Skip to content

Bump the ci-constraints group across 1 directory with 15 updates - #65

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/ci/ci-constraints-080bf05af0
Open

Bump the ci-constraints group across 1 directory with 15 updates#65
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/ci/ci-constraints-080bf05af0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 21, 2026

Copy link
Copy Markdown
Contributor

Bumps the ci-constraints group with 15 updates in the /ci directory:

Package From To
charset-normalizer 3.4.9 3.5.1
filelock 3.32.2 4.0.0
idna 3.18 3.20
imagesize 2.0.0 2.0.1
msgpack 1.2.1 1.2.2
platformdirs 4.11.0 4.11.10
pygments 2.20.0 2.21.0
urllib3 2.7.0 2.8.0
webencodings 0.5.1 0.6.1
cyclonedx-python-lib 11.11.0 11.12.0
pip-api 0.0.34 0.0.35
coverage 7.15.4 7.16.1
setuptools 83.0.0 84.0.0
wheel 0.47.0 0.48.0
flake8-bugbear 25.11.29 26.9.9

Updates charset-normalizer from 3.4.9 to 3.5.1

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.1

3.5.1 (2026-08-15)

Changed

  • Raised upper bound of setuptools to v84 (#794)
  • Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

  • No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

Version 3.5.0

3.5.0 (2026-08-12)

Added

  • Explicit support for Python 3.15

Fixed

  • Comparing a CharsetMatch to a non-alias encoding strings (#773)
  • Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
  • A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
  • iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

  • Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
  • Applied micro-optimization on several utils.
  • CharsetMatches no longer sort on each match insertion.

Misc

  • Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).
Changelog

Sourced from charset-normalizer's changelog.

3.5.1 (2026-08-15)

Changed

  • Raised upper bound of setuptools to v84 (#794)
  • Cache performance access optimization for our CharInfo struct (prebuilt only).

Fixed

  • No longer decoding large content when the noise detector output give a high entropy. Only impacted large content input >1M bytes.

3.5.0 (2026-08-12)

Added

  • Explicit support for Python 3.15

Fixed

  • Comparing a CharsetMatch to a non-alias encoding strings (#773)
  • Return 0.0 CharsetMatch.multi_byte_usage for empty payloads instead of crashing (#774)
  • A file with both a charset declaration and BOM/SIG did not verify first the BOM/SIG charset.
  • iso2022* cases misdetected due to a flaw in our multibyte chunking logic.

Changed

  • Replaced the optional mypyc build with Cython extensions while retaining the pure Python fallback. The previous engine (mypyc) started to hit rough limit around the optimization of our noise/coherence detector while Cython allows us to steer the engine toward the right generated optimized sources. This change SHOULD not impact bundler (e.g. Pyinstaller) as the module are immediately discoverable (i.e. not hidden import like mypyc did). Moreover, a long wished distribution is the abi3 wheels, this will allow us to no longer rush each year when a new Python interpreter is released. We still distribute the interpreter specific wheels for faster performance.
  • Applied micro-optimization on several utils.
  • CharsetMatches no longer sort on each match insertion.

Misc

  • Removed an old performance optimization attempt in apy.py (success_fast_tracked+payload_result_cache).
Commits
  • e239bdc Merge pull request #795 from jawah/release-3.5.1
  • 648ad77 docs: update faq
  • fab2749 docs: write changelog for 3.5.1
  • 7d32774 chore: bump version to 3.5.1
  • 9a69f60 docs: update data/info
  • 5dcc6dd perf: charinfo cache access optimization in cython
  • ea3b447 fix: do not validate-decode large payload when md says it's noise
  • a05917f chore: allow setuptools 84 builds (#794)
  • 3325d87 Merge pull request #792 from jawah/update-cibuildwheel-action
  • 77203b1 chore: reformat noxfile.py
  • Additional commits viewable in compare view

Updates filelock from 3.32.2 to 4.0.0

Release notes

Sourced from filelock's releases.

4.0.0

What's Changed

Full Changelog: tox-dev/filelock@3.32.7...4.0.0

3.32.7

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.32.6...3.32.7

3.32.6

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.32.5...3.32.6

3.32.5

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.32.4...3.32.5

... (truncated)

Changelog

Sourced from filelock's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.0.1 (2026-09-19)

  • poll_interval is now validated at construction, on the setter, and on acquire(): a negative, non-finite, or non-numeric value raises :class:ValueError/:class:TypeError immediately instead of failing inside time.sleep. :pr:739

4.0.0 (2026-09-17)

  • The :class:~filelock.SoftReadWriteLock on-disk protocol is a generation log under <path>.rw, and a process running an earlier release does not see it: an old and a new participant on one lock path do not exclude each other. Stop every participant, upgrade them all, then restart them; the new code ignores leftover .state, .write and .readers/ files, and you can delete them. The filesystem must provide no-replace hard links, as it must for :class:~filelock.StrictSoftFileLock, so a runtime without os.link raises :class:~filelock.SoftFileLockProtocolError on acquire. Constructing a singleton again with a different on_compromise, or with poll_interval at or above stale_threshold, now raises :class:ValueError. :pr:735
  • :class:~filelock.SoftReadWriteLock exposes :attr:~filelock.SoftReadWriteLock.generation as a fencing token for the protected resource and reports a lost hold through on_compromise and :attr:~filelock.SoftReadWriteLock.compromise. :pr:735
  • :class:~filelock.SoftReadWriteLock no longer deadlocks when a holder dies on another host mid-transition, and release() no longer waits on a mutex a dead host left behind (:pr:725, :pr:735). The state mutex is gone. Each transition is one atomic snapshot commit, and liveness is a heartbeat nonce read on the observer's own clock rather than an mtime read against another host's. :pr:735

3.32.7 (2026-09-16)

  • Validate final-symlink refusal by error number so the test works across libc implementations. :pr:737
  • Document that :meth:~filelock.BaseFileLock.acquire reads blocking=None as the lock's blocking attribute and raises :class:~filelock.Timeout after one attempt when blocking=False. :pr:733

3.32.6 (2026-09-08)

  • SoftFileLease and AsyncSoftFileLease now reject a boolean or non-finite lease_duration, which used to publish an owner record their own owner property reads back as malformed. :pr:723
  • Reject non-finite heartbeat, stale, and polling intervals in SoftReadWriteLock and AsyncSoftReadWriteLock, including cached singleton construction and overflow in the default stale threshold. :pr:724

... (truncated)

Commits
  • 7e57436 Release 4.0.0
  • f974328 🐛 fix(soft-rw): replace the state mutex with a generation log (#738)
  • 20929f7 Release 3.32.7
  • 35f07c4 [pre-commit.ci] pre-commit autoupdate (#736)
  • e860d39 📝 docs: say acquire() falls back to the lock's blocking attribute (#733)
  • c530efe Fix final symlink test on musl (#737)
  • 4efd93e Release 3.32.6
  • 7b7b7a8 Fix SoftReadWriteLock state lock timeout (#726)
  • f2f7b86 fix: respect ACL write access when the owner write bit is absent (#728)
  • e947a69 test(soft-rw): reuse existing test module (#730)
  • Additional commits viewable in compare view

Updates idna from 3.18 to 3.20

Release notes

Sourced from idna's releases.

v3.20

  • Update to Unicode 18.0.0.
  • Better enforcement of the domain length limit in the incremental codec.
  • Add support for Python 3.15.

v3.19

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Changelog

Sourced from idna's changelog.

3.20 (2026-09-17)

  • Update to Unicode 18.0.0.
  • Better enforcement of the domain length limit in the incremental codec.
  • Add support for Python 3.15.

3.19 (2026-08-18)

  • Restore the std3_rules option, which had no effect since changes to UTS #46 processing in Unicode 16. Note that uts46_remap() defaults to enabling STD3 rules, so direct callers will see input containing non-LDH ASCII characters rejected again.
  • Performance improvements to UTS #46 mapping, particularly for ASCII-only domains.
  • Test on free-threaded CPython with the GIL disabled and document thread safety.
  • Expose the Unicode version of the generated tables as idna.unicode_version, and show it in idna --version.
  • Add code, text, codepoint and position attributes to IDNAError so that the failed rule and the offending character can be identified without parsing the exception message.
  • The deprecated transitional argument to encode() and uts46_remap() is now completely ignored, and gives a deprecation warning for the latter.
  • Reject A-labels that are not the canonical Punycode encoding of their U-label.
  • Fix CONTEXTJ violations raising IDNAError instead of InvalidCodepointContext.
  • Consistently raise IDNAError for empty labels and non-ASCII bytes passed to label helper functions and the incremental codec.
  • Add property-based tests, extended fuzzing targets, coverage measurement, and CI checks that the data tables match the generator output.
  • Various code quality and tooling improvements.

Thanks to stefan6419846, LouieLuNZ, and Salvatore Corvaglia for contributions to this release.

Commits
  • d55e65e Release 3.20
  • 0c0824a Pre-release 3.20rc0
  • bd7c316 Note Python 3.15 support in the 3.20 changelog
  • b6cce85 Merge pull request #276 from kjd/unicode-18
  • 9a4bc59 Update to Unicode 18.0.0
  • dfab5a0 Merge branch 'python-3.15'
  • 417c354 Read the latest Unicode version from the DerivedAge.txt header instead of the...
  • cd17392 Merge pull request #274 from kjd/fix-decode-length-check
  • c5796d7 Skip the decode round-trip check for domains past encode's length limit
  • d6ee690 Update to Python 3.15 release candidate in CI and add trove classifier
  • Additional commits viewable in compare view

Updates imagesize from 2.0.0 to 2.0.1

Release notes

Sourced from imagesize's releases.

Bug fix

  • Optimize metadata parsing and HTTP range reads.
  • Fix JPEG2000 box parsing.
  • Accept single-quoted SVG dimensions.
  • Return positive heights for top-down BMP images.
  • Remove the upper Python version cap, migrate packaging to pyproject.toml, and add Python 3.15 CI coverage.
  • Bump the package version to 2.0.1 and add recent feedback contributors to the README.

Related issues: shibukawa/imagesize_py#64 shibukawa/imagesize_py#83 shibukawa/imagesize_py#84

Related pull requests: shibukawa/imagesize_py#86 shibukawa/imagesize_py#87 shibukawa/imagesize_py#88 shibukawa/imagesize_py#89 shibukawa/imagesize_py#90 shibukawa/imagesize_py#91 shibukawa/imagesize_py#92

Commits
  • cf87fc0 Prepare release 2.0.1
  • 24992f6 Merge pull request #92 from shibukawa/feature/add-test-python315
  • cda8b07 Add Python 3.15 test coverage
  • a42d408 Merge pull request #91 from shibukawa/feature/fix-issue83
  • a83b14f Merge remote-tracking branch 'origin/master' into feature/fix-issue84
  • a1374b1 Optimize metadata parsing and HTTP range reads
  • d088634 Merge pull request #90 from shibukawa/feature/fix-issue84
  • fde3b5e Fix JPEG2000 box parsing for issue 84
  • 7d5c748 Merge pull request #87 from stephenfin/pyproject
  • efe3db1 Merge pull request #89 from jdillard/fix-64-svg-single-quotes
  • Additional commits viewable in compare view

Updates msgpack from 1.2.1 to 1.2.2

Release notes

Sourced from msgpack's releases.

v1.2.2

What's Changed

New Contributors

Full Changelog: msgpack/msgpack-python@v1.2.1...v1.2.2

Changelog

Sourced from msgpack's changelog.

1.2.2

Release Date: 2026-08-27

  • Fix the read_size documentation. #700
  • Fix silent truncation when unpacking an out-of-range timestamp with timestamp=3. #701
  • Prevent reentrant calls to Unpacker.feed() while unpacking. #704
  • Improve error handling and reporting in unpacking functions. #707
  • Fix Timestamp.from_datetime() precision for far-future datetimes. #710
  • Fix typos in the documentation. #712
  • Validate the nanoseconds range when unpacking timestamps in the C extension. #716
  • Fix a use-after-free in the unpackb() ExtraData path for non-contiguous input. #722
  • Prevent a buffer overflow when converting Packer's buf_size. #726
  • Translate RecursionError to StackError in the fallback Unpacker.skip(). #727
  • Raise OverflowError when use_single_float=True cannot represent a value. #728
Commits
  • 7381b31 release
  • ee1bd3c release v1.2.2 (#730)
  • 57d28a2 Raise OverflowError when use_single_float cannot represent a value (#728)
  • d374a17 Avoid parallel execution of the recursion-limit nesting test on free-threaded...
  • e94e1dc Validate nanoseconds range when unpacking timestamps in the C extension (#716)
  • 2e4be09 fix: translate RecursionError to StackError in fallback Unpacker.skip() (#727)
  • 9f9bdae Convert Packer's buf_size once (#726)
  • 809bfcd remove unused variable
  • 186d4db Bump pypa/cibuildwheel from 4.1.1 to 4.2.0(#724)
  • ea6b84f Bump pypa/gh-action-pypi-publish from 1.14.1 to 1.14.2 in the all-dependencie...
  • Additional commits viewable in compare view

Updates platformdirs from 4.11.0 to 4.11.10

Release notes

Sourced from platformdirs's releases.

4.11.10

What's Changed

Full Changelog: tox-dev/platformdirs@4.11.9...4.11.10

4.11.9

What's Changed

New Contributors

Full Changelog: tox-dev/platformdirs@4.11.8...4.11.9

4.11.8

What's Changed

New Contributors

Full Changelog: tox-dev/platformdirs@4.11.7...4.11.8

4.11.7

Full Changelog: tox-dev/platformdirs@4.11.6...4.11.7

4.11.6

... (truncated)

Changelog

Sourced from platformdirs's changelog.

########### Changelog ###########

.. towncrier-draft-entries:: Unreleased

.. towncrier release notes start

4.11.11 (2026-09-19)

  • Reject appname, appauthor and version values that leave the platform base directory (a .. segment, a leading separator, a drive or a UNC share) with ValueError, so ensure_exists cannot create directories outside it - by :user:Pitchfork-and-Torch. :pr:552

4.11.10 (2026-09-18)

  • With ensure_exists, the site_*_dir and site_*_path properties and the iter_*_dirs iterators only create the site directories they return or yield, instead of every entry in the site list - by :user:darrenhuai. :pr:550

4.11.9 (2026-09-16)

  • Accept multipath in :func:~platformdirs.site_cache_dir and :func:~platformdirs.site_cache_path. Without it, the function API could not return the Homebrew cache prefix that :attr:~platformdirs.macos.MacOS.site_cache_dir adds under multipath - by :user:darrenhuai. :pr:544
  • Parse Unix user-dirs.dirs line by line like xdg-user-dir. The INI parser raised on a repeated key or a line without =, and returned trailing comments and backslash escapes inside :func:~platformdirs.user_documents_dir and the other media directories. The last valid assignment now wins, and platformdirs unescapes the quoted value and ignores text after the closing quote - by :user:darrenhuai. :pr:545
  • Read PUBLIC before the home directory in :func:~platformdirs.user_publicshare_dir on Windows, so it no longer raises RuntimeError when PUBLIC is set and the home directory cannot be determined - by :user:emme1t. :pr:546
  • Raise RuntimeError from :class:~platformdirs.android.Android directories when the app folder cannot be found, instead of TypeError: expected str, bytes or os.PathLike object, not NoneType - by :user:Str0k. :pr:547

4.11.8 (2026-09-08)

  • Make :func:~platformdirs.user_data_path, :func:~platformdirs.user_config_path, :func:~platformdirs.user_preference_path and :func:~platformdirs.user_applications_path return the first site entry when root is redirected by use_site_for_root under multipath, matching their site_*_path twins. They passed the whole joined list to :class:~pathlib.Path, giving one unusable path such as /xdg/a/foo:/xdg/b/foo - by :user:darrenhuai. :pr:538

... (truncated)

Commits
  • 35391fc Release 4.11.10
  • 7d5c85d fix: only create the site dirs a call hands back (#550)
  • 5118d32 👷 ci(release): docstrfmt the changelog before committing it (#551)
  • 4ebd03d Release 4.11.9
  • 0ae539b fix: raise RuntimeError when the Android app folder is missing (#547)
  • de87396 fix: resolve PUBLIC before looking up the user home (#546)
  • 2ba683b fix: accept multipath in the site cache functions (#544)
  • bdb0a67 fix: read user-dirs.dirs as shell assignments, not INI (#545)
  • 5921065 [pre-commit.ci] pre-commit autoupdate (#549)
  • c5ef1ed Release 4.11.8
  • Additional commits viewable in compare view

Updates pygments from 2.20.0 to 2.21.0

Release notes

Sourced from pygments's releases.

2.21.0

  • New lexers:

  • Updated lexers:

    • Bash: Fix coloured keyword at the beginning of a name (#2926)
    • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
    • C#:
      • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
      • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
      • Recognize union (#3182)
    • C/C++:
      • Add C23/C++26 attributes (#3084)
      • Add more C2Y keywords (#3092)
      • Highlight a function following a namespace body (#2928)
      • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
      • Add .ipp as a file extension (#3141, #1008)
    • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
    • Csound: Add missing opcode parameter type letter (#3161)
    • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
    • D: Allow non-ASCII (Unicode) identifiers (#1088)
    • Fish: Fix single quote backslash escape (#3138, #2821)
    • Go: Various lexer improvements (#3199)
    • GoogleSQL: Require a word break after SET (#3167)
    • Hexdump: Only match valid digits (#3200, #2847)
    • JavaScript: Highlight the arguments object (#3146)
    • Jsonnet: Recognize colons in array slice expressions (#2828)
    • JSX: Allow apostrophes in element text (#2816)
    • Julia: Fix rstrings backslash (#3140, #2537)
    • Kotlin: Support companion objects without an explicit name (#2525)
    • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
    • Kusto: Recognize member-access dots in dynamic objects (#2779)
    • Lua: Various improvements (#3143)
    • Macaulay2: Update symbols to 1.26.05 (#3120)
    • Markdown:
      • Highlight bold-italics (***...*** and ___...___) (#3067)
      • Fix mention regex to support hyphens in usernames (#3139, #3135)
    • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for embedded code blocks (#3133)
    • Mathematica: Recognize \[Name] named-character escapes such as \[Nu] instead of emitting an Error token (#3097)

... (truncated)

Changelog

Sourced from pygments's changelog.

Version 2.21.0

(released August 17th, 2026)

  • New lexers:

  • Updated lexers:

    • Bash: Fix coloured keyword at the beginning of a name (#2926)
    • Boogie: Add missing Boogie and Civl Verifier keywords (#3156)
    • C#:
      • Recognize interpolated verbatim strings with either $@ or @$ prefixes (#2685)
      • Support dollar-prefixed and multi-quote raw strings (#3129, #2897)
      • Recognize union (#3182)
    • C/C++:
      • Add C23/C++26 attributes (#3084)
      • Add more C2Y keywords (#3092)
      • Highlight a function following a namespace body (#2928)
      • Fix C/C++ lexer support for multiline pre-processor comments (#3051)
      • Add .ipp as a file extension (#3141, #1008)
    • Clojure: Recognize named, octal and unicode character literals such as \space and \o377 as a single token (#979)
    • Csound: Add missing opcode parameter type letter (#3161)
    • CUDA: Derive from the C++ lexer instead of C to highlight C++ constructs such as template, class and namespace (#3127)
    • D: Allow non-ASCII (Unicode) identifiers (#1088)
    • Fish: Fix single quote backslash escape (#3138, #2821)
    • Go: Various lexer improvements (#3199)
    • GoogleSQL: Require a word break after SET (#3167)
    • Hexdump: Only match valid digits (#3200, #2847)
    • JavaScript: Highlight the arguments object (#3146)
    • Jsonnet: Recognize colons in array slice expressions (#2828)
    • JSX: Allow apostrophes in element text (#2816)
    • Julia: Fix rstrings backslash (#3140, #2537)
    • Kotlin: Support companion objects without an explicit name (#2525)
    • Kotlin: Don't let a nullable type marker (?) consume the following character, so Foo?, and a?:b tokenize correctly (#2964)
    • Kusto: Recognize member-access dots in dynamic objects (#2779)
    • Lua: Various improvements (#3143)
    • Macaulay2: Update symbols to 1.26.05 (#3120)
    • Markdown:
      • Highlight bold-italics (***...*** and ___...___) (#3067)
      • Fix mention regex to support hyphens in usernames (#3139, #3135)
    • Markdown, reStructuredText, TiddlyWiki5: Fix wrong token offsets for

... (truncated)

Commits
  • a43b45d Get ready for the 2.21.0 release.
  • d8f14cb Fix version_added for Purescript.
  • 19c5817 Remove superfluous parentheses from PostgresExplainLexer (#3232)
  • 9992e09 Merge pull request #3191 from jvoisin/dupes
  • bd22577 Fix regexlint warnings after latest update.
  • 6a62df1 Release preparation: Update the changelog.
  • aabba32 Merge pull request #3221 from jvoisin/alter
  • d3441d0 Merge pull request #3225 from jvoisin/caddy
  • c593f3f Add a lexer for Caddy
  • 0644b53 Simplify single-character regex alternations to character classes
  • Additional commits viewable in compare view

Updates urllib3 from 2.7.0 to 2.8.0

Release notes

Sourced from urllib3's releases.

2.8.0

🚀 urllib3 is ...

Description has been truncated

@dependabot
Bump the ci-constraints group across 1 directory with 15 updates
8031e73 
Bumps the ci-constraints group with 15 updates in the /ci directory:

| Package | From | To |
| --- | --- | --- |
| [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.9` | `3.5.1` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.32.2` | `4.0.0` |
| [idna](https://github.com/kjd/idna) | `3.18` | `3.20` |
| [imagesize](https://github.com/shibukawa/imagesize_py) | `2.0.0` | `2.0.1` |
| [msgpack](https://github.com/msgpack/msgpack-python) | `1.2.1` | `1.2.2` |
| [platformdirs](https://github.com/tox-dev/platformdirs) | `4.11.0` | `4.11.10` |
| [pygments](https://github.com/pygments/pygments) | `2.20.0` | `2.21.0` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.7.0` | `2.8.0` |
| [webencodings](https://github.com/CourtBouillon/webencodings) | `0.5.1` | `0.6.1` |
| [cyclonedx-python-lib](https://github.com/CycloneDX/cyclonedx-python-lib) | `11.11.0` | `11.12.0` |
| [pip-api](https://github.com/di/pip-api) | `0.0.34` | `0.0.35` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.15.4` | `7.16.1` |
| [setuptools](https://github.com/pypa/setuptools) | `83.0.0` | `84.0.0` |
| [wheel](https://github.com/pypa/wheel) | `0.47.0` | `0.48.0` |
| [flake8-bugbear](https://github.com/PyCQA/flake8-bugbear) | `25.11.29` | `26.9.9` |



Updates `charset-normalizer` from 3.4.9 to 3.5.1
- [Release notes](https://github.com/jawah/charset_normalizer/releases)
- [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md)
- [Commits](jawah/charset_normalizer@3.4.9...3.5.1)

Updates `filelock` from 3.32.2 to 4.0.0
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.32.2...4.0.0)

Updates `idna` from 3.18 to 3.20
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.18...v3.20)

Updates `imagesize` from 2.0.0 to 2.0.1
- [Release notes](https://github.com/shibukawa/imagesize_py/releases)
- [Commits](shibukawa/imagesize_py@2.0.0...2.0.1)

Updates `msgpack` from 1.2.1 to 1.2.2
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.2.1...v1.2.2)

Updates `platformdirs` from 4.11.0 to 4.11.10
- [Release notes](https://github.com/tox-dev/platformdirs/releases)
- [Changelog](https://github.com/tox-dev/platformdirs/blob/main/docs/changelog.rst)
- [Commits](tox-dev/platformdirs@4.11.0...4.11.10)

Updates `pygments` from 2.20.0 to 2.21.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.20.0...2.21.0)

Updates `urllib3` from 2.7.0 to 2.8.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.7.0...2.8.0)

Updates `webencodings` from 0.5.1 to 0.6.1
- [Release notes](https://github.com/CourtBouillon/webencodings/releases)
- [Changelog](https://github.com/CourtBouillon/webencodings/blob/main/docs/changelog.rst)
- [Commits](CourtBouillon/webencodings@v0.5.1...v0.6.1)

Updates `cyclonedx-python-lib` from 11.11.0 to 11.12.0
- [Release notes](https://github.com/CycloneDX/cyclonedx-python-lib/releases)
- [Changelog](https://github.com/CycloneDX/cyclonedx-python-lib/blob/main/CHANGELOG.md)
- [Commits](CycloneDX/cyclonedx-python-lib@v11.11.0...v11.12.0)

Updates `pip-api` from 0.0.34 to 0.0.35
- [Release notes](https://github.com/di/pip-api/releases)
- [Changelog](https://github.com/di/pip-api/blob/master/CHANGELOG)
- [Commits](di/pip-api@0.0.34...0.0.35)

Updates `coverage` from 7.15.4 to 7.16.1
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.15.4...7.16.1)

Updates `setuptools` from 83.0.0 to 84.0.0
- [Release notes](https://github.com/pypa/setuptools/releases)
- [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst)
- [Commits](pypa/setuptools@v83.0.0...v84.0.0)

Updates `wheel` from 0.47.0 to 0.48.0
- [Release notes](https://github.com/pypa/wheel/releases)
- [Changelog](https://github.com/pypa/wheel/blob/main/docs/news.rst)
- [Commits](pypa/wheel@0.47.0...0.48.0)

Updates `flake8-bugbear` from 25.11.29 to 26.9.9
- [Release notes](https://github.com/PyCQA/flake8-bugbear/releases)
- [Commits](PyCQA/flake8-bugbear@25.11.29...26.9.9)

---
updated-dependencies:
- dependency-name: charset-normalizer
  dependency-version: 3.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: filelock
  dependency-version: 4.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-constraints
- dependency-name: idna
  dependency-version: '3.20'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: imagesize
  dependency-version: 2.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-constraints
- dependency-name: msgpack
  dependency-version: 1.2.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-constraints
- dependency-name: platformdirs
  dependency-version: 4.11.10
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-constraints
- dependency-name: pygments
  dependency-version: 2.21.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: urllib3
  dependency-version: 2.8.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: webencodings
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: cyclonedx-python-lib
  dependency-version: 11.12.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: pip-api
  dependency-version: 0.0.35
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: ci-constraints
- dependency-name: coverage
  dependency-version: 7.16.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: setuptools
  dependency-version: 84.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-constraints
- dependency-name: wheel
  dependency-version: 0.48.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: ci-constraints
- dependency-name: flake8-bugbear
  dependency-version: 26.9.9
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: ci-constraints
...

Signed-off-by: dependabot[bot] <support@github.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ci dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants