Skip to content

Bump the python-security-updates group across 1 directory with 16 updates - #624

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/python-security-updates-17ae4d8831
Closed

Bump the python-security-updates group across 1 directory with 16 updates#624
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/python-security-updates-17ae4d8831

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 19, 2026 •
edited by RussTedrake
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-security-updates group with 16 updates in the / directory:

Package From To
lxml 5.3.1 6.1.0
black 25.1.0 26.3.1
poetry 2.0.1 2.3.4
requests 2.32.3 2.33.0
bleach 6.2.0 6.4.0
dulwich 0.22.7 1.2.15
filelock 3.17.0 3.20.3
fonttools 4.56.0 4.60.2
idna 3.10 3.15
jinja2 3.1.5 3.1.6
lxml-html-clean 0.4.1 0.4.4
mistune 2.0.5 3.3.3
msgpack 1.1.0 1.2.1
pygments 2.19.1 2.20.0
urllib3 2.3.0 2.7.0
virtualenv 20.29.2 20.36.1

Updates lxml from 5.3.1 to 6.1.0

Release notes

Sourced from lxml's releases.

lxml-6.1.0

No release notes provided.

lxml-6.0.4

No release notes provided.

lxml-6.0.3

No release notes provided.

lxml-6.0.2

No release notes provided.

lxml-6.0.1

No release notes provided.

lxml-6.0.0

No release notes provided.

lxml-5.4.0

5.4.0 (2025-04-22)

Bugs fixed

  • LP#2107279: Binary wheels use libxml2 2.13.8 and libxslt 1.1.43 to resolve several CVEs. (Binary wheels for Windows continue to use a patched libxml2 2.11.9 and libxslt 1.1.39.) Issue found by Anatoly Katyushin, see https://bugs.launchpad.net/lxml/+bug/2107279

lxml-5.3.2

No release notes provided.

Changelog

Sourced from lxml's changelog.

6.1.0 (2026-04-17)

This release fixes a possible external entity injection (XXE) vulnerability in iterparse() and the ETCompatXMLParser.

Features added

  • GH#486: The HTML ARIA accessibility attributes were added to the set of safe attributes in lxml.html.defs. This allows lxml_html_clean to pass them through. Patch by oomsveta.

  • The default chunk size for reading from file-likes in iterparse() is now configurable with a new chunk_size argument.

Bugs fixed

  • LP#2146291: The resolve_entities option was still set to True for iterparse and ETCompatXMLParser, allowing for external entity injection (XXE) when using these parsers without setting this option explicitly. The default was now changed to 'internal' only (as for the normal XML and HTML parsers since lxml 5.0). Issue found by Sihao Qiu as CVE-2026-41066.

6.0.4 (2026-04-12)

Bugs fixed

  • LP#2148019: Spurious MemoryError during namespace cleanup.

6.0.3 (2026-04-09)

Bugs fixed

  • Several out of memory error cases now raise MemoryError that were not handled before.

  • Slicing with large step values (outside of +/- sys.maxsize) could trigger undefined C behaviour.

  • LP#2125399: Some failing tests were fixed or disabled in PyPy.

  • LP#2138421: Memory leak in error cases when setting the public_id or system_url of a document.

... (truncated)

Commits
  • 43722f4 Update changelog.
  • 8747040 Name version of option change in docstring.
  • 6c36e6c Fix pypistats URL in download statistics script.
  • c7d76d6 Change security policy to point to Github security advisories.
  • 378ccf8 Update project income report.
  • 315270b Docs: Reduce TOC depth of package pages and move module contents first.
  • 6dbba7f Docs: Show current year in copyright line.
  • e4385bf Update project income report.
  • 5bed1e1 Validate file hashes in release download script.
  • c13ee10 Prepare release of 6.1.0.
  • Additional commits viewable in compare view

Updates black from 25.1.0 to 26.3.1

Release notes

Sourced from black's releases.

26.3.1

Stable style

  • Prevent Jupyter notebook magic masking collisions from corrupting cells by using exact-length placeholders for short magics and aborting if a placeholder can no longer be unmasked safely (#5038)

Configuration

  • Always hash cache filename components derived from --python-cell-magics so custom magic names cannot affect cache paths (#5038)

Blackd

  • Disable browser-originated requests by default, add configurable origin allowlisting and request body limits, and bound executor submissions to improve backpressure (#5039)

26.3.0

Stable style

  • Don't double-decode input, causing non-UTF-8 files to be corrupted (#4964)
  • Fix crash on standalone comment in lambda default arguments (#4993)
  • Preserve parentheses when # type: ignore comments would be merged with other comments on the same line, preventing AST equivalence failures (#4888)

Preview style

  • Fix bug where if guards in case blocks were incorrectly split when the pattern had a trailing comma (#4884)
  • Fix string_processing crashing on unassigned long string literals with trailing commas (one-item tuples) (#4929)
  • Simplify implementation of the power operator "hugging" logic (#4918)

Packaging

  • Fix shutdown errors in PyInstaller builds on macOS by disabling multiprocessing in frozen environments (#4930)

Performance

  • Introduce winloop for windows as an alternative to uvloop (#4996)
  • Remove deprecated function uvloop.install() in favor of uvloop.new_event_loop() (#4996)
  • Rename maybe_install_uvloop function to maybe_use_uvloop to simplify loop installation and creation of either a uvloop/winloop evenloop or default eventloop (#4996)

Output

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.3.1

Stable style

  • Prevent Jupyter notebook magic masking collisions from corrupting cells by using exact-length placeholders for short magics and aborting if a placeholder can no longer be unmasked safely (#5038)

Configuration

  • Always hash cache filename components derived from --python-cell-magics so custom magic names cannot affect cache paths (#5038)

Blackd

  • Disable browser-originated requests by default, add configurable origin allowlisting and request body limits, and bound executor submissions to improve backpressure (#5039)

Version 26.3.0

Stable style

  • Don't double-decode input, causing non-UTF-8 files to be corrupted (#4964)
  • Fix crash on standalone comment in lambda default arguments (#4993)
  • Preserve parentheses when # type: ignore comments would be merged with other comments on the same line, preventing AST equivalence failures (#4888)

Preview style

  • Fix bug where if guards in case blocks were incorrectly split when the pattern had a trailing comma (#4884)
  • Fix string_processing crashing on unassigned long string literals with trailing commas (one-item tuples) (#4929)
  • Simplify implementation of the power operator "hugging" logic (#4918)

Packaging

  • Fix shutdown errors in PyInstaller builds on macOS by disabling multiprocessing in frozen environments (#4930)

Performance

  • Introduce winloop for windows as an alternative to uvloop (#4996)
  • Remove deprecated function uvloop.install() in favor of uvloop.new_event_loop() (#4996)
  • Rename maybe_install_uvloop function to maybe_use_uvloop to simplify loop installation and creation of either a uvloop/winloop eventloop or default eventloop (#4996)

... (truncated)

Commits

Updates poetry from 2.0.1 to 2.3.4

Release notes

Sourced from poetry's releases.

2.3.4

Fixed

  • Fix a performance regression in the wheel installer that was introduced in Poetry 2.3.3 (#10821).
  • Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#10837).

2.3.3

Fixed

  • Fix a path traversal vulnerability in the wheel installer that could allow malicious wheel files to write files outside the intended installation directory (#10792).
  • Fix an issue where git dependencies from annotated tags could not be updated (#10719).
  • Fix an issue where empty VIRTUAL_ENV or CONDA_PREFIX environment variables (e.g., after conda deactivate) would cause Poetry to incorrectly detect an active virtualenv (#10784).
  • Fix an issue where an incomprehensible error message was printed when .venv was a file instead of a directory (#10777).
  • Fix an issue where HTTP Basic Authentication credentials could be corrupted during request preparation, causing authentication failures with long tokens (#10748).
  • Fix an issue where poetry publish --no-interaction --build requested user interaction (#10769).
  • Fix an issue where poetry init and poetry new created a deprecated project.license format (#10787).

Docs

  • Clarify the differences between poetry install and poetry update (#10713).
  • Clarify the section of fields in the pyproject.toml examples (#10753).
  • Add a note about the different installation location when Python from the Microsoft Store is used (#10759).
  • Fix the system requirements for Poetry (#10739).
  • Fix the poetry cache clear example (#10749).
  • Fix the link to pipx installation instructions (#10783).

poetry-core (2.3.2)

  • Fix an issue where platform_release could not be parsed on Debian Trixie (#930).
  • Fix an issue where using project.readme.text in the pyproject.toml file resulted in broken metadata (#914).
  • Fix an issue where dependency groups were considered equal when their resolved dependencies were equal, even if the groups themselves were not (#919).
  • Fix an issue where removing a dependency from a group that included another group resulted in other dependencies being added to the included group (#922).
  • Fix an issue where PEP 735 include-group entries were lost when [tool.poetry.group] also defined include-groups for the same group (#924).
  • Fix an issue where the union of <value> not in <marker> constraints was wrongly treated as always satisfied (#925).
  • Fix an issue where a post release with a local version identifier was wrongly allowed by a > version constraint (#921).
  • Fix an issue where a version with the local version identifier 0 was treated as equal to the corresponding public version (#920).
  • Fix an issue where a != <version> constraint wrongly disallowed pre releases and post releases of the specified version (#929).
  • Fix an issue where in and not in constraints were wrongly not allowed by specific compound constraints (#927).

2.3.2

Changed

  • Allow dulwich>=1.0 (#10701).

poetry-core (2.3.1)

  • Fix an issue where platform_release could not be parsed on Windows Server (#911).

2.3.1

Fixed

... (truncated)

Changelog

Sourced from poetry's changelog.

[2.3.4] - 2026-04-12

Fixed

  • Fix a performance regression in the wheel installer that was introduced in Poetry 2.3.3 (#10821).
  • Fix a path traversal vulnerability in sdist extraction on Python 3.10.0-3.10.12 and 3.11.0-3.11.4 that could allow malicious tarball files to write files outside the target directory (#10837).

[2.3.3] - 2026-03-29

Fixed

  • Fix a path traversal vulnerability in the wheel installer that could allow malicious wheel files to write files outside the intended installation directory (#10792).
  • Fix an issue where git dependencies from annotated tags could not be updated (#10719).
  • Fix an issue where empty VIRTUAL_ENV or CONDA_PREFIX environment variables (e.g., after conda deactivate) would cause Poetry to incorrectly detect an active virtualenv (#10784).
  • Fix an issue where an incomprehensible error message was printed when .venv was a file instead of a directory (#10777).
  • Fix an issue where HTTP Basic Authentication credentials could be corrupted during request preparation, causing authentication failures with long tokens (#10748).
  • Fix an issue where poetry publish --no-interaction --build requested user interaction (#10769).
  • Fix an issue where poetry init and poetry new created a deprecated project.license format (#10787).

Docs

  • Clarify the differences between poetry install and poetry update (#10713).
  • Clarify the section of fields in the pyproject.toml examples (#10753).
  • Add a note about the different installation location when Python from the Microsoft Store is used (#10759).
  • Fix the system requirements for Poetry (#10739).
  • Fix the poetry cache clear example (#10749).
  • Fix the link to pipx installation instructions (#10783).

poetry-core (2.3.2)

  • Fix an issue where platform_release could not be parsed on Debian Trixie (#930).
  • Fix an issue where using project.readme.text in the pyproject.toml file resulted in broken metadata (#914).
  • Fix an issue where dependency groups were considered equal when their resolved dependencies were equal, even if the groups themselves were not (#919).
  • Fix an issue where removing a dependency from a group that included another group resulted in other dependencies being added to the included group (#922).
  • Fix an issue where PEP 735 include-group entries were lost when [tool.poetry.group] also defined include-groups for the same group (#924).
  • Fix an issue where the union of <value> not in <marker> constraints was wrongly treated as always satisfied (#925).
  • Fix an issue where a post release with a local version identifier was wrongly allowed by a > version constraint (#921).
  • Fix an issue where a version with the local version identifier 0 was treated as equal to the corresponding public version (#920).
  • Fix an issue where a != <version> constraint wrongly disallowed pre releases and post releases of the specified version (#929).
  • Fix an issue where in and not in constraints were wrongly not allowed by specific compound constraints (#927).

[2.3.2] - 2026-02-01

Changed

  • Allow dulwich>=1.0 (#10701).

poetry-core (2.3.1)

... (truncated)

Commits
  • 7c7af71 release: bump version to 2.3.4
  • e512e7f fix: refuse to write files outside the target directory during sdist extracti...
  • 506c09d perf: use os.path.abspath() instead of Path.resolve() (#10821)
  • 3d0151a release: bump version to 2.3.3
  • 89f09aa fix long path issue on Windows (#10794)
  • e068177 installer: fix path traversal (#10792)
  • d76a2f6 chore: require new poetry-core version (#10790)
  • 859d443 Update init & new commands for PEP 639 (License) (#10787)
  • 2ff2845 fix: pass auth via Request constructor instead of calling HTTPBasicAuth on un...
  • 286e43b env: improve error handling if .venv is not a directory but a file (#10777)
  • Additional commits viewable in compare view

Updates requests from 2.32.3 to 2.33.0

Release notes

Sourced from requests's releases.

v2.33.0

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

  • The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

  • Added support for Python 3.14.
  • Dropped support for Python 3.8 following its end of support.

v2.32.4

2.32.4 (2025-06-10)

... (truncated)

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

  • 📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

  • CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

  • Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

  • Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

  • Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

  • Various typo fixes and doc improvements.

2.32.5 (2025-08-18)

Bugfixes

  • The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

  • Added support for Python 3.14.
  • Dropped support for Python 3.8 following its end of support.

2.32.4 (2025-06-10)

Security

  • CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file.

... (truncated)

Commits
  • bc04dfd v2.33.0
  • 66d21cb Merge commit from fork
  • 8b9bc8f Move badges to top of README (#7293)
  • e331a28 Remove unused extraction call (#7292)
  • 753fd08 docs: fix FAQ grammar in httplib2 example
  • 774a0b8 docs(socks): same block as other sections
  • 9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
  • ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
  • 0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
  • d568f47 docs: clarify Quickstart POST example (#6960)
  • Additional commits viewable in compare view

Updates bleach from 6.2.0 to 6.4.0

Changelog

Sourced from bleach's changelog.

Version 6.4.0 (June 5th, 2026)

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

  • Dropped support for pypy 3.10. (#764)

Security fixes

  • Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

    Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.

    For example::

    import bleach payload1 = 'Click' result1 = bleach.clean(payload1) print(repr(result1))

    outputs::

    'Click'

    See the advisory for details.

  • Fix GHSA-gj48-438w-jh9v.

    Fix issue where URI sanitization wasn't happening in formaction attributes.

    See the advisory for details.

Bug fixes

  • Add support for pypy 3.11. (#764)

  • Drop version max in tinycss2 pin. (#772)

    This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.

Version 6.3.0 (October 27th, 2025)

... (truncated)

Commits
  • f0355a7 fix: fix last release date in CHANGES
  • ae4e8a2 chore: bleach 6.4.0 and final release
  • 970df58 fix: uri-sanitization in formaction attributes
  • 7c4867c fix: xss bypass in allowed protocol test using unicode invisible characters
  • 913ab75 fix: reduce redundancy in workflow jobs
  • 218c15a fix: rework pip caching
  • 4f0b097 fix: fix tox platform restrictions
  • e95a79d chore: update pytest
  • 91539d4 Bump actions/cache from 5.0.3 to 5.0.4
  • cd47b4c fix: handle left-angle-bracket that's not a tag (#733)
  • Additional commits viewable in compare view

Updates dulwich from 0.22.7 to 1.2.15

Release notes

Sourced from dulwich's releases.

dulwich-1.2.15

  • Detect delta cycles in Pack.resolve_object: a crafted pack with REF_DELTA objects that name each other sent get_raw into an unbounded loop. Such chains now raise DeltaCycle.
  • Fix porcelain.clean when the target directory and the repository path are spelled differently, such as via a relative path or a symlink. (Jelmer Vernooij)
  • Memoize tag peeling on the object store, so refs sharing an annotated tag chain no longer re-walk it once per ref. show_ref --dereference and the ref advertisement were quadratic. (Jelmer Vernooij, #2406)
  • Give a .gitignore in a subdirectory precedence over one closer to the root, matching git. A negation in a deeper file no longer loses to a rule at the root, and a nested negation no longer re-includes a path whose parent directory stays excluded. (Jelmer Vernooij, #2399)
  • Reject reftable tables.list entries that contain a path separator or are absolute, so a hostile repository cannot make a ref lookup open a file outside the reftable directory. (netliomax25-code)
  • Support dulwich commit -C/--reuse-message and -c/--reedit-message to reuse a commit's message, author and author date, optionally editing the message. The committer and new commit ancestry remain independent. (eunwoo song, #1845)
  • List local branches for bare dulwich branch and standalone dulwich branch --list [pattern]. Listing empty repositories or patterns with no matches succeeds without changing refs. (be-student, #1847)
  • Add dulwich commit --author="Name <email>" to override the author of a new or amended commit. (kudala-bharani, #1845)
  • Set branch.<name>.remote and branch.<name>.merge for the branch checked out by a clone, so that a subsequent git pull with no arguments has tracking information. (Jelmer Vernooij, #2376)
  • Keep relative paths relative in SSHGitClient.get_url, emitting git's ssh://host/~/path form. Cloning from an scp-style URL like user@host:git/repo.git previously stored ssh://user@host/git/repo.git as the remote URL, which points at a different repository. (Jelmer Vernooij, #2375)
  • Name a symlink by its own path in porcelain.path_to_tree_path, rather than by the path of its target. porcelain.status listed a tracked symlink as untracked whenever the file it pointed at was itself untracked or missing, so a modified symlink was reported twice. (Jerry Xiao)
  • Ignore gitignore lines that carry no pattern, such as a bare ! or /. A bare ! previously re-included a directory that an earlier pattern in the same file had ignored. (Jelmer Vernooij, #2398)
  • Avoid quadratic cost in PktLineParser.parse, which resliced its remaining buffer once per pkt-line. (Jelmer Vernooij, #2408)

dulwich-1.2.14

Collapse consecutive ** segments in wildmatch translation, matching git's behavior and avoiding catastrophic regex backtracking on patterns like a/**/**/**/z from untrusted repositories. (netliomax25-code)

dulwich-1.2.13

  • Make concurrent Pack.get_raw calls thread-safe by synchronizing PackData's resolved-object offset cache. (Bojan Zivanovic)

  • Speed up cached PackData.get_object_at lookups by acquiring the offset-cache lock directly instead of through a with statement. (Bojan Zivanovic)

  • Bound fetch negotiation the way C Git's MAX_IN_VAIN does: give up after 256 unacknowledged "have" lines instead of draining the whole graph walker into stateless (HTTP) requests. (Bojan Zivanovic, #2343)

  • Add repo.sanitize_user_identity, which builds an identity from a name and an email sanitized the way git's fmt_ident does, for callers who cannot reject invalid input via check_user_identity. (Bojan Zivanovic, #2342)

  • Make concurrent PackData reads thread-safe by mmap-ing pack contents and indexing the mapping at explicit offsets instead of sharing the file position. New unpack_object_at, read_pack_header_at, read_zlib_chunks_at, take_msb_bytes_at and compute_buffer_sha read from a buffer; the existing read-callable variants remain for streams. (Bojan Zivanovic, Jelmer Vernooij)

  • Deduplicate the commit walk in find_shallow and get_depth (dulwich.object_store). Both re-expanded a commit once per path that reached it, so a merge-heavy history walked in exponential time. (netliomax25-code)

  • SECURITY: Don't follow symlinks when writing messages in

... (truncated)

Changelog

Sourced from dulwich's changelog.

1.2.15 2026-09-14

  • Detect delta cycles in Pack.resolve_object: a crafted pack with REF_DELTA objects that name each other sent get_raw into an unbounded loop. Such chains now raise DeltaCycle.

  • Fix porcelain.clean when the target directory and the repository path are spelled differently, such as via a relative path or a symlink. (Jelmer Vernooij)

  • Enter a directory whose contents are excluded by a pattern such as dir/* when walking the work tree, so a later negation can re-include a file below it. (Jelmer Vernooij, #2409)

  • Memoize tag peeling on the object store, so refs sharing an annotated tag chain no longer re-walk it once per ref. show_ref --dereference and the ref advertisement were quadratic. (Jelmer Vernooij, #2406)

  • Give a .gitignore in a subdirectory precedence over one closer to the root, matching git. A negation in a deeper file no longer loses to a rule at the root, and a nested negation no longer re-includes a path whose parent directory stays excluded. (Jelmer Vernooij, #2399)

  • Reject reftable tables.list entries that contain a path separator or are absolute, so a hostile repository cannot make a ref lookup open a file outside the reftable directory. (netliomax25-code)

  • Support dulwich commit -C/--reuse-message and -c/--reedit-message to reuse a commit's message, author and author date, optionally editing the message. The committer and new commit ancestry remain independent. (eunwoo song, #1845)

  • List local branches for bare dulwich branch and standalone dulwich branch --list [pattern]. Listing empty repositories or patterns with no matches succeeds without changing refs. (be-student, #1847)

  • Add dulwich commit --author="Name <email>" to override the author of a new or amended commit. (kudala-bharani, #1845)

  • Set branch.<name>.remote and branch.<name>.merge for the branch checked out by a clone, so that a subsequent git pull with no arguments has tracking information. (Jelmer Vernooij, #2376)

  • Keep relative paths relative in SSHGitClient.get_url, emitting git's ssh://host/~/path form. Cloning from an scp-style URL like user@host:git/repo.git previously stored ssh://user@host/git/repo.git as the remote URL, which points at a different repository. (Jelmer Vernooij, #2375)

  • Name a symlink by its own path in porcelain.path_to_tree_path, rather

... (truncated)

Commits
  • b84b2ad Release 1.2.15
  • ee235e8 Memoize tag peeling on the object store (#2407)
  • 7fe797b Memoize tag peeling on the object store
  • f6fc1b3 protocol: Avoid quadratic cost in PktLineParser.parse (#2410)
  • 60660d2 protocol: Avoid quadratic cost in PktLineParser.parse
  • e0952f9 More gitignore matching improvements (#2409)
  • fa2d6da Match ignore patterns by entry name and type, as git does
  • 43d67eb Share one ignore decision path between filter and manager
  • cb0d914 Name the directory re-inclusion checks in ignore matching
  • fa1a579 Keep a directory excluded by name against a "!dir/**/" negation
  • Additional commits viewable in compare view

Updates filelock from 3.17.0 to 3.20.3

Release notes

Sourced from filelock's releases.

3.20.3

What's Changed

Full Changelog: tox-dev/filelock@3.20.2...3.20.3

3.20.2

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.20.1...3.20.2

3.20.1

What's Changed

Full Changelog: tox-dev/filelock@3.20.0...3.20.1

3.20.0

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.19.1...3.20.0

3.19.1

What's Changed

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.0.1 (2026-09-19)

  • poll_interval is now validated at construction, on the setter, and on acquire(): a negative, non-finite, or non-numeric value raises :class:ValueError/:class:TypeError immediately instead of failing inside time.sleep. :pr:739

4.0.0 (2026-09-17)

  • The :class:~filelock.SoftReadWriteLock on-disk protocol is a generation log under <path>.rw, and a process running an earlier release does not see it: an old and a new participant on one lock path do not exclude each other. Stop every participant, upgrade them all, then restart them; the new code ignores leftover .state, .write and .readers/ files, and you can delete them. The filesystem must provide no-replace hard links, as it must for :class:~filelock.StrictSoftFileLock, so a runtime without os.link raises :class:~filelock.SoftFileLockProtocolError on acquire. Constructing a singleton again with a different on_compromise, or with poll_interval at or above stale_threshold, now raises :class:ValueError. :pr:735
  • :class:~filelock.SoftReadWriteLock exposes :attr:~filelock.SoftReadWriteLock.generation as a fencing token for the protected resource and reports a lost hold through on_compromise and :attr:~filelock.SoftReadWriteLock.compromise. :pr:735
  • :class:~filelock.SoftReadWriteLock no longer deadlocks when a holder dies on another host mid-transition, and release() no longer waits on a mutex a dead host left behind (:pr:725, :pr:735). The state mutex is gone. Each transition is one atomic snapshot commit, and liveness is a heartbeat nonce read on the observer's own clock rather than an mtime read against another host's. :pr:735

3.32.7 (2026-09-16)

  • Validate final-symlink refusal by error number so the test works across libc implementations. :pr:737
  • Document that :meth:~filelock.BaseFileLock.acquire reads blocking=None as the lock's blocking attribute and raises :class:~filelock.Timeout after one attempt when blocking=False. :pr:733

3.32.6 (2026-09-08)

  • SoftFileLease and AsyncSoftFileLease now reject a boolean or non-finite lease_duration, which used to publish an owner record their own owner property reads back as malformed. :pr:723
  • Reject non-finite heartbeat, stale, and polling intervals in SoftReadWriteLock and AsyncSoftReadWriteLock, including cached singleton construction and overflow in the default stale threshold. :pr:724

... (truncated)

Commits

Updates fonttools from 4.56.0 to 4.60.2

Release notes

Sourced from fonttools's releases.

4.60.2

  • Backport release Same as 4.61.0 but without "Drop support for EOL Python 3.9" change to allow downstream projects still on Python 3.9 to avail of the security fix for CVE-2025-66034 (#3994, #3999).

4.60.1

  • [ufoLib] Reverted accidental method name change in UFOReader.getKerningGroupConversionRenameMaps that broke compatibility with downstream projects like defcon (#3948, #3947, robotools/defcon#478).
  • [ufoLib] Added test coverage for getKerningGroupConversionRenameMaps method (#3950).
  • [subset] Don't try to subset BASE table; pass it through by default instead (#3949).
  • [subset] Remove empty BaseRecord entries in MarkBasePos lookups (Reviewable

@dependabot
Bump the python-security-updates group across 1 directory with 16 upd…
2c71a78 
…ates

Bumps the python-security-updates group with 16 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [lxml](https://github.com/lxml/lxml) | `5.3.1` | `6.1.0` |
| [black](https://github.com/psf/black) | `25.1.0` | `26.3.1` |
| [poetry](https://github.com/python-poetry/poetry) | `2.0.1` | `2.3.4` |
| [requests](https://github.com/psf/requests) | `2.32.3` | `2.33.0` |
| [bleach](https://github.com/mozilla/bleach) | `6.2.0` | `6.4.0` |
| [dulwich](https://github.com/dulwich/dulwich) | `0.22.7` | `1.2.15` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.17.0` | `3.20.3` |
| [fonttools](https://github.com/fonttools/fonttools) | `4.56.0` | `4.60.2` |
| [idna](https://github.com/kjd/idna) | `3.10` | `3.15` |
| [jinja2](https://github.com/pallets/jinja) | `3.1.5` | `3.1.6` |
| [lxml-html-clean](https://github.com/fedora-python/lxml_html_clean) | `0.4.1` | `0.4.4` |
| [mistune](https://github.com/lepture/mistune) | `2.0.5` | `3.3.3` |
| [msgpack](https://github.com/msgpack/msgpack-python) | `1.1.0` | `1.2.1` |
| [pygments](https://github.com/pygments/pygments) | `2.19.1` | `2.20.0` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.3.0` | `2.7.0` |
| [virtualenv](https://github.com/pypa/virtualenv) | `20.29.2` | `20.36.1` |



Updates `lxml` from 5.3.1 to 6.1.0
- [Release notes](https://github.com/lxml/lxml/releases)
- [Changelog](https://github.com/lxml/lxml/blob/master/CHANGES.txt)
- [Commits](lxml/lxml@lxml-5.3.1...lxml-6.1.0)

Updates `black` from 25.1.0 to 26.3.1
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@25.1.0...26.3.1)

Updates `poetry` from 2.0.1 to 2.3.4
- [Release notes](https://github.com/python-poetry/poetry/releases)
- [Changelog](https://github.com/python-poetry/poetry/blob/main/CHANGELOG.md)
- [Commits](python-poetry/poetry@2.0.1...2.3.4)

Updates `requests` from 2.32.3 to 2.33.0
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.3...v2.33.0)

Updates `bleach` from 6.2.0 to 6.4.0
- [Changelog](https://github.com/mozilla/bleach/blob/main/CHANGES)
- [Commits](mozilla/bleach@v6.2.0...v6.4.0)

Updates `dulwich` from 0.22.7 to 1.2.15
- [Release notes](https://github.com/dulwich/dulwich/releases)
- [Changelog](https://github.com/jelmer/dulwich/blob/main/NEWS)
- [Commits](jelmer/dulwich@dulwich-0.22.7...dulwich-1.2.15)

Updates `filelock` from 3.17.0 to 3.20.3
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.17.0...3.20.3)

Updates `fonttools` from 4.56.0 to 4.60.2
- [Release notes](https://github.com/fonttools/fonttools/releases)
- [Changelog](https://github.com/fonttools/fonttools/blob/main/NEWS.rst)
- [Commits](fonttools/fonttools@4.56.0...4.60.2)

Updates `idna` from 3.10 to 3.15
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.10...v3.15)

Updates `jinja2` from 3.1.5 to 3.1.6
- [Release notes](https://github.com/pallets/jinja/releases)
- [Changelog](https://github.com/pallets/jinja/blob/main/CHANGES.rst)
- [Commits](pallets/jinja@3.1.5...3.1.6)

Updates `lxml-html-clean` from 0.4.1 to 0.4.4
- [Changelog](https://github.com/fedora-python/lxml_html_clean/blob/main/CHANGES.rst)
- [Commits](fedora-python/lxml_html_clean@0.4.1...0.4.4)

Updates `mistune` from 2.0.5 to 3.3.3
- [Release notes](https://github.com/lepture/mistune/releases)
- [Changelog](https://github.com/lepture/mistune/blob/main/docs/changes.rst)
- [Commits](lepture/mistune@v2.0.5...v3.3.3)

Updates `msgpack` from 1.1.0 to 1.2.1
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.1.0...v1.2.1)

Updates `pygments` from 2.19.1 to 2.20.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.19.1...2.20.0)

Updates `urllib3` from 2.3.0 to 2.7.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.3.0...2.7.0)

Updates `virtualenv` from 20.29.2 to 20.36.1
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@20.29.2...20.36.1)

---
updated-dependencies:
- dependency-name: lxml
  dependency-version: 6.1.0
  dependency-type: direct:production
  dependency-group: python-security-updates
- dependency-name: black
  dependency-version: 26.3.1
  dependency-type: direct:development
  dependency-group: python-security-updates
- dependency-name: poetry
  dependency-version: 2.3.4
  dependency-type: direct:development
  dependency-group: python-security-updates
- dependency-name: requests
  dependency-version: 2.33.0
  dependency-type: direct:development
  dependency-group: python-security-updates
- dependency-name: bleach
  dependency-version: 6.4.0
  dependency-type: indirect
  dependency-group: python-security-updates
- dependency-name: dulwich
  dependency-version: 1.2.15
  dependency-type: indirect
  dependency-group: python-security-updates
- dependency-name: filelock
  dependency-version: 3.20.3
  dependency-type: indirect
  dependency-group: python-security-updates
- dependency-name: fonttools
  dependency-version: 4.60.2
  dependency-type: indirect
  dependency-group: python-security-updates
- dependency-name: idna
  dependency-version: '3.15'
  dependency-type: indirect
  dependency-group: python-security-updates
- dependency-name: jinja2
  dependency-version: 3.1.6
  dependency-type: indirect
  dependency-group: python-security-updates
- dependency-name: lxml-html-clean
  dependency-version: 0.4.4
  dependency-type: indirect
  dependency-group: python-security-updates
- dependency-name: mistune
  dependency-version: 3.3.3
  dependency-type: indirect
  dependency-group: python-security-updates
- dependency-name: msgpack
  dependency-version: 1.2.1
  dependency-type: indirect
  dependency-group: python-security-updates
- dependency-name: pygments
  dependency-version: 2.20.0
  dependency-type: indirect
  dependency-group: python-security-updates
- dependency-name: urllib3
  dependency-version: 2.7.0
  dependency-type: indirect
  dependency-group: python-security-updates
- dependency-name: virtualenv
  dependency-version: 20.36.1
  dependency-type: indirect
  dependency-group: python-security-updates
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 19, 2026
@RussTedrake RussTedrake mentioned this pull request Sep 19, 2026
Merged
@dependabot @github

dependabot Bot commented on behalf of github Sep 19, 2026

Copy link
Copy Markdown
Contributor Author

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

@dependabot
dependabot Bot deleted the dependabot/pip/python-security-updates-17ae4d8831 branch September 19, 2026 21:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@RussTedrake