Skip to content

Bump the python-dependencies group with 3 updates - #53

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/python-dependencies-6a3eb8615c
Closed

Bump the python-dependencies group with 3 updates#53
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/uv/python-dependencies-6a3eb8615c

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the python-dependencies group with 3 updates: holidays, pyinstaller and uvicorn.

Updates holidays from 0.102 to 0.103

Release notes

Sourced from holidays's releases.

v0.103

Version 0.103

Released August 17, 2026

New Contributors:

Full Changelog: vacanza/holidays@v0.102...v0.103

Changelog

Sourced from holidays's changelog.

Version 0.103

Released August 17, 2026

Commits

Updates pyinstaller from 6.22.0 to 6.22.2

Release notes

Sourced from pyinstaller's releases.

v6.22.2

Please see the v6.22.2 section of the changelog for a list of the changes since v6.22.1.

v6.22.1

Please see the v6.22.1 section of the changelog for a list of the changes since v6.22.0.

Changelog

Sourced from pyinstaller's changelog.

6.22.2 (2026-08-17)

Bugfix


* (Windows) Fix spurious security validation error when a ``onefile``
  executable is launched from a symlinked directory or a junction.
  (:issue:`9508`)

6.22.1 (2026-08-15)


Bugfix

  • Fix invalid spec file generation when :option:--hide-console option is given (regression introduced in v6.22.0). (:issue:9503)
  • (NetBSD) Fix binary dependency analysis. (:issue:9505)
  • (NetBSD) Fix/improve NetBSD support: add the is_netbsd platform flag, treat NetBSD as a Unix platform, and search /usr/local/lib for shared libraries, as is already done for FreeBSD and OpenBSD. (:issue:9496)
  • (OpenBSD) Fix binary dependency analysis. (:issue:9505)

Incompatible Changes


* (POSIX) Executables built in ``onedir`` mode with ``setuid`` bit set
  now validate the owner and permissions on their contents directory
  (typically the ``_internal`` directory); the owner ID must match the
  effective user ID under which the process is running, and the
  permissions on the directory need to be `0700`. This aims to prevent
  unprivileged users from modifying contents of an application that
  runs in privileged mode. (:issue:`9492`)
* (POSIX) When running as a ``onefile`` child process (on POSIX platforms
  other than OpenBSD and AIX), the bootloader now attempts to verify
  the parent process executable via ``procfs`` lookup. This check is
  mandatory for ``onefile`` executables with ``setuid`` bit set; if the
  relevant ``procfs`` entry is inaccessible (for example, due to ``procfs``
  not being mounted, as is the case on FreeBSD by default, or due to access
  being blocked by local security policy), the process will exit with
  security validation error message. For regular ``onefile`` executables
  (without ``setuid`` bit set), the parent-process check is enforced when the
  relevant ``procfs`` entry is accessible, and skipped when it happens to be
  inaccessible. (:issue:`9492`)
* (POSIX) When running as a ``onefile`` child process and the executable
  has ``setuid`` bit set, the bootloader now validates the owner and
  permissions on the (inherited) temporary directory. The owner ID of the
</tr></table>

... (truncated)

Commits
  • 19f42e7 Release v6.22.2. [skip ci]
  • 72bbdb4 bootloader: Windows: use QueryFullProcessImageNameW for executable resolution
  • 0d6941c tests: add test to ensure security validation works with symlinked executables
  • 6e00368 Tests: Requirements: Scheduled weekly dependency update for week 33 (#9506)
  • 22ea0f2 Release v6.22.1. [skip ci]
  • e709c04 bootloader: relax parent-process validation requirements on POSIX platforms
  • e0388d3 bootloader: relax parent-process validation requirements on FreeBSD
  • 92afdf8 tests: test_application_home_directory_hijack: handle 8.3 short paths
  • 4b509a2 tests: improve logging in test_application_home_directory_hijack
  • 66b0249 doc: document the new security validation and its implications
  • Additional commits viewable in compare view

Updates uvicorn from 0.52.3 to 0.52.4

Release notes

Sourced from uvicorn's releases.

Version 0.52.4

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)

Full Changelog: Kludex/uvicorn@0.52.3...0.52.4

Changelog

Sourced from uvicorn's changelog.

0.52.4 (August 18, 2026)

Fixed

  • Remove duplicate Date headers from accepted WebSocket handshakes with websockets-sansio (#3078)
Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python-dependencies group with 3 updates
736f2dd 
Bumps the python-dependencies group with 3 updates: [holidays](https://github.com/vacanza/holidays), [pyinstaller](https://github.com/pyinstaller/pyinstaller) and [uvicorn](https://github.com/Kludex/uvicorn).


Updates `holidays` from 0.102 to 0.103
- [Release notes](https://github.com/vacanza/holidays/releases)
- [Changelog](https://github.com/vacanza/holidays/blob/dev/CHANGES.md)
- [Commits](vacanza/holidays@v0.102...v0.103)

Updates `pyinstaller` from 6.22.0 to 6.22.2
- [Release notes](https://github.com/pyinstaller/pyinstaller/releases)
- [Changelog](https://github.com/pyinstaller/pyinstaller/blob/develop/doc/CHANGES.rst)
- [Commits](pyinstaller/pyinstaller@v6.22.0...v6.22.2)

Updates `uvicorn` from 0.52.3 to 0.52.4
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.52.3...0.52.4)

---
updated-dependencies:
- dependency-name: holidays
  dependency-version: '0.103'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python-dependencies
- dependency-name: pyinstaller
  dependency-version: 6.22.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
- dependency-name: uvicorn
  dependency-version: 0.52.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 24, 2026
@dependabot @github

dependabot Bot commented on behalf of github Aug 31, 2026

Copy link
Copy Markdown
Contributor Author

Looks like these dependencies are updatable in another way, so this is no longer needed.

@dependabot dependabot Bot closed this Aug 31, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/python-dependencies-6a3eb8615c branch August 31, 2026 02:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants