Skip to content

Bump the pip-all group across 1 directory with 10 updates#390

Open
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/pip-all-b2db0c2f59
Open

Bump the pip-all group across 1 directory with 10 updates#390
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/pip/pip-all-b2db0c2f59

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 18, 2026 •
edited
Loading

Bumps the pip-all group with 10 updates in the / directory:

Package From To
gunicorn 25.3.0 26.0.0
requests 2.33.1 2.34.2
sentry-sdk 2.59.0 2.60.0
black 26.3.1 26.5.0
coverage 7.13.5 7.14.0
django-stubs 6.0.3 6.0.4
djangorestframework-stubs 3.16.9 3.17.0
mypy 1.20.2 2.1.0
selenium 4.43.0 4.44.0
types-requests 2.33.0.20260503 2.33.0.20260513

Updates gunicorn from 25.3.0 to 26.0.0

Release notes

Sourced from gunicorn's releases.

26.0.0

Breaking Changes

  • Eventlet worker removed: The eventlet worker class has been dropped. Migrate to gevent, gthread, or tornado.

New Features

  • ASGI Framework Compatibility Suite: New end-to-end compatibility test harness covering Starlette, FastAPI, Litestar, Quart, Sanic, and BlackSheep. Current grid passes 438/444 tests (98%).
  • ASGI Test Suite Expansion: 134 additional ASGI unit tests covering protocol semantics, lifespan, websockets, and chunked framing.

Security

  • HTTP/1.1 Request-Target Validation (RFC 9112 sections 3.2.3, 3.2.4):
    • Reject authority-form request-target outside CONNECT
    • Reject asterisk-form request-target outside OPTIONS
    • Reject relative-reference request-targets
  • Header Field Hardening (RFC 9110):
    • Reject control characters in header field-value (section 5.5)
    • Reject forbidden trailer field-names (section 6.5.1)
    • Reject Content-Length list form (RFC 9112 section 6.3)
  • Request Smuggling Hardening:
    • Tighten keepalive gate and scope finish_body byte cap
    • Keep _body_receiver alive across the keepalive smuggling gate so pipelined requests cannot re-enter a closed body
    • Address parser/protocol findings from a six-point WSGI/ASGI audit
  • PROXY Protocol (ASGI): Enforce proxy_allow_ips and tighten v1/v2 parsing in the ASGI callback parser.
  • Connection Draining: Drain the connection on close per RFC 9112 section 9.6 to prevent reset-on-close truncation.

Bug Fixes

  • Body Framing on HEAD/204/304:
    • Keep Content-Length on HEAD and 304 responses (#3621)
    • Drop body framing on HEAD/204/304 even when the framework set it
    • Warn once when an ASGI app emits a body for a no-body response
  • HTTP/2 ASGI:
    • Fix _handle_stream_ended to set _body_complete in the async HTTP/2 handler so request bodies finalize correctly on stream end
    • Add InvalidChunkExtension mapping and fast-parser support in ASGI tests (#3565)
  • HTTP/1.1 100-Continue: Stop adding Transfer-Encoding: chunked to 100-Continue interim responses.
  • WebSocket Close Handshake (RFC 6455):
    • Comply with the close handshake state machine
    • Close the transport after the close handshake completes
    • Fix binary send when the text key is None
  • Early Hints: Validate headers in the early_hints callback to match process_headers; pass only the header name to InvalidHeader (#3588).
  • ASGI Framework Fixes:
    • Fix ASGI disconnect handling for Django-style apps
    • Fix Litestar request handling (use raw ASGI receive for body/headers)
    • Fix Litestar HTTP endpoints for compatibility tests
    • Fix Quart headers endpoint to normalize keys to lowercase
    • Fix Quart WebSocket close test app (missing accept())
    • Fix duplicate Transfer-Encoding header for BlackSheep streaming

... (truncated)

Commits
  • 5d819cf release: 26.0.0
  • b45c70d Merge pull request #3611 from zc-mattcen/docs-typo
  • 99c8d48 Merge pull request #3623 from benoitc/chore/drop-eventlet-add-h2-uvloop-test-...
  • 5a655af Merge pull request #3622 from benoitc/test/docker-port-and-ipv4-fixes
  • 201df19 chore: remove eventlet worker; add h2 and uvloop to test deps
  • f4ac8e1 test: pass action name to dirty client and stabilize after TTOU spam
  • 54d38af test: unblock docker fixtures on macOS hosts
  • 68843c8 Merge pull request #3621 from benoitc/fix/asgi-preserve-content-length-on-hea...
  • 31f2618 Merge pull request #3620 from benoitc/fix/asgi-proxy-protocol-trust-and-parsing
  • 41ec752 fix: keep Content-Length on HEAD and 304 responses
  • Additional commits viewable in compare view

Updates requests from 2.33.1 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)
Commits

Updates sentry-sdk from 2.59.0 to 2.60.0

Release notes

Sourced from sentry-sdk's releases.

2.60.0

Adds a new stream_gen_ai_spans option that controls how gen_ai spans are sent to Sentry. When set, the SDK extracts all gen_ai spans out of a transaction and sends them as v2 envelope items.

Enable this option if gen_ai spans are being dropped because the transaction payload exceeds size limits.

import sentry_sdk
sentry_sdk.init(
dsn='https://examplePublicKey@o0.ingest.sentry.io/0',
stream_gen_ai_spans=True,
)

New Features ✨

Bug Fixes 🐛

Openai

Other

Internal Changes 🔧

Django

Openai

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.60.0

Adds a new stream_gen_ai_spans option that controls how gen_ai spans are sent to Sentry. When set, the SDK extracts all gen_ai spans out of a transaction and sends them as v2 envelope items.

Enable this option if gen_ai spans are being dropped because the transaction payload exceeds size limits.

import sentry_sdk
sentry_sdk.init(
dsn='https://examplePublicKey@o0.ingest.sentry.io/0',
stream_gen_ai_spans=True,
)

New Features ✨

Bug Fixes 🐛

Openai

Other

Internal Changes 🔧

Django

Openai

... (truncated)

Commits
  • e30caaa Update CHANGELOG.md
  • d31ac85 release: 2.60.0
  • fcb9305 feat: Remove truncation when stream_gen_ai_spans is enabled (#6260)
  • 253a4d4 feat: Add option to send GenAI spans in the new span format (#6079)
  • 619d803 test(langchain): Inline global state (#6261)
  • f92c803 Revert "fix: Work around compromised transitive dependency (#6257)" (#6262)
  • 7a303dc Add option to drop scrubbed user IP addresses (#6241)
  • edaa6d6 feat(pymongo): Add span streaming support (#6253)
  • 0e47ead feat(asyncpg): Add cursor span support via BaseCursor method patching (#6252)
  • 17cc8c7 fix: Use proto version 2 to fix backfilled user agent and IP (#6256)
  • Additional commits viewable in compare view

Updates black from 26.3.1 to 26.5.0

Release notes

Sourced from black's releases.

26.5.0

Highlights

  • Add support for unpacking in comprehensions (PEP 798) and for lazy imports (PEP 810), both new syntactic features in Python 3.15 (#5048)
  • Python 3.15 is now supported. Compiled wheels are not yet provided for Python 3.15, so performance may be slower than on existing Python versions. Wheels will be provided once Python 3.15 is later in its release cycle. (#5127)

Stable style

  • Fix # fmt: skip being ignored in nested if expressions with parenthesized in clauses (#4903)
  • Add syntactic support for Python 3.15 (#5048)
  • Fix crash when an f-string follows a # fmt: off comment inside brackets (#5097)
  • Preserve multiline compound statement headers when # fmt: skip is placed on the colon line (#5117)

Preview style

  • Improve heuristics around whether blank lines should appear before, within and after groups of same-name decorated functions (such as @overload groups) in .pyi stub files (#5021)
  • Fix blank lines being removed between a function and a decorated class in .pyi stub files (#5092)
  • Prevent string merger from creating unsplittable long lines when a pragma comment (e.g. # type: ignore) follows the closing bracket (#5096)

Packaging

Output

  • Improve parse error readability by showing multi-line output with an error pointer. (#5068)
  • Add SourceASTParseError to distinguish source parse failures from internal safety errors, improving error reporting when Black's lenient parser accepts input that ast.parse() rejects (#5080)

Blackd

  • Return HTTP 400 (Bad Request) for source parse failures instead of HTTP 500, keeping HTTP 500 only for genuine internal safety errors (#5080)

Integrations

  • Added documentation for doctest formatting tools and updated the integrations index to match (#4916)

... (truncated)

Changelog

Sourced from black's changelog.

Version 26.5.0

Highlights

  • Add support for unpacking in comprehensions (PEP 798) and for lazy imports (PEP 810), both new syntactic features in Python 3.15 (#5048)
  • Python 3.15 is now supported. Compiled wheels are not yet provided for Python 3.15, so performance may be slower than on existing Python versions. Wheels will be provided once Python 3.15 is later in its release cycle. (#5127)

Stable style

  • Fix # fmt: skip being ignored in nested if expressions with parenthesized in clauses (#4903)
  • Add syntactic support for Python 3.15 (#5048)
  • Fix crash when an f-string follows a # fmt: off comment inside brackets (#5097)
  • Preserve multiline compound statement headers when # fmt: skip is placed on the colon line (#5117)

Preview style

  • Improve heuristics around whether blank lines should appear before, within and after groups of same-name decorated functions (such as @overload groups) in .pyi stub files (#5021)
  • Fix blank lines being removed between a function and a decorated class in .pyi stub files (#5092)
  • Prevent string merger from creating unsplittable long lines when a pragma comment (e.g. # type: ignore) follows the closing bracket (#5096)

Packaging

Output

  • Improve parse error readability by showing multi-line output with an error pointer. (#5068)
  • Add SourceASTParseError to distinguish source parse failures from internal safety errors, improving error reporting when Black's lenient parser accepts input that ast.parse() rejects (#5080)

Blackd

  • Return HTTP 400 (Bad Request) for source parse failures instead of HTTP 500, keeping HTTP 500 only for genuine internal safety errors (#5080)

Integrations

  • Added documentation for doctest formatting tools and updated the integrations index to match (#4916)

... (truncated)

Commits

Updates coverage from 7.13.5 to 7.14.0

Changelog

Sourced from coverage's changelog.

Version 7.14.0 — 2026-05-10

  • Feature: now when running one of the reporting commands, if there are parallel data files that need combining, they will be implicitly combined before creating the report. There is no option to avoid the combination; let us know if you have a use case that requires it. Thanks, Tim Hatch <pull 2162_>. Closes issue 1781.

  • Fix: the output from combine was too verbose, listing each file considered. Now it shows a single line with the counts of files combined, files skipped, and files with errors. The -q flag suppresses this line. The old detailed lines are available with the new --debug=combine option.

  • Fix: running a Python file through a symlink now sets the sys.path correctly, matching regular Python behavior. Fixes issue 2157_.

  • Fix: Collector.flush_data could fail with "RuntimeError: Set changed size during iteration" when a tracer in another thread added a line to the per-file set that add_lines (or add_arcs) was iterating. The values passed to CoverageData are now snapshotted via dict.copy() and set.copy(), which are atomic under the GIL. Thanks, Alex Vandiver <pull 2165_>_.

  • Fix: the soft keyword lazy is now bolded in HTML reports.

  • We are no longer testing eventlet support. Eventlet started issuing stern deprecation warnings that break our tests. Our support code is still there.

.. _issue 1781: coveragepy/coveragepy#1781 .. _issue 2157: coveragepy/coveragepy#2157 .. _pull 2162: coveragepy/coveragepy#2162 .. _pull 2165: coveragepy/coveragepy#2165

.. _changes_7-13-5:

Commits
  • 646351b docs: sample HTML for 7.14.0
  • 39cd015 docs: prep for 7.14.0
  • 649e8aa docs: thanks Alex Vandiver for #2165
  • 8cd392e fix: snapshot data in Collector.flush_data to avoid threading race (#2165)
  • c48e0ed fix: less output for combining
  • c2a3a28 docs: explain the change from #2162
  • 1cd47aa fix: implicit combine-during-report now removes the combined data files
  • 2d99fd7 feat: automatically combine coverage in report, thanks Tim Hatch (#2162)
  • 9fbdcdf fix: lazy soft keywords are bolded
  • 5de7d02 build: oops, misplaced quote
  • Additional commits viewable in compare view

Updates django-stubs from 6.0.3 to 6.0.4

Commits

Updates djangorestframework-stubs from 3.16.9 to 3.17.0

Release notes

Sourced from djangorestframework-stubs's releases.

3.17.0

Versioning

This is the first version targeting djangorestframework v3.17 and django-stubs v6.0. However, not all stubs have been updated yet for 3.17:

What's Changed

Housekeeping

New Contributors

Full Changelog: typeddjango/djangorestframework-stubs@3.16.9...3.17.0

Commits

Updates mypy from 1.20.2 to 2.1.0

Changelog

Sourced from mypy's changelog.

Mypy Release Notes

Next Release

Mypy 2.1

We’ve just uploaded mypy 2.1.0 to the Python Package Index (PyPI). Mypy is a static type checker for Python. This release includes new features, performance improvements and bug fixes. You can install it as follows:

python3 -m pip install -U mypy

You can read the full documentation for this release on Read the Docs.

librt.vecs: Fast Growable Array Type for Mypyc

The new librt.vecs module provides an efficient growable array type vec that is optimized for mypyc use. It provides fast, packed arrays with integer and floating point value types, which can be several times faster than list, and tens of times faster than array.array in code compiled using mypyc. It also supports nested vec objects and non-value-type items, such as vec[vec[str]].

Refer to the documentation for the details.

Contributed by Jukka Lehtosalo.

librt.random: Fast Pseudo-Random Number Generation

The new librt.random module provides fast pseudo-random number generation that is optimized for code compiled using mypyc. It can be 3x to 10x faster than the stdlib random module in compiled code.

Refer to the documentation for the details.

Contributed by Jukka Lehtosalo (PR 21433).

Mypyc Improvements

  • Make compilation order with multiple files consistent (Piotr Sawicki, PR 21419)
  • Fix crash on accessing StopAsyncIteration (Piotr Sawicki, PR 21406)
  • Fix incremental compilation with separate flag (Vaggelis Danias, PR 21299)

Fixes to Crashes

  • Fix crash on partial type with --allow-redefinition and global declaration (Jukka Lehtosalo, PR 21428)
  • Fix broken awaitable generator patching (Ivan Levkivskyi, PR 21435)

Changes to Messages

... (truncated)

Commits

Updates selenium from 4.43.0 to 4.44.0

Release notes

Sourced from selenium's releases.

Selenium 4.44.0

Detailed Changelogs by Component

Java     |     Python     |     DotNet     |     Ruby     |     JavaScript

What's Changed

@dependabot
Bump the pip-all group across 1 directory with 10 updates
7d0b319 
Bumps the pip-all group with 10 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [gunicorn](https://github.com/benoitc/gunicorn) | `25.3.0` | `26.0.0` |
| [requests](https://github.com/psf/requests) | `2.33.1` | `2.34.2` |
| [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.59.0` | `2.60.0` |
| [black](https://github.com/psf/black) | `26.3.1` | `26.5.0` |
| [coverage](https://github.com/coveragepy/coveragepy) | `7.13.5` | `7.14.0` |
| [django-stubs](https://github.com/typeddjango/django-stubs) | `6.0.3` | `6.0.4` |
| [djangorestframework-stubs](https://github.com/typeddjango/djangorestframework-stubs) | `3.16.9` | `3.17.0` |
| [mypy](https://github.com/python/mypy) | `1.20.2` | `2.1.0` |
| [selenium](https://github.com/SeleniumHQ/Selenium) | `4.43.0` | `4.44.0` |
| [types-requests](https://github.com/python/typeshed) | `2.33.0.20260503` | `2.33.0.20260513` |



Updates `gunicorn` from 25.3.0 to 26.0.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@25.3.0...26.0.0)

Updates `requests` from 2.33.1 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.1...v2.34.2)

Updates `sentry-sdk` from 2.59.0 to 2.60.0
- [Release notes](https://github.com/getsentry/sentry-python/releases)
- [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md)
- [Commits](getsentry/sentry-python@2.59.0...2.60.0)

Updates `black` from 26.3.1 to 26.5.0
- [Release notes](https://github.com/psf/black/releases)
- [Changelog](https://github.com/psf/black/blob/main/CHANGES.md)
- [Commits](psf/black@26.3.1...26.5.0)

Updates `coverage` from 7.13.5 to 7.14.0
- [Release notes](https://github.com/coveragepy/coveragepy/releases)
- [Changelog](https://github.com/coveragepy/coveragepy/blob/main/CHANGES.rst)
- [Commits](coveragepy/coveragepy@7.13.5...7.14.0)

Updates `django-stubs` from 6.0.3 to 6.0.4
- [Release notes](https://github.com/typeddjango/django-stubs/releases)
- [Commits](typeddjango/django-stubs@6.0.3...6.0.4)

Updates `djangorestframework-stubs` from 3.16.9 to 3.17.0
- [Release notes](https://github.com/typeddjango/djangorestframework-stubs/releases)
- [Commits](typeddjango/djangorestframework-stubs@3.16.9...3.17.0)

Updates `mypy` from 1.20.2 to 2.1.0
- [Changelog](https://github.com/python/mypy/blob/master/CHANGELOG.md)
- [Commits](python/mypy@v1.20.2...v2.1.0)

Updates `selenium` from 4.43.0 to 4.44.0
- [Release notes](https://github.com/SeleniumHQ/Selenium/releases)
- [Commits](SeleniumHQ/selenium@selenium-4.43.0...selenium-4.44.0)

Updates `types-requests` from 2.33.0.20260503 to 2.33.0.20260513
- [Commits](https://github.com/python/typeshed/commits)

---
updated-dependencies:
- dependency-name: gunicorn
  dependency-version: 26.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip-all
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: sentry-sdk
  dependency-version: 2.60.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: black
  dependency-version: 26.5.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: coverage
  dependency-version: 7.14.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: django-stubs
  dependency-version: 6.0.4
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-all
- dependency-name: djangorestframework-stubs
  dependency-version: 3.17.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: mypy
  dependency-version: 2.1.0
  dependency-type: direct:development
  update-type: version-update:semver-major
  dependency-group: pip-all
- dependency-name: selenium
  dependency-version: 4.44.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip-all
- dependency-name: types-requests
  dependency-version: 2.33.0.20260513
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: pip-all
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels May 18, 2026
@sonarqubecloud
Copy link
Copy Markdown

sonarqubecloud Bot commented May 18, 2026

Quality Gate Passed Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants