From 809e3943ad7ee629850a8c9019f961aaffc1d028 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 5 Jan 2026 10:24:01 +0000 Subject: [PATCH 1/3] Bump certifi from 2025.11.12 to 2026.1.4 (#11920) Bumps [certifi](https://github.com/certifi/python-certifi) from 2025.11.12 to 2026.1.4.
Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=certifi&package-manager=pip&previous-version=2025.11.12&new-version=2026.1.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/doc-spelling.txt | 12 ++++++------ requirements/doc.txt | 10 +++++----- 4 files changed, 13 insertions(+), 13 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 533a3793f50..7807ee24aac 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -36,7 +36,7 @@ brotli==1.2.0 ; platform_python_implementation == "CPython" # via -r requirements/runtime-deps.in build==1.3.0 # via pip-tools -certifi==2025.11.12 +certifi==2026.1.4 # via requests cffi==2.0.0 # via diff --git a/requirements/dev.txt b/requirements/dev.txt index 512b0f83839..282d23e2182 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -36,7 +36,7 @@ brotli==1.2.0 ; platform_python_implementation == "CPython" # via -r requirements/runtime-deps.in build==1.3.0 # via pip-tools -certifi==2025.11.12 +certifi==2026.1.4 # via requests cffi==2.0.0 # via diff --git a/requirements/doc-spelling.txt b/requirements/doc-spelling.txt index ccf6009ba55..8da572fdca4 100644 --- a/requirements/doc-spelling.txt +++ b/requirements/doc-spelling.txt @@ -5,12 +5,12 @@ # pip-compile --allow-unsafe --output-file=requirements/doc-spelling.txt --strip-extras requirements/doc-spelling.in # aiohttp-theme==0.1.7 - # via -r doc.in + # via -r requirements/doc.in alabaster==1.0.0 # via sphinx babel==2.17.0 # via sphinx -certifi==2025.11.12 +certifi==2026.1.4 # via requests charset-normalizer==3.4.4 # via requests @@ -42,7 +42,7 @@ snowballstemmer==3.0.1 # via sphinx sphinx==8.1.3 # via - # -r doc.in + # -r requirements/doc.in # sphinxcontrib-spelling # sphinxcontrib-towncrier sphinxcontrib-applehelp==2.0.0 @@ -58,16 +58,16 @@ sphinxcontrib-qthelp==2.0.0 sphinxcontrib-serializinghtml==2.0.0 # via sphinx sphinxcontrib-spelling==8.0.2 ; platform_system != "Windows" - # via -r doc-spelling.in + # via -r requirements/doc-spelling.in sphinxcontrib-towncrier==0.5.0a0 - # via -r doc.in + # via -r requirements/doc.in tomli==2.3.0 # via # sphinx # towncrier towncrier==25.8.0 # via - # -r doc.in + # -r requirements/doc.in # sphinxcontrib-towncrier urllib3==2.6.2 # via requests diff --git a/requirements/doc.txt b/requirements/doc.txt index 172009f1cc9..1309e2cf11e 100644 --- a/requirements/doc.txt +++ b/requirements/doc.txt @@ -5,12 +5,12 @@ # pip-compile --allow-unsafe --output-file=requirements/doc.txt --resolver=backtracking --strip-extras requirements/doc.in # aiohttp-theme==0.1.7 - # via -r doc.in + # via -r requirements/doc.in alabaster==1.0.0 # via sphinx babel==2.17.0 # via sphinx -certifi==2025.11.12 +certifi==2026.1.4 # via requests charset-normalizer==3.4.4 # via requests @@ -38,7 +38,7 @@ snowballstemmer==3.0.1 # via sphinx sphinx==8.1.3 # via - # -r doc.in + # -r requirements/doc.in # sphinxcontrib-towncrier sphinxcontrib-applehelp==2.0.0 # via sphinx @@ -53,14 +53,14 @@ sphinxcontrib-qthelp==2.0.0 sphinxcontrib-serializinghtml==2.0.0 # via sphinx sphinxcontrib-towncrier==0.5.0a0 - # via -r doc.in + # via -r requirements/doc.in tomli==2.3.0 # via # sphinx # towncrier towncrier==25.8.0 # via - # -r doc.in + # -r requirements/doc.in # sphinxcontrib-towncrier urllib3==2.6.2 # via requests From efab2093017747a72dc974971c6a73121414d9ce Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 5 Jan 2026 10:30:14 +0000 Subject: [PATCH 2/3] Bump filelock from 3.20.1 to 3.20.2 (#11921) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.20.1 to 3.20.2.
Release notes

Sourced from filelock's releases.

3.20.2

What's Changed

New Contributors

Full Changelog: https://github.com/tox-dev/filelock/compare/3.20.1...3.20.2

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=filelock&package-manager=pip&previous-version=3.20.1&new-version=3.20.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/dev.txt | 2 +- requirements/lint.txt | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 7807ee24aac..81041a90ef2 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -69,7 +69,7 @@ exceptiongroup==1.3.1 # via pytest execnet==2.1.2 # via pytest-xdist -filelock==3.20.1 +filelock==3.20.2 # via virtualenv forbiddenfruit==0.1.4 # via blockbuster diff --git a/requirements/dev.txt b/requirements/dev.txt index 282d23e2182..af8f14884b8 100644 --- a/requirements/dev.txt +++ b/requirements/dev.txt @@ -67,7 +67,7 @@ exceptiongroup==1.3.1 # via pytest execnet==2.1.2 # via pytest-xdist -filelock==3.20.1 +filelock==3.20.2 # via virtualenv forbiddenfruit==0.1.4 # via blockbuster diff --git a/requirements/lint.txt b/requirements/lint.txt index 115561f8c07..6e5bcd57027 100644 --- a/requirements/lint.txt +++ b/requirements/lint.txt @@ -29,7 +29,7 @@ distlib==0.4.0 # via virtualenv exceptiongroup==1.3.1 # via pytest -filelock==3.20.1 +filelock==3.20.2 # via virtualenv forbiddenfruit==0.1.4 # via blockbuster From 926d6a2b17e6d858759b21d4b7f7f2f00e400927 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 5 Jan 2026 10:33:31 +0000 Subject: [PATCH 3/3] Bump cython from 3.2.3 to 3.2.4 (#11922) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps [cython](https://github.com/cython/cython) from 3.2.3 to 3.2.4.
Changelog

Sourced from cython's changelog.

3.2.4 (2026-01-04)

Features added

  • In preparation of Cython 3.3, a new decorator @collection_type(tname) can be used to advertise an extension type as being a 'sequence' or 'mapping'. This currently only has the effect of setting the Py_TPFLAGS_SEQUENCE flag on the type or not, but is provided for convenience to allow using the new decorator already in Cython 3.2 code.

  • Several C++ exception declarations were added to libcpp.exceptions. (Github issue :issue:7389)

Bugs fixed

  • Pseudo-literal default values of function arguments like arg=str() could generate invalid C code when internally converted into a real literal. (Github issue :issue:6192)

  • The pickle serialisation of extension types using the auto_pickle feature was larger than necessary since 3.2.0 for types without Python object attributes. It is now back to the state before 3.2.0 again. (Github issue :issue:7443)

  • Constants are now only made immortal on freethreading Python if they are not shared. (Github issue :issue:7439)

  • PyDict_SetDefaultRef() is now used when available to avoid temporary borrowed references. (Github issue :issue:7347)

  • Includes all fixes as of Cython 3.1.8.

Commits

[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=cython&package-manager=pip&previous-version=3.2.3&new-version=3.2.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) ---
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Signed-off-by: dependabot[bot] Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> --- requirements/constraints.txt | 2 +- requirements/cython.txt | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/requirements/constraints.txt b/requirements/constraints.txt index 81041a90ef2..bc17d007bbe 100644 --- a/requirements/constraints.txt +++ b/requirements/constraints.txt @@ -59,7 +59,7 @@ coverage==7.13.1 # pytest-cov cryptography==46.0.3 # via trustme -cython==3.2.3 +cython==3.2.4 # via -r requirements/cython.in distlib==0.4.0 # via virtualenv diff --git a/requirements/cython.txt b/requirements/cython.txt index 667d8f52cd0..03fa291992c 100644 --- a/requirements/cython.txt +++ b/requirements/cython.txt @@ -4,7 +4,7 @@ # # pip-compile --allow-unsafe --output-file=requirements/cython.txt --resolver=backtracking --strip-extras requirements/cython.in # -cython==3.2.3 +cython==3.2.4 # via -r requirements/cython.in multidict==6.7.0 # via -r requirements/multidict.in