Bump the pip-minor-patch group across 1 directory with 6 updates

[dependabot]

Bumps the pip-minor-patch group with 6 updates in the /backend directory:

Package	From	To
django	4.2.26	4.2.27
psycopg-binary	3.2.13	3.3.2
psycopg	3.2.13	3.3.2
boto3	1.41.3	1.42.22
pillow	12.0.0	12.1.0
pywebpush	2.1.0	2.2.0

Updates django from 4.2.26 to 4.2.27

Commits

• 5948e66 [4.2.x] Bumped version for 4.2.27 release.
• 4d2b880 [4.2.x] Fixed CVE-2025-64460 -- Corrected quadratic inner text accumulation i...
• f997037 [4.2.x] Fixed CVE-2025-13372 -- Protected FilteredRelation against SQL inject...
• 4b5dcc9 [4.2.x] Added script to archive EOL stable branches.
• 0e85bdb [4.2.x] Refs #36743 -- Added missing release notes for 5.1.15 and 4.2.27.
• e697349 [4.2.x] Fixed #36743 -- Increased URL max length enforced in HttpResponseRedi...
• 7d7f27b [4.2.x] Added timeout-minutes directive to all GitHub Actions workflows.
• b40c057 [4.2.x] Added stub release notes and release date for 4.2.27.
• b794e74 [4.2.x] Configured dangerous-triggers zizmor rule.
• 6a80390 [4.2.x] Addressed unpinned-uses zizmor finding.
• Additional commits viewable in compare view

Updates psycopg-binary from 3.2.13 to 3.3.2

Changelog

Sourced from psycopg-binary's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Current release

Psycopg 3.3.2 ^^^^^^^^^^^^^

Fix race condition in adapters at startup (:ticket:[#1230](https://github.com/psycopg/psycopg/issues/1230)).

Psycopg 3.3.1 ^^^^^^^^^^^^^

Fix iteration on server-side cursors (:ticket:[#1226](https://github.com/psycopg/psycopg/issues/1226)).

Psycopg 3.3.0

.. rubric:: New top-level features

• Add :ref:template strings queries \<template-strings> (:ticket:[#1054](https://github.com/psycopg/psycopg/issues/1054)).
• More flexible :ref:composite adaptation<adapt-composite>: it is now possible to adapt Python objects to PostgreSQL composites and back even if they are not sequences or if they take keyword arguments (:ticket:[#932](https://github.com/psycopg/psycopg/issues/932), 🎫[#1202](https://github.com/psycopg/psycopg/issues/1202)).
• Cursors are now iterators_, not just iterables_. This means you can call next\ (cur) or anext\ (cur), which is useful as a :ref:type-safe expression <typing-fetchone> (:ticket:[#1064](https://github.com/psycopg/psycopg/issues/1064)).
• Add Cursor.set_result() and Cursor.results() to move across the result sets of queries executed though ~Cursor.executemany() or ~Cursor.execute() with multiple statements (:tickets:[#1080](https://github.com/psycopg/psycopg/issues/1080), [#1170](https://github.com/psycopg/psycopg/issues/1170)).
• Add :ref:transaction-status to report the status during and after a ~Connection.transaction() block (:ticket:[#969](https://github.com/psycopg/psycopg/issues/969)).
• Allow to change loaders using ~adapt.AdaptersMap.register_loader() on Cursor.adapters after a query result has been already returned (:ticket:[#884](https://github.com/psycopg/psycopg/issues/884)).

.. rubric:: New libpq wrapper features

• Add pq.PGconn.used_gssapi attribute and Capabilities.has_used_gssapi() function (:ticket:[#1138](https://github.com/psycopg/psycopg/issues/1138)).
• Add ConnectionInfo.full_protocol_version attribute,

... (truncated)

Commits

• bc9e7bd chore: bump psycopg package version to 3.3.2
• 3bcabb4 Merge pull request #1231 from noirbee/fix/1230-adapter-get-dumper-race-condition
• 08bfe00 fix(adapters): avoid race condition when replacing class name with itself
• 7be710e fix: mark external libpq C functions as noexcept nogil
• 6a24300 docs: larger font for 3.3.0 release
• 5a60a1e chore: bump psycopg package version to 3.3.2.dev1
• 9bdd78c chore: bump psycopg package version to 3.3.1
• 4d27426 Merge branch 'fix/server-cursor-iter'
• b9b82e8 fix: fix iteration on server-side cursor
• 2a75357 fix: add test to verify iteration in server-side cursor broken
• Additional commits viewable in compare view

Updates psycopg from 3.2.13 to 3.3.2

Changelog

Sourced from psycopg's changelog.

.. currentmodule:: psycopg

.. index:: single: Release notes single: News

psycopg release notes

Current release

Psycopg 3.3.2 ^^^^^^^^^^^^^

Fix race condition in adapters at startup (:ticket:[#1230](https://github.com/psycopg/psycopg/issues/1230)).

Psycopg 3.3.1 ^^^^^^^^^^^^^

Fix iteration on server-side cursors (:ticket:[#1226](https://github.com/psycopg/psycopg/issues/1226)).

Psycopg 3.3.0

.. rubric:: New top-level features

• Add :ref:template strings queries \<template-strings> (:ticket:[#1054](https://github.com/psycopg/psycopg/issues/1054)).
• More flexible :ref:composite adaptation<adapt-composite>: it is now possible to adapt Python objects to PostgreSQL composites and back even if they are not sequences or if they take keyword arguments (:ticket:[#932](https://github.com/psycopg/psycopg/issues/932), 🎫[#1202](https://github.com/psycopg/psycopg/issues/1202)).
• Cursors are now iterators_, not just iterables_. This means you can call next\ (cur) or anext\ (cur), which is useful as a :ref:type-safe expression <typing-fetchone> (:ticket:[#1064](https://github.com/psycopg/psycopg/issues/1064)).
• Add Cursor.set_result() and Cursor.results() to move across the result sets of queries executed though ~Cursor.executemany() or ~Cursor.execute() with multiple statements (:tickets:[#1080](https://github.com/psycopg/psycopg/issues/1080), [#1170](https://github.com/psycopg/psycopg/issues/1170)).
• Add :ref:transaction-status to report the status during and after a ~Connection.transaction() block (:ticket:[#969](https://github.com/psycopg/psycopg/issues/969)).
• Allow to change loaders using ~adapt.AdaptersMap.register_loader() on Cursor.adapters after a query result has been already returned (:ticket:[#884](https://github.com/psycopg/psycopg/issues/884)).

.. rubric:: New libpq wrapper features

• Add pq.PGconn.used_gssapi attribute and Capabilities.has_used_gssapi() function (:ticket:[#1138](https://github.com/psycopg/psycopg/issues/1138)).
• Add ConnectionInfo.full_protocol_version attribute,

... (truncated)

Commits

• bc9e7bd chore: bump psycopg package version to 3.3.2
• 3bcabb4 Merge pull request #1231 from noirbee/fix/1230-adapter-get-dumper-race-condition
• 08bfe00 fix(adapters): avoid race condition when replacing class name with itself
• 7be710e fix: mark external libpq C functions as noexcept nogil
• 6a24300 docs: larger font for 3.3.0 release
• 5a60a1e chore: bump psycopg package version to 3.3.2.dev1
• 9bdd78c chore: bump psycopg package version to 3.3.1
• 4d27426 Merge branch 'fix/server-cursor-iter'
• b9b82e8 fix: fix iteration on server-side cursor
• 2a75357 fix: add test to verify iteration in server-side cursor broken
• Additional commits viewable in compare view

Updates boto3 from 1.41.3 to 1.42.22

Commits

• 3d9e762 Merge branch 'release-1.42.22'
• 49b583a Bumping version to 1.42.22
• 9f9109b Add changelog entries from botocore
• 2686568 Merge branch 'release-1.42.21'
• de1e0fc Merge branch 'release-1.42.21' into develop
• 526ed55 Bumping version to 1.42.21
• 63fc7f0 Add changelog entries from botocore
• 9af28cc Merge branch 'release-1.42.20'
• f09d123 Merge branch 'release-1.42.20' into develop
• d2abf5f Bumping version to 1.42.20
• Additional commits viewable in compare view

Updates pillow from 12.0.0 to 12.1.0

Release notes

Sourced from pillow's releases.

12.1.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.1.0.html

Deprecations

• Deprecate getdata(), in favour of new get_flattened_data() #9292 [@​radarhere]

Documentation

• Specify APNG duration type when opening #9368 [@​radarhere]
• Added release notes for #9350 #9366 [@​radarhere]
• Update ImageMorph documentation #9349 [@​radarhere]
• Docs: update major bump cadence #9334 [@​hugovk]
• Add release notes for #9070 #9320 [@​radarhere]
• Updated Ubuntu version #9306 [@​radarhere]
• Update macOS tested Pillow versions #9265 [@​radarhere]

Dependencies

• Update harfbuzz to 12.3.0 #9355 [@​radarhere]
• Update xz to 5.8.2 #9343 [@​radarhere]
• Updated libjpeg-turbo to 3.1.3 #9333 [@​radarhere]
• Updated zlib-ng to 2.3.2 #9324 [@​radarhere]
• Updated libpng to 1.6.53 #9325 [@​radarhere]
• Update actions/checkout action to v6 #9323 [@renovate[bot]]
• Update dependency mypy to v1.19.0 #9322 [@renovate[bot]]
• Updated libpng to 1.6.51 #9305 [@​radarhere]
• Updated brotli to 1.2.0 #9284 [@​radarhere]
• Update libimagequant to 4.4.1 #9301 [@​radarhere]
• Update zlib-ng to 2.3.1, except on manylinux2014 aarch64 #9312 [@​radarhere]
• Updated harfbuzz to 12.2.0 #9289 [@​radarhere]
• Update github-actions #9277 [@renovate[bot]]

Testing

• Replace pre-commit with prek #9360 [@​hugovk]
• Test PyQt6 on Python 3.14 on Windows #9353 [@​radarhere]
• Test 32-bit Windows on Windows Server 2022 #9345 [@​radarhere]
• Correct variable type #9335 [@​radarhere]
• Fix ResourceWarnings in selftest.py #9332 [@​hugovk]
• Fix testing good P mode BMP images #9319 [@​radarhere]
• Test Python 3.15 pre-release #9331 [@​hugovk]
• Test ImageFont.ImageFont, in case freetype2 is not supported #9287 [@​radarhere]
• Add Fedora 43 #9290 [@​radarhere]
• Remove Fedora 41 #9260 [@​radarhere]

Type hints

• Add ImageFile context manager #9367 [@​radarhere]
• Assert fp is not None #8617 [@​radarhere]

... (truncated)

Commits

• 46f45f6 12.1.0 version bump
• c9ac097 Simplify band splitting (#9291)
• 3baedf2 Deprecate getdata(), in favour of new get_flattened_data() (#9292)
• b51a036 Specify APNG duration type when opening (#9368)
• 8d08e31 Add release notes for #9348 (#9369)
• 432707e Added release notes for #9348
• 2d58910 Specify APNG duration type when opening
• 8dee8dd Add ImageFile context manager (#9367)
• b2d9bc3 Support saving APNG float durations (#9365)
• f130c10 Allow 1 mode images in MorphOp (#9348)
• Additional commits viewable in compare view

Updates pywebpush from 2.1.0 to 2.2.0

Changelog

Sourced from pywebpush's changelog.

2.2.0 (2026-)

• Update rst files to reflect md file changes

Add comment discussing additional work for Windows Notification Service (WNS)

• Update the README.md file to mention the required, non-standard headers.

BREAKING_CHANGE This version also drops legacy support for GCM/FCM authorization keys, since those items are obsolete according to Google. See https://firebase.google.com/docs/cloud-messaging/auth-server#authorize-legacy-protocol-send-requests

2.1.2 (2025-11-10)

chore: fix formatting chore: update CHANGELOG chore: note admin update

2.1.1 (2025-10-14)

This was an administrative push to test a new publication system.

Commits

• See full diff in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
pywebpush	[< 2.1, > 2.0.0]
pywebpush	[< 2.2, > 2.1.0]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}