Update tools updates - #635
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
==3.1.2→==3.1.3==6.0.2→==6.0.3==3.1.3→==3.1.83.21.3→3.24.1==7.11.0→==7.15.27.15.3==3.1.2→==3.1.3==6.0.1→==6.0.59.3.1→9.6.18.11.1→8.14.5==0.23.1→==0.25.00.26.0==4.16.0→==4.17.0==2.32.5→==2.34.2==3.1.5→==3.1.85.12.1→5.14.41.5.32→1.5.381.6.1(+1)2.0.17→2.0.183.1.8→3.2.41.0.79→1.5.92.12.1→2.19.02.15.2→2.22.12.12.1→2.19.02.12.1→2.19.02.15.2→2.22.12.15.1→2.22.02.12.7.1→2.22.13.0.0→3.2.05.16.0→5.34.01.7.26→1.7.360.14.0→0.15.13.5.1→3.5.433.4.6-jre→33.6.0-jre3.11.3→3.15.1.13.15.1.2Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
pallets/flask (Flask)
v3.1.3Compare Source
Released 2026-02-18
but not the values, such as
inandlen. :ghsa:68rp-wp8r-4726yaml/pyyaml (PyYAML)
v6.0.3Compare Source
What's Changed
Full Changelog: yaml/pyyaml@6.0.2...6.0.3
pallets/werkzeug (Werkzeug)
v3.1.8Compare Source
Released 2026-04-02
Request.hostandget_hostreturn the empty string if the header ismissing or has invalid characters. :issue:
3142v3.1.7Compare Source
Released 2026-03-23
parse_list_headerpreserves partially quoted items, discards emptyitems, and returns empty for unclosed quoted values. :pr:
3128WWWAuthenticate.to_headerdoes not produce a trailing space when thereare no parameters. :issue:
3127Transfer-Encodingis parsed as a set. :pr:3134Request.host,get_host, andhost_is_trustedvalidate thecharacters of the value. An empty value is no longer allowed. A Unix socket
server address is ignored. The
trusted_listargument tohost_is_trustedis optional. :pr:31133088Response.make_conditionalsets theAccept-Rangesheader even if itis not a satisfiable range request. :issue:
3108merge_slashesmerges any number of consecutive slashes. :issue:3121v3.1.6Compare Source
Released 2026-02-19
safe_joinon Windows does not allow special devices names inmulti-segment paths. :ghsa:
29vq-49wr-vm6xv3.1.5Compare Source
Released 2026-01-08
safe_joinon Windows does not allow more special device names, regardlessof extension or surrounding spaces. :ghsa:
87hc-h4r5-73f7\r\nsequence at a chunk boundary.This fixes the previous attempt, which caused incorrect content lengths.
:issue:
3065:issue:3077AttributeErrorwhen initializingDebuggedApplicationwithpin_security=False. :issue:3075v3.1.4Compare Source
Released 2025-11-28
safe_joinon Windows does not allow special device names. This preventsreading from these when using
send_from_directory.secure_filenamealready prevented writing to these. :ghsa:
hgf8-39gv-g3f23020\r\nsequence at a chunk boundary.:issue:
30653054Request.jsonannotation is more accurate. :issue:3067source lines. :issue:
3044HTTPException.get_responseannotation and doc better conveys thedistinction between WSGI and sans-IO responses. :issue:
3056coveragepy/coveragepy (coverage)
v7.15.2Compare Source
increased memory use during reporting for large projects. Now we use a
different approach that is both faster and slimmer than 7.15.0. Fixes
issue 2229_... _issue 2229: #2229
.. _changes_7-15-1:
v7.15.1Compare Source
Fix: in the HTML report with
show_contextsenabled, a context labelcontaining
</script>(for example a parametrized pytest node id) couldclose the inline
<script>element in a file page early, injecting markup.Context labels are now fully escaped. Thanks,
Rajath Mohare <pull 2224_>_.A number of performance improvements thanks to Paul Kehrer, in pull requests
2213 <pull 2213_>,2214 <pull 2214_>,2215 <pull 2215_>,2216 <pull 2216_>,2218 <pull 2218_>,2220 <pull 2220_>, and2221 <pull 2221_>_... _pull 2213: #2213
.. _pull 2214: #2214
.. _pull 2215: #2215
.. _pull 2216: #2216
.. _pull 2218: #2218
.. _pull 2220: #2220
.. _pull 2221: #2221
.. _pull 2224: #2224
.. _changes_7-15-0:
v7.15.0Compare Source
Since 7.14.0, reporting commands implicitly combine parallel data files. Now
those commands have a new option
--keep-combinedto retain the data filesafter combining them instead of the default, which is to delete them.
Finishes
issue 2198_.Fix: the LCOV report would incorrectly count excluded functions as uncovered,
as described in
issue 2205. This is now fixed thanks toMartin Kuntz Jacobsen <pull 2206_>.When running your program, coverage now correctly sets
yourmodule.__spec__.loaderasstrongly recommended <--loader--_>,avoiding the deprecation warning described in
issue 2208. Thanks,A5rocks <pull 2209_>_.Fix: with Python 3.10, running with the
-I(isolated mode) option didn'tcorrectly omit the current directory from the module search path, as
described in
issue 2103. That is now fixed thanks toIlia Sorokin <pull 2211_>... --loader--: https://docs.python.org/3/reference/datamodel.html#module.__loader_
.. _issue 2103: #2103
.. _issue 2198: #2198
.. _issue 2205: #2205
.. _pull 2206: #2206
.. _issue 2208: #2208
.. _pull 2209: #2209
.. _pull 2211: #2211
.. _changes_7-14-3:
v7.14.3Compare Source
Fix: the default
...exclusion rule now also matches function bodieswhose closing return-type bracket is on its own line (for example, after a
long
-> dict[ ... ]annotation that a formatter has split over multiplelines). Closes
issue 2185, thanksMengjia Shang <pull 2196_>.Fix: On 3.13t, we incorrectly issued
Couldn't import C tracererrors.We can't import the C tracer because in 7.14.2 we stopped shipping compiled
wheels for 3.13t. Thanks,
Hugo van Kemenade <pull 2203_>_... _issue 2185: #2185
.. _pull 2196: #2196
.. _pull 2203: #2203
.. _changes_7-14-2:
v7.14.2Compare Source
Fix: some messages were being written to stdout, making
coverage json -o -useless for capturing JSON output. Now messages are written to stderr,fixing
issue 2197_.Fix:
CoverageDatakept one SQLite connection per thread that recordedcoverage, but never closed them when those threads terminated. On long runs
with many short-lived threads this leaked one file descriptor per dead
thread, eventually failing with
OSError: [Errno 24] Too many open files.Connections belonging to terminated threads are now closed and dropped.
Fixes
issue 2192_.Fix: when using sys.monitoring, we were assuming we could use the
COVERAGE_IDtool id. But other tools might also assume they could usethat id. Pre-allocated ids don't really make sense, so now we search for a
usable one instead. Fixes
issue 2187. Thanks,Matthew Lloyd <pull 2198_>.Following
the advice of cibuildwheel <no-13t_>_, we no longer distributewheels for Python 3.13 free-threaded.
.. _issue 2187: #2187
.. _issue 2192: #2192
.. _issue 2197: #2197
.. _pull 2198: #2198
.. _no-13t: https://py-free-threading.github.io/ci/#building-free-threaded-wheels-with-cibuildwheel
.. _changes_7-14-1:
v7.14.1Compare Source
Fix: the HTML report used typographic niceties to make file paths more
readable by adding a small amount of space around slashes. Those spaces
interfered with searching the page for file paths of interest. Now the report
uses CSS to accomplish the same visual tweak so that searches with slashes
work correctly. Closes
issue 2170_.Add a 3.16 PyPI classifier <hugo-316_>_ since we test on the 3.16 mainbranch.
.. _issue 2170: #2170
.. _hugo-316: https://mastodon.social/@hugovk/116588523571204490
.. _changes_7-14-0:
v7.14.0Compare Source
Feature: now when running one of the reporting commands, if there are
parallel data files that need combining, they will be implicitly combined
before creating the report. There is no option to avoid the combination; let
us know if you have a use case that requires it. Thanks,
Tim Hatch <pull 2162_>. Closesissue 1781.Fix: the output from
combinewas too verbose, listing each fileconsidered. Now it shows a single line with the counts of files combined,
files skipped, and files with errors. The
-qflag suppresses this line.The old detailed lines are available with the new
--debug=combineoption.Fix: running a Python file through a symlink now sets the sys.path correctly,
matching regular Python behavior. Fixes
issue 2157_.Fix:
Collector.flush_datacould fail with "RuntimeError: Set changedsize during iteration" when a tracer in another thread added a line to the
per-file set that
add_lines(oradd_arcs) was iterating. The valuespassed to
CoverageDataare now snapshotted viadict.copy()andset.copy(), which are atomic under the GIL. Thanks,Alex Vandiver <pull 2165_>_.Fix: the soft keyword
lazyis now bolded in HTML reports.We are no longer testing eventlet support. Eventlet started issuing stern
deprecation warnings that break our tests. Our support code is still there.
.. _issue 1781: #1781
.. _issue 2157: #2157
.. _pull 2162: #2162
.. _pull 2165: #2165
.. _changes_7-13-5:
v7.13.5Compare Source
Fix:
issue 2138_ describes a memory leak that happened when repeatedlyusing the Coverage API with in-memory data. This is now fixed.
Fix: the markdown-formatted coverage report didn't fully escape special
characters in file paths (
issue 2141). This would be very unlikely tocause a problem, but now it's done properly, thanks to
Ellie Ayla <pull 2142_>.Fix: the C extension wouldn't build on VS2019, but now it does (
issue 2145_)... _issue 2138: #2138
.. _issue 2141: #2141
.. _pull 2142: #2142
.. _issue 2145: #2145
.. _changes_7-13-4:
v7.13.4Compare Source
Fix: the third-party code fix in 7.13.3 required examining the parent
directories where coverage was run. In the unusual situation that one of the
parent directories is unreadable, a PermissionError would occur, as
described in
issue 2129_. This is now fixed.Fix: in test suites that change sys.path, coverage.py could fail with
"RuntimeError: Set changed size during iteration" as described and fixed in
pull 2130_. Thanks, Noah Fatsi.We now publish ppc64le wheels, thanks to
Pankhudi Jain <pull 2121_>_... _pull 2121: #2121
.. _issue 2129: #2129
.. _pull 2130: #2130
.. _changes_7-13-3:
v7.13.3Compare Source
been, slowing down test execution. This happened with layered virtual
environments such as uv sometimes makes. The problem is fixed, closing
issue 2082_. Now any directory on sys.path that is inside a virtualenv isconsidered third-party code.
.. _issue 2082: #2082
.. _changes_7-13-2:
v7.13.2Compare Source
Fix: when Python is installed via symlinks, for example with Homebrew, the
standard library files could be incorrectly included in coverage reports.
This is now fixed, closing
issue 2115_.Fix: if a data file is created with no read permissions, the combine step
would fail completely. Now a warning is issued and the file is skipped.
Closes
issue 2117_... _issue 2115: #2115
.. _issue 2117: #2117
.. _changes_7-13-1:
v7.13.1Compare Source
Added: the JSON report now includes a
"start_line"key for function andclass regions, indicating the first line of the region in the source. Closes
issue 2110_.Added: The
debug datacommand now takes file names as arguments on thecommand line, so you can inspect specific data files without needing to set
the
COVERAGE_FILEenvironment variable.Fix: the JSON report used to report module docstrings as executed lines,
which no other report did, as described in
issue 2105_. This is now fixed,thanks to Jianrong Zhao.
Fix: coverage.py uses a more disciplined approach to detecting where
third-party code is installed, and avoids measuring it. This shouldn't change
any behavior. If you find that it does, please get in touch.
Performance: data files that will be combined now record their hash as part
of the file name. This lets us skip duplicate data more quickly, speeding the
combining step.
Docs: added a section explaining more about what is considered a missing
branch and how it is reported: :ref:
branch_explain, as requested inissue 1597. Thanks toAyisha Mohammed <pull 2092_>.Tests: the test suite misunderstood what core was being tested if
COVERAGE_COREwasn't set on 3.14+. This is now fixed, closingissue 2109_... _issue 1597: #1597
.. _pull 2092: #2092
.. _issue 2105: #2105
.. _issue 2109: #2109
.. _issue 2110: #2110
.. _changes_7-13-0:
v7.13.0Compare Source
Feature: coverage.py now supports :file:
.coveragerc.tomlconfigurationfiles. These files use TOML syntax and take priority over
:file:
pyproject.tomlbut lower priority than :file:.coveragercfiles.Closes
issue 1643_ thanks toOlena Yefymenko <pull 1952_>_.Fix: we now include a permanent .pth file which is installed with the code,
fixing
issue 2084. In 7.12.1b1 this was done incorrectly: it didn't workwhen using the source wheel (
py3-none-any). This is now fixed. Thanks,Henry Schreiner <pull 2100_>.Deprecated: when coverage.py is installed, it creates three command entry
points:
coverage,coverage3, andcoverage-3.10(if installed forPython 3.10). The second and third of these are not needed and will
eventually be removed. They still work for now, but print a message about
their deprecation.
.. _issue 1643: #1643
.. _pull 1952: #1952
.. _pull 2100: #2100
.. _changes_7-12-1b1:
v7.12.0Compare Source
The HTML report now shows separate coverage totals for statements and
branches, as well as the usual combined coverage percentage. Thanks to Ryuta
Otsuka for the
discussion <issue 2081_>_ and theimplementation <pull 2085_>_.The JSON report now includes separate coverage totals for statements and
branches, thanks to
Ryuta Otsuka <pull 2090_>_.Fix:
except*clauses were not handled properly under the "sysmon"measurement core, causing KeyError exceptions as described in
issue 2086_.This is now fixed.
Fix: we now defend against aggressive mocking of
open()that could causeerrors inside coverage.py. An example of a failure is in
issue 2083_.Fix: in unusual cases where a test suite intentionally exhausts the system's
file descriptors to test handling errors in
open(), coverage.py wouldfail when trying to open source files, as described in
issue 2091_. Thisis now fixed.
A small tweak to the HTML report: file paths now use thin spaces around
slashes to make them easier to read.
.. _issue 2081: #2081
.. _issue 2083: #2083
.. _pull 2085: #2085
.. _issue 2086: #2086
.. _pull 2090: #2090
.. _issue 2091: #2091
.. _changes_7-11-3:
v7.11.3Compare Source
Fix: the 7.11.1 changes meant that conflicts between a requested measurement
core and other settings would raise an error. This was a breaking change from
previous behavior, as reported in
issue 2076_ andissue 2078_.The previous behavior has been restored: when the requested core conflicts
with other settings, another core is used instead, and a warning is issued.
For contributors: the repo has moved from Ned's
nedbat GitHub account_ tothe
coveragepy GitHub organization_. The default branch has changed frommaster to main.
.. _issue 2076: #2076
.. _issue 2078: #2078
.. _nedbat GitHub account: https://github.com/nedbat
.. _coveragepy GitHub organization: https://github.com/coveragepy
.. _changes_7-11-2:
v7.11.2Compare Source
Fix: using the "sysmon" measurement core in 7.11.1, if Python code was
claimed to come from a non-Python file, a
NotPythonexception could beraised. This could happen for example with Jinja templates compiled to
Python, as reported in
issue 2077_. This is now fixed.Doc: corrected the first entry in the 7.11.1 changelog.
.. _issue 2077: #2077
.. _changes_7-11-1:
v7.11.1Compare Source
Fix: some chanages to details of how the measurement core is chosen, and how
conflicting settings are handled. The "sysmon" core cannot be used with some
conurrency settings, with dynamic context, and in Python 3.12/3.13, with
branch measurement.
If the core is not specified and defaults to "sysmon" (Python 3.14+), but
other settings conflict with sysmon, then the "ctrace" core will be used
instead with no warning. For concurrency conflicts, this used to produce an
error, as described in
issue 2064_.If the "sysmon" core is explicitly requested in your configuration, but
other settings conflict, an error is now raised. This used to produce a
warning.
Fix: some multi-line case clauses or for loops (and probably other
constructs) could cause incorrect claims of missing branches with the
sys.monitoring core, as described in
issue 2070_. This is now fixed.Fix: when running in pytest under coverage, a
breakpoint()would stop inthe wrong frame, one level down from where it should, as described in
issue 1420_. This was due to a coverage change in v6.4.1 that seemed to give aslight performance improvement, but I couldn't reproduce the performance
gain, so it's been reverted, fixing the debugger problem.
A new debug option
--debug=coreshows which core is in use and why.Split
sqlitedebugging information out of thesys:ref:coverage debug <cmd_debug>and :ref:cmd_run_debugoptions since it's bulky and notvery useful.
Updated the :ref:
howitworkspage to better describe the three differentmeasurement cores.
.. _issue 1420: #1420
.. _issue 2064: #2064
.. _issue 2070: #2070
.. _changes_7-11-0:
corydolphin/flask-cors (flask-cors)
v6.0.5Compare Source
Supersedes 6.0.4
What's Changed
Full Changelog: corydolphin/flask-cors@6.0.3...6.0.5
v6.0.4Compare Source
What's Changed
Full Changelog: corydolphin/flask-cors@6.0.3...6.0.4
v6.0.3Compare Source
What's Changed
Full Changelog: corydolphin/flask-cors@6.0.2...6.0.3
v6.0.2Compare Source
What's Changed
New Contributors
Full Changelog: corydolphin/flask-cors@6.0.1...6.0.2
gradle/gradle (gradle)
v9.6.1Compare Source
v9.6.0Compare Source
v9.5.1: 9.5.1Compare Source
The Gradle team is excited to announce Gradle 9.5.1.
Here are the highlights of this release:
Read the Release Notes
We would like to thank the following community members for their contributions to this release of Gradle:
atm1020,
mataha,
Adam,
Attila Kelemen,
Benedikt Ritter,
Björn Kautler,
Caro Silva Rode,
CHANHAN,
Dmitry Nezavitin,
Eng Zer Jun,
KugelLibelle,
Madalin Valceleanu,
Markus Gaisbauer,
Oliver Kopp,
Philip Wedemann,
ploober,
Roberto Perez Alcolea,
Rohit Anand,
Suvrat Acharya,
Ujwal Suresh Vanjare,
Victor Merkulov
Upgrade instructions
Switch your build to use Gradle 9.5.1 by updating your wrapper:
See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.
For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.
Reporting problems
If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.
We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.
v9.5.0: 9.5.0Compare Source
The Gradle team is excited to announce Gradle 9.5.0.
Here are the highlights of this release:
Read the Release Notes
We would like to thank the following community members for their contributions to this release of Gradle:
atm1020,
mataha,
Adam,
Attila Kelemen,
Benedikt Ritter,
Björn Kautler,
Caro Silva Rode,
CHANHAN,
Dmitry Nezavitin,
Eng Zer Jun,
KugelLibelle,
Madalin Valceleanu,
Markus Gaisbauer,
Oliver Kopp,
Philip Wedemann,
ploober,
Roberto Perez Alcolea,
Rohit Anand,
Suvrat Acharya,
Ujwal Suresh Vanjare,
Victor Merkulov
Upgrade instructions
Switch your build to use Gradle 9.5.0 by updating your wrapper:
See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.
For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.
Reporting problems
If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.
We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.
v9.4.1: 9.4.1Compare Source
The Gradle team is excited to announce Gradle 9.4.1.
Here are the highlights of this release:
Read the Release Notes
We would like to thank the following community members for their contributions to this release of Gradle:
akankshaa-00,
Attila Kelemen,
Björn Kautler,
dblood,
Dennis Rieks,
duvvuvenkataramana,
John Burns,
Julian,
kevinstembridge,
Niels Doucet,
Philip Wedemann,
ploober,
Richard Hernandez,
Roberto Perez Alcolea,
Sebastian Lövdahl,
stephan2405,
Stephane Landelle,
Ujwal Suresh Vanjare,
Victor Merkulov,
Vincent Potuček,
Vladimir Sitnikov.
Upgrade instructions
Switch your build to use Gradle 9.4.1 by updating your wrapper:
See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.
For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.
Reporting problems
If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.
We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.
v9.4.0: 9.4.0Compare Source
The Gradle team is excited to announce Gradle 9.4.0.
Here are the highlights of this release:
Read the Release Notes
We would like to thank the following community members for their contributions to this release of Gradle:
akankshaa-00,
Attila Kelemen,
Björn Kautler,
dblood,
Dennis Rieks,
duvvuvenkataramana,
John Burns,
Julian,
kevinstembridge,
Niels Doucet,
Philip Wedemann,
ploober,
Richard Hernandez,
Roberto Perez Alcolea,
Sebastian Lövdahl,
stephan2405,
Stephane Landelle,
Ujwal Suresh Vanjare,
Victor Merkulov,
Vincent Potuček,
Vladimir Sitnikov.
Upgrade instructions
Switch your build to use Gradle 9.4.0 by updating your wrapper:
See the Gradle 9.x upgrade guide to learn about deprecations, breaking changes and other considerations when upgrading.
For Java, Groovy, Kotlin and Android compatibility, see the full compatibility notes.
Reporting problems
If you find a problem with this release, please file a bug on GitHub Issues adhering to our issue guidelines.
If you're not sure you're encountering a bug, please use the forum.
We hope you will build happiness with Gradle, and we look forward to your feedback via Twitter or on GitHub.
prometheus/client_python (prometheus-client)
v0.25.0Compare Source
What's Changed
Full Changelog: prometheus/client_python@v0.24.1...v0.25.0
v0.24.1Compare Source
v0.24.0Compare Source
What's Changed
Full Changelog: prometheus/client_python@v0.23.1...v0.24.0
mongodb/mongo-python-driver (pymongo)
v4.17.0: PyMongo 4.17.0Compare Source
Community notes
What's Changed
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.