Bump the python group across 1 directory with 15 updates

[dependabot]

Bumps the python group with 15 updates in the / directory:

Package	From	To
click	8.4.2	8.5.0
flask-security-too	5.7.1	5.9.0
flask-caching	2.4.1	2.5.1
sqlalchemy	2.0.51	2.0.54
psycopg2-binary	2.9.12	2.9.13
cryptography	50.0.0	50.0.1
python-dotenv	1.2.2	1.2.3
pytz	2026.2	2026.4
orjson	3.11.9	3.12.0
gunicorn	26.0.0	26.2.0
stripe	15.3.0	15.6.1
chargebee	3.25.0	3.29.0
redis	8.0.1	8.1.0
ruff	0.15.21	0.16.8
pre-commit	4.6.0	4.6.2

Updates click from 8.4.2 to 8.5.0

Release notes

Sourced from click's releases.

8.5.0

This is the Click 8.5.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.5.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-5-0 Milestone https://github.com/pallets/click/milestone/33

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. #2672 #3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. #2986 #3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. #2983 #3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when #2969 began writing the prompt with input() directly. #3572 #3653
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. #2877 #3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). #3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. #3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). #2819 #3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. #3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.5.0

Released 2026-08-24

• Add built-in shell completion support for PowerShell (Windows PowerShell 5.1+ and pwsh 7+) alongside the existing bash, zsh, and fish completers. Use _FOO_BAR_COMPLETE=powershell_source foo-bar to generate the completion script. {issue}2672 {pr}3637
• Supported versions of Windows enable ANSI terminal styles by default. Colorama is no longer a dependency and is not used. {issue}2986 {pr}3505
• {class}Argument accepts a help parameter, and help output includes a Positional arguments section when argument help is available. {issue}2983 {pr}3473
• confirm() and prompt() strip ANSI color and style codes from the prompt when the output stream does not support them, matching echo(). This stripping was lost in 8.4.0 when {pr}2969 began writing the prompt with input() directly. {issue}3572 {pr}3653
• Fix test failures when using pytest >= 9.1. {pr}3656
• {class}Path with allow_dash=True no longer triggers a BytesWarning, an error under python -bb, when checking a value against the - convention. {issue}2877 {pr}3642
• Add {func}custom_version_option, a --version option whose output is produced by a callback, covering cases {func}version_option intentionally does not. The feature set of {func}version_option is now frozen; see [discussion #3527](`@version_option` future direction pallets/click#3527). {pr}3581
• style() and secho() no longer silently drop the 256-color index 0 (black) passed as fg or bg, and now validate color arguments. Invalid colors raise a ValueError instead of a TypeError. {pr}3677
• The automatic help option stores its value under the reserved name _click_default_help instead of help, so a parameter named help no longer breaks parsing. The new name is visible in {meth}Command.to_info_dict output. Parameters that overwrite each other's value trigger a warning: an argument sharing its name with another parameter, or any parameter claiming the reserved name. Options may still share a name to compete for the same value (feature switches). {issue}2819 {pr}3678
• unstyle and the ANSI handling behind help-text wrapping now strip the full CSI escape-sequence grammar. {pr}3681
• Streamline Option flag handling: the flag-kind, type, lazy-default and validation steps in Option.__init__ move into focused helpers, and flag_value and default keep their unset sentinel at construction (resolved lazily on read) so is UNSET reliably tells a user-supplied value from an auto-derived one. Runtime behavior is unchanged, but {meth}Parameter.to_info_dict now resolves default=True on a feature switch to its flag_value, matching what the function receives at call time. {pr}3641
• {func}get_binary_stream and {func}get_text_stream are deprecated and will be removed in Click 9.0. {issue}3481 {pr}3695
• The following click.utils names were never intentionally public and are now private (_-prefixed). The old names remain available with a DeprecationWarning until Click 9.0: LazyFile, KeepOpenFile,

... (truncated)

Commits

• 8b19813 Release version 8.5.0
• 2c8cd3a Add FAQ entry about UnicodeEncodeError on Windows (#3778)
• 131c86a Add FAQ entry about UnicodeEncodeError on Windows
• e1fd594 Add support of pathlib.Path to edit (#3781)
• a1d8785 Add support of pathlib.Path to edit
• 2103e15 Forward all user's parameters set in PAGER and improve flag detection (#3777)
• a6256bf Forwards all user's parameters set in PAGER
• 61b69e9 Resolve the pager command once, in _pager_contextmanager (#3776)
• 9835b0f Resolve the pager command once, in _pager_contextmanager
• f36d58b Refactor pager stream handling (#3767)
• Additional commits viewable in compare view

Updates flask-security-too from 5.7.1 to 5.9.0

Changelog

Sourced from flask-security-too's changelog.

Version 5.9.0

Released September 24, 2026

This release adds support for refresh tokens (finally!). In addition there are several configuration changes that try to align Flask-Security with latest best-practices.

Please read these notes carefully - in particular the change to the default auth token lifetime might severely impact some applications.

Features & Improvements +++++++++++++++++++++++

• (:issue:1206) Add support for refresh tokens. See :ref:token_topic
• (:pr:1233) Change :py:data:SECURITY_TOKEN_MAX_AGE from an int to a timedelta. Also - change default from never expire to 15 minutes.
• (:pr:1235) Change default :py:data:SECURITY_LOGOUT_METHODS to be just "POST"
• (:issue:1228) Change default csrf and tf_validity cookie config to secure=True
• (:issue:1228) The tf_validity cookie name is now configurable via :py:data:SECURITY_TWO_FACTOR_VALIDITY_COOKIE_NAME
• (:issue:1237) Add support for CSRF on logout (default False)
• (:pr:1241) Convert all _WITHIN configuration variables to use timedelta
• (:issue:1153) Enable localization of %(within)s variables using humanize
• (:pr:1249) Add link expiration to confirmation and reset password email templates.
• (:issue:536 Add template path configuration variables for all email templates.
• (:issue:1254) Webauthn/passkey name input value is now sanitized and normalized. A new utility method :py:meth:flask_security.input_svn is now used and is available for applications to use.
• (:pr:1271) Username validation and normalization now uses the new :py:meth:flask_security.input_svn utility. This has some backwards compatibility concerns - see below.
• (:pr:1259) Allow redirects to exactly :py:data:SECURITY_REDIRECT_BASE_DOMAIN by adding '.' to :py:data:SECURITY_REDIRECT_ALLOWED_SUBDOMAINS.

Fixes +++++

• (:issue:1108) /verify and /us-verify forms now include the optional next field so form-posted redirect URLs are validated and preserved. (DSeaStar)
• (:issue:1212) Newly introduced :py:meth:.UserMixin.is_locked logic is inverted.
• (:pr:1234) Fix for GHSA-f66q-9rf6-8795 - WebAuthn reauthentication freshness bypass. (tonghuaroot)
• (:issue:1244) Fix login form remember me checkbox.
• (:pr:1258) A JSON request body can set a form field (email, password, username, identity, name, phone, refresh token, recovery/2FA code, ...) to a non-string value (e.g. a dict), which used to crash with an unhandled TypeError instead of failing validation cleanly. (miettal)
• (:issue:1263) :py:data:SECURITY_CACHE_CONTROL directives were added to every application response instead of just responses from Flask-Security endpoints as documented.
• (:issue:1272) Properly re-export public methods (using redundant symbol aliases).

Docs and Chores +++++++++++++++

... (truncated)

Commits

• 98fd02e Release Version 5.9
• d88c796 Add a test to ensure remember_me doesn't imply fresh session verifica… (#1290)
• f732dd5 Add a test to ensure remember_me doesn't imply fresh session verification
• 5d47d69 Chore - drop 3.10 support; improve pre-commit (#1287)
• 1da258d Chore - drop 3.10 support; improve pre-commit
• 66c5604 Out with dependabot (#1286)
• 702235f Out with dependabot
• 2fd3b6e Convert requirements to dependency_groups (#1284)
• 0d91554 Convert requirements to dependency_groups
• 357f36f More work on pyright --verifytypes (#1283)
• Additional commits viewable in compare view

Updates flask-caching from 2.4.1 to 2.5.1

Release notes

Sourced from flask-caching's releases.

2.5.1

This is the Flask-Caching 2.5.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask-Caching/2.5.1/ Changes: https://flask-caching.readthedocs.io/en/latest/changelog/#version-2-5-1

2.5.0

Note: This release will invalidate your caches because we changed the default hash_method from hashlib.md5 to hashlib.sha256. This can be changed back via CACHE_HASH_METHOD if you wish to still use the old hash_method!

Added / Improved

• Specifying timeouts now also works with datetime.timedelta. #266
• Add config option CACHE_SERIALIZER to set the cachelib serializer the backend uses. #209
• cachelib backends can now be configured directly via CACHE_TYPE="cachelib.ValkeyCache. #668
• Send Signals for cache hits and misses. #237 and #667
• Add Cache.delete_cached() and extend make_cache_key() with path and query_args arguments to make deleting views decorated with cached(query_string=True) possible. #243
• Add CACHE_HASH_METHOD to set the hash method used for the cache keys of @cached and @memoize.
• Add an is_stale option to @cached and @memoize. It is called on a cache hit with the cached value. Unlike forced_update it uses the value itself to check whether the cache is stale. Can be used in combination with forced_update #392
• @cached and @memoize now preserve the wrapped function's signature and expose uncached, cache_timeout, make_cache_key delete_memoized to type checkers.
• Add CACHE_FILE_HASH_METHOD config option to FileSystemCache to allow using a different hash function for cache keys. #660
• Add pool_size and pool_blocking to make MemcachedCache backends thread-safe. #663
• Document that CACHE_REDIS_HOST accepts an already created redis.Redis client instead of a host name, which allows sharing a connection pool with other extensions and the application. #629
• Clarify docs about decorator order regarding @staticmethod and @classmethod when memoizing. #440
• Modify SimpleCache docs as it's now thread-safe using an RLock for all operations. #663

Changed

• Drop support for Python 3.10 and require cachelib 0.17.0+
• Remove the deprecated lowercase CACHE_TYPE names (null, simple, filesystem, redis, redissentinel, rediscluster, uwsgi, memcached, gaememcached, saslmemcached and spreadsaslmemcached)
• Use hashlib.sha256 instead of hashlib.md5 for hashing the cache keys. This changes the generated keys, so entries cached by an earlier version become obsolete. If you wish to still use hashlib.md5 set the config CACHE_HASH_METHOD = hashlib.md5. #563
• @cached and @memoize now go through the public Cache proxy methods (get, set, has, delete, delete_many, get_many and set_many) instead of calling the backend directly. #417
• CACHE_IGNORE_ERRORS is now used by every backend instead of only SimpleCache and FileSystemCache.
• The delete_many method is now used from cachelib. A key that does not exist counts as deleted, and with CACHE_IGNORE_ERRORS set to False a RuntimeError is raised if the key could not be deleted.
• Call @memoize forced_update callbacks once per decorated function call instead of once while making the key and again before cache lookup. #387
• @cached now caches an HTTPException raised by the view (i.e. through abort()). This exception will now be re-raises on a cache hit. Use response_filter, to keep the exception out of the cache. #444
• The {% cache %} Jinja tag no longer propagates backend errors. If the cache is unavailable, the block is rendered normally instead of raising, matching the existing behavior of @memoize. #564 #565

Fixed

• Include key_prefix when building @cached(query_string=True) cache keys. #302
• Fix a @memoize cache-key collision when a parameter has a falsy default (e.g. 0, "", False): calling with the default was keyed the same as passing None, returning the wrong cached result. #656
• Fix @cached(response_hit_indication=True) appending a new after_request function to the app on every request.
• Fix a view returning an iterator of strings, for example when using flask.stream_template it previously returned a list of JSON strings instead of the rendered template. #511
• Fix __caching_id__ never being usable. @memoize silently ignored that and ran the function uncached.
• delete_memoized now takes the instance from a bound method, so cache.delete_memoized(obj.method, 1) deletes the cache for obj.method(1) instead of silently deleting nothing. The current behaviour by passing the instance keeps working as well. #554
• Fix @memoize invalidating a function's entire cache by not updating the memoize version key's timeout. It is now refreshed each time an entry is written, with that entry's own timeout. #531

New Contributors

• @​uttam12331 made their first contribution in pallets-eco/flask-caching#656
• @​deepakganesh78 made their first contribution in pallets-eco/flask-caching#655

... (truncated)

Changelog

Sourced from flask-caching's changelog.

Version 2.5.1

Released 2026-09-04

• @cached no longer treats view arguments named path or query_args as the explicit make_cache_key() arguments of the same name. :issue:679

Version 2.5.0

Released 2026-08-24

• Specifying timeouts now also works with datetime.timedelta. :issue:266
• Add config option CACHE_SERIALIZER to set the cachelib serializer the backend uses. :issue:209
• cachelib backends can now be configured directly via CACHE_TYPE="cachelib.ValkeyCache. :pr:668
• @cached and @memoize now go through the public Cache proxy methods (get, set, has, delete, delete_many, get_many and set_many) instead of calling the backend directly. :issue:417
• Document that CACHE_REDIS_HOST accepts an already created redis.Redis client instead of a host name, which allows sharing a connection pool with other extensions and the application. :issue:629
• Send Signals for cache hits and misses. :pr:[#237](https://github.com/pallets-eco/flask-caching/issues/237) and :pr:667
• Include key_prefix when building @cached(query_string=True) cache keys. :issue:302
• Add Cache.delete_cached() and extend make_cache_key() with path and query_args arguments to make deleting views decorated with cached(query_string=True) possible. :issue:243
• Use hashlib.sha256 instead of hashlib.md5 for hashing the cache keys. This changes the generated keys, so entries cached by an earlier version become obsolete. If you wish to still use hashlib.md5 set the config CACHE_HASH_METHOD = hashlib.md5. :pr:563
• Add CACHE_HASH_METHOD to set the hash method used for the cache keys of @cached and @memoize.
• Drop support for Python 3.10 and require cachelib 0.17.0+
• CACHE_IGNORE_ERRORS is now used by every backend instead of only SimpleCache and FileSystemCache.
• The delete_many method is now used from cachelib. A key that does not exist counts as deleted, and with CACHE_IGNORE_ERRORS set to False a RuntimeError is raised if the key could not be deleted.
• Clarify docs about decorator order regarding @staticmethod and @classmethod when memoizing. :issue:440
• Remove the deprecated lowercase CACHE_TYPE names (null, simple, filesystem, redis, redissentinel, rediscluster, uwsgi, memcached, gaememcached, saslmemcached and spreadsaslmemcached)
• Call @memoize forced_update callbacks once per decorated function

... (truncated)

Commits

• f1ccf5b Merge pull request #682 from pallets-eco/release-v2.5.1
• 45320ad release version 2.5.1
• cd48c77 Fix 'path' and 'query_args' variable in cache key. Fixes #679
• 5330047 fix docs not building
• 3933b3f Allow flit_core 4.x
• 8dd912a Update publish workflow
• 01f0e3f Version 2.5.0
• 66a8e05 Improve exception handling for the cached decorator. Fixes #444
• b09952d Bump cachelib to 0.17.0
• fca9ac2 Convert str to int instead of casting
• Additional commits viewable in compare view

Updates sqlalchemy from 2.0.51 to 2.0.54

Release notes

Sourced from sqlalchemy's releases.

2.0.54

Released: September 15, 2026

platform

• [platform] [change] Binary wheels are no longer built for Python 3.7. PyPI now rejects wheel files whose filename does not begin with the normalized project name, and the packaging tools that can be installed on Python 3.7 do not produce such a filename. As a result, SQLAlchemy 2.0.44 was the last release to publish Python 3.7 wheels to PyPI, and releases 2.0.45 and later have been available on Python 3.7 only as a source distribution; the wheel builds for Python 3.7 are now removed. Python 3.7 remains supported by the 2.0 series.

• [platform] [bug] Fixed issue where the Cython extensions were compiled without the freethreading_compatible directive, so that they did not declare themselves as safe to run without the GIL. On a free-threaded Python interpreter such as Python 3.13t or 3.14t, importing SQLAlchemy would cause the interpreter to re-enable the GIL, emitting a RuntimeWarning. The directive is now set when building for Python 3.13 and above, and a test has been added which confirms that importing SQLAlchemy on a free-threaded build does not enable the GIL.

  References: #13592

2.0.53

Released: September 14, 2026

orm

• [orm] [bug] Fixed issue where an expression passed to _orm.with_expression() that embedded a _sql.select(), such as a correlated _sql.exists(), would fail to populate the attribute correctly on the second and subsequent executions of an otherwise identical statement, when the _orm.query_expression() attribute was loaded by a relationship loader that emits a second query, i.e. _orm.selectinload(), _orm.lazyload() or _orm.immediateload().

  References: #13560

• [orm] [bug] Fixed memory issue where mapped classes, along with their Table and _orm.Mapper objects, would not be garbage collected after the _orm.registry in which they were mapped had been disposed and dereferenced. The issue would occur for mappings that made use of _orm.relationship() together with constructs such as an

... (truncated)

Commits

• See full diff in compare view

Updates psycopg2-binary from 2.9.12 to 2.9.13

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.13 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.15 (:ticket:[#1848](https://github.com/psycopg/psycopg2/issues/1848)).
• Fix parsing of malformed bytea input.
• Fix parsing of malformed int64 input in arrays (:ticket:[#1847](https://github.com/psycopg/psycopg2/issues/1847)).
• Add a pyproject.toml file to declare a PEP 517 build backend (:ticket:[#1788](https://github.com/psycopg/psycopg2/issues/1788)).
• Drop support for Python 3.9.

What's new in psycopg 2.9.12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.14.
• Avoid a segfault passing more arguments than placeholders if Python is built with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
• Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 18.
• Drop support for Python 3.8.

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.13.
• Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
• Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.12.
• Drop support for Python 3.6.

What's new in psycopg 2.9.8

... (truncated)

Commits

• f650e7a chore: bump to release 2.9.13
• 368c8a1 chore!: drop support for Python 3.9
• 9b39e65 chore: drop scaleway build support
• 2ca7041 fix: fix handling of PostgreSQL 18 exceptions
• 5385c02 Build CPython 3.15 wheels
• 1d32e1f ci: only attempt triggering documentation refresh when pushing on main repo
• 433e7b7 chore: add pyproject.toml file to declare a PEP 517 build backend
• 8fb80bc fix: fix parsing of malformed int64 input in arrays
• f98014a fix: fix parsing of malformed bytea input
• 822b79c chore: bump dependencies in binary package
• Additional commits viewable in compare view

Updates cryptography from 50.0.0 to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25

* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.
.. _v50-0-0:

Commits

• ffde75a bump for 50.0.1 + changelog (#15520)
• See full diff in compare view

Updates python-dotenv from 1.2.2 to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

• Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
• set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
• dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
• Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

Commits

• 49515af Bump version: 1.2.2 → 1.2.3
• 8ac846f chore: add release runbook (RELEASING.md) and make release target
• bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
• f7b18d9 fix: round-trip backslashes through set_key (#680)
• 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
• f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
• 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
• 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
• 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
• 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
• Additional commits viewable in compare view

Updates pytz from 2026.2 to 2026.4

Commits

• 1ac6e51 Bump version numbers to 2026.4 (2026d)
• 1672798 IANA 2026d
• 0b5995b Squashed 'tz/' changes from 71f28b9ab3..bac9223f4b
• e96461b Make deprecation notice louder
• 3c7af58 Merge branch 'nicoleman0-fix/timezone-non-string-input' into 2026d
• 234a247 Merge branch 'nicoleman0-fix/fixedoffset-basetzinfo' into 2026d
• 8f8a588 Raise UnknownTimeZoneError for non-string zone arguments
• 1f0f27e Make _FixedOffset a BaseTzInfo exposing _utcoffset
• 661bca9 Bump version numbers to 2026.3.post1 for python2 fix
• 1e31a16 Log python version running tests, force python2
• Additional commits viewable in compare view

Updates orjson from 3.11.9 to 3.12.0

Release notes

Sourced from orjson's releases.

3.12.0

Changed

• Serialization implementation substantially rewritten.
• Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
• No longer publish PyPI wheels for ppc64le and s390x.

Changelog

Sourced from orjson's changelog.

3.12.0 - 2026-08-14

Changed

• Serialization implementation substantially rewritten.
• Publish PyPI wheels for Python 3.15. For Python 3.15 and later, manylinux_2_39 (2024) is targeted instead of manylinux_2_17 (2012).
• No longer publish PyPI wheels for ppc64le and s390x.

Commits

• 6737895 3.12.0
• c2a6e8f JsonWriter, iterators
• 6a2d7a7 yyjson 1ea2fb0
• 97bf170 build update
• See full diff in compare view

Updates gunicorn from 26.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

gunicorn 26.1.0

New Features

• Glob patterns in reload_extra_files: entries containing *, ? or [

... (truncated)

Commits

• 36f2a3c gunicorn 26.2.0
• cbba350 test: cover the h2c edge paths that had none
• 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
• 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
• 5853551 Merge pull request #3712 from Rotzbua/patch-1
• 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
• 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
• 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
• 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
• 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
• Additional commits viewable in compare view

Updates stripe from 15.3.0 to 15.6.1

Release notes

Sourced from stripe's releases.

v15.6.1

• #1896 Harden API requestor code against malicious URLs
• #1898 Use cryptographically secure boundaries for multipart file uploads
• #1860 Dispatch discriminated union fields to their variant class

See the changelog for more details.

v15.6.0

This release changes the pinned API version to 2026-08-26.dahlia.

• #1881 Add new EventNotificationHandler class for better thin event management

  • We've been putting a lot of time into rethinking the event handling experience in the SDKs. This new class is the culmination of that effort.
  • They're designed for a tight coupling with both StripeClient and the fully-typed nature of thin events. This delivers painless event destination upgrades, in-editor checks for common mistakes, and better code modularity.
  • Now that we've released thin event notifications for v1 objects, these new handlers are our recommended path for all integrations using thin event notifications.
  • See more detailed docs here: https://docs.stripe.com/webhooks/event-notification-handlers
  • As part of this work, we've widened some of the types our webhook-related methods take so they play more nicely with the types commonly returned by popular web frameworks (#1888)

• #1876 Update generated code

  • Add support for new resource billing.FeedbackOption
  • Add support for create, deactivate, list, modify, and retrieve methods on resource billing.FeedbackOption
  • Add support for payment_method_settings on AccountSession.Component and AccountSessionCreateParamsComponent
  • Add support for feedback_options on BillingPortal.Configuration.Feature.SubscriptionCancel.CancellationReason, billing_portal.ConfigurationCreateParamsFeatureSubscriptionCancelCancellationReason, and billing_portal.ConfigurationModifyParamsFeatureSubscriptionCancelCancellationReason
  • Add support for new value customer_update on enums BillingPortal.Session.Flow.type and billing_portal.SessionCreateParamsFlowDatum.type
  • Add support for customer_update on BillingPortal.Session.Flow
  • Add support for funding_source_group on Charge.PaymentMethodDetail.Card.Wallet.Link and Charge.PaymentMethodDetail.Link
  • Add support for funding_types_blocked on Checkout.Session.PaymentMethodOption.Card.Restriction and checkout.SessionCreateParamsPaymentMethodOptionCardRestriction
  • Add support for metadata on ConfirmationToken
  • Add support for active_entitlements and customer_portal on CustomerSession.Component and CustomerSessionCreateParamsComponent
  • Add support for country on FinancialConnections.Session.Filter
  • Add support for frozen_fields on InvoiceItem
  • Add support for billie on Invoice.PaymentSetting.PaymentMethodOption, InvoiceCreateParamsPaymentSettingPaymentMethodOption, InvoiceModifyParamsPaymentSettingPaymentMethodOption, Subscription.PaymentSetting.PaymentMethodOption, SubscriptionCreateParamsPaymentSettingPaymentMethodOption, and SubscriptionModifyParamsPaymentSettingPaymentMethodOption
  • Add support for new value billie on enums Invoice.PaymentSetting.payment_method_types, InvoiceCreateParamsPaymentSetting.payment_method_types, InvoiceModifyParamsPaymentSetting.payment_method_types, Subscription.PaymentSetting.payment_method_types, SubscriptionCreateParamsPaymentSetting.payment_method_types, and SubscriptionModifyParamsPaymentSetting.payment_method_types
  • ⚠️ Remove support for cryptogram on PaymentAttemptRecord.PaymentMethodDetail.Card.ThreeDSecure and PaymentRecord.PaymentMethodDetail.Card.ThreeDSecure
  • Add support for new value touch_n_go on enums PaymentIntent.allowed_payment_method_types, PaymentIntentConfirmParams.allowed_payment_method_types, PaymentIntentCreateParams.allowed_payment_method_types, PaymentIntentModifyParams.allowed_payment_method_types, SetupIntent.allowed_payment_method_types, SetupIntentConfirmParams.allowed_payment_method_types, SetupIntentCreateParams.allowed_payment_method_types, and SetupIntentModifyParams.allowed_payment_method_types
  • Change PaymentIntent.allowed_payment_method_types and SetupIntent.allowed_payment_method_types to be required
  • Add support for application_fee_amount, application_fee_percent, on_behalf_of, and transfer_data on PaymentLinkModifyParams
  • Add support for feedback_option on Subscription.CancellationDetail, SubscriptionCancelParamsCancellationDetail, and SubscriptionModifyParamsCancellationDetail
  • Add support for igic on Tax.Registration.CountryOption.At, Tax.Registration.CountryOption.Be, Tax.Registration.CountryOption.Bg, Tax.Registration.CountryOption.Cy, Tax.Registration.CountryOption.Cz, Tax.Registration.CountryOption.De, Tax.Registration.CountryOption.Dk, Tax.Registration.CountryOption.E, Tax.Registration.CountryOption.Ee, Tax.Registration.CountryOption.Fi, Tax.Registration.CountryOption.Fr, Tax.Registration.CountryOption.Gr, Tax.Registration.CountryOption.Hr, Tax.Registration.CountryOption.Hu, Tax.Registration.CountryOption.Ie, Tax.Registration.CountryOption.It, Tax.Registration.CountryOption.Lt, Tax.Registration.CountryOption.Lu, Tax.Registration.CountryOption.Lv, Tax.Registration.CountryOption.Mt, Tax.Registration.CountryOption.Nl, Tax.Registration.CountryOption.Pl, Tax.Registration.CountryOption.Pt, Tax.Registration.CountryOption.Ro, Tax.Registration.CountryOption.Se, Tax.Registration.CountryOption.Si, Tax.Registration.CountryOption.Sk, tax.RegistrationCreateParamsCountryOptionAt, tax.RegistrationCreateParamsCountryOptionBe, tax.RegistrationCreateParamsCountryOptionBg, tax.RegistrationCreateParamsCountryOptionCy, tax.RegistrationCreateParamsCountryOptionCz, tax.RegistrationCreatePa...

    Description has been truncated