Skip to content

chore(deps): bump the python-dependencies group across 1 directory with 31 updates#687

Merged
TreyWW merged 2 commits into
mainfrom
dependabot/pip/python-dependencies-73ec17bf5b
Jul 16, 2026
Merged

chore(deps): bump the python-dependencies group across 1 directory with 31 updates#687
TreyWW merged 2 commits into
mainfrom
dependabot/pip/python-dependencies-73ec17bf5b

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 8, 2026

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 31 updates in the / directory:

Package From To
bleach 6.1.0 6.4.0
boto3 1.34.76 1.43.24
django-storages 1.14.2 1.14.6
pillow 12.1.1 12.2.0
django 5.2.12 5.2.15
django-webpack-loader 3.2.3 3.2.4
djangorestframework 3.16.1 3.17.1
mypy 1.18.2 1.19.1
djangorestframework-stubs 3.16.8 3.16.9
grpcio 1.78.0 1.81.0
typos 1.44.0 1.47.2
pulumi-aws 6.83.2 6.83.4
types-python-dateutil 2.9.0.20260305 2.9.0.20260518
types-markdown 3.10.2.20260211 3.10.2.20260518
types-pygments 2.19.0.20251121 2.20.0.20260518
types-psycopg2 2.9.21.20260223 2.9.21.20260518
types-pycurl 7.45.7.20251101 7.46.0.20260509
types-six 1.17.0.20251009 1.17.0.20260518
social-auth-app-django 5.6.0 5.9.0
django-environ 0.11.2 0.13.0
python-dateutil 2.9.0 2.9.0.post0
django-htmx 1.17.3 1.27.0
django-markdownify 0.9.3 0.9.7
model-bakery 1.17.0 1.23.4
mkdocs-material 9.7.4 9.7.6
mysqlclient 2.2.0 2.2.8
mariadb 1.1.8 1.1.14
psycopg2-binary 2.9.11 2.9.12
djlint 1.36.4 1.39.0
coverage 7.13.4 7.14.1
bump-my-version 0.19.3 0.33.0

Updates bleach from 6.1.0 to 6.4.0

Changelog

Sourced from bleach's changelog.

Version 6.4.0 (June 5th, 2026)

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

  • Dropped support for pypy 3.10. (#764)

Security fixes

  • Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

    Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.

    For example::

    import bleach payload1 = 'Click' result1 = bleach.clean(payload1) print(repr(result1))

    outputs::

    'Click'

    See the advisory for details.

  • Fix GHSA-gj48-438w-jh9v.

    Fix issue where URI sanitization wasn't happening in formaction attributes.

    See the advisory for details.

Bug fixes

  • Add support for pypy 3.11. (#764)

  • Drop version max in tinycss2 pin. (#772)

    This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.

Version 6.3.0 (October 27th, 2025)

... (truncated)

Commits
  • f0355a7 fix: fix last release date in CHANGES
  • ae4e8a2 chore: bleach 6.4.0 and final release
  • 970df58 fix: uri-sanitization in formaction attributes
  • 7c4867c fix: xss bypass in allowed protocol test using unicode invisible characters
  • 913ab75 fix: reduce redundancy in workflow jobs
  • 218c15a fix: rework pip caching
  • 4f0b097 fix: fix tox platform restrictions
  • e95a79d chore: update pytest
  • 91539d4 Bump actions/cache from 5.0.3 to 5.0.4
  • cd47b4c fix: handle left-angle-bracket that's not a tag (#733)
  • Additional commits viewable in compare view

Updates boto3 from 1.34.76 to 1.43.24

Commits
  • b2b302b Merge branch 'release-1.43.24'
  • 02fd3ca Bumping version to 1.43.24
  • fcaf9ff Add changelog entries from botocore
  • f2106e0 Merge branch 'release-1.43.23'
  • 5f98326 Merge branch 'release-1.43.23' into develop
  • d7e5b7c Bumping version to 1.43.23
  • 86efe86 Add changelog entries from botocore
  • 8384440 Merge branch 'release-1.43.22'
  • eea01a7 Merge branch 'release-1.43.22' into develop
  • eff8ee7 Bumping version to 1.43.22
  • Additional commits viewable in compare view

Updates django-storages from 1.14.2 to 1.14.6

Changelog

Sourced from django-storages's changelog.

1.14.6 (2025-04-01)


Google Cloud

  • Add option to sign URLs via IAM Blob API ([#1427](https://github.com/jschneier/django-storages/issues/1427)_)

S3

  • Fix exists calls when using SSE-C ([#1451](https://github.com/jschneier/django-storages/issues/1451)_)
  • Default url_protocol to https: if set to None ([#1483](https://github.com/jschneier/django-storages/issues/1483)_)

.. _#1427: jschneier/django-storages#1427 .. _#1451: jschneier/django-storages#1451 .. _#1483: jschneier/django-storages#1483

1.14.5 (2025-02-15)


General

  • Revert exists() behavior to pre-1.14.4 semantics with additional hardening for Django versions < 4.2 to fix CVE-2024-39330. This change matches the eventual behavior Django itself shipped with. ([#1484](https://github.com/jschneier/django-storages/issues/1484), [#1486](https://github.com/jschneier/django-storages/issues/1486))
  • Add support for Django 5.1 ([#1444](https://github.com/jschneier/django-storages/issues/1444)_)

Azure

  • Deprecated: The setting AZURE_API_VERSION/api_version setting is deprecated in favor of the new AZURE_CLIENT_OPTIONS setting. A future version will remove support for this setting.
  • Add AZURE_CLIENT_OPTIONS settings to enable customization of all BlobServiceClient parameters such as api_version and all retry* options. ([#1432](https://github.com/jschneier/django-storages/issues/1432)_)

Dropbox

  • As part of the above hardening fix a bug was uncovered whereby a root_path setting would be applied multiple times during save() ([#1484](https://github.com/jschneier/django-storages/issues/1484)_)
  • Fix setting OAuth2 access token via env var ([#1452](https://github.com/jschneier/django-storages/issues/1452)_)

FTP

  • Fix incorrect exists() results due to an errant appended slash ([#1438](https://github.com/jschneier/django-storages/issues/1438)_)

Google Cloud

... (truncated)

Commits

Updates pillow from 12.1.1 to 12.2.0

Release notes

Sourced from pillow's releases.

12.2.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.2.0.html

Documentation

Dependencies

Testing

Other changes

... (truncated)

Commits

Updates django from 5.2.12 to 5.2.15

Commits
  • 21e9840 [5.2.x] Bumped version for 5.2.15 release.
  • 9b62b0a [5.2.x] Fixed CVE-2026-48587 -- Ignored whitespace padding when checking Vary...
  • 050a3dc [5.2.x] Fixed CVE-2026-35193 -- Varied on Authorization when caching non-publ...
  • 366d9ae [5.2.x] Fixed CVE-2026-8404 -- Used Cache-Control directives case-insensitive...
  • 4e47d2b [5.2.x] Fixed CVE-2026-7666 -- Delayed setting SMTP connection until fully co...
  • 594360c [5.2.x] Fixed CVE-2026-6873 -- Prevented signed cookie salt namespace collisi...
  • e074d83 [5.2.x] Included commit hash in checksum file when building artifacts for rel...
  • c502754 [5.2.x] Updated links to severity levels in release notes.
  • 72f5b41 [5.2.x] Added stub release notes and release date for 5.2.15.
  • 7084825 [5.2.x] Refs #35844 -- Ran further selenium tests with --parallel=1.
  • Additional commits viewable in compare view

Updates django-webpack-loader from 3.2.3 to 3.2.4

Release notes

Sourced from django-webpack-loader's releases.

3.2.4

What's Changed

New Contributors

Full Changelog: django-webpack/django-webpack-loader@3.2.3...3.2.4

Changelog

Sourced from django-webpack-loader's changelog.

[3.2.4] -- 2026-05-13

  • Refactor get_as_url_to_tag_dict when dealing with extra arguments in elements
  • Fix skip_common_chunks usage at get_files to add parity with render_bundle (#431)
  • Add integrity and CSP nonce to preload script tags (#432)
  • Fix hanging or broken stats file (#430)
  • Handle issue when webpack stats change mid-request (#429)
  • Fix AttributeError in config check for non-dict WEBPACK_LOADER (#427)
Commits
  • 8bf16ad v3.2.4
  • cd16b8e Refactor get_as_url_to_tag_dict when dealing with extra arguments in the elem...
  • d445315 Use find_packages
  • cc4a74f Revert readme.rst on gitignore
  • fe833ae Fix skip_common_chunks usage at get_files to add parity with render_bundle #431
  • 895adc2 Add integrity and csp nonce to preload script tags #432
  • 60da34d Fix hanging or broken stats file #430
  • dc4e0a6 Handle issue when webpack stats change mid-request #429
  • 69f60ab Fix issue on setup.py #426
  • 6cdb146 test: cover invalid WEBPACK_LOADER type in config check
  • Additional commits viewable in compare view

Updates djangorestframework from 3.16.1 to 3.17.1

Release notes

Sourced from djangorestframework's releases.

3.17.1

What's Changed

Bug fixes

Full Changelog: encode/django-rest-framework@3.17.0...3.17.1

3.17.0

What's Changed

Breaking changes

Features

Bug fixes

Translations

Packaging

Other changes

New Contributors

... (truncated)

Commits
  • 22e231c Prepare bug fix release 3.17.1 (#9931)
  • 8e99b53 Add condition to skip pushed tags from forks (#9924)
  • c0407de Fix HTMLFormRenderer with empty datetime values (#9928)
  • 30d58a7 Fix the book sizing in the documentation (#9926)
  • 6f03b79 Tweak order of changes in release notes
  • 021ab56 Bump version and update release notes for 3.17.0 (#9921)
  • 19ebad7 Bump mkdocs-material[imaging] from 9.7.4 to 9.7.5 (#9923)
  • f222c55 Correct requires-python key in pyproject.toml
  • 7e7de6f Remove code fences from release checklist
  • c599d30 Update release process
  • Additional commits viewable in compare view

Updates mypy from 1.18.2 to 1.19.1

Changelog

Sourced from mypy's changelog.

Mypy 1.19.1

  • Fix noncommutative joins with bounded TypeVars (Shantanu, PR 20345)
  • Respect output format for cached runs by serializing raw errors in cache metas (Ivan Levkivskyi, PR 20372)
  • Allow types.NoneType in match cases (A5rocks, PR 20383)
  • Fix mypyc generator regression with empty tuple (BobTheBuidler, PR 20371)
  • Fix crash involving Unpack-ed TypeVarTuple (Shantanu, PR 20323)
  • Fix crash on star import of redefinition (Ivan Levkivskyi, PR 20333)
  • Fix crash on typevar with forward ref used in other module (Ivan Levkivskyi, PR 20334)
  • Fail with an explicit error on PyPy (Ivan Levkivskyi, PR 20389)

Acknowledgements

Thanks to all mypy contributors who contributed to this release:

  • A5rocks
  • BobTheBuidler
  • bzoracler
  • Chainfire
  • Christoph Tyralla
  • David Foster
  • Frank Dana
  • Guo Ci
  • iap
  • Ivan Levkivskyi
  • James Hilton-Balfe
  • jhance
  • Joren Hammudoglu
  • Jukka Lehtosalo
  • KarelKenens
  • Kevin Kannammalil
  • Marc Mueller
  • Michael Carlstrom
  • Michael J. Sullivan
  • Piotr Sawicki
  • Randolf Scholz
  • Shantanu
  • Sigve Sebastian Farstad
  • sobolevn
  • Stanislav Terliakov
  • Stephen Morton
  • Theodore Ando
  • Thiago J. Barbalho
  • wyattscarpenter

I’d also like to thank my employer, Dropbox, for supporting mypy development.

Mypy 1.18

We’ve just uploaded mypy 1.18.1 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance

... (truncated)

Commits

Updates djangorestframework-stubs from 3.16.8 to 3.16.9

Release notes

Sourced from djangorestframework-stubs's releases.

3.16.9

Versioning

  • This will be the last version to support django-stubs 5.2. But django-stubs 6.0 will mostly also work if you use older Django.
  • This will be the last version to target djangorestframework 3.16 -- the next version will be updating to 3.17.
  • Mypy 1.20 is now supported.

Help wanted!

👉 Your help is needed to update stubs for djangorestframework version 3.17!

What's Changed

Housekeeping

New Contributors

Full Changelog: typeddjango/djangorestframework-stubs@3.16.8...3.16.9

Commits

Updates grpcio from 1.78.0 to 1.81.0

Release notes

Sourced from grpcio's releases.

Release v1.81.0

This is release 1.81.0 (graphic) of gRPC Core.

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

  • [EventEngine] Fix a potential use-after-free error on Windows. (#42078)
  • [ssl] Server side handshaker factory stores a map of key signers. (#42002)
  • [Core] Fix completion queue shutdown race on weak memory models (ARM). (#41510)
  • [EventEngine] Fix a Windows race that causes an assertion error. (#41563)
  • [grpc_error] enable error_flatten experiment in OSS. (#41471)
  • [Python] Trim Python2 backward compatiblity syntax - removed (object) inheritance. (#41708)

Objective-C

  • [ObjC] Add receiveNextMessage to GRPCUnaryProtoCall. (#42260)

Python

  • [Python] Add typing_extensions dep to aio Bazel target. (#42001)
  • [Python] [Pyright] Part 1 - Pyright for src/python/grpcio/grpc/aio/_base_server.py. (#42240)
  • [Python] Drop 3.9. (#42145)
  • [Python] grpc-status: Relax protobuf dependency upper bound to allow 7.x. (#41948)
  • [Python] [Typeguard] Part 5 - Add Typeguard SYNC Stack in tests. (#40278)
  • [Python] Remove GIL from ReceiveMessageOperation.un_c method. (#41812)
  • [Python] Support observability in AsyncIO stack. (#41573)

Ruby

  • [Ruby] Drop support for EOL Ruby 3.1 and clean up. (#41435)
  • [Ruby] Composed CallCredentials keep a reference to their source. (#41782)

Release v1.81.0-pre1

This is a prerelease of gRPC Core 1.81.0 (graphic).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This prerelease contains refinements, improvements, and bug fixes.

Release v1.80.0

This is release 1.80.0 (glimmering) of gRPC Core.

... (truncated)

Commits
  • 8bdf11e [Release] Bump version to 1.81.0 (on v1.81.x branch) (#42432)
  • 0029e06 Move all gRPC Session classes to the experimental namespace (#42462)
  • 1f18268 [CI] Fix Asan thread_stress_test error by reducing thread count (#42424) (#42...
  • ee3fed7 Backport MacOS fix cl/917004588 to v1.81.x (#42441)
  • 6244f3b [Release] Bump version to 1.81.0-pre1 (on v1.81.x branch) (#42378)
  • 1108777 [Release] Bump core version to 54.0.0 for upcoming release (#42321)
  • 74940e8 [fix] Add back the do-while loop that handles the TSI_RESULT correctly.
  • 5c6185c [CHTTP2] Assert
  • 51bc437 Automated rollback of commit aab1eab78f9fcb3fc6e0aa9c8d7a59de280dbe3f.
  • 03a2dc7 [Cleanup] Reduce log noise in latent see.
  • Additional commits viewable in compare view

Updates typos from 1.44.0 to 1.47.2

Release notes

Sourced from typos's releases.

v1.47.2

[1.47.2] - 2026-06-04

Fixes

  • Don't correct inferrable
  • Correct unused inferible variant

v1.47.1

[1.47.1] - 2026-06-03

Fixes

  • Don't correct requestors

v1.47.0

[1.47.0] - 2026-05-29

Features

  • Updated the dictionary with the May 2026 changes

v1.46.3

[1.46.3] - 2026-05-23

Fixes

  • Don't correct to sequentials
  • Don't correct to subdolder

v1.46.2

[1.46.2] - 2026-05-16

Fixes

  • Don't correct to criterias
  • Don't correct to replaceables

v1.46.1

[1.46.1] - 2026-05-08

Fixes

  • Don't correct to confidentials

v1.46.0

[1.46.0] - 2026-04-30

Features

... (truncated)

Changelog

Sourced from typos's changelog.

[1.47.2] - 2026-06-04

Fixes

  • Don't correct inferrable
  • Correct unused inferible variant

[1.47.1] - 2026-06-03

Fixes

  • Don't correct requestors

[1.47.0] - 2026-05-29

Features

  • Updated the dictionary with the May 2026 changes

[1.46.3] - 2026-05-23

Fixes

  • Don't correct to sequentials
  • Don't correct to subdolder

[1.46.2] - 2026-05-16

Fixes

  • Don't correct to criterias
  • Don't correct to replaceables

[1.46.1] - 2026-05-08

Fixes

  • Don't correct to confidentials

[1.46.0] - 2026-04-30

Features

  • Updated the dictionary with the April 2026 changes

[1.45.2] - 2026-04-27

Fixes

  • Ignore ssh ed25519 public keys

... (truncated)

Commits

…th 31 updates

Bumps the python-dependencies group with 31 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [bleach](https://github.com/mozilla/bleach) | `6.1.0` | `6.4.0` |
| [boto3](https://github.com/boto/boto3) | `1.34.76` | `1.43.24` |
| [django-storages](https://github.com/jschneier/django-storages) | `1.14.2` | `1.14.6` |
| [pillow](https://github.com/python-pillow/Pillow) | `12.1.1` | `12.2.0` |
| [django](https://github.com/django/django) | `5.2.12` | `5.2.15` |
| [django-webpack-loader](https://github.com/django-webpack/django-webpack-loader) | `3.2.3` | `3.2.4` |
| [djangorestframework](https://github.com/encode/django-rest-framework) | `3.16.1` | `3.17.1` |
| [mypy](https://github.com/python/mypy) | `1.18.2` | `1.19.1` |
| [djangorestframework-stubs](https://github.com/typeddjango/djangorestframework-stubs) | `3.16.8` | `3.16.9` |
| [grpcio](https://github.com/grpc/grpc) | `1.78.0` | `1.81.0` |
| [typos](https://github.com/crate-ci/typos) | `1.44.0` | `1.47.2` |
| [pulumi-aws](https://github.com/pulumi/pulumi-aws) | `6.83.2` | `6.83.4` |
| [types-python-dateutil](https://github.com/python/typeshed) | `2.9.0.20260305` | `2.9.0.20260518` |
| [types-markdown](https://github.com/python/typeshed) | `3.10.2.20260211` | `3.10.2.20260518` |
| [types-pygments](https://github.com/python/typeshed) | `2.19.0.20251121` | `2.20.0.20260518` |
| [types-psycopg2](https://github.com/python/typeshed) | `2.9.21.20260223` | `2.9.21.20260518` |
| [types-pycurl](https://github.com/python/typeshed) | `7.45.7.20251101` | `7.46.0.20260509` |
| [types-six](https://github.com/python/typeshed) | `1.17.0.20251009` | `1.17.0.20260518` |
| [social-auth-app-django](https://github.com/python-social-auth/social-app-django) | `5.6.0` | `5.9.0` |
| [django-environ](https://github.com/joke2k/django-environ) | `0.11.2` | `0.13.0` |
| [python-dateutil](https://github.com/dateutil/dateutil) | `2.9.0` | `2.9.0.post0` |
| [django-htmx](https://github.com/adamchainz/django-htmx) | `1.17.3` | `1.27.0` |
| [django-markdownify](https://github.com/erwinmatijsen/django-markdownify) | `0.9.3` | `0.9.7` |
| [model-bakery](https://github.com/model-bakers/model_bakery) | `1.17.0` | `1.23.4` |
| [mkdocs-material](https://github.com/squidfunk/mkdocs-material) | `9.7.4` | `9.7.6` |
| [mysqlclient](https://github.com/PyMySQL/mysqlclient) | `2.2.0` | `2.2.8` |
| [mariadb](https://github.com/mariadb-corporation/mariadb-connector-python) | `1.1.8` | `1.1.14` |
| [psycopg2-binary](https://github.com/psycopg/psycopg2) | `2.9.11` | `2.9.12` |
| [djlint](https://github.com/djlint/djLint) | `1.36.4` | `1.39.0` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.13.4` | `7.14.1` |
| [bump-my-version](https://github.com/callowayproject/bump-my-version) | `0.19.3` | `0.33.0` |



Updates `bleach` from 6.1.0 to 6.4.0
- [Changelog](https://github.com/mozilla/bleach/blob/main/CHANGES)
- [Commits](mozilla/bleach@v6.1.0...v6.4.0)

Updates `boto3` from 1.34.76 to 1.43.24
- [Release notes](https://github.com/boto/boto3/releases)
- [Commits](boto/boto3@1.34.76...1.43.24)

Updates `django-storages` from 1.14.2 to 1.14.6
- [Changelog](https://github.com/jschneier/django-storages/blob/master/CHANGELOG.rst)
- [Commits](jschneier/django-storages@1.14.2...1.14.6)

Updates `pillow` from 12.1.1 to 12.2.0
- [Release notes](https://github.com/python-pillow/Pillow/releases)
- [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst)
- [Commits](python-pillow/Pillow@12.1.1...12.2.0)

Updates `django` from 5.2.12 to 5.2.15
- [Commits](django/django@5.2.12...5.2.15)

Updates `django-webpack-loader` from 3.2.3 to 3.2.4
- [Release notes](https://github.com/django-webpack/django-webpack-loader/releases)
- [Changelog](https://github.com/django-webpack/django-webpack-loader/blob/master/CHANGELOG.md)
- [Commits](django-webpack/django-webpack-loader@3.2.3...3.2.4)

Updates `djangorestframework` from 3.16.1 to 3.17.1
- [Release notes](https://github.com/encode/django-rest-framework/releases)
- [Commits](encode/django-rest-framework@3.16.1...3.17.1)

Updates `mypy` from 1.18.2 to 1.19.1
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.18.2...v1.19.1)

Updates `djangorestframework-stubs` from 3.16.8 to 3.16.9
- [Release notes](https://github.com/typeddjango/djangorestframework-stubs/releases)
- [Commits](typeddjango/djangorestframework-stubs@3.16.8...3.16.9)

Updates `grpcio` from 1.78.0 to 1.81.0
- [Release notes](https://github.com/grpc/grpc/releases)
- [Commits](grpc/grpc@v1.78.0...v1.81.0)

Updates `typos` from 1.44.0 to 1.47.2
- [Release notes](https://github.com/crate-ci/typos/releases)
- [Changelog](https://github.com/crate-ci/typos/blob/master/CHANGELOG.md)
- [Commits](crate-ci/typos@v1.44.0...v1.47.2)

Updates `pulumi-aws` from 6.83.2 to 6.83.4
- [Release notes](https://github.com/pulumi/pulumi-aws/releases)
- [Changelog](https://github.com/pulumi/pulumi-aws/blob/master/CHANGELOG_OLD.md)
- [Commits](pulumi/pulumi-aws@v6.83.2...v6.83.4)

Updates `types-python-dateutil` from 2.9.0.20260305 to 2.9.0.20260518
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-markdown` from 3.10.2.20260211 to 3.10.2.20260518
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-pygments` from 2.19.0.20251121 to 2.20.0.20260518
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-psycopg2` from 2.9.21.20260223 to 2.9.21.20260518
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-pycurl` from 7.45.7.20251101 to 7.46.0.20260509
- [Commits](https://github.com/python/typeshed/commits)

Updates `types-six` from 1.17.0.20251009 to 1.17.0.20260518
- [Commits](https://github.com/python/typeshed/commits)

Updates `social-auth-app-django` from 5.6.0 to 5.9.0
- [Release notes](https://github.com/python-social-auth/social-app-django/releases)
- [Changelog](https://github.com/python-social-auth/social-app-django/blob/master/CHANGELOG.md)
- [Commits](python-social-auth/social-app-django@5.6.0...5.9.0)

Updates `django-environ` from 0.11.2 to 0.13.0
- [Release notes](https://github.com/joke2k/django-environ/releases)
- [Changelog](https://github.com/joke2k/django-environ/blob/develop/CHANGELOG.rst)
- [Commits](joke2k/django-environ@v0.11.2...v0.13.0)

Updates `python-dateutil` from 2.9.0 to 2.9.0.post0
- [Release notes](https://github.com/dateutil/dateutil/releases)
- [Changelog](https://github.com/dateutil/dateutil/blob/master/NEWS)
- [Commits](dateutil/dateutil@2.9.0...2.9.0.post0)

Updates `django-htmx` from 1.17.3 to 1.27.0
- [Changelog](https://github.com/adamchainz/django-htmx/blob/main/docs/changelog.rst)
- [Commits](adamchainz/django-htmx@1.17.3...1.27.0)

Updates `django-markdownify` from 0.9.3 to 0.9.7
- [Commits](erwinmatijsen/django-markdownify@0.9.3...0.9.7)

Updates `model-bakery` from 1.17.0 to 1.23.4
- [Release notes](https://github.com/model-bakers/model_bakery/releases)
- [Changelog](https://github.com/model-bakers/model_bakery/blob/main/CHANGELOG.md)
- [Commits](model-bakers/model_bakery@1.17.0...1.23.4)

Updates `mkdocs-material` from 9.7.4 to 9.7.6
- [Release notes](https://github.com/squidfunk/mkdocs-material/releases)
- [Changelog](https://github.com/squidfunk/mkdocs-material/blob/master/CHANGELOG)
- [Commits](squidfunk/mkdocs-material@9.7.4...9.7.6)

Updates `mysqlclient` from 2.2.0 to 2.2.8
- [Release notes](https://github.com/PyMySQL/mysqlclient/releases)
- [Changelog](https://github.com/PyMySQL/mysqlclient/blob/main/HISTORY.rst)
- [Commits](PyMySQL/mysqlclient@v2.2.0...v2.2.8)

Updates `mariadb` from 1.1.8 to 1.1.14
- [Release notes](https://github.com/mariadb-corporation/mariadb-connector-python/releases)
- [Changelog](https://github.com/mariadb-corporation/mariadb-connector-python/blob/1.1/CHANGELOG.md)
- [Commits](mariadb-corporation/mariadb-connector-python@v1.1.8...v1.1.14)

Updates `psycopg2-binary` from 2.9.11 to 2.9.12
- [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS)
- [Commits](psycopg/psycopg2@2.9.11...2.9.12)

Updates `djlint` from 1.36.4 to 1.39.0
- [Release notes](https://github.com/djlint/djLint/releases)
- [Changelog](https://github.com/djlint/djLint/blob/master/CHANGELOG.md)
- [Commits](djlint/djLint@v1.36.4...v1.39.0)

Updates `coverage` from 7.13.4 to 7.14.1
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.13.4...7.14.1)

Updates `bump-my-version` from 0.19.3 to 0.33.0
- [Release notes](https://github.com/callowayproject/bump-my-version/releases)
- [Changelog](https://github.com/callowayproject/bump-my-version/blob/master/CHANGELOG.md)
- [Commits](callowayproject/bump-my-version@0.19.3...0.33.0)

---
updated-dependencies:
- dependency-name: bleach
  dependency-version: 6.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: boto3
  dependency-version: 1.43.24
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: django-storages
  dependency-version: 1.14.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: pillow
  dependency-version: 12.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: django
  dependency-version: 5.2.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: django-webpack-loader
  dependency-version: 3.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: djangorestframework
  dependency-version: 3.17.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: mypy
  dependency-version: 1.19.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: djangorestframework-stubs
  dependency-version: 3.16.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: grpcio
  dependency-version: 1.81.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: typos
  dependency-version: 1.47.2
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: pulumi-aws
  dependency-version: 6.83.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: types-python-dateutil
  dependency-version: 2.9.0.20260518
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: types-markdown
  dependency-version: 3.10.2.20260518
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: types-pygments
  dependency-version: 2.20.0.20260518
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: types-psycopg2
  dependency-version: 2.9.21.20260518
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: types-pycurl
  dependency-version: 7.46.0.20260509
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: types-six
  dependency-version: 1.17.0.20260518
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: social-auth-app-django
  dependency-version: 5.9.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: django-environ
  dependency-version: 0.13.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: python-dateutil
  dependency-version: 2.9.0.post0
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: django-htmx
  dependency-version: 1.27.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: django-markdownify
  dependency-version: 0.9.7
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: model-bakery
  dependency-version: 1.23.4
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: mkdocs-material
  dependency-version: 9.7.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: mysqlclient
  dependency-version: 2.2.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: mariadb
  dependency-version: 1.1.14
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: psycopg2-binary
  dependency-version: 2.9.12
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: djlint
  dependency-version: 1.39.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: coverage
  dependency-version: 7.14.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: bump-my-version
  dependency-version: 0.33.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jun 8, 2026
@github-actions

github-actions Bot commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

Dependency Review

The following issues were found:
  • ✅ 0 vulnerable package(s)
  • ✅ 0 package(s) with incompatible licenses
  • ✅ 0 package(s) with invalid SPDX license definitions
  • ⚠️ 18 package(s) with unknown licenses.
  • ⚠️ 1 packages with OpenSSF Scorecard issues.
See the Details below.

License Issues

poetry.lock

PackageVersionLicenseIssue Type
django5.2.15NullUnknown License
django-environ0.13.0NullUnknown License
djangorestframework-stubs3.16.9NullUnknown License
djlint1.39.0NullUnknown License
grpcio1.81.0NullUnknown License
librt0.11.0NullUnknown License
mkdocs-material9.7.6NullUnknown License
model-bakery1.23.4NullUnknown License
pulumi-aws6.83.4NullUnknown License
social-auth-app-django5.9.0NullUnknown License
types-markdown3.10.2.20260518NullUnknown License
types-psycopg22.9.21.20260518NullUnknown License
types-pycurl7.46.0.20260509NullUnknown License
types-pygments2.20.0.20260518NullUnknown License
types-python-dateutil2.9.0.20260518NullUnknown License
types-six1.17.0.20260518NullUnknown License
typos1.47.2NullUnknown License
bleach6.4.0NullUnknown License

OpenSSF Scorecard

Scorecard details
PackageVersionScoreDetails
pip/anyio 4.13.0 UnknownUnknown
pip/bleach 6.4.0 🟢 4.9
Details
CheckScoreReason
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Security-Policy🟢 10security policy file detected
Pinned-Dependencies🟢 4dependency not pinned by hash detected -- score normalized to 4
Maintained⚠️ 0project is archived
Code-Review⚠️ 0Found 0/17 approved changesets -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Binary-Artifacts🟢 10no binaries found in the repo
Fuzzing🟢 10project is fuzzed
License🟢 9license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/boto3 1.43.24 🟢 7.4
Details
CheckScoreReason
Code-Review⚠️ 0Found 1/28 approved changesets -- score normalized to 0
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Packaging⚠️ -1packaging workflow not detected
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Security-Policy🟢 10security policy file detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies🟢 10all dependencies are pinned
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
pip/botocore 1.43.24 🟢 8
Details
CheckScoreReason
Code-Review⚠️ 0Found 0/28 approved changesets -- score normalized to 0
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Fuzzing🟢 10project is fuzzed
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
Binary-Artifacts🟢 10no binaries found in the repo
SAST🟢 10SAST tool is run on all commits
Pinned-Dependencies🟢 8dependency not pinned by hash detected -- score normalized to 8
pip/bracex 2.6 UnknownUnknown
pip/bump-my-version 0.33.0 UnknownUnknown
pip/coverage 7.14.1 UnknownUnknown
pip/django 5.2.15 UnknownUnknown
pip/django-environ 0.13.0 UnknownUnknown
pip/django-htmx 1.27.0 UnknownUnknown
pip/django-markdownify 0.9.7 ⚠️ 2.5
Details
CheckScoreReason
Packaging⚠️ -1packaging workflow not detected
Dangerous-Workflow⚠️ -1no workflows found
Code-Review⚠️ 0Found 1/15 approved changesets -- score normalized to 0
Pinned-Dependencies⚠️ -1no dependencies found
Maintained⚠️ 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1
Token-Permissions⚠️ -1No tokens found
Binary-Artifacts🟢 10no binaries found in the repo
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/django-storages 1.14.6 UnknownUnknown
pip/django-webpack-loader 3.2.4 🟢 5.4
Details
CheckScoreReason
Maintained🟢 79 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 7
Token-Permissions⚠️ -1No tokens found
Dangerous-Workflow⚠️ -1no workflows found
Packaging⚠️ -1packaging workflow not detected
Code-Review🟢 10all changesets reviewed
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ -1no dependencies found
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/djangorestframework 3.17.1 UnknownUnknown
pip/djangorestframework-stubs 3.16.9 UnknownUnknown
pip/djlint 1.39.0 UnknownUnknown
pip/exceptiongroup 1.3.1 UnknownUnknown
pip/grpcio 1.81.0 UnknownUnknown
pip/h11 0.16.0 🟢 4.4
Details
CheckScoreReason
Code-Review🟢 5Found 9/18 approved changesets -- score normalized to 5
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Maintained⚠️ 00 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Binary-Artifacts🟢 10no binaries found in the repo
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
Fuzzing🟢 10project is fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/httpcore 1.0.9 UnknownUnknown
pip/httpx 0.28.1 UnknownUnknown
pip/librt 0.11.0 UnknownUnknown
pip/mariadb 1.1.14 🟢 3.9
Details
CheckScoreReason
Code-Review⚠️ 0Found 1/29 approved changesets -- score normalized to 0
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 34 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 3
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
Security-Policy⚠️ 0security policy file not detected
Fuzzing⚠️ 0project is not fuzzed
License🟢 10license file detected
Signed-Releases⚠️ -1no releases found
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Packaging🟢 10packaging workflow detected
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/mkdocs-material 9.7.6 UnknownUnknown
pip/model-bakery 1.23.4 UnknownUnknown
pip/mypy 1.19.1 UnknownUnknown
pip/mysqlclient 2.2.8 UnknownUnknown
pip/pillow 12.2.0 UnknownUnknown
pip/psycopg2-binary 2.9.12 UnknownUnknown
pip/pulumi-aws 6.83.4 UnknownUnknown
pip/python-dateutil 2.9.0.post0 🟢 5.4
Details
CheckScoreReason
Code-Review⚠️ 1Found 3/17 approved changesets -- score normalized to 1
Maintained🟢 1012 commit(s) and 2 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Binary-Artifacts🟢 10no binaries found in the repo
Packaging⚠️ -1packaging workflow not detected
Token-Permissions⚠️ 0detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies⚠️ 0dependency not pinned by hash detected -- score normalized to 0
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Security-Policy⚠️ 0security policy file not detected
License🟢 9license file detected
Fuzzing🟢 10project is fuzzed
Branch-Protection⚠️ -1internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases🟢 82 out of the last 2 releases have a total of 2 signed artifacts.
SAST⚠️ 0SAST tool is not run on all commits -- score normalized to 0
pip/s3transfer 0.18.0 🟢 7.7
Details
CheckScoreReason
Code-Review🟢 3Found 7/18 approved changesets -- score normalized to 3
Binary-Artifacts🟢 10no binaries found in the repo
Maintained🟢 1030 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Dangerous-Workflow🟢 10no dangerous workflow patterns detected
Security-Policy🟢 10security policy file detected
Packaging⚠️ -1packaging workflow not detected
CII-Best-Practices⚠️ 0no effort to earn an OpenSSF best practices badge detected
Token-Permissions🟢 9detected GitHub workflow tokens with excessive permissions
Pinned-Dependencies🟢 10all dependencies are pinned
License🟢 10license file detected
Fuzzing⚠️ 0project is not fuzzed
Signed-Releases⚠️ -1no releases found
Branch-Protection🟢 6branch protection is not maximal on development and all release branches
SAST🟢 10SAST tool is run on all commits
pip/social-auth-app-django 5.9.0 UnknownUnknown
pip/types-markdown 3.10.2.20260518 UnknownUnknown
pip/types-psycopg2 2.9.21.20260518 UnknownUnknown
pip/types-pycurl 7.46.0.20260509 UnknownUnknown
pip/types-pygments 2.20.0.20260518 UnknownUnknown
pip/types-python-dateutil 2.9.0.20260518 UnknownUnknown
pip/types-six 1.17.0.20260518 UnknownUnknown
pip/typos 1.47.2 UnknownUnknown
pip/wcmatch 10.1 UnknownUnknown

Scanned Files

  • poetry.lock

@O-sama12 O-sama12 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM to me overall

@O-sama12 O-sama12 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM to me overall

@TreyWW

TreyWW commented Jul 16, 2026

Copy link
Copy Markdown
Owner

Thanks for the second pair of eyes @O-sama12

@TreyWW
TreyWW merged commit 70e83d7 into main Jul 16, 2026
5 checks passed
@TreyWW
TreyWW deleted the dependabot/pip/python-dependencies-73ec17bf5b branch July 16, 2026 21:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants