Bump the uv group across 1 directory with 2 updates by dependabot[bot] · Pull Request #7756 · ethyca/fides

dependabot · 2026-03-25T17:46:05Z

Bumps the uv group with 2 updates in the / directory: requests and werkzeug.

Updates requests from 2.32.5 to 2.33.0

Release notes

v2.33.0

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

New Contributors

@M0d3v1 made their first contribution in psf/requests#6865

@aminvakil made their first contribution in psf/requests#7220

@E8Price made their first contribution in psf/requests#6960

@mitre88 made their first contribution in psf/requests#7244

@magsen made their first contribution in psf/requests#6553

@Rohan5commit made their first contribution in psf/requests#7227

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2330-2026-03-25

Changelog

Sourced from requests's changelog.

2.33.0 (2026-03-25)

Announcements

📣 Requests is adding inline types. If you have a typed code base that uses Requests, please take a look at #7271. Give it a try, and report any gaps or feedback you may have in the issue. 📣

Security

CVE-2026-25645 requests.utils.extract_zipped_paths now extracts contents to a non-deterministic location to prevent malicious file replacement. This does not affect default usage of Requests, only applications calling the utility function directly.

Improvements

Migrated to a PEP 517 build system using setuptools. (#7012)

Bugfixes

Fixed an issue where an empty netrc entry could cause malformed authentication to be applied to Requests on Python 3.11+. (#7205)

Deprecations

Dropped support for Python 3.9 following its end of support. (#7196)

Documentation

Various typo fixes and doc improvements.

Commits

bc04dfd v2.33.0
66d21cb Merge commit from fork
8b9bc8f Move badges to top of README (#7293)
e331a28 Remove unused extraction call (#7292)
753fd08 docs: fix FAQ grammar in httplib2 example
774a0b8 docs(socks): same block as other sections
9c72a41 Bump github/codeql-action from 4.33.0 to 4.34.1
ebf7190 Bump github/codeql-action from 4.32.0 to 4.33.0
0e4ae38 docs: exclude Response.is_permanent_redirect from API docs (#7244)
d568f47 docs: clarify Quickstart POST example (#6960)
Additional commits viewable in compare view

Updates werkzeug from 3.0.6 to 3.1.6

Release notes

Sourced from werkzeug's releases.

3.1.6

This is the Werkzeug 3.1.6 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.6/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-6

safe_join on Windows does not allow special devices names in multi-segment paths. GHSA-29vq-49wr-vm6x

3.1.5

This is the Werkzeug 3.1.5 security fix release, which fixes security issues and bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.5/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-5 Milestone: https://github.com/pallets/werkzeug/milestone/43?closed=1

safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. GHSA-87hc-h4r5-73f7

The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. #3065 #3077

Fix AttributeError when initializing DebuggedApplication with pin_security=False. #3075

3.1.4

This is the Werkzeug 3.1.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.4/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-4 Milestone: https://github.com/pallets/werkzeug/milestone/42?closed=1

safe_join on Windows does not allow special device names. This prevents reading from these when using send_from_directory. secure_filename already prevented writing to these. ghsa-hgf8-39gv-g3f2

The debugger pin fails after 10 attempts instead of 11. #3020

The multipart form parser handles a \r\n sequence at a chunk boundary. #3065

Improve CPU usage during Watchdog reloader. #3054

Request.json annotation is more accurate. #3067

Traceback rendering handles when the line number is beyond the available source lines. #3044

HTTPException.get_response annotation and doc better conveys the distinction between WSGI and sans-IO responses. #3056

3.1.3

This is the Werkzeug 3.1.3 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.

PyPI: https://pypi.org/project/Werkzeug/3.1.3/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-3 Milestone: https://github.com/pallets/werkzeug/milestone/41?closed=1

Initial data passed to MultiDict and similar interfaces only accepts list, tuple, or set when passing multiple values. It had been changed to accept any Collection, but this matched types that should be treated as single values, such as bytes. #2994

When the Host header is not set and Request.host falls back to the WSGI SERVER_NAME value, if that value is an IPv6 address it is wrapped in [] to match the Host header. #2993

3.1.2

This is the Werkzeug 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes vs 3.1.0.

PyPI: https://pypi.org/project/Werkzeug/3.1.2/ Changes: https://werkzeug.palletsprojects.com/en/stable/changes/#version-3-1-2

... (truncated)

Changelog

Sourced from werkzeug's changelog.

Version 3.1.6

Released 2026-02-19

safe_join on Windows does not allow special devices names in multi-segment paths. :ghsa:29vq-49wr-vm6x

Response.make_conditional sets the Accept-Ranges header even if it is not a satisfiable range request. :issue:3108

Version 3.1.5

Released 2026-01-08

safe_join on Windows does not allow more special device names, regardless of extension or surrounding spaces. :ghsa:87hc-h4r5-73f7

The multipart form parser handles a \r\n sequence at a chunk boundary. This fixes the previous attempt, which caused incorrect content lengths. :issue:3065 :issue:3077

Fix AttributeError when initializing DebuggedApplication with pin_security=False. :issue:3075

Version 3.1.4

Released 2025-11-28

safe_join on Windows does not allow special device names. This prevents reading from these when using send_from_directory. secure_filename already prevented writing to these. :ghsa:hgf8-39gv-g3f2

The debugger pin fails after 10 attempts instead of 11. :pr:3020

The multipart form parser handles a \r\n sequence at a chunk boundary. :issue:3065

Improve CPU usage during Watchdog reloader. :issue:3054

Request.json annotation is more accurate. :issue:3067

Traceback rendering handles when the line number is beyond the available source lines. :issue:3044

HTTPException.get_response annotation and doc better conveys the distinction between WSGI and sans-IO responses. :issue:3056

Version 3.1.3

Released 2024-11-08

Initial data passed to MultiDict and similar interfaces only accepts

... (truncated)

Commits

04da1b5 release version 3.1.6
f407712 Merge commit from fork
f54fe98 safe_join prevents Windows special device names in multi-segment paths
d005985 start version 3.1.6
8565c2c document rule priority (#3102)
3febc7e document rule priority
2525b82 remove state machine docs
4abfbd5 rewrite build docstring (#3097)
161c18b rewrite build docstring
86e11c2 release version 3.1.5 (#3085)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

vercel · 2026-03-25T17:46:10Z

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
fides-plus-nightly	Ignored	Preview	Mar 26, 2026 0:19am
fides-privacy-center	Ignored		Mar 26, 2026 0:19am

github-actions · 2026-03-25T17:46:22Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)

See the Details below.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA d0bfa0f.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

uv.lock

greptile-apps · 2026-03-25T17:47:37Z

Greptile Summary

This is a routine Dependabot security dependency bump updating requests from 2.32.5 → 2.33.0 and werkzeug from 3.0.6 → 3.1.6, both of which carry security fixes.

requests 2.33.0 — Addresses CVE-2026-25645 in requests.utils.extract_zipped_paths (non-deterministic extraction to prevent malicious file replacement), fixes a malformed-auth bug with empty netrc entries on Python 3.11+, and drops Python 3.9 support. The version specifier was relaxed from ~=2.32.5 (patch-only) to >=2.32.5,<2.34.0 to accommodate the minor-version bump.
werkzeug 3.1.6 — Resolves three safe_join Windows security advisories (GHSA-29vq-49wr-vm6x, GHSA-87hc-h4r5-73f7, GHSA-hgf8-39gv-g3f2) and several multipart-parser and debugger bugs introduced between 3.0.6 and 3.1.6. Werkzeug is a dev-only dependency, so the security impact is limited to development environments. The minor-version jump (3.0 → 3.1) is low-risk given Werkzeug's strong semver adherence and the fact that it is only used in dev.
The uv.lock hashes are consistent with the updated specifiers and match the published PyPI artifacts.

Confidence Score: 5/5

This PR is safe to merge — it contains only automated security-fix dependency bumps with no logic changes.
Both updates are security-driven and well-understood. requests 2.33.0 is a minor release with a CVE fix and backward-compatible changes. werkzeug is a dev-only dependency, so the 3.0 → 3.1 minor bump carries minimal production risk. The lockfile hashes are correct and there are no code changes to review.
No files require special attention.

Important Files Changed

Filename	Overview
pyproject.toml	Updates `requests` version specifier from `~=2.32.5` to `>=2.32.5,<2.34.0` to allow the 2.33.0 bump, and pins `werkzeug` from `3.0.6` to `3.1.6` in dev dependencies.
uv.lock	Lockfile updated with new hashes and URLs for `requests` 2.33.0 and `werkzeug` 3.1.6; all entries are consistent with the pyproject.toml changes.

_{Reviews (1): Last reviewed commit: "Bump the uv group across 1 directory wit..." | Re-trigger Greptile}

Bumps the uv group with 2 updates in the / directory: [requests](https://github.com/psf/requests) and [werkzeug](https://github.com/pallets/werkzeug). Updates `requests` from 2.32.5 to 2.33.0 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.5...v2.33.0) Updates `werkzeug` from 3.0.6 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@3.0.6...3.1.6) --- updated-dependencies: - dependency-name: requests dependency-version: 2.33.0 dependency-type: direct:production dependency-group: uv - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: direct:development dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Mar 25, 2026

dependabot bot mentioned this pull request Mar 25, 2026

Bump werkzeug from 3.0.6 to 3.1.6 in the uv group across 1 directory #7717

Closed

dependabot bot force-pushed the dependabot/uv/uv-00e99168f7 branch 2 times, most recently from 9fe9c43 to 3e30c26 Compare March 25, 2026 20:56

dependabot bot force-pushed the dependabot/uv/uv-00e99168f7 branch from 3e30c26 to d0bfa0f Compare March 26, 2026 00:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the uv group across 1 directory with 2 updates#7756

Bump the uv group across 1 directory with 2 updates#7756
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/uv/uv-00e99168f7

dependabot bot commented on behalf of github Mar 25, 2026 •

edited

Loading

Uh oh!

vercel bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Mar 25, 2026 •

edited

Loading

Uh oh!

greptile-apps bot commented Mar 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot bot commented on behalf of github Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.33.0

2.33.0 (2026-03-25)

New Contributors

2.33.0 (2026-03-25)

3.1.6

3.1.5

3.1.4

3.1.3

3.1.2

Version 3.1.6

Version 3.1.5

Version 3.1.4

Version 3.1.3

Uh oh!

vercel bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Mar 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Snapshot Warnings

Scanned Files

Uh oh!

greptile-apps bot commented Mar 25, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Mar 25, 2026 •

edited

Loading

vercel bot commented Mar 25, 2026 •

edited

Loading

github-actions bot commented Mar 25, 2026 •

edited

Loading