Skip to content

Bump the uv group across 1 directory with 8 updates - #10

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-216464c371
Open

Bump the uv group across 1 directory with 8 updates#10
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-216464c371

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Feb 3, 2026

Copy link
Copy Markdown

Bumps the uv group with 8 updates in the / directory:

Package From To
wagtail 7.0.2 7.0.4
authlib 1.6.1 1.6.6
django 5.2.4 5.2.9
django-allauth 65.10.0 65.13.0
filelock 3.16.1 3.20.3
marshmallow 4.0.0 4.1.2
urllib3 2.5.0 2.6.3
virtualenv 20.32.0 20.36.1

Updates wagtail from 7.0.2 to 7.0.4

Release notes

Sourced from wagtail's releases.

7.0.4

  • Fix: Prevent error on custom generic create and edit views without a header icon (Sage Abdullah)
  • Fix: CVE-2026-25517: Improper permission handling on admin preview endpoints (thxtech, Matt Westcott, Jake Howard)

7.0.3

  • Fix: Prevent crash when previewing a form page with an empty field type (Sage Abdullah)
Changelog

Sourced from wagtail's changelog.

7.0.4 (03.02.2026)


 * Fix: Prevent error on custom generic create and edit views without a header icon (Sage Abdullah)
 * Fix: CVE-2026-25517: Improper permission handling on admin preview endpoints (thxtech, Matt Westcott, Jake Howard)

7.0.3 (28.08.2025)

  • Fix: Prevent crash when previewing a form page with an empty field type (Sage Abdullah)
Commits

Updates authlib from 1.6.1 to 1.6.6

Release notes

Sourced from authlib's releases.

v1.6.6

What's Changed

New Contributors

Full Changelog: authlib/authlib@v1.6.5...v1.6.6

v1.6.5

What's Changed

New Contributors

Full Changelog: authlib/authlib@v1.6.4...v1.6.5

v1.6.4

What's Changed

New Contributors

Full Changelog: authlib/authlib@v1.6.3...v1.6.4

Version 1.6.3

What's Changed

... (truncated)

Changelog

Sourced from authlib's changelog.

Version 1.6.6

Released on Dec 12, 2025

  • get_jwt_config takes a client parameter, :pr:844.
  • Fix incorrect signature when Content-Type is x-www-form-urlencoded for OAuth 1.0 Client, :pr:778.
  • Use expires_in in OAuth2Token when expires_at is unparsable, :pr:842.
  • Always track state in session for OAuth client integrations.

Version 1.6.5

Released on Oct 2, 2025

  • RFC7591 generate_client_info and generate_client_secret take a request parameter.
  • Add size limitation when decode JWS/JWE to prevent DoS.
  • Add size limitation for DEF JWE zip algorithm.

Version 1.6.4

Released on Sep 17, 2025

  • Fix InsecureTransportError error raising. :issue:795
  • Fix response_mode=form_post with Starlette client. :issue:793
  • Validate crit header value, reject unprotected header in crit header.

Version 1.6.3

Released on Aug 26, 2025

  • OIDC id_token are signed according to id_token_signed_response_alg client metadata. :issue:755

Version 1.6.2

Released on Aug 23, 2025

  • Temporarily restore OAuth2Request body parameter. :issue:781 :pr:791
  • Allow 127.0.0.1 in insecure transport mode. :pr:788
  • Raise MissingCodeException when the code parameter is missing. :issue:793 :pr:794
  • Fix id_token generation with EdDSA algs. :issue:799 :pr:800
Commits
  • bb7a315 chore: release 1.6.6
  • 0a423d4 Merge pull request #844 from azmeuk/806-get-jwt-config-client
  • 2808378 Merge commit from fork
  • 714502a feat: get_jwt_config takes a client parameter
  • 260d04e Fix: Use expires_in when expires_at is unparsable
  • eb37124 Merge pull request #778 from shc261392/fix-httpx-oauth1-form-data-incorrect-s...
  • 0ba9ec4 docs: fix guide on requests self signed certificate
  • a2e9943 docs: indicate that #743 needs a migration
  • 06015d2 test: factorize the token fixture
  • 9ec4256 chore: release 1.6.5
  • Additional commits viewable in compare view

Updates django from 5.2.4 to 5.2.9

Commits
  • c14b756 [5.2.x] Bumped version for 5.2.9 release.
  • 99e7d22 [5.2.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation i...
  • 479415c [5.2.x] Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL inject...
  • da1dfe6 [5.2.x] Fixed #36712 -- Evaluated type annotations lazily in template tag reg...
  • e2ddec4 [5.2.x] Refs #36743 -- Corrected docstring for DisallowedRedirect.
  • b83ee61 [5.2.x] Closed temporary files in OverwritingStorageTests.test_save_overwrite...
  • 645dc99 [5.2.x] Refs #35535 -- Used intended decorator in test_simple_block_tag_paren...
  • 8558605 [5.2.x] Added link to Python Pickle documentation in docs/topics/cache.txt.
  • de1dc3a [5.2.x] Fixed outdated redis-py link in cache docs.
  • ee92d41 [5.2.x] Highlighted community package upgrade utilities in docs/howto/upgrade...
  • Additional commits viewable in compare view

Updates django-allauth from 65.10.0 to 65.13.0

Commits

Updates filelock from 3.16.1 to 3.20.3

Release notes

Sourced from filelock's releases.

3.20.3

What's Changed

Full Changelog: tox-dev/filelock@3.20.2...3.20.3

3.20.2

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.20.1...3.20.2

3.20.1

What's Changed

Full Changelog: tox-dev/filelock@3.20.0...3.20.1

3.20.0

What's Changed

New Contributors

Full Changelog: tox-dev/filelock@3.19.1...3.20.0

3.19.1

What's Changed

... (truncated)

Commits

Updates marshmallow from 4.0.0 to 4.1.2

Changelog

Sourced from marshmallow's changelog.

4.1.2 (2025-12-19)

Bug fixes:

  • :cve:2025-68480: Merge error store messages without rebuilding collections. Thanks 카푸치노 for reporting and :user:deckar01 for the fix.

4.1.1 (2025-11-05)

Bug fixes:

  • Ensure URL validator is case-insensitive when using custom schemes (:pr:2874). Thanks :user:T90REAL for the PR.

4.1.0 (2025-11-01)

Other changes:

  • Add __len__ implementation to missing so that it can be used with validate.Length <marshmallow.validate.Length> (:pr:2861). Thanks :user:agentgodzilla for the PR.
  • Drop support for Python 3.9 (:pr:2363).
  • Test against Python 3.14 (:pr:2864).

4.0.1 (2025-08-28)

Bug fixes:

  • Fix wildcard import of from marshmallow import * (:pr:2823). Thanks :user:Florian-Laport for the PR.
Commits
  • 692e79d Merge pull request #2876 from marshmallow-code/delint
  • 045c5f6 [pre-commit.ci] auto fixes from pre-commit.com hooks
  • 94c4d98 Delint
  • d24a0c9 Merge commit from fork
  • 1682640 Bump version and update changelog
  • 36f8787 Only deep copy error message collections
  • 70141f4 Add test coverage for error message modification
  • 218d98a Merge error store messages without rebuilding collections
  • 80f1110 Bump version and update changelog
  • 10fe10b Merge pull request #2874 from T90REAL/fix_case_sensitivity
  • Additional commits viewable in compare view

Updates urllib3 from 2.5.0 to 2.6.3

Release notes

Sourced from urllib3's releases.

2.6.3

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

2.6.2

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

  • Fixed HTTPResponse.read_chunked() to properly handle leftover data in the decoder's buffer when reading compressed chunked responses. (urllib3/urllib3#3734)

2.6.1

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Changes

  • Restore previously removed HTTPResponse.getheaders() and HTTPResponse.getheader() methods. (#3731)

2.6.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

  • Fixed a security issue where streaming API could improperly handle highly compressed HTTP content ("decompression bombs") leading to excessive resource consumption even when a small amount of data was requested. Reading small chunks of compressed data is safer and much more efficient now. (CVE-2025-66471 reported by @​Cycloctane, 8.9 High, GHSA-2xpw-w6gg-jr37)
  • Fixed a security issue where an attacker could compose an HTTP response with virtually unlimited links in the Content-Encoding header, potentially leading to a denial of service (DoS) attack by exhausting system resources during decoding. The number of allowed chained encodings is now limited to 5. (CVE-2025-66418 reported by @​illia-v, 8.9 High, GHSA-gm62-xv2j-4w53)

[!IMPORTANT]

  • If urllib3 is not installed with the optional urllib3[brotli] extra, but your environment contains a Brotli/brotlicffi/brotlipy package anyway, make sure to upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 to benefit from the security fixes and avoid warnings. Prefer using urllib3[brotli] to install a compatible Brotli package automatically.

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.6.3 (2026-01-07)

  • Fixed a high-severity security issue where decompression-bomb safeguards of the streaming API were bypassed when HTTP redirects were followed. (GHSA-38jv-5279-wg99 <https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99>__)
  • Started treating Retry-After times greater than 6 hours as 6 hours by default. ([#3743](https://github.com/urllib3/urllib3/issues/3743) <https://github.com/urllib3/urllib3/issues/3743>__)
  • Fixed urllib3.connection.VerifiedHTTPSConnection on Emscripten. ([#3752](https://github.com/urllib3/urllib3/issues/3752) <https://github.com/urllib3/urllib3/issues/3752>__)

2.6.2 (2025-12-11)

  • Fixed HTTPResponse.read_chunked() to properly handle leftover data in the decoder's buffer when reading compressed chunked responses. ([#3734](https://github.com/urllib3/urllib3/issues/3734) <https://github.com/urllib3/urllib3/issues/3734>__)

2.6.1 (2025-12-08)

  • Restore previously removed HTTPResponse.getheaders() and HTTPResponse.getheader() methods. ([#3731](https://github.com/urllib3/urllib3/issues/3731) <https://github.com/urllib3/urllib3/issues/3731>__)

2.6.0 (2025-12-05)

Security

  • Fixed a security issue where streaming API could improperly handle highly compressed HTTP content ("decompression bombs") leading to excessive resource consumption even when a small amount of data was requested. Reading small chunks of compressed data is safer and much more efficient now. (GHSA-2xpw-w6gg-jr37 <https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37>__)
  • Fixed a security issue where an attacker could compose an HTTP response with virtually unlimited links in the Content-Encoding header, potentially leading to a denial of service (DoS) attack by exhausting system resources during decoding. The number of allowed chained encodings is now limited to 5. (GHSA-gm62-xv2j-4w53 <https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53>__)

.. caution::

  • If urllib3 is not installed with the optional urllib3[brotli] extra, but your environment contains a Brotli/brotlicffi/brotlipy package anyway, make sure to upgrade it to at least Brotli 1.2.0 or brotlicffi 1.2.0.0 to benefit from the security fixes and avoid warnings. Prefer using

... (truncated)

Commits
  • 0248277 Release 2.6.3
  • 8864ac4 Merge commit from fork
  • 70cecb2 Fix Scorecard issues related to vulnerable dev dependencies (#3755)
  • 41f249a Move "v2.0 Migration Guide" to the end of the table of contents (#3747)
  • fd4dffd Patch VerifiedHTTPSConnection for Emscripten (#3752)
  • 13f0bfd Handle massive values in Retry-After when calculating time to sleep for (#3743)
  • 8c480bf Bump actions/upload-artifact from 5.0.0 to 6.0.0 (#3748)
  • 4b40616 Bump actions/cache from 4.3.0 to 5.0.1 (#3750)
  • 82b8479 Bump actions/download-artifact from 6.0.0 to 7.0.0 (#3749)
  • 34284cb Mention experimental features in the security policy (#3746)
  • Additional commits viewable in compare view

Updates virtualenv from 20.32.0 to 20.36.1

Release notes

Sourced from virtualenv's releases.

20.36.1

What's Changed

Full Changelog: pypa/virtualenv@20.36.0...20.36.1

20.36.0

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.35.3...20.36.0

20.35.4

What's Changed

New Contributors

Full Changelog: pypa/virtualenv@20.35.3...20.35.4

20.35.3

... (truncated)

Changelog

Sourced from virtualenv's changelog.

v20.36.1 (2026-01-09)

Bugfixes - 20.36.1

- Fix TOCTOU vulnerabilities in app_data and lock directory creation that could be exploited via symlink attacks - reported by :user:`tsigouris007`, fixed by :user:`gaborbernat`. (:issue:`3013`)

v20.36.0 (2026-01-07)


Features - 20.36.0

  • Add support for PEP 440 version specifiers in the --python flag. Users can now specify Python versions using operators like >=, <=, ~=, etc. For example: virtualenv --python=">=3.12" myenv . (:issue:2994`)

v20.35.4 (2025-10-28)

Bugfixes - 20.35.4

- Fix race condition in ``_virtualenv.py`` when file is overwritten during import, preventing ``NameError`` when ``_DISTUTILS_PATCH`` is accessed - by :user:`gracetyy`. (:issue:`2969`)
- Upgrade embedded wheels:

    

  • pip to 25.3 from 25.2 (:issue:2989)
    • 



v20.35.3 (2025-10-10)


Bugfixes - 20.35.3

  • Accept RuntimeError in test_too_many_open_files, by :user:esafak (:issue:2935)

v20.35.2 (2025-10-10)

Bugfixes - 20.35.2

- Revert out changes related to the extraction of the discovery module - by :user:`gaborbernat`. (:issue:`2978`)

v20.35.1 (2025-10-09)


Bugfixes - 20.35.1

  • Patch get_interpreter to handle missing cache and app_data - by :user:esafak (:issue:2972)
  • Fix backwards incompatible changes to PythonInfo - by :user:gaborbernat. (:issue:2975)

v20.35.0 (2025-10-08)

Features - 20.35.0

... (truncated)

Commits
  • d0ad11d release 20.36.1
  • dec4cec Merge pull request #3013 from gaborbernat/fix-sec
  • 5fe5d38 release 20.36.0 (#3011)
  • 9719376 release 20.36.0
  • 0276db6 Add support for PEP 440 version specifiers in the --python flag. (#3008)
  • 4f900c2 Fix Interpreter discovery bug wrt. Microsoft Store shortcut using Latin-1 (#3...
  • 13afcc6 fix: resolve EncodingWarning in tox upgrade environment (#3007)
  • 31b5d31 [pre-commit.ci] pre-commit autoupdate (#2997)
  • 7c28422 fix: update filelock dependency version to 3.20.1 to fix CVE CVE-2025-68146 (...
  • 365628c test_too_many_open_files: assert on errno.EMFILE instead of strerror (#3001)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the uv group across 1 directory with 8 updates
a9aadd7 
Bumps the uv group with 8 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [wagtail](https://github.com/wagtail/wagtail) | `7.0.2` | `7.0.4` |
| [authlib](https://github.com/authlib/authlib) | `1.6.1` | `1.6.6` |
| [django](https://github.com/django/django) | `5.2.4` | `5.2.9` |
| [django-allauth](https://github.com/sponsors/pennersr) | `65.10.0` | `65.13.0` |
| [filelock](https://github.com/tox-dev/py-filelock) | `3.16.1` | `3.20.3` |
| [marshmallow](https://github.com/marshmallow-code/marshmallow) | `4.0.0` | `4.1.2` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.5.0` | `2.6.3` |
| [virtualenv](https://github.com/pypa/virtualenv) | `20.32.0` | `20.36.1` |



Updates `wagtail` from 7.0.2 to 7.0.4
- [Release notes](https://github.com/wagtail/wagtail/releases)
- [Changelog](https://github.com/wagtail/wagtail/blob/main/CHANGELOG.txt)
- [Commits](wagtail/wagtail@v7.0.2...v7.0.4)

Updates `authlib` from 1.6.1 to 1.6.6
- [Release notes](https://github.com/authlib/authlib/releases)
- [Changelog](https://github.com/authlib/authlib/blob/main/docs/changelog.rst)
- [Commits](authlib/authlib@v1.6.1...v1.6.6)

Updates `django` from 5.2.4 to 5.2.9
- [Commits](django/django@5.2.4...5.2.9)

Updates `django-allauth` from 65.10.0 to 65.13.0
- [Commits](https://github.com/sponsors/pennersr/commits)

Updates `filelock` from 3.16.1 to 3.20.3
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.16.1...3.20.3)

Updates `marshmallow` from 4.0.0 to 4.1.2
- [Changelog](https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst)
- [Commits](marshmallow-code/marshmallow@4.0.0...4.1.2)

Updates `urllib3` from 2.5.0 to 2.6.3
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.5.0...2.6.3)

Updates `virtualenv` from 20.32.0 to 20.36.1
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@20.32.0...20.36.1)

---
updated-dependencies:
- dependency-name: wagtail
  dependency-version: 7.0.4
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: authlib
  dependency-version: 1.6.6
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: django
  dependency-version: 5.2.9
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: django-allauth
  dependency-version: 65.13.0
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: filelock
  dependency-version: 3.20.3
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: marshmallow
  dependency-version: 4.1.2
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: urllib3
  dependency-version: 2.6.3
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: virtualenv
  dependency-version: 20.36.1
  dependency-type: direct:production
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Feb 3, 2026
@sonarqubecloud

sonarqubecloud Bot commented Feb 3, 2026

Copy link
Copy Markdown

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants