[dependabot]

Bumps the python-dependencies group with 6 updates:

Package	From	To
extract-msg	0.56.1	0.57.0
starlette	1.9.0	1.10.0
alembic	1.20.0	1.20.1
aio-pika	10.1.1	10.2.0
grpcio	1.84.0	1.84.1
playwright	1.64.0	1.64.1

Updates extract-msg from 0.56.1 to 0.57.0

Release notes

Sourced from extract-msg's releases.

Version 0.57.0

v0.57.0

• [Advisory GHSA-cxpg-prmv-g4pp] Fixed a vulnerability related to unchecked input passed out to wkhtmltopdf when converting the MSG file to PDF. Javascript is now strongly blocked from being enabled and will be stripped from the HTML where appropriate before reaching wkhtmltopdf. Additionally, the option --wk-allow-external-files on the command line (or wkAllowExternalFiles to MessageBase.save()) will be required for external files to be loaded into the HTML to convert. Without these, they will be stripped before reaching wkhtmltopdf for security.
• [Advisory GHSA-mqxr-j8rh-p4q4] Fixed an issue where an attacker controlled MSG file could take advantage of a poorly written section of code in the RTF deencapsulation function on the extract-msg side to waste massive amounts of time and memory resources.
• [Advisory GHSA-rgjf-vmqv-8pv9] Change the way multiple type properties are accessed for binary and string. This includes modifications to MSGFile.getMultipleBinary(), MSGFile.getMultipleString(), and MSGFile.exists() to significantly reduce wasted times for malicious files. Malicious files previously could cause extract-msg to do unnecessarily large numbers of calls to MSGFile.exists() which previously did not use caching to speed up its search.
• Changed MSGFile.listDir() to return a tuple of tuples to prevent it's cache results from being tampered with.
• Fixed an issue with MSGFile.listDir() that caused it to not cache in certain circumstances when it should always cache.
• Fixed a check in MSGFile.getMultipleBinary() that executed wrong and did not properly check for bad data.
• Fixed MSGFile._getTypedSteam() to correctly parse binary and string streams when an entry is missing.
• Fixed StandardViolationError being raised without checking error behavior in MSGFile.getMultipleBinary() and MSGFile.getMultipleString().
• Added check for standard violation in MSGFile.getMultipleString() that is raised (or logged, depending on error behavior) if a string stream is missing a null byte. This also doesn't strip the last character in the stream if it is not null.
• Added length check log to MSGFile.getMultipleBinary() and MSGFile.getMultipleString() that checks to see if the expected length for each stream matches what the length stream says. If not, it logs a warning about the mismatch, but does not consider this a gross violation of the standard.
• Changed how MessageBase.deencapsulatedRtf handles RTF data without a closing brace.
• Fixed wrong return being used in extract_msg.encoding.utils.singleByteEncode() and extract_msg.encoding.utils.variableByteEncode().
• Fixed missing return in extract_msg.encoding.utils.singleByteEncode().
• Fixed wrong parameter names for codec types made in extract_msg.encoding.utils.createSBEncoding() and extract_msg.encoding.utils.createVBEncoding().
• Fix some values being incorrectly returned from encode/decode functions in extract_msg.encoding.utils.

Changelog

Sourced from extract-msg's changelog.

v0.57.0

• [Advisory GHSA-cxpg-prmv-g4pp] Fixed a vulnerability related to unchecked input passed out to wkhtmltopdf when converting the MSG file to PDF. Javascript is now strongly blocked from being enabled and will be stripped from the HTML where appropriate before reaching wkhtmltopdf. Additionally, the option --wk-allow-external-files on the command line (or wkAllowExternalFiles to MessageBase.save()) will be required for external files to be loaded into the HTML to convert. Without these, they will be stripped before reaching wkhtmltopdf for security.
• [Advisory GHSA-mqxr-j8rh-p4q4] Fixed an issue where an attacker controlled MSG file could take advantage of a poorly written section of code in the RTF deencapsulation function on the extract-msg side to waste massive amounts of time and memory resources.
• [Advisory GHSA-rgjf-vmqv-8pv9] Change the way multiple type properties are accessed for binary and string. This includes modifications to MSGFile.getMultipleBinary(), MSGFile.getMultipleString(), and MSGFile.exists() to significantly reduce wasted times for malicious files. Malicious files previously could cause extract-msg to do unnecessarily large numbers of calls to MSGFile.exists() which previously did not use caching to speed up its search.
• Changed MSGFile.listDir() to return a tuple of tuples to prevent it's cache results from being tampered with.
• Fixed an issue with MSGFile.listDir() that caused it to not cache in certain circumstances when it should always cache.
• Fixed a check in MSGFile.getMultipleBinary() that executed wrong and did not properly check for bad data.
• Fixed MSGFile._getTypedSteam() to correctly parse binary and string streams when an entry is missing.
• Fixed StandardViolationError being raised without checking error behavior in MSGFile.getMultipleBinary() and MSGFile.getMultipleString().
• Added check for standard violation in MSGFile.getMultipleString() that is raised (or logged, depending on error behavior) if a string stream is missing a null byte. This also doesn't strip the last character in the stream if it is not null.
• Added length check log to MSGFile.getMultipleBinary() and MSGFile.getMultipleString() that checks to see if the expected length for each stream matches what the length stream says. If not, it logs a warning about the mismatch, but does not consider this a gross violation of the standard.
• Changed how MessageBase.deencapsulatedRtf handles RTF data without a closing brace.
• Fixed wrong return being used in extract_msg.encoding.utils.singleByteEncode() and extract_msg.encoding.utils.variableByteEncode().
• Fixed missing return in extract_msg.encoding.utils.singleByteEncode().
• Fixed wrong parameter names for codec types made in extract_msg.encoding.utils.createSBEncoding() and extract_msg.encoding.utils.createVBEncoding().
• Fix some values being incorrectly returned from encode/decode functions in extract_msg.encoding.utils.

v0.56.1

• [[TeamMsgExtractor #484](TeamMsgExtractor/msg-extractor#484 Corrected the way the HTML body is decoded in MessageBase.asEmailMessage() to prevent encoding errors.

v0.56.0

• [[TeamMsgExtractor #478](TeamMsgExtractor/msg-extractor#478 Expand allowable versions of ebcdic to include 2.x. The 2.0 release is a pure technical release with no functional changes; it only drops support for Python 2 and 3.8. The lower bound is unchanged so installs on Python 3.8 will continue to resolve to ebcdic 1.1.1.
• [[TeamMsgExtractor #469](TeamMsgExtractor/msg-extractor#469 Expanded beautifulsoup to allow for versions up to 5.*.*. I was previously hesitant to do so because they sometimes do what seems like non backwards compatible changes in minor versions, but it looks like this should be fine.
• [[TeamMsgExtractor #471](TeamMsgExtractor/msg-extractor#471 Added .strip() to file name determination to ensure that folders with trailing spaces would be corrected before being used.
• [[TeamMsgExtractor #481](TeamMsgExtractor/msg-extractor#481 Fixed a typo that caused an HTML body created from plain text to end with </head> instead of </html>.
• [[TeamMsgExtractor #476](TeamMsgExtractor/msg-extractor#476 Fixed MessageBase.asEmailMessage() raising ValueError when a message has multiple To recipients.

v0.55.0

• [[TeamMsgExtractor #465](TeamMsgExtractor/msg-extractor#465 Added missing msg.close() to openMsg(). If the MSG file was actually just a plain OLE file, it would be left open.
• Adjusted the default value of maxNameLength for MessageBase.save() to 40 instead of 256.
• Adjusted exception handling for MessageBase.save() to properly report the reason a folder fails to be created.
• Simplified some of the code for MessageBase.save().
• Fixed some typing information.

v0.54.1

• [[TeamMsgExtractor #462](TeamMsgExtractor/msg-extractor#462 Fix potential issue where child MSG might have incompatible encoding to parent MSG when trying to grab a stream from the parent.
• Added code to attempt to significantly improve RTF deencapsulation times. This tries to strip away unneeded data before passing it to RTFDE. This shows improvements on all files that take more than one second. Currently, this actually fixes some files previously outputting wrong from RTFDE when deencapsulating the HTML body, specifically around non breaking spaces sometimes not transferring over.

v0.54.0

• [[TeamMsgExtractor #456](TeamMsgExtractor/msg-extractor#456 Changed the prepared html output to use plainly encoded HTML instead of prettified, since current prettification options used mangles the output and causes the output to sometimes be very large.

v0.53.2

• [[TeamMsgExtractor #452](TeamMsgExtractor/msg-extractor#452 Adjusted code to allow html encoding to be cached to try to speed up bs4 operations.
• [[TeamMsgExtractor #453](TeamMsgExtractor/msg-extractor#453 Fixed handler for too large filetimes so that some filetimes being too large doesn't break the handler.
• Fixed a bug that would cause an error in task objects due to a lack of enumerate.
• Fix TOCEntry not initializing DVTargetDevice correctly.
• Add temporary properties for ContentID to SignedAttachment. AFAIK these can't ever be set, but this prevents errors in some places.

v0.53.1

• Expanded allowable range for red-black-tree-mod.

... (truncated)

Commits

• bfa86ed Version 0.57.0
• 6f31da7 Add special case for python version 3.8 and 3.9
• eba2d1f Remove accidentally added line
• a0913aa Remove action usage for pure apt, fix typo
• 3b02409 Correctly try to use packages (forgot to specify that's what I was doing
• 92983fc Update workflow to try and get wkhtmltopdf
• 7baac9b Fix some issues with encodings
• b053db3 Bump date and copyright
• 360d26b Ensure all tests are active
• f27992c Update security policy
• Additional commits viewable in compare view

Updates starlette from 1.9.0 to 1.10.0

Release notes

Sourced from starlette's releases.

Version 1.10.0

📝 Leaner URL-encoded form parsing

Starlette 1.10.0 parses URL-encoded forms with less memory and CPU, no longer drops the last field when a stream ends early, and lets you compare FormData that holds several uploads under one key.

uv pip install starlette==1.10.0

• Forms with many fields parse faster and use less memory (#3724). FormParser builds each field in the parser callbacks instead of queueing every event and replaying it. On CodSpeed, 1000 fields went from 42.8 ms to 34.9 ms and from 63.5 KB to 54.5 KB, and the max_fields limit case went from 6,880 B to 864 B.
• The last field is kept when the request stream ends without an empty chunk (#3599). The parser is now finalized once the stream is exhausted, so custom streams that never yield a final b"" no longer lose their last field.
• FormData with repeated uploads can be compared (#3619). Comparing two FormData objects with several UploadFile values under the same key used to raise TypeError.

⚠️ Behaviour changes

• Multidict equality keeps the order of values under a repeated key (#3619). Keys can still appear in any order, but QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal, matching what getlist() returns.
• starlette.formparsers.FormMessage is deprecated (#3724). The parser no longer uses it, and FormParser.messages is gone. Calling FormMessage(...) emits a StarletteDeprecationWarning.

🧭 Routing and URL generation

• Path parameter values that look like a placeholder are kept as they are (#3725). url_path_for("route", category="{id}", id="42") on /{category}/{id} now returns /{id}/42 instead of /42/42. Substitution also got faster, from 549 ns to 520 ns with two parameters and from 1,078 ns to 779 ns with five.
• Route matching does less work per request (#3665, #3722). Match members are compared by identity, cutting up to 4.9% of the instructions per dispatch in the routing benchmarks.
• WSGIMiddleware strips root_path only at a path segment boundary (#3718). A request to /application under a root_path of /app no longer becomes /lication.
• FloatConvertor reports NaN and infinity correctly (#3716). NaN was reported as a negative float.

🛡️ Middleware, responses and config

• Handled exceptions no longer keep requests alive (#3205). Starlette clears the traceback after an exception handler runs, so an exception instance reused across requests, such as a module-level HTTPException, no longer pins per-request objects in memory.
• Middlewares accept http.response.start without headers (#3721). BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware default the omitted field to an empty list instead of raising KeyError.
• FileResponse ignores Range on methods other than GET and HEAD (#3679). A POST endpoint that returns a file now sends the full file, as RFC 9110 requires.
• Config strips one pair of matching outer quotes from env file values (#3720). KEY='say "hi"' now reads as say "hi" instead of say "hi.

Full changelog: 1.9.0...1.10.0

Changelog

Sourced from starlette's changelog.

1.10.0 (October 24, 2026)

Changed

• Compare multidicts such as FormData and QueryParams by key while keeping the order of values under a repeated key, so FormData with repeated uploads no longer raises TypeError. QueryParams("a=1&a=2") and QueryParams("a=2&a=1") are no longer equal #3619.
• Build URL-encoded form fields in the parser callbacks, lowering memory and CPU usage for forms with many fields #3724.
• Compare Match members by identity during routing #3665 and #3722.

Deprecated

• Deprecate starlette.formparsers.FormMessage, which is no longer used #3724.

Fixed

• Parse the last URL-encoded form field when the request stream ends without an empty chunk #3599.
• Keep path parameter values that look like another placeholder in url_path_for() #3725.
• Default omitted http.response.start headers in BaseHTTPMiddleware, GZipMiddleware and SessionMiddleware instead of raising KeyError #3721.
• Clear the traceback of handled exceptions, so reused exception instances no longer keep per-request objects alive #3205.
• Strip only one pair of matching outer quotes from Config env file values #3720.
• Strip root_path from PATH_INFO only at a path segment boundary in WSGIMiddleware #3718.
• Report NaN and infinity correctly in FloatConvertor.to_string() #3716.
• Ignore Range on requests other than GET and HEAD in FileResponse #3679.

Commits

• 8aa828c Version 1.10.0 (#3728)
• a85a5c3 Substitute URL path parameters in a single pass (#3725)
• 6b8b612 Finalize URL-encoded form parsing at stream exhaustion (#3599)
• b973efd Build URL-encoded form fields in parser callbacks (#3724)
• d7731e0 Compare FormData with repeated uploads without raising TypeError (#3619)
• fb3e818 Compare remaining Match members by identity in routing (#3722)
• fc23aa1 Compare Match members by identity in Router.app (#3665)
• fe000fb Replace the removed route decorator hint in the host routing docs (#3713)
• 4114432 Default omitted http.response.start headers in middlewares (#3721)
• 1a01a02 Clear exc.traceback after handled exceptions to prevent memory leak (#3205)
• Additional commits viewable in compare view

Updates alembic from 1.20.0 to 1.20.1

Release notes

Sourced from alembic's releases.

1.20.1

Released: October 21, 2026

bug

• [bug] [autogenerate] Fixed issue where a table or column comment set to an empty string would cause autogenerate to detect a comment change on every run. As most backends, including PostgreSQL, MySQL, MariaDB and Oracle, don't store an empty string comment distinctly from no comment, autogenerate now treats an empty string comment the same as None when comparing comments. Additionally, an empty string comment is now rendered in op.create_table() and op.add_column() directives, where it was previously omitted. Pull request courtesy vineoy.

  References: #1085

• [bug] [autogenerate] [postgresql] Fixed rendering of the PostgreSQL ~sqlalchemy.dialects.postgresql.DOMAIN type in autogenerated migration scripts. Previously the type was rendered using repr(), which omitted the check, not_null, default, collation, constraint_name, schema and create_type arguments and did not apply a dialect prefix to the underlying data type. The full set of arguments is now rendered and the underlying data type is rendered using the standard type-rendering logic. Pull request courtesy Sebastian Cao.

  References: #1360

• [bug] [autogenerate] [postgresql] Fixed false-positive "Computed default cannot be modified" warning emitted during autogenerate when comparing PostgreSQL Computed columns whose reflected SQL expression includes type cast specifiers such as ::regconfig or ::text, which PostgreSQL adds to the expression as stored. These cast specifiers are now stripped before comparison so that otherwise equivalent expressions no longer trigger the warning. Pull request courtesy Sebastian Cao.

  References: #1462

• [bug] [autogenerate] [postgresql] Fixed issue where autogenerate would detect an unchanged PostgreSQL expression-based index as modified when the expression included type casts, such as a cast to a type with a length or precision, a nested cast, or a cast followed by a DESC modifier.

• [bug] [postgresql] Fixed bug where Operations.alter_column() against a PostgreSQL identity column would render an incomplete, invalid ALTER TABLE ... ALTER COLUMN statement with no clause at all when existing_server_default was omitted, even if there were no existing server default. Pull request courtesy Riti Grover.

... (truncated)

Commits

• See full diff in compare view

Updates aio-pika from 10.1.1 to 10.2.0

Release notes

Sourced from aio-pika's releases.

10.2.0

What's Changed

• Test free-threaded builds and Python 3.15 in CI by @​mosquito in mosquito/aio-pika#735
• Isolate cancellation of close notifications by @​IlyaKhalafi in mosquito/aio-pika#732
• Complete close notifications without a transport by @​IlyaKhalafi in mosquito/aio-pika#731
• Clean up RPC futures when calls fail or are cancelled by @​zhechen-cs in mosquito/aio-pika#725
• Invoke callbacks outside the collection lock by @​zhechen-cs in mosquito/aio-pika#727
• Preserve robust bindings across routing keys and exchange references by @​zhechen-cs in mosquito/aio-pika#726
• Apply host_exceptions in the RPC factory by @​IlyaKhalafi in mosquito/aio-pika#730
• Avoid holding the pool lock while waiting for returned items by @​zhechen-cs in mosquito/aio-pika#724
• Stop keeping queue iterators in memory by @​mosquito in mosquito/aio-pika#736

New Contributors

• @​IlyaKhalafi made their first contribution in mosquito/aio-pika#732
• @​zhechen-cs made their first contribution in mosquito/aio-pika#725

Full Changelog: mosquito/aio-pika@10.1.2...10.2.0

10.1.2

What's Changed

• Require aiormq 7.2.4 by @​mosquito in mosquito/aio-pika#734

Full Changelog: mosquito/aio-pika@10.1.1...10.1.2

Commits

• 8dd3bb7 Merge pull request #736 from mosquito/fix/issue-733-iterator-leak
• 2de9c72 Merge pull request #724 from zhechen-cs/fix/pool-shutdown-lock
• e64c008 Merge pull request #730 from IlyaKhalafi/fix/rpc-factory-host-exceptions
• 2cc8e71 Merge pull request #726 from zhechen-cs/fix/robust-binding-identity
• eac1127 Merge pull request #727 from zhechen-cs/fix/callback-dispatch-lock
• ee16fb8 fix: stop keeping queue iterators in memory
• fa3eeb2 Apply host_exceptions in the RPC factory
• 47cb748 Avoid holding the pool lock while waiting for returned items
• e9a192a Preserve robust bindings across routing keys and exchange references
• 495c109 Merge pull request #725 from zhechen-cs/fix/rpc-call-future-cleanup
• Additional commits viewable in compare view

Updates grpcio from 1.84.0 to 1.84.1

Release notes

Sourced from grpcio's releases.

Release v1.84.1

This is release gRPC Core 1.84.1 (gimbal).

For gRPC documentation, see grpc.io. For previous releases, see Releases.

This release contains refinements, improvements, and bug fixes, with highlights listed below.

Core

• [Backport][v1.84.x][security] Update gRPC repo roots. (#43700)

Commits

• b0c0c4f [Release] Bump version to 1.84.1 (on v1.84.x branch) (#43709)
• 405e6a1 [Backport][v1.84.x][security] Update gRPC repo roots. (#43700)
• 826616a [Backport][v1.84.x][CI] Various macOS CI reliability fixes (#43701)
• 49d6985 [PSM Interop][Backport v1.84.x] Update xDS legacy test scripts for health pro...
• See full diff in compare view

Updates playwright from 1.64.0 to 1.64.1

Release notes

Sourced from playwright's releases.

v1.64.1

Highlights

microsoft/playwright-python#3283 - chore: roll Node.js to 24.22.1

The bundled Node.js 24.22.1 is a security release that distrusts the compromised eMudhra intermediate CAs. The driver uses Node's CA store for its own TLS connections, for example connect_over_cdp to a wss:// endpoint.

Browser Versions

• Chromium 156.0.8078.4
• Mozilla Firefox 157.0
• WebKit 27.2

This version was also tested against the following stable channels:

• Google Chrome 155
• Microsoft Edge 155

Commits

• bcb9deb cherry-pick(#3283): chore: roll Node.js to 24.22.1
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions