Repository navigation
Update all non-major dependencies - #1587
Merged
Merged
Conversation
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
28 times, most recently
from
September 10, 2026 01:16
12706b3 to
dcc527b
Compare
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 11, 2026 15:29
dcc527b to
9725c70
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
9 times, most recently
from
September 24, 2026 05:06
8ee82a3 to
4f1ee4a
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
13 times, most recently
from
September 30, 2026 16:07
8280178 to
d71dd9f
Compare
This was referenced Sep 30, 2026
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 30, 2026 17:00
d71dd9f to
d1398bf
Compare
renovate
Bot
force-pushed
the
renovate/all-minor-patch
branch
from
September 30, 2026 17:44
d1398bf to
47710c6
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.7.9→5.7.465.7.47==5.2.16→==5.2.17==65.18.0→==65.19.465.19.5==0.15.0→==0.15.1==2.9.0→==2.9.1==7.0.0→==7.1.1==0.51.1→==0.52.1==0.19.0→==0.20.0==0.19.0→==0.20.0==3.18.0→==3.18.1==9.4.1→==9.5.19.4.4→9.5.29.5.39.4.4→9.5.29.5.3==0.23.0→==0.23.2==26.0.0→==26.2.0==1.31.0→==1.32.4==9.16.0→==9.17.1==2.5.1→==2.5.3==3.11.9→==3.12.0==3.0.5→==3.0.6==3.3.4→==3.3.6==2.13.4→==2.13.5==2.66.1→==2.70.02.71.0Release Notes
saadeghi/daisyui (daisyui)
v5.7.46Compare Source
Bug Fixes
v5.7.45Compare Source
Bug Fixes
v5.7.44Compare Source
Bug Fixes
v5.7.43Compare Source
Bug Fixes
v5.7.42Compare Source
Bug Fixes
v5.7.41Compare Source
Bug Fixes
v5.7.40Compare Source
Bug Fixes
v5.7.39Compare Source
Bug Fixes
v5.7.38Compare Source
Bug Fixes
dock(#4753) (fe22841)v5.7.37Compare Source
Bug Fixes
v5.7.36Compare Source
Bug Fixes
v5.7.35Compare Source
Bug Fixes
v5.7.34Compare Source
Bug Fixes
v5.7.33Compare Source
Bug Fixes
v5.7.32Compare Source
Bug Fixes
v5.7.28Compare Source
Bug Fixes
v5.7.27Compare Source
Bug Fixes
v5.7.26Compare Source
Bug Fixes
v5.7.25Compare Source
Bug Fixes
v5.7.24Compare Source
Bug Fixes
v5.7.23Compare Source
Bug Fixes
v5.7.22Compare Source
Bug Fixes
v5.7.21Compare Source
Bug Fixes
fab-floweractions (#4683) (e4e6419)v5.7.20Compare Source
Bug Fixes
v5.7.19Compare Source
Bug Fixes
v5.7.18Compare Source
Bug Fixes
v5.7.17Compare Source
Bug Fixes
v5.7.16Compare Source
Bug Fixes
v5.7.15Compare Source
Bug Fixes
v5.7.14Compare Source
Bug Fixes
v5.7.13Compare Source
Bug Fixes
v5.7.12Compare Source
Bug Fixes
v5.7.11Compare Source
Bug Fixes
v5.7.10Compare Source
Bug Fixes
django/django (django)
v5.2.17Compare Source
allauth/django-allauth (django-allauth)
v65.19.4Compare Source
v65.19.3Compare Source
v65.19.2Compare Source
v65.19.1Compare Source
v65.19.0Compare Source
kitware-resonant/django-auth-style (django-auth-style)
v0.15.1Compare Source
noripyt/django-cachalot (django-cachalot)
v2.9.1Compare Source
django-commons/django-debug-toolbar (django-debug-toolbar)
v7.1.1Compare Source
Changelog
What's Changed
Full Changelog: django-commons/django-debug-toolbar@7.1.0...7.1.1
v7.1.0Compare Source
Changelog
django.tasks, Django 6.0+). On older versions of Django, the panel explains that upgrading is required.show_toolbar_with_dockeron Docker runtimes such as OrbStack that can resolvehost.docker.internalto an address outside the container network.What's Changed
New Contributors
Full Changelog: django-commons/django-debug-toolbar@7.0.0...7.1.0
kitware-resonant/cookiecutter-resonant (django-resonant-settings)
v0.52.1Compare Source
Cookiecutter Changes
v0.52.0Compare Source
Cookiecutter Changes
HEROKU_APPenv var, for use by Heroku CLInodefeature to resolve a bugterraform-heroku-resonantdjango-resonant-settingsChangesAUTHENTICATION_BACKENDSsettingcreatesuperuseremail verificationkitware-resonant/django-resonant-utils (django-resonant-utils)
v0.20.0Compare Source
django-oauth-toolkit+django-ninjaintegrationdjango-oauth-toolkit.SelectRelatedManagerFullNameSignupFormencode/django-rest-framework (djangorestframework)
v3.18.1Compare Source
What's Changed
Bug fixes
IntegerFieldminimums in OpenAPI schema definition by @zainnadeem786 in #9989Other changes
ListSerializererror formats by @Kub-AT in #10027New Contributors
Full Changelog: encode/django-rest-framework@3.18.0...3.18.1
elastic/elasticsearch-py (elasticsearch)
v9.5.1Compare Source
Changelog
v9.5.0Compare Source
Changelog
elastic/dockerfiles (elasticsearch)
v9.5.2Compare Source
v9.5.1Compare Source
v9.4.6Compare Source
v9.4.5Compare Source
googleapis/google-cloud-python (google-analytics-data)
v0.23.2: google-analytics-data: v0.23.2Compare Source
Features
v0.23.1: google-analytics-data: v0.23.1Compare Source
Features
benoitc/gunicorn (gunicorn)
v26.2.0: gunicorn 26.2.0Compare Source
Cleartext HTTP/2 lands, and an HTTP/2 security fix.
Cleartext HTTP/2 (h2c)
http2_cleartextacceptsprior-knowledge,upgrade,bothoroff(thedefault). Prior knowledge serves a connection that opens with the HTTP/2
preface;
upgradehonours an HTTP/1.1Upgrade: h2crequest. Both work on thegthread, gevent and asgi workers.
This is for deployments where TLS is terminated by a proxy that speaks HTTP/2
upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in
forwarded_allow_ipsare considered; everyone else is served HTTP/1.x exactlyas if the setting were off. Each mechanism is enabled separately, so turning one
on does not turn the other on.
Do not expose a cleartext HTTP/2 port to the internet.
Security
HTTP2Requestbuilt its headers straight from the stream, so nothing the HTTP/1path enforces applied over HTTP/2: the underscore and
header_mappolicy,duplicate
HostandContent-Type, control characters in values, and theforwarded_allow_ipstrust gate. An untrusted client could setSCRIPT_NAMEand forge
HTTP_*entries in the WSGI environ, and decidewsgi.url_schemethrough
:scheme. Both request classes now share one policy mixin, and thescheme comes from the transport.
If you serve HTTP/2, this is the reason to upgrade.
Other HTTP/2 fixes
WSGI responses were buffered whole before anything was sent; they stream now.
HEAD, 204 and 304 no longer carry a body. Events read while blocked on a
flow-control window were discarded, losing requests and body data outright.
sendfile()is refused on HTTP/2 responses rather than bypassing framing.Request bodies dropped on Upgrade requests
On the ASGI worker with the fast parser, any request carrying an
Upgradeheader reached the application with an empty body, whatever the header's value
and with HTTP/2 switched off entirely. Fixed in
gunicorn_h1c0.6.9, which thefastextra now requires.Full changelog: https://gunicorn.org/news/
v26.1.0: gunicorn 26.1.0Compare Source
New Features
reload_extra_files: entries containing*,?or[are treated as patterns, so
ui/*/config.jsonwatches every view's configwithout listing them one by one. Patterns are re-expanded on every reload
check rather than once at startup, so a file created later starts being
watched without restarting gunicorn, and
**recurses. A pattern matchingnothing warns instead of failing, since with live expansion it may match later
(#1643,
#3662).
Security
checked against the advisory database.
tornado,h2,setuptoolsandpymdown-extensionspermitted vulnerable versions and now require the firstclean release;
pytestandhttpxwere unpinned and now carry floors. Thetornadoexample pinnedtornado<6, which was both the source of severaladvisories and older than the
>=6.5.0the tornado worker needs, so theexample could not run as pinned.
Bug Fixes
SIGHUP did not reload the logger configuration:
Arbiter.reload()re-read the configuration file but kept using the logger built at startup,
calling only
reopen_files()on its existing handlers. Changes tologconfig,logconfig_dict,logconfig_jsonandloglevelwere ignoreduntil a full restart, which in containers meant replacing the pod. The
existing logger now re-runs its setup on reload, so new handlers, formats
and levels take effect while the process identity and its listeners are
preserved, and re-running the setup no longer stacks duplicate syslog
handlers. An invalid log configuration on reload is not fatal either: the
error is reported on stderr, the previous working configuration is restored
and the master keeps running with it
(#3353).
Truncated chunked bodies accepted: RFC 9112 section 7.1.2 ends a chunked
body with
0 CRLF CRLF, the second CRLF being the mandatory empty trailersection.
ChunkedReader.parse_chunk_size()swallowed theNoMoreDataraisedwhile scanning for it, so a body cut short right after the last chunk line was
treated as complete instead of rejected. It now raises
ChunkMissingTerminator(#3382,
#3685).
--spewcrashed on dynamically generated code: the trace hook indexed the2-tuple returned by
inspect.getsourcelines()by line number rather thanindexing the list of lines, so a frame with no
__file__raisedAttributeError: 'int' object has no attribute 'rstrip'on line 1 andIndexErrorbeyond it. The tuple is now unpacked and offset by the source'sstarting line (#3344,
#3495).
Duplicate
HostandContent-Typeheaders accepted: RFC 9110 section 5.3allows only one of each, and a repeat cannot be merged into a list, so the
message means different things to gunicorn and to anything downstream. Both
are now rejected with
InvalidHeader. The check lives in the policy hookshared by both parsers, so the pure-Python and fast parsers agree. Duplicate
Content-Lengthwas already rejected and is unchanged(#3366,
#3548).
Non-worker children reported as failed workers:
reap_workers()reapsevery child through
waitpid(-1), including processes the kernel reparentedonto gunicorn when it runs as PID 1 in a container, but it logged the exit
status before checking whether the pid was ever a worker. An unrelated process
produced
Worker (pid:N) exited with code Mand triggered alerts. Moreseriously, such a process exiting with code 3 or 4 raised
HaltServerand shutthe server down. Ownership is now established first: the dirty arbiter is
reported as itself, unknown children are reaped silently at debug level, and
only real workers can halt the server
(#3220,
#3566).
Dirty arbiter exits were invisible on SIGCHLD:
handle_chld()calledreap_workers()first, whosewaitpid(-1)claimed the dirty arbiter beforereap_dirty_arbiter()could identify it, so the latter always hitECHILDandits reporting never ran. The dirty arbiter is now reaped first, and
reap_workers()recognises it if it exits mid-loop.Dirty arbiter returned stale responses after a worker timeout: when a
request reached
dirty_timeoutthe arbiter answered the client with a timeouterror but kept the worker connection open. The worker's late response was then
the first message waiting on that socket, so the next request routed to the
same worker received the previous request's result, and every request after it
stayed one response behind. The connection is now closed on timeout, so the
late answer is discarded with it
(#3626).
ASGI connection count leaked on server-initiated close:
nr_connswasonly decremented in
connection_lost(), behind a guard keyed on the sameflag
_close_transport()sets first. Every close the server started (aConnection: closeresponse, a keepalive timeout, an error abort) leaked onecount, so
ASGIWorker._shutdown()ran the fullgraceful_timeoutand warnedabout connections that were already gone. The guard now uses its own flag, so
the decrement and the rest of the cleanup run exactly once whichever side
closes first (#3661).
Inotify reloader on cwd-relative extra files:
reload_extra_filesentrieswith no directory part (for example
.env) produced an empty dirname, andwatching it raised
InotifyErrorwithENOENT. The current directory is nowwatched as
.(#3377,#3667).
StatsD zero-valued metrics: gauges, counters, histograms and timers
reporting
0were silently dropped because the value was tested fortruthiness. Only
Noneis skipped now(#3676).
Spurious no-body warning from
sendfile(): a HEAD, 204 or 304 responseserved through
sendfile()warned about dropped body bytes even when thefile was empty and nothing was dropped. It now warns only when there are
bytes to drop, matching
write()(#3684).
Bare
exceptin the gevent websocket example: narrowed toexcept Exception(#3683).ASGI
receive()cancellation: Letasyncio.CancelledErrorpropagatefrom
BodyReceiverinstead of swallowing it and returninghttp.disconnect. Frameworks that cancel their disconnect listener afterthe response completes (Django) no longer see the cancel masked, so
request_finishedfires andclose_old_connections()runs. Fixes idledatabase connections leaking since 25.1.0
(#3627,
#3654).
Control socket leak on SIGHUP reload: The control thread is now marked
ready once its loop and server are live, and the stop paths wait on that
readiness before scheduling shutdown. Reloads no longer leak one thread and
its selector fd plus unix socket per worker, which eventually raised
"too many open files"
(#3648).
WSGI body framing on HEAD/1xx/204/304: Mirror the ASGI strip-and-warn
behavior on the WSGI path.
Content-Lengthis stripped on 1xx/204 perRFC 9110 section 6.4.2, body bytes are dropped for no-body responses in
both
write()andsendfile(), and a single warning is logged per request(#3413).
Refactoring
termination message in
Arbiter.reap_workers()(#3678).
Changes
packagingis no longer a runtime dependency: it was only ever imported bythe gevent worker, to compare gevent's version. It moved to the
geventandtestingextras, so a plainpip install gunicornpulls in nothing(#3643).
Fast HTTP Parser: Require
gunicorn_h1c >= 0.6.6, which rejects duplicateHostandContent-Typeheaders in the C parser itself. Gunicorn alreadyrefuses them on both the WSGI and ASGI paths, so this changes nothing that is
reachable; it moves the rejection to where the bytes are read and lets the
ASGI corpus exercise those cases against the fast parser directly.
Full changelog: https://gunicorn.org/2026-news/
pypa/hatch (hatchling)
v1.32.4: Hatchling v1.32.4Compare Source
Fixed:
BuildHookInterfacein 1.32.3, which broke plugins that subscripted the interface with a single argument (e.g.BuildHookInterface[MyConfig]) by raisingTypeErrorat import time.BuilderConfigis likewise no longer generic, restoring the pre-1.32.3 plugin interface.v1.32.3: Hatchling v1.32.3Fixed:
2026.08.10are no longer stripped of leading zeros. Distribution file names and.dist-infodirectories continue to use the PEP 440 normalized form.v1.32.0: Hatchling v1.32.0Compare Source
Changed:
Bump default core metadata version to 2.5
Add
tomlkitas a runtime dependency, which is required to rewritepyproject.tomlwhen setting a static versionAdded:
versioncommand can now set a version that is statically defined by theproject.versionfield, updatingpyproject.tomlin place. Pass--forceto allow an explicit downgradeFixed:
Allow the
; privateannotation onproject.import-namesandproject.import-namespacesentries rather than rejecting them as invalid import names.Reject
project.readmepaths that are absolute or resolve outside of the project directory.ipython/ipython (ipython)
v9.17.1Compare Source
v9.17.0Compare Source
v9.16.1Compare Source
numpy/numpy (numpy)
v2.5.3Compare Source
v2.5.2Compare Source
ijl/orjson (orjson)
v3.12.0Compare Source
Changed
manylinux_2_39(2024) is targeted instead ofmanylinux_2_17(2012).pandas-dev/pandas (pandas)
v3.0.6: pandas 3.0.6Compare Source
We are pleased to announce the release of pandas 3.0.6.
This is a patch release in the 3.0.x series and includes some regression fixes and bug fixes. We recommend that all users of the 3.0.x series upgrade to this version. This is also the first release to support Python 3.15.
See the full whatsnew for a list of all the changes.
Pandas 3.0 supports Python 3.11 and higher.
The release can be installed from PyPI:
Or from conda-forge
Please report any issues with the release on the pandas issue tracker.
Thanks to all the contributors who made this release possible.
psycopg/psycopg (psycopg)
v3.3.6Compare Source
v3.3.5Compare Source
pydantic/pydantic (pydantic)
v2.13.5Compare Source
getsentry/sentry-python (sentry-sdk)
v2.70.0Compare Source
New Features ✨
Configuration
📅 Schedule: (UTC)
* 0-3 1 * *)🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.