\u003c/code\u003e\u003c/a\u003e Remove redundant casts in \u003ccode\u003eRSAAlgorithm.prepare_key\u003c/code\u003e and `ECAlgorithm.prepare...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81\"\u003e\u003ccode\u003e95791b1\u003c/code\u003e\u003c/a\u003e Bundle security fixes and hardening into 2.13.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508\"\u003e\u003ccode\u003edcc27a9\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1155\"\u003e#1155\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a\"\u003e\u003ccode\u003e9d08a9a\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1146\"\u003e#1146\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64\"\u003e\u003ccode\u003eb87c100\u003c/code\u003e\u003c/a\u003e Bump codecov/codecov-action from 5 to 6 (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1154\"\u003e#1154\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812\"\u003e\u003ccode\u003e40e3147\u003c/code\u003e\u003c/a\u003e Migrate development extras to dependency groups (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1152\"\u003e#1152\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/a4e1a3d1218b01c5806420b8f16d9308ac4adc30\"\u003e\u003ccode\u003ea4e1a3d\u003c/code\u003e\u003c/a\u003e Add typing_extensions dependency for Python \u0026lt; 3.11 (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1151\"\u003e#1151\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/bd9700cca7f9258fadcc429c1034e508025931f2\"\u003e\u003ccode\u003ebd9700c\u003c/code\u003e\u003c/a\u003e Use PyJWK algorithm when encoding without explicit algorithm (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1148\"\u003e#1148\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.10.1...2.13.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pypdf` from 6.10.2 to 6.12.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/py-pdf/pypdf/releases\"\u003epypdf's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.12.0, 2026-05-21\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDisallow cross-reference streams with zero-only width values (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3791\"\u003e#3791\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAvoid excessive whitespace in layout mode text extraction (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3790\"\u003e#3790\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImplement SASLprep (RFC 4013) for AES-256 password normalization (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3780\"\u003e#3780\u003c/a\u003e) by \u003ca href=\"https://github.com/adityamoolya\"\u003e\u003ccode\u003e@​adityamoolya\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCID font resource from font file to encode more characters (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3652\"\u003e#3652\u003c/a\u003e) by \u003ca href=\"https://github.com/PJBrs\"\u003e\u003ccode\u003e@​PJBrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance Improvements (PI)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eOptimize retrieval of named destinatinos in reader (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3442\"\u003e#3442\u003c/a\u003e) by \u003ca href=\"https://github.com/larsga\"\u003e\u003ccode\u003e@​larsga\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes (BUG)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix TreeObject.insert_child KeyError on fresh children (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3786\"\u003e#3786\u003c/a\u003e) by \u003ca href=\"https://github.com/Abzaek\"\u003e\u003ccode\u003e@​Abzaek\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAppearanceStream: Also honor user-set font name when not flattening annotations (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3781\"\u003e#3781\u003c/a\u003e) by \u003ca href=\"https://github.com/PJBrs\"\u003e\u003ccode\u003e@​PJBrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation (DOC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBlock encrypting writer in incremental mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3789\"\u003e#3789\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.11.0...6.12.0\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.11.0, 2026-05-09\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eInitialise a Font from an embedded font file (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3704\"\u003e#3704\u003c/a\u003e) by \u003ca href=\"https://github.com/PJBrs\"\u003e\u003ccode\u003e@​PJBrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAllow to fix AES padding length in non-strict mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3742\"\u003e#3742\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDeveloper Experience (DEV)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEnable PyPy testing again (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3752\"\u003e#3752\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAlign mypy Makefile target with strict mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3690\"\u003e#3690\u003c/a\u003e) by \u003ca href=\"https://github.com/costajohnt\"\u003e\u003ccode\u003e@​costajohnt\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.10.2...6.11.0\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md\"\u003epypdf's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.12.0, 2026-05-21\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDisallow cross-reference streams with zero-only width values (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3791\"\u003e#3791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAvoid excessive whitespace in layout mode text extraction (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3790\"\u003e#3790\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImplement SASLprep (RFC 4013) for AES-256 password normalization (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3780\"\u003e#3780\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eCID font resource from font file to encode more characters (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3652\"\u003e#3652\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance Improvements (PI)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eOptimize retrieval of named destinatinos in reader (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3442\"\u003e#3442\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes (BUG)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix TreeObject.insert_child KeyError on fresh children (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3786\"\u003e#3786\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAppearanceStream: Also honor user-set font name when not flattening annotations (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3781\"\u003e#3781\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation (DOC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBlock encrypting writer in incremental mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3789\"\u003e#3789\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.11.0...6.12.0\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.11.0, 2026-05-09\u003c/h2\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eInitialise a Font from an embedded font file (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3704\"\u003e#3704\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAllow to fix AES padding length in non-strict mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3742\"\u003e#3742\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDeveloper Experience (DEV)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEnable PyPy testing again (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3752\"\u003e#3752\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAlign mypy Makefile target with strict mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3690\"\u003e#3690\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.10.2...6.11.0\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/08eb1435ef2e4d1e3d5fe90636c3cee7aa6f4470\"\u003e\u003ccode\u003e08eb143\u003c/code\u003e\u003c/a\u003e REL: 6.12.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/507d7c9aa6ea83389b954b9c3c0c528fe5d5da70\"\u003e\u003ccode\u003e507d7c9\u003c/code\u003e\u003c/a\u003e SEC: Disallow cross-reference streams with zero-only width values (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3791\"\u003e#3791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/9d2747057c4afc06ccc0fc6244a3915ba6ea6f0b\"\u003e\u003ccode\u003e9d27470\u003c/code\u003e\u003c/a\u003e SEC: Avoid excessive whitespace in layout mode text extraction (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3790\"\u003e#3790\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/0a8e699d33ff1d82fae17b7cfa6d01b822be50b2\"\u003e\u003ccode\u003e0a8e699\u003c/code\u003e\u003c/a\u003e DOC: Block encrypting writer in incremental mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3789\"\u003e#3789\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/541ebd4e6e0c23dd90f5723210b585655d2a9519\"\u003e\u003ccode\u003e541ebd4\u003c/code\u003e\u003c/a\u003e DEV: Update idna from version 3.10 to 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/de405a8d3fc7156140570b03dc1db95f85fe1159\"\u003e\u003ccode\u003ede405a8\u003c/code\u003e\u003c/a\u003e DEV: Update idna from version 3.10 to 3.15\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/a2b90f978e97828cb2254fb146d5194727c79171\"\u003e\u003ccode\u003ea2b90f9\u003c/code\u003e\u003c/a\u003e ROB: AppearanceStream: Also honor user-set font name when not flattening anno...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/22bd60f913c0fe3b0354d73911d202dfc1a1acf8\"\u003e\u003ccode\u003e22bd60f\u003c/code\u003e\u003c/a\u003e MAINT: Tiny change of comments (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3787\"\u003e#3787\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/29953925e9ca8ec6f941ae7efbaf2829cbd51b35\"\u003e\u003ccode\u003e2995392\u003c/code\u003e\u003c/a\u003e ENH: Implement SASLprep (RFC 4013) for AES-256 password normalization (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3780\"\u003e#3780\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/commit/e044789d4ad8b6c370f6cee5b563579a2b832784\"\u003e\u003ccode\u003ee044789\u003c/code\u003e\u003c/a\u003e TST: Disable PyPy update checks after image update\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.10.2...6.12.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `torch` from 2.5.1 to 2.12.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/pytorch/pytorch/releases\"\u003etorch's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003ePyTorch 2.12.0 Release Notes\u003c/h1\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#highlights\"\u003eHighlights\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#backwards-incompatible-changes\"\u003eBackwards Incompatible Changes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#deprecations\"\u003eDeprecations\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#new-features\"\u003eNew Features\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#improvements\"\u003eImprovements\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#bug-fixes\"\u003eBug fixes\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#performance\"\u003ePerformance\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#documentation\"\u003eDocumentation\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#developers\"\u003eDevelopers\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/blob/HEAD/#security\"\u003eSecurity\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch1\u003eHighlights\u003c/h1\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003cp\u003eFor more details about these highlighted features, you can look at the release blogpost. Below are the full release notes for this release.\u003c/p\u003e\n\u003ch1\u003eBackwards Incompatible Changes\u003c/h1\u003e\n\u003ch2\u003eBuild Frontend\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003eStrengthened SVE compile checks in \u003ccode\u003eFindARM.cmake\u003c/code\u003e, which may reject previously accepted but incorrect SVE configurations (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/pull/176646\"\u003e#176646\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003eSource builds that enable SVE now validate the compiler configuration more strictly. If a build previously passed with an incomplete or mismatched SVE setup, it may now fail during CMake configuration instead of later in compilation. Update the compiler/toolchain flags so they accurately describe the target SVE support, or disable SVE for that build.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eUpdated the minimum CUDA version required to build PyTorch from source to CUDA 12.6 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/pull/178925\"\u003e#178925\u003c/a\u003e)\u003c/p\u003e\n\u003cp\u003eBuilding PyTorch from source with CUDA versions older than 12.6 is no longer supported. Users building custom binaries should install CUDA 12.6 or newer and make sure \u003ccode\u003eCUDA_HOME\u003c/code\u003e points to that installation.\u003c/p\u003e\n\u003cp\u003eVersion 2.11:\u003c/p\u003e\n\u003cpre lang=\"bash\"\u003e\u003ccode\u003eCUDA_HOME=/usr/local/cuda-12.4 python setup.py develop\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003cp\u003eVersion 2.12:\u003c/p\u003e\n\u003cpre lang=\"bash\"\u003e\u003ccode\u003eCUDA_HOME=/usr/local/cuda-12.6 python setup.py develop\r\n\u003c/code\u003e\u003c/pre\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eEnforced a C++20 minimum in CMake build files (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/pull/178662\"\u003e#178662\u003c/a\u003e)\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/0d62256a2b23365f8e1604297eb23a6545102aa8\"\u003e\u003ccode\u003e0d62256\u003c/code\u003e\u003c/a\u003e [release] Dockerfile: skip torchaudio install when CUDA_PATH=cu132 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/183346\"\u003e#183346\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/7661cd9c6b841b62b7f411aa52ec51f05457263b\"\u003e\u003ccode\u003e7661cd9\u003c/code\u003e\u003c/a\u003e [MPS] Fix SDPA wrong output for permuted q/k/v with B \u0026gt; 1 (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/181886\"\u003e#181886\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/9da6087ab64ab6a2118686420ca5353c90dd7e1f\"\u003e\u003ccode\u003e9da6087\u003c/code\u003e\u003c/a\u003e Fix stale PYTORCH_RELEASES_CODE_CC dict (fixes \u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/182250\"\u003e#182250\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/182369\"\u003e#182369\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/e4c37cc011d47246ce8ea4b99c9b28fb7f400224\"\u003e\u003ccode\u003ee4c37cc\u003c/code\u003e\u003c/a\u003e Avoid raw stream name collisions in Inductor (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/182178\"\u003e#182178\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/822d047dc8dd8d919f83c3ad5c786e405075d1f0\"\u003e\u003ccode\u003e822d047\u003c/code\u003e\u003c/a\u003e [MPS] Fix bool mask handling in 1-pass SDPA decode kernel (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/182285\"\u003e#182285\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/182311\"\u003e#182311\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/5c5e523cd520e6986006e45be243b3ee927ea546\"\u003e\u003ccode\u003e5c5e523\u003c/code\u003e\u003c/a\u003e Add enable_gqa parameter to SDPA MPS meta registration (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/181550\"\u003e#181550\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/eece52ead16886e5463c3dcee9b04db783cc68d5\"\u003e\u003ccode\u003eeece52e\u003c/code\u003e\u003c/a\u003e [AOTI] Add BC-safe c_shim v2 for _scaled_dot_product_attention_math_for_mps e...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/b39330bbe210b9628207e84d8ba2cabb7975fbac\"\u003e\u003ccode\u003eb39330b\u003c/code\u003e\u003c/a\u003e [Inductor] Call latest c_shim version for versioned fallback ops (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/181548\"\u003e#181548\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/06f10d088229a25ac52bd14b6cacc04a4161f6ca\"\u003e\u003ccode\u003e06f10d0\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;[FSDP2] add fqn to communication ops\u0026quot; (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/182100\"\u003e#182100\u003c/a\u003e) (\u003ca href=\"https://redirect.github.com/pytorch/pytorch/issues/182157\"\u003e#182157\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/pytorch/pytorch/commit/449e3393139a1aca9afec120c9a63f98f12d55b0\"\u003e\u003ccode\u003e449e339\u003c/code\u003e\u003c/a\u003e Revert \u0026quot;[Inductor] Improve materialization heuristic for a chain of computaio...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/pytorch/pytorch/compare/v2.5.1...v2.12.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `tornado` from 6.5.5 to 6.5.7\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pyarrow` from 16.1.0 to 23.0.1\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/apache/arrow/releases\"\u003epyarrow's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eApache Arrow 23.0.1\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/23.0.1.html\"\u003ehttps://arrow.apache.org/release/23.0.1.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.1 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 23.0.1 RC0\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/23.0.0.html\"\u003ehttps://arrow.apache.org/release/23.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 23.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 23.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/22.0.0.html\"\u003ehttps://arrow.apache.org/release/22.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0 RC1\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 22.0.0 RC1\u003c/p\u003e\n\u003ch2\u003eApache Arrow 22.0.0 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 22.0.0 RC0\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/21.0.0.html\"\u003ehttps://arrow.apache.org/release/21.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC6\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC6\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC5\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC5\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC4\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC4\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC3\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC3\u003c/p\u003e\n\u003ch2\u003eApache Arrow 21.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 21.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0\u003c/h2\u003e\n\u003cp\u003eRelease Notes URL: \u003ca href=\"https://arrow.apache.org/release/20.0.0.html\"\u003ehttps://arrow.apache.org/release/20.0.0.html\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC2\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC2\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC1\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC1\u003c/p\u003e\n\u003ch2\u003eApache Arrow 20.0.0 RC0\u003c/h2\u003e\n\u003cp\u003eRelease Notes: Release Candidate: 20.0.0 RC0\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/82a374e5f3de5b744f26591e6cd96de6349c76d9\"\u003e\u003ccode\u003e82a374e\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update versions for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/c1ae37c4a597f466b1806e65a9e011be1060dfc5\"\u003e\u003ccode\u003ec1ae37c\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update .deb/.rpm changelogs for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/8f6e55736f60f1f95aee1e8765c6b75ad9589111\"\u003e\u003ccode\u003e8f6e557\u003c/code\u003e\u003c/a\u003e MINOR: [Release] Update CHANGELOG.md for 23.0.1\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/4e16a1aeed83a65e6b49556c2fed8e9061cdf980\"\u003e\u003ccode\u003e4e16a1a\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49159\"\u003eGH-49159\u003c/a\u003e: [C++][Gandiva] Detect overflow in repeat() (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49160\"\u003e#49160\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/985621dbfcf3fd2061889e43c50b59825df84f3f\"\u003e\u003ccode\u003e985621d\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/48817\"\u003eGH-48817\u003c/a\u003e [R][C++] Bump C++20 in R build infrastructure (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/48819\"\u003e#48819\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/1bea06ad4e14d75dd97a78a0148cd9cf6f4df0bc\"\u003e\u003ccode\u003e1bea06a\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49024\"\u003eGH-49024\u003c/a\u003e: [CI] Update Debian version in \u003ccode\u003e.env\u003c/code\u003e (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49032\"\u003e#49032\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/147bcd6d8f3fef05dd06968d3b60c17721c60334\"\u003e\u003ccode\u003e147bcd6\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49156\"\u003eGH-49156\u003c/a\u003e: [Python] Require GIL for string comparison (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49161\"\u003e#49161\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/e4f922b1621b6c833f583cf26500f115ab5bc483\"\u003e\u003ccode\u003ee4f922b\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49138\"\u003eGH-49138\u003c/a\u003e: [Packaging][Python] Remove nightly cython install from manylinux wh...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/f9376e4721b81bad9fe3fe840926a3283f95ee30\"\u003e\u003ccode\u003ef9376e4\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49003\"\u003eGH-49003\u003c/a\u003e: [C++] Don't consider \u003ccode\u003eout_of_range\u003c/code\u003e an error in float parsing (\u003ca href=\"https://redirect.github.com/apache/arrow/issues/49095\"\u003e#49095\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/apache/arrow/commit/ab2c0ad6b23d05d5f77fc8a34d5a1c4baaacb0a4\"\u003e\u003ccode\u003eab2c0ad\u003c/code\u003e\u003c/a\u003e \u003ca href=\"https://redirect.github.com/apache/arrow/issues/49044\"\u003eGH-49044\u003c/a\u003e: [CI][Python] Fix test_download_tzdata_on_windows by adding required...\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/apache/arrow/compare/r-16.1.0...apache-arrow-23.0.1\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pyjwt` from 2.10.1 to 2.13.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/releases\"\u003epyjwt's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e2.13.0\u003c/h2\u003e\n\u003ch1\u003ePyJWT 2.13.0 — Security Release\u003c/h1\u003e\n\u003cp\u003eThis release bundles five security fixes plus three additional hardening / spec-compliance changes. We recommend all users upgrade.\u003c/p\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\"\u003e\u003ccode\u003eGHSA-xgmm-8j9v-c9wx\u003c/code\u003e\u003c/a\u003e — JWK JSON accepted as HMAC secret (algorithm confusion).\u003c/strong\u003e \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e previously rejected PEM- and SSH-formatted asymmetric keys but did not catch a JWK passed as a raw JSON string. In a verifier configured with both symmetric and asymmetric algorithms in \u003ccode\u003ealgorithms=[…]\u003c/code\u003e and a raw-JSON JWK as the key, an attacker could forge HS256 tokens using the JWK text as the HMAC secret. The guard has been extended to reject any JWK-shaped JSON. \u003cem\u003eReported by \u003ca href=\"https://github.com/aradona91\"\u003e\u003ccode\u003e@​aradona91\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\"\u003e\u003ccode\u003eGHSA-jq35-7prp-9v3f\u003c/code\u003e\u003c/a\u003e — Algorithm allow-list bypass with \u003ccode\u003ePyJWK\u003c/code\u003e / \u003ccode\u003ePyJWKClient\u003c/code\u003e.\u003c/strong\u003e When verifying with a \u003ccode\u003ePyJWK\u003c/code\u003e, the caller's \u003ccode\u003ealgorithms=[…]\u003c/code\u003e allow-list was checked against the token header \u003ccode\u003ealg\u003c/code\u003e as a string only; actual verification used the algorithm bound to the \u003ccode\u003ePyJWK\u003c/code\u003e. An attacker who controlled a registered JWKS key could sign with one algorithm and advertise another on the header. PyJWT now requires the token header \u003ccode\u003ealg\u003c/code\u003e to match the \u003ccode\u003ePyJWK\u003c/code\u003e's algorithm before verification. \u003cem\u003eReported by \u003ca href=\"https://github.com/sushi-gif\"\u003e\u003ccode\u003e@​sushi-gif\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\"\u003e\u003ccode\u003eGHSA-w7vc-732c-9m39\u003c/code\u003e\u003c/a\u003e — DoS via base64 decode of unused payload segment when \u003ccode\u003eb64=false\u003c/code\u003e.\u003c/strong\u003e For detached-payload JWS (\u003ccode\u003eb64=false\u003c/code\u003e), the compact-form payload segment was base64-decoded before being discarded in favor of the caller-supplied \u003ccode\u003edetached_payload\u003c/code\u003e. An attacker could inflate the unused segment to force CPU + memory cost without holding a valid signature. The segment is now required to be empty per RFC 7515 Appendix F, and is no longer decoded. \u003cem\u003eReported by \u003ca href=\"https://github.com/thesmartshadow\"\u003e\u003ccode\u003e@​thesmartshadow\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\"\u003e\u003ccode\u003eGHSA-993g-76c3-p5m4\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e accepts non-HTTP(S) URIs.\u003c/strong\u003e \u003ccode\u003ePyJWKClient.fetch_data\u003c/code\u003e passed its URI to \u003ccode\u003eurllib.request.urlopen\u003c/code\u003e, which by default also handles \u003ccode\u003efile://\u003c/code\u003e, \u003ccode\u003eftp://\u003c/code\u003e, and \u003ccode\u003edata:\u003c/code\u003e schemes. An application that fed an attacker-influenced URI into \u003ccode\u003ePyJWKClient\u003c/code\u003e could be coerced into reading local files or reaching other unintended schemes. \u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects any URI whose scheme isn't \u003ccode\u003ehttp\u003c/code\u003e or \u003ccode\u003ehttps\u003c/code\u003e. \u003cem\u003eReported by \u003ca href=\"https://github.com/KEIJOT\"\u003e\u003ccode\u003e@​KEIJOT\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003e\u003cstrong\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\"\u003e\u003ccode\u003eGHSA-fhv5-28vv-h8m8\u003c/code\u003e\u003c/a\u003e — \u003ccode\u003ePyJWKClient\u003c/code\u003e cache wiped on fetch error.\u003c/strong\u003e A \u003ccode\u003efinally\u003c/code\u003e-block \u003ccode\u003eput(jwk_set=None)\u003c/code\u003e cleared the JWK Set cache whenever a fetch raised, turning a transient JWKS-endpoint outage into application-wide auth failure. The cache write was moved into the success path; transient errors no longer evict valid cached keys. \u003cem\u003eReported by \u003ca href=\"https://github.com/eddieran\"\u003e\u003ccode\u003e@​eddieran\u003c/code\u003e\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eFixed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eReject empty HMAC keys outright in \u003ccode\u003eHMACAlgorithm.prepare_key\u003c/code\u003e with \u003ccode\u003eInvalidKeyError\u003c/code\u003e instead of accepting them with only a warning. Defends against the \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e footgun. \u003cem\u003eThanks to \u003ca href=\"https://github.com/SnailSploit\"\u003e\u003ccode\u003e@​SnailSploit\u003c/code\u003e\u003c/a\u003e and \u003ca href=\"https://github.com/spartan8806\"\u003e\u003ccode\u003e@​spartan8806\u003c/code\u003e\u003c/a\u003e for the reports.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003eForward per-call \u003ccode\u003eoptions\u003c/code\u003e (including \u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e) from \u003ccode\u003ePyJWT.decode\u003c/code\u003e through to \u003ccode\u003ePyJWS._verify_signature\u003c/code\u003e. The option was previously silently dropped between the two layers, so it only took effect when set on the \u003ccode\u003ePyJWT\u003c/code\u003e instance. \u003cem\u003eThanks to \u003ca href=\"https://github.com/WLUB\"\u003e\u003ccode\u003e@​WLUB\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRFC 7797 §3 compliance for \u003ccode\u003eb64=false\u003c/code\u003e:\u003c/strong\u003e the encoder now auto-adds \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e to \u003ccode\u003ecrit\u003c/code\u003e, and the decoder rejects tokens that set \u003ccode\u003eb64=false\u003c/code\u003e without listing it in \u003ccode\u003ecrit\u003c/code\u003e. \u003cem\u003eThanks to \u003ca href=\"https://github.com/MachineLearning-Nerd\"\u003e\u003ccode\u003e@​MachineLearning-Nerd\u003c/code\u003e\u003c/a\u003e for the report.\u003c/em\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eChanged\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups, by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/pull/1152\"\u003e#1152\u003c/a\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2\u003eUpgrade notes\u003c/h2\u003e\n\u003cp\u003eMost fixes are invisible to correctly-configured callers. A few behavioral changes you may encounter:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eEmpty HMAC keys now raise.\u003c/strong\u003e If your app passed \u003ccode\u003e\u0026quot;\u0026quot;\u003c/code\u003e or \u003ccode\u003eb\u0026quot;\u0026quot;\u003c/code\u003e as a secret (often via a missing env var, e.g. \u003ccode\u003eos.getenv(\u0026quot;JWT_SECRET\u0026quot;, \u0026quot;\u0026quot;)\u003c/code\u003e), \u003ccode\u003eencode\u003c/code\u003e/\u003ccode\u003edecode\u003c/code\u003e will now raise \u003ccode\u003eInvalidKeyError\u003c/code\u003e. This is the intended behavior — fix the configuration.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWK\u003c/code\u003e decoding now requires the token's \u003ccode\u003ealg\u003c/code\u003e to match the JWK's algorithm.\u003c/strong\u003e Previously a mismatch was silently honored if the header \u003ccode\u003ealg\u003c/code\u003e appeared in the allow-list. Tokens that relied on this mismatch will now fail with \u003ccode\u003eInvalidAlgorithmError\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003ePyJWKClient\u003c/code\u003e now rejects non-HTTP(S) URIs at construction time.\u003c/strong\u003e Tests or dev environments that fetched JWKS from \u003ccode\u003efile://\u003c/code\u003e URIs need to switch to a local HTTP server or load the JWKS by other means (e.g. construct \u003ccode\u003ePyJWKSet.from_dict(...)\u003c/code\u003e directly).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eb64=false\u003c/code\u003e tokens are now strictly RFC 7515 / 7797 compliant.\u003c/strong\u003e Tokens with a non-empty compact-form payload segment, or that omit \u003ccode\u003e\u0026quot;b64\u0026quot;\u003c/code\u003e from \u003ccode\u003ecrit\u003c/code\u003e, will be rejected. PyJWT-produced tokens always satisfy both invariants, so round-trips through PyJWT are unaffected.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003e\u003ccode\u003eenforce_minimum_key_length\u003c/code\u003e set per-call now takes effect.\u003c/strong\u003e Callers who passed \u003ccode\u003eoptions={\u0026quot;enforce_minimum_key_length\u0026quot;: True}\u003c/code\u003e to \u003ccode\u003ejwt.decode()\u003c/code\u003e previously got no enforcement; they will now get \u003ccode\u003eInvalidKeyError\u003c/code\u003e on undersized keys, as documented.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull changelog:\u003c/strong\u003e \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\"\u003ehttps://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e2.12.1\u003c/h2\u003e\n\u003ch2\u003eWhat's Changed\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAdd typing_extensions dependency for Python \u0026lt; 3.11 by \u003ca href=\"https://github.com/jpadilla\"\u003e\u003ccode\u003e@​jpadilla\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/pull/1151\"\u003ejpadilla/pyjwt#1151\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eFull Changelog\u003c/strong\u003e: \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\"\u003ehttps://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003e2.12.0\u003c/h2\u003e\n\u003ch2\u003eSecurity\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eValidate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. by \u003ca href=\"https://github.com/dmbs335\"\u003e\u003ccode\u003e@​dmbs335\u003c/code\u003e\u003c/a\u003e in \u003ca href=\"https://github.com/jpadilla/pyjwt/security/advisories/GHSA-752w-5fwx-jx9f\"\u003eGHSA-752w-5fwx-jx9f\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/jpadilla/pyjwt/blob/master/CHANGELOG.rst\"\u003epyjwt's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003e\u003ccode\u003ev2.13.0 \u0026lt;https://github.com/jpadilla/pyjwt/compare/2.12.1...2.13.0\u0026gt;\u003c/code\u003e__\u003c/h2\u003e\n\u003cp\u003eSecurity\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject JWK JSON documents passed as raw HMAC secrets in\n  ``HMACAlgorithm.prepare_key`` to close an algorithm-confusion gap that\n  the existing PEM/SSH guard did not cover. Reported by @aradona91 in\n  `GHSA-xgmm-8j9v-c9wx \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-xgmm-8j9v-c9wx\u0026gt;`__.\n- Bind the JWT header ``alg`` to ``PyJWK.algorithm_name`` during\n  verification so the caller's ``algorithms=[...]`` allow-list cannot be\n  bypassed when decoding with a ``PyJWK`` / ``PyJWKClient`` key. Reported\n  by @sushi-gif in `GHSA-jq35-7prp-9v3f \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-jq35-7prp-9v3f\u0026gt;`__.\n- Reject non-``http(s)`` URI schemes in ``PyJWKClient`` so attacker-\n  influenced URIs cannot read local files or reach unintended schemes via\n  urllib's default ``file://`` / ``ftp://`` / ``data:`` handlers. Reported\n  by @KEIJOT in `GHSA-993g-76c3-p5m4 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-993g-76c3-p5m4\u0026gt;`__.\n- Preserve the cached JWK Set on fetch errors in ``PyJWKClient.fetch_data``.\n  The previous ``finally``-block ``put(None)`` pattern cleared the cache\n  on any transient outage, turning one bad JWKS request into application-\n  wide auth failure. Reported by @eddieran in `GHSA-fhv5-28vv-h8m8 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-fhv5-28vv-h8m8\u0026gt;`__.\n- Skip the unconditional base64 decode of the compact-form payload segment\n  when ``b64=false`` is set in the protected header, and require that\n  segment to be empty (RFC 7515 Appendix F detached form). Closes an\n  unauthenticated DoS amplifier. Reported by @thesmartshadow in\n  `GHSA-w7vc-732c-9m39 \u0026lt;https://github.com/jpadilla/pyjwt/security/advisories/GHSA-w7vc-732c-9m39\u0026gt;`__.\n\u003cp\u003eFixed\u003c/p\u003e\n\u003cpre\u003e\u003ccode\u003e\n- Reject empty HMAC keys outright in ``HMACAlgorithm.prepare_key`` with\n  ``InvalidKeyError`` instead of accepting them with only a warning.\n  Thanks to @SnailSploit and @spartan8806 for independently flagging the\n  footgun.\n- Forward per-call ``options`` (including ``enforce_minimum_key_length``)\n  from ``PyJWT.decode`` through to ``PyJWS._verify_signature`` so the\n  option actually takes effect when set at the call site rather than only\n  on the ``PyJWT`` instance. Thanks to @WLUB for the report.\n- RFC 7797 §3 compliance for ``b64=false``: the encoder now auto-adds\n  ``\u0026amp;quot;b64\u0026amp;quot;`` to the ``crit`` header parameter, and the decoder rejects\n  tokens that set ``b64=false`` without listing it in ``crit``. Thanks to\n  @MachineLearning-Nerd for the report.\n\nChanged\n\u003c/code\u003e\u003c/pre\u003e\n\u003cul\u003e\n\u003cli\u003eMigrate the \u003ccode\u003edev\u003c/code\u003e, \u003ccode\u003edocs\u003c/code\u003e, and \u003ccode\u003etests\u003c/code\u003e package extras to dependency groups by \u003ca href=\"https://github.com/kurtmckee\"\u003e\u003ccode\u003e@​kurtmckee\u003c/code\u003e\u003c/a\u003e in \u003ccode\u003e[#1152](https://github.com/jpadilla/pyjwt/issues/1152) \u0026amp;lt;https://github.com/jpadilla/pyjwt/pull/1152\u0026amp;gt;\u003c/code\u003e__\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ccode\u003ev2.12.1 \u0026amp;lt;https://github.com/jpadilla/pyjwt/compare/2.12.0...2.12.1\u0026amp;gt;\u003c/code\u003e__\n\u0026lt;/tr\u0026gt;\u0026lt;/table\u0026gt;\n\u003c/code\u003e\u003c/pre\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/7144e4534c34810f4525dc4578a32addd8212cff\"\u003e\u003ccode\u003e7144e45\u003c/code\u003e\u003c/a\u003e Apply ruff format\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/d2f4bec4963897c0ef96ef64a875894f2c8542ab\"\u003e\u003ccode\u003ed2f4bec\u003c/code\u003e\u003c/a\u003e Restore \u003ccode\u003ecast()\u003c/code\u003e calls with cross-version \u003ccode\u003etype: ignore\u003c/code\u003e for \u003ccode\u003eprepare_key\u003c/code\u003e\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/22f478cebddd8294259c30f037ecb92b0b348774\"\u003e\u003ccode\u003e22f478c\u003c/code\u003e\u003c/a\u003e Remove redundant casts in \u003ccode\u003eRSAAlgorithm.prepare_key\u003c/code\u003e and `ECAlgorithm.prepare...\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/95791b1759b8aa4f2203575d344d5c78564cdc81\"\u003e\u003ccode\u003e95791b1\u003c/code\u003e\u003c/a\u003e Bundle security fixes and hardening into 2.13.0\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/dcc27a9d3182a2349c30b160758785c6ce7a6508\"\u003e\u003ccode\u003edcc27a9\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1155\"\u003e#1155\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/9d08a9a1896845ed8eaf88e6f6ac61e5800c3e7a\"\u003e\u003ccode\u003e9d08a9a\u003c/code\u003e\u003c/a\u003e [pre-commit.ci] pre-commit autoupdate (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1146\"\u003e#1146\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/b87c10014d4109f0214fea188d00faaaf8a80e64\"\u003e\u003ccode\u003eb87c100\u003c/code\u003e\u003c/a\u003e Bump codecov/codecov-action from 5 to 6 (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1154\"\u003e#1154\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/40e3147eb5f790d8d041772e5fc00728a176c812\"\u003e\u003ccode\u003e40e3147\u003c/code\u003e\u003c/a\u003e Migrate development extras to dependency groups (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1152\"\u003e#1152\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/a4e1a3d1218b01c5806420b8f16d9308ac4adc30\"\u003e\u003ccode\u003ea4e1a3d\u003c/code\u003e\u003c/a\u003e Add typing_extensions dependency for Python \u0026lt; 3.11 (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1151\"\u003e#1151\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/jpadilla/pyjwt/commit/bd9700cca7f9258fadcc429c1034e508025931f2\"\u003e\u003ccode\u003ebd9700c\u003c/code\u003e\u003c/a\u003e Use PyJWK algorithm when encoding without explicit algorithm (\u003ca href=\"https://redirect.github.com/jpadilla/pyjwt/issues/1148\"\u003e#1148\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/jpadilla/pyjwt/compare/2.10.1...2.13.0\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\nUpdates `pypdf` from 6.10.2 to 6.12.0\n\u003cdetails\u003e\n\u003csummary\u003eRelease notes\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/py-pdf/pypdf/releases\"\u003epypdf's releases\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.12.0, 2026-05-21\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDisallow cross-reference streams with zero-only width values (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3791\"\u003e#3791\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAvoid excessive whitespace in layout mode text extraction (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3790\"\u003e#3790\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImplement SASLprep (RFC 4013) for AES-256 password normalization (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3780\"\u003e#3780\u003c/a\u003e) by \u003ca href=\"https://github.com/adityamoolya\"\u003e\u003ccode\u003e@​adityamoolya\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eCID font resource from font file to encode more characters (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3652\"\u003e#3652\u003c/a\u003e) by \u003ca href=\"https://github.com/PJBrs\"\u003e\u003ccode\u003e@​PJBrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance Improvements (PI)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eOptimize retrieval of named destinatinos in reader (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3442\"\u003e#3442\u003c/a\u003e) by \u003ca href=\"https://github.com/larsga\"\u003e\u003ccode\u003e@​larsga\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes (BUG)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix TreeObject.insert_child KeyError on fresh children (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3786\"\u003e#3786\u003c/a\u003e) by \u003ca href=\"https://github.com/Abzaek\"\u003e\u003ccode\u003e@​Abzaek\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAppearanceStream: Also honor user-set font name when not flattening annotations (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3781\"\u003e#3781\u003c/a\u003e) by \u003ca href=\"https://github.com/PJBrs\"\u003e\u003ccode\u003e@​PJBrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation (DOC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBlock encrypting writer in incremental mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3789\"\u003e#3789\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.11.0...6.12.0\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003ch2\u003eVersion 6.11.0, 2026-05-09\u003c/h2\u003e\n\u003ch2\u003eWhat's new\u003c/h2\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eInitialise a Font from an embedded font file (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3704\"\u003e#3704\u003c/a\u003e) by \u003ca href=\"https://github.com/PJBrs\"\u003e\u003ccode\u003e@​PJBrs\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAllow to fix AES padding length in non-strict mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3742\"\u003e#3742\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDeveloper Experience (DEV)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eEnable PyPy testing again (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3752\"\u003e#3752\u003c/a\u003e) by \u003ca href=\"https://github.com/stefan6419846\"\u003e\u003ccode\u003e@​stefan6419846\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003cli\u003eAlign mypy Makefile target with strict mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3690\"\u003e#3690\u003c/a\u003e) by \u003ca href=\"https://github.com/costajohnt\"\u003e\u003ccode\u003e@​costajohnt\u003c/code\u003e\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.10.2...6.11.0\"\u003eFull Changelog\u003c/a\u003e\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/py-pdf/pypdf/blob/main/CHANGELOG.md\"\u003epypdf's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch2\u003eVersion 6.12.0, 2026-05-21\u003c/h2\u003e\n\u003ch3\u003eSecurity (SEC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eDisallow cross-reference streams with zero-only width values (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3791\"\u003e#3791\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eAvoid excessive whitespace in layout mode text extraction (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3790\"\u003e#3790\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eNew Features (ENH)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eImplement SASLprep (RFC 4013) for AES-256 password normalization (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3780\"\u003e#3780\u003c/a\u003e)\u003c/li\u003e\n\u003cli\u003eCID font resource from font file to encode more characters (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3652\"\u003e#3652\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003ePerformance Improvements (PI)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eOptimize retrieval of named destinatinos in reader (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3442\"\u003e#3442\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eBug Fixes (BUG)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eFix TreeObject.insert_child KeyError on fresh children (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3786\"\u003e#3786\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eRobustness (ROB)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eAppearanceStream: Also honor user-set font name when not flattening annotations (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3781\"\u003e#3781\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3\u003eDocumentation (DOC)\u003c/h3\u003e\n\u003cul\u003e\n\u003cli\u003eBlock encrypting writer in incremental mode (\u003ca href=\"https://redirect.github.com/py-pdf/pypdf/issues/3789\"\u003e#3789\u003c/a\u003e)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003ca href=\"https://github.com/py-pdf/pypdf/compare/6.11.0...6...\n\n_Description has been truncated_","html_url":"https://github.com/HarleyCoops/Qwen3-RailroadEngineer1959-RL/pull/31","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/HarleyCoops%2FQwen3-RailroadEngineer1959-RL/issues/31","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/31/packages"}},{"old_version":"6.5.6","new_version":"6.5.7","update_type":"patch","path":null,"pr_created_at":"2026-06-15T21:36:45.000Z","version_change":"6.5.6 → 6.5.7","issue":{"uuid":"4669093683","node_id":"PR_kwDOK45rdc7mvloO","number":2010,"state":"closed","title":"MAINT: Bump tornado from 6.5.6 to 6.5.7","user":"dependabot[bot]","labels":["dependencies","python:uv"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-17T01:06:29.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-15T21:36:45.000Z","updated_at":"2026-06-17T01:06:31.000Z","time_to_close":98984,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"MAINT: Bump","packages":[{"name":"tornado","old_version":"6.5.6","new_version":"6.5.7","repository_url":"https://github.com/tornadoweb/tornado"}],"path":null,"ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.6 to 6.5.7.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/48fc2d43d1f48b8b3b0be5dcf6a7634c6f45b1c4\"\u003e\u003ccode\u003e48fc2d4\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3633\"\u003e#3633\u003c/a\u003e from bdarnell/curl-reset-65\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/4ae1ddd14245e56e9fb6fb14d4b9508301fbb841\"\u003e\u003ccode\u003e4ae1ddd\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.7\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/3154caabc9a60cb0b6953d28877b2785fbd3ab43\"\u003e\u003ccode\u003e3154caa\u003c/code\u003e\u003c/a\u003e curl_httpclient: Reset the curl object before putting it on the freelist\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/7d869c0739b264797ef92b6aa4a80c54b5993ea2\"\u003e\u003ccode\u003e7d869c0\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3631\"\u003e#3631\u003c/a\u003e from bdarnell/cve-links\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/288241f6812bb7204984573e55de21d17af951f3\"\u003e\u003ccode\u003e288241f\u003c/code\u003e\u003c/a\u003e docs: Use the correct link syntax\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/8da981c0f614f63d9d3b2cd5017db2b40e5642f6\"\u003e\u003ccode\u003e8da981c\u003c/code\u003e\u003c/a\u003e docs: Add CVE links to 6.5.6 release notes\u003c/li\u003e\n\u003cli\u003eSee full diff in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.6...v6.5.7\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=uv\u0026previous-version=6.5.6\u0026new-version=6.5.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/microsoft/PyRIT/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/microsoft/PyRIT/pull/2010","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/microsoft%2FPyRIT/issues/2010","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/2010/packages"}},{"old_version":"6.5.5","new_version":"6.5.6","update_type":"patch","path":"/workshops/Building_Generative_AI_applications/notebooks/app","pr_created_at":"2026-06-15T16:15:39.000Z","version_change":"6.5.5 → 6.5.6","issue":{"uuid":"4666863201","node_id":"PR_kwDOMdpTR87moIlq","number":318,"state":"closed","title":"Bump tornado from 6.5.5 to 6.5.6 in /workshops/Building_Generative_AI_applications/notebooks/app","user":"dependabot[bot]","labels":["dependencies","python"],"assignees":[],"locked":false,"comments_count":1,"pull_request":true,"closed_at":"2026-06-17T01:11:47.000Z","author_association":null,"state_reason":null,"created_at":"2026-06-15T16:15:39.000Z","updated_at":"2026-06-17T01:11:49.000Z","time_to_close":118568,"merged_at":null,"merged_by":null,"closed_by":null,"dependency_metadata":{"prefix":"Bump","packages":[{"name":"tornado","old_version":"6.5.5","new_version":"6.5.6","repository_url":"https://github.com/tornadoweb/tornado"}],"path":"/workshops/Building_Generative_AI_applications/notebooks/app","ecosystem":"pip"},"body":"Bumps [tornado](https://github.com/tornadoweb/tornado) from 6.5.5 to 6.5.6.\n\u003cdetails\u003e\n\u003csummary\u003eChangelog\u003c/summary\u003e\n\u003cp\u003e\u003cem\u003eSourced from \u003ca href=\"https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst\"\u003etornado's changelog\u003c/a\u003e.\u003c/em\u003e\u003c/p\u003e\n\u003cblockquote\u003e\n\u003ch1\u003eRelease notes\u003c/h1\u003e\n\u003cp\u003e.. toctree::\n:maxdepth: 2\u003c/p\u003e\n\u003cp\u003ereleases/v6.5.7\nreleases/v6.5.6\nreleases/v6.5.5\nreleases/v6.5.4\nreleases/v6.5.3\nreleases/v6.5.2\nreleases/v6.5.1\nreleases/v6.5.0\nreleases/v6.4.2\nreleases/v6.4.1\nreleases/v6.4.0\nreleases/v6.3.3\nreleases/v6.3.2\nreleases/v6.3.1\nreleases/v6.3.0\nreleases/v6.2.0\nreleases/v6.1.0\nreleases/v6.0.4\nreleases/v6.0.3\nreleases/v6.0.2\nreleases/v6.0.1\nreleases/v6.0.0\nreleases/v5.1.1\nreleases/v5.1.0\nreleases/v5.0.2\nreleases/v5.0.1\nreleases/v5.0.0\nreleases/v4.5.3\nreleases/v4.5.2\nreleases/v4.5.1\nreleases/v4.5.0\nreleases/v4.4.3\nreleases/v4.4.2\nreleases/v4.4.1\nreleases/v4.4.0\nreleases/v4.3.0\nreleases/v4.2.1\nreleases/v4.2.0\nreleases/v4.1.0\nreleases/v4.0.2\nreleases/v4.0.1\nreleases/v4.0.0\nreleases/v3.2.2\nreleases/v3.2.1\u003c/p\u003e\n\u003c!-- raw HTML omitted --\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e... (truncated)\u003c/p\u003e\n\u003c/details\u003e\n\u003cdetails\u003e\n\u003csummary\u003eCommits\u003c/summary\u003e\n\u003cul\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751\"\u003e\u003ccode\u003eaba2569\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3626\"\u003e#3626\u003c/a\u003e from bdarnell/fixes-656\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a24b260e0d22fd48acea1a2635526c1700e7ac09\"\u003e\u003ccode\u003ea24b260\u003c/code\u003e\u003c/a\u003e httpclient_test: Accept an additional error message variant\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/a74240a70268fe5cb40a127951cb21549ab9ff24\"\u003e\u003ccode\u003ea74240a\u003c/code\u003e\u003c/a\u003e Release notes and version bump for 6.5.6.\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/e8fc7edb238f1022e39f9d0b9d297fc7c21fb0a5\"\u003e\u003ccode\u003ee8fc7ed\u003c/code\u003e\u003c/a\u003e simple_httpclient: Strip auth headers on cross-origin redirects\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/96dc88c2a05705287856b2cd6b4b4034f9a6aaac\"\u003e\u003ccode\u003e96dc88c\u003c/code\u003e\u003c/a\u003e speedups: validate mask length\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/ff808b33adc52d89a549376a5e3628e92abbc8ff\"\u003e\u003ccode\u003eff808b3\u003c/code\u003e\u003c/a\u003e http1connection: Enforce max_body_size in _GzipMessageDelegate\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/ede4e37f93c1edbc0bf749e9a57c9db2501cd54b\"\u003e\u003ccode\u003eede4e37\u003c/code\u003e\u003c/a\u003e auth: Correctly parse check_authentication response\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/1c178bef88bbd29907eb94a2a649a4a6675681de\"\u003e\u003ccode\u003e1c178be\u003c/code\u003e\u003c/a\u003e Remove obsolete curl force_timeout workaround\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/c99d55bb6cc0c9da2c6696545ed4ee1d20b7fcf0\"\u003e\u003ccode\u003ec99d55b\u003c/code\u003e\u003c/a\u003e Replace deprecated pycurl IOCTLFUNCTION callback with SEEKFUNCTION\u003c/li\u003e\n\u003cli\u003e\u003ca href=\"https://github.com/tornadoweb/tornado/commit/27614316ef8ad125fe18725cf96e384560ba0e14\"\u003e\u003ccode\u003e2761431\u003c/code\u003e\u003c/a\u003e Merge pull request \u003ca href=\"https://redirect.github.com/tornadoweb/tornado/issues/3587\"\u003e#3587\u003c/a\u003e from bdarnell/fix-link\u003c/li\u003e\n\u003cli\u003eAdditional commits viewable in \u003ca href=\"https://github.com/tornadoweb/tornado/compare/v6.5.5...v6.5.6\"\u003ecompare view\u003c/a\u003e\u003c/li\u003e\n\u003c/ul\u003e\n\u003c/details\u003e\n\u003cbr /\u003e\n\n\n[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tornado\u0026package-manager=pip\u0026previous-version=6.5.5\u0026new-version=6.5.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)\n\nDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.\n\n[//]: # (dependabot-automerge-start)\n[//]: # (dependabot-automerge-end)\n\n---\n\n\u003cdetails\u003e\n\u003csummary\u003eDependabot commands and options\u003c/summary\u003e\n\u003cbr /\u003e\n\nYou can trigger Dependabot actions by commenting on this PR:\n- `@dependabot rebase` will rebase this PR\n- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it\n- `@dependabot show \u003cdependency name\u003e ignore conditions` will show all of the ignore conditions of the specified dependency\n- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)\n- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)\nYou can disable automated security fix PRs for this repo from the [Security Alerts page](https://github.com/aws-samples/amazon-neptune-generative-ai-samples/network/alerts).\n\n\u003c/details\u003e","html_url":"https://github.com/aws-samples/amazon-neptune-generative-ai-samples/pull/318","url":"https://dependabot.ecosyste.ms/api/v1/hosts/GitHub/repositories/aws-samples%2Famazon-neptune-generative-ai-samples/issues/318","packages_url":"https://dependabot.ecosyste.ms/api/v1/issues/318/packages"}}]}