Skip to content

Bump the python group with 9 updates#864

Merged
djperrefort merged 1 commit into
mainfrom
dependabot/pip/python-5e4d235e8a
Jul 1, 2026
Merged

Bump the python group with 9 updates#864
djperrefort merged 1 commit into
mainfrom
dependabot/pip/python-5e4d235e8a

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 1, 2026

Copy link
Copy Markdown
Contributor

Bumps the python group with 9 updates:

Package From To
django 5.2.14 5.2.15
django-environ 0.13.0 0.14.0
django-health-check 4.4.1 4.4.3
django-jazzmin 3.0.4 3.0.5
faker 40.20.0 40.27.0
nh3 0.3.5 0.3.6
redis 7.4.0 8.0.1
servestatic 4.3.0 4.3.1
uvicorn 0.48.0 0.49.0

Updates django from 5.2.14 to 5.2.15

Commits
  • 21e9840 [5.2.x] Bumped version for 5.2.15 release.
  • 9b62b0a [5.2.x] Fixed CVE-2026-48587 -- Ignored whitespace padding when checking Vary...
  • 050a3dc [5.2.x] Fixed CVE-2026-35193 -- Varied on Authorization when caching non-publ...
  • 366d9ae [5.2.x] Fixed CVE-2026-8404 -- Used Cache-Control directives case-insensitive...
  • 4e47d2b [5.2.x] Fixed CVE-2026-7666 -- Delayed setting SMTP connection until fully co...
  • 594360c [5.2.x] Fixed CVE-2026-6873 -- Prevented signed cookie salt namespace collisi...
  • e074d83 [5.2.x] Included commit hash in checksum file when building artifacts for rel...
  • c502754 [5.2.x] Updated links to severity levels in release notes.
  • 72f5b41 [5.2.x] Added stub release notes and release date for 5.2.15.
  • 7084825 [5.2.x] Refs #35844 -- Ran further selenium tests with --parallel=1.
  • Additional commits viewable in compare view

Updates django-environ from 0.13.0 to 0.14.0

Release notes

Sourced from django-environ's releases.

v0.14.0

django-environ 0.14.0 improves type annotations across Env and updates Env.read_env() to support caller-owned file-like objects without closing them.

This is the final django-environ release supporting Python 3.9.

Added

  • Type annotations and matching docstring information for Env methods.
  • A conditional typing_extensions dependency providing TypeAlias on Python 3.9.

Changed

  • Env.read_env() now accepts path-like and file-like objects without closing file-like objects supplied by the caller.

Fixed

  • Env.read_env() now raises an explicit error when it cannot determine the caller frame used to resolve the default .env path.

Full changelog: joke2k/django-environ@v0.13.0...v0.14.0

PyPI: https://pypi.org/project/django-environ/0.14.0/

Changelog

Sourced from django-environ's changelog.

v0.14.0_ - 18-June-2026

Added +++++

  • Added type annotations and matching docstring information to Env methods [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.
  • Added a Python 3.9 compatibility dependency on typing_extensions for TypeAlias [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.

Changed +++++++

  • Updated Env.read_env() to accept path-like and file-like objects without closing file-like objects supplied by the caller [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.

Fixed +++++

  • Added an explicit error when Env.read_env() cannot determine its caller frame while resolving the default .env path [#633](https://github.com/joke2k/django-environ/issues/633) <https://github.com/joke2k/django-environ/pull/633>_.
Commits
  • 6e1b461 Merge pull request #635 from joke2k/release/0.14.0
  • b65f66e chore(release): prepare 0.14.0
  • 39f980a Merge pull request #633 from joke2k/hotfix/0.14-apply-pr-600
  • 020825c ci: allow release and hotfix PRs to target main
  • 6c1dd5b fix(typing): support TypeAlias on Python 3.9
  • c0d7b2b Ensure Env.read_env supports any file-like object
  • c41ee54 Guard against an inability to read stack frames
  • 64bfe4b Add type information to docstrings
  • 791df95 Add type annotations to str and bool parameters of methods in Env
  • 4370592 Merge branch 'develop' into main
  • See full diff in compare view

Updates django-health-check from 4.4.1 to 4.4.3

Release notes

Sourced from django-health-check's releases.

4.4.3

What's Changed

New Contributors

Full Changelog: codingjoe/django-health-check@4.4.2...4.4.3

4.4.2

What's Changed

  • Add sponsors to readme

Full Changelog: codingjoe/django-health-check@4.4.1...4.4.2

Commits
  • 46c7d08 Fix #742 -- Remove blank lines in OpenMetrics output (#741)
  • 0ef6677 [pre-commit.ci] pre-commit autoupdate
  • bf59fb0 Bump actions/checkout from 6 to 7
  • 2409afb [pre-commit.ci] pre-commit autoupdate
  • c2fb029 Update sponsor image link in README.md
  • 5e0ec1f [pre-commit.ci] pre-commit autoupdate
  • ccb4f7f Bump codecov/codecov-action from 6 to 7
  • d09fca3 Add sponsors section
  • 537935f [pre-commit.ci] pre-commit autoupdate
  • 7221356 [pre-commit.ci] pre-commit autoupdate
  • Additional commits viewable in compare view

Updates django-jazzmin from 3.0.4 to 3.0.5

Release notes

Sourced from django-jazzmin's releases.

v3.0.5 🌈

Changes

Commits
  • 2bd7a46 Merge pull request #675 from Rakanhf/fix/missing-bootstrap-bundle-sourcemap-674
  • 719cb88 Merge pull request #670 from kantegory/patch-search-help-text
  • 322bf3b Merge branch 'main' into patch-search-help-text
  • 9ee93f8 fix(static): include missing bootstrap.bundle.min.js.map for collectstatic
  • fb02d20 fix search_help_text placeholder rendering
  • See full diff in compare view

Updates faker from 40.20.0 to 40.27.0

Release notes

Sourced from faker's releases.

Release v40.27.0

See CHANGELOG.md.

Release v40.26.0

See CHANGELOG.md.

Release v40.25.0

See CHANGELOG.md.

Release v40.24.1

See CHANGELOG.md.

Release v40.24.0

See CHANGELOG.md.

Release v40.23.1

See CHANGELOG.md.

Release v40.23.0

See CHANGELOG.md.

Release v40.22.0

See CHANGELOG.md.

Release v40.21.0

See CHANGELOG.md.

Changelog

Sourced from faker's changelog.

v40.27.0 - 2026-06-30

v40.26.0 - 2026-06-30

  • Update providers job, phone_number, bank and ssn for pt_BR (#2386). Thanks @​dclobato.
  • Update phone number test regex for pt_BR. Thanks @​fcurella.

v40.25.0 - 2026-06-30

v40.24.1 - 2026-06-30

  • Fix: prevent infinite recursion in _safe_random_int when both bounds collapse to the same integer (#2396). Thanks @​gaoflow.

v40.24.0 - 2026-06-30

v40.23.1 - 2026-06-30

v40.23.0 - 2026-06-10

v40.22.0 - 2026-06-09

v40.21.0 - 2026-06-02

Commits

Updates nh3 from 0.3.5 to 0.3.6

Release notes

Sourced from nh3's releases.

v0.3.6

What's Changed

Full Changelog: messense/nh3@v0.3.5...v0.3.6

Commits
  • bea70df Bump version to 0.3.6
  • 788cee2 Expose ammonia's url_relative policy via url_relative kwarg (#131)
  • e76a81a Bump pyo3 from 0.28.3 to 0.29.0 (#130)
  • 8ec45a3 Add nh3.escape alias for clean_text (#127)
  • a1e0226 Document tag_attribute_values as alternate to attributes (#126)
  • 389fb79 Validate clean_content_tags conflict with tags (#125)
  • 61aad5a Bump uraimo/run-on-arch-action in the github-actions group (#124)
  • See full diff in compare view

Updates redis from 7.4.0 to 8.0.1

Release notes

Sourced from redis's releases.

8.0.1

Changes

🐛 Bug Fixes

  • Fix Unix socket maintenance notification handling and tests (#4097)
  • Fix async cluster node connection release on write errors (#4111)
  • Fixed async MultiDBClient with underlying RedisCluster (#4108)
  • Fix hiredis readiness checks for high file descriptors (#4115)
  • fix(search): parse RESP3 FT.SEARCH responses with bytes-typed keys (#4109)
  • Fixing pubsub's listen method to be blocking. (#4119)
  • fix(asyncio): release pooled connection when Pipeline.reset() is cancelled (#4123)
  • Avoid per-check fd allocation in hiredis _socket_can_read() — use poll() instead of a per-call selector (#4118)

🧰 Maintenance

  • Updating PyJWT dependency. (#4100)
  • Update CI badge in README.md (#4099)
  • Add missing url query argument parser for ssl_min_version (#4047)
  • ci: least-privilege permissions on spellcheck (read) and stale-issues (job-level write for actions/stale) (#4080)
  • Bumping github-versions actions (#4102)
  • Updating lib version + supported Redis versions in README.md + updating the Redis versions in CI test matrix (#4092)

We'd like to thank all the contributors who worked on this release! @​violuke @​mokashang @​arpitjain099 @​coredumperror @​elena-kolevska @​vladvildanov @​petyaslavova

8.0.0

Changes

🚀 Highlights

Async Cluster PubSub

This release introduces full asyncio Cluster PubSub support, bringing shard-channel capabilities (SSUBSCRIBE, SUNSUBSCRIBE, SPUBLISH) to the async RedisCluster client. The new ClusterPubSub class in redis.asyncio.cluster automatically routes shard-channel subscriptions to the correct cluster node based on key-slot hashing, manages per-node PubSub connections, and supports round-robin message retrieval across nodes. Users can create a cluster pubsub instance via RedisCluster.pubsub() and use ssubscribe(), sunsubscribe(), and get_sharded_message() just as they would with the sync cluster client.

Keyspace and subkey notifications

Redis Keyspace Notifications are now supported for standalone and cluster deployments in both sync and async modes. New classes — KeyspaceNotifications, ClusterKeyspaceNotifications, AsyncKeyspaceNotifications, and AsyncClusterKeyspaceNotifications — provide a high-level API for keyspace/keyevent subscriptions and subkey notification families: subkeyspace, subkeyevent, subkeyspaceitem, and subkeyspaceevent. Convenience methods like subscribe_keyspace(), subscribe_keyevent(), subscribe_subkeyspace(), subscribe_subkeyevent(), subscribe_subkeyspaceitem(), and subscribe_subkeyspaceevent() simplify common patterns, with channel classes for both key and subkey channels.

In cluster mode, subscriptions are managed across primary nodes because each node emits notifications only for keys it owns, with built-in topology-change handling. Sync run_in_thread() and async listen() workflows are supported.

Redis Array commands(https://redis.io/docs/latest/develop/data-types/arrays/)

redis-py now supports Redis Arrays, a preview Redis data type for sparse, index-addressable sequences of strings. New AR* command helpers cover indexed reads/writes, range scans, deletion, cursor-based insertion, ring-buffer writes, metadata, text search, and aggregation, including ARGET, ARSET, ARMGET, ARMSET, ARSCAN, ARGREP, ARRING, and AROP.

Type Hints Improvements (breaking changes)

The @overload pattern has been applied systematically across core commands (core.py), VectorSet commands, and module commands (Search, JSON, TimeSeries, Bloom filters) to provide distinct return types for sync and async clients. Previously, methods returned a combined ResponseT (i.e., Union[Awaitable[Any], Any]), which caused static analysis tools like mypy and Pyright to flag false positives. Now, sync clients see concrete return types (e.g., int, bool, list[str]) while async clients see Awaitable[...] wrappers. This is a breaking change for type-checking only—runtime behavior is unchanged, but code relying on the old union return types in type annotations may need updates. Two new protocol types, SyncClientProtocol and AsyncClientProtocol, are used in overload signatures to enable this distinction.

RESP3 by default with opt-in unified responses

... (truncated)

Commits
  • 7c0fd11 Updating lib version to 8.0.1
  • b7a4d7d Avoid per-check fd allocation in hiredis _socket_can_read() — use poll() ...
  • eec778e fix(asyncio): release pooled connection when Pipeline.reset() is cancelled (#...
  • 08e01bb Fixing pubsub's listen method to be blocking. (#4119)
  • 3d5257a fix(search): parse RESP3 FT.SEARCH responses with bytes-typed keys (#4109)
  • cce28ff Fix hiredis readiness checks for high file descriptors (#4115)
  • e20691c Fixed async MultiDBClient with underlying RedisCluster (#4108)
  • ea37fcc Fix async cluster node connection release on write errors (#4111)
  • f4146fa Updating lib version + supported Redis versions in README.md + updating the R...
  • d47674e Bumping github-versions actions (#4102)
  • Additional commits viewable in compare view

Updates servestatic from 4.3.0 to 4.3.1

Release notes

Sourced from servestatic's releases.

4.3.1

  • Fix manifest file mangling during collectstatic dry run.
Changelog

Sourced from servestatic's changelog.

[4.3.1] - 2026-06-06

  • Fix manifest file mangling during collectstatic dry run.
Commits

Updates uvicorn from 0.48.0 to 0.49.0

Release notes

Sourced from uvicorn's releases.

Version 0.49.0

What's Changed

Full Changelog: Kludex/uvicorn@0.48.0...0.49.0

Changelog

Sourced from uvicorn's changelog.

0.49.0 (June 3, 2026)

Changed

  • Bump httptools minimum version to 0.8.0 (#2962)
  • Consume duplicate forwarding headers in ProxyHeadersMiddleware (reverses the 0.48.0 behavior of ignoring them) (#2971)
Commits
  • 3ef2e3e Version 0.49.0 (#2973)
  • eeb64b1 Consume duplicate forwarding headers in ProxyHeadersMiddleware (#2971)
  • 630f4ac Make the watchfiles reload tests deterministic (#2972)
  • 9154922 chore(deps): bump the github-actions group across 1 directory with 6 updates ...
  • 739727a Migrate docs deploy from Cloudflare Pages to Workers (#2967)
  • be4a240 Gate docs preview deploy on Cloudflare token presence (#2966)
  • c489d7e Bump httptools minimum version to 0.8.0 (#2962)
  • 9f547bd Skip docs preview deploy for Dependabot PRs (#2961)
  • 44446b8 Migrate documentation from MkDocs Material to Zensical (#2959)
  • cfd659c Bump pymdown-extensions to 10.21.3 (#2958)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
Bump the python group with 9 updates
ae196f6 
Bumps the python group with 9 updates:

| Package | From | To |
| --- | --- | --- |
| [django](https://github.com/django/django) | `5.2.14` | `5.2.15` |
| [django-environ](https://github.com/joke2k/django-environ) | `0.13.0` | `0.14.0` |
| [django-health-check](https://github.com/codingjoe/django-health-check) | `4.4.1` | `4.4.3` |
| [django-jazzmin](https://github.com/farridav/django-jazzmin) | `3.0.4` | `3.0.5` |
| [faker](https://github.com/joke2k/faker) | `40.20.0` | `40.27.0` |
| [nh3](https://github.com/messense/nh3) | `0.3.5` | `0.3.6` |
| [redis](https://github.com/redis/redis-py) | `7.4.0` | `8.0.1` |
| [servestatic](https://github.com/Archmonger/ServeStatic) | `4.3.0` | `4.3.1` |
| [uvicorn](https://github.com/Kludex/uvicorn) | `0.48.0` | `0.49.0` |


Updates `django` from 5.2.14 to 5.2.15
- [Commits](django/django@5.2.14...5.2.15)

Updates `django-environ` from 0.13.0 to 0.14.0
- [Release notes](https://github.com/joke2k/django-environ/releases)
- [Changelog](https://github.com/joke2k/django-environ/blob/v0.14.0/CHANGELOG.rst)
- [Commits](joke2k/django-environ@v0.13.0...v0.14.0)

Updates `django-health-check` from 4.4.1 to 4.4.3
- [Release notes](https://github.com/codingjoe/django-health-check/releases)
- [Commits](codingjoe/django-health-check@4.4.1...4.4.3)

Updates `django-jazzmin` from 3.0.4 to 3.0.5
- [Release notes](https://github.com/farridav/django-jazzmin/releases)
- [Commits](farridav/django-jazzmin@v3.0.4...v3.0.5)

Updates `faker` from 40.20.0 to 40.27.0
- [Release notes](https://github.com/joke2k/faker/releases)
- [Changelog](https://github.com/joke2k/faker/blob/master/CHANGELOG.md)
- [Commits](joke2k/faker@v40.20.0...v40.27.0)

Updates `nh3` from 0.3.5 to 0.3.6
- [Release notes](https://github.com/messense/nh3/releases)
- [Commits](messense/nh3@v0.3.5...v0.3.6)

Updates `redis` from 7.4.0 to 8.0.1
- [Release notes](https://github.com/redis/redis-py/releases)
- [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES)
- [Commits](redis/redis-py@v7.4.0...v8.0.1)

Updates `servestatic` from 4.3.0 to 4.3.1
- [Release notes](https://github.com/Archmonger/ServeStatic/releases)
- [Changelog](https://github.com/Archmonger/ServeStatic/blob/main/CHANGELOG.md)
- [Commits](Archmonger/ServeStatic@4.3.0...4.3.1)

Updates `uvicorn` from 0.48.0 to 0.49.0
- [Release notes](https://github.com/Kludex/uvicorn/releases)
- [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md)
- [Commits](Kludex/uvicorn@0.48.0...0.49.0)

---
updated-dependencies:
- dependency-name: django
  dependency-version: 5.2.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: django-environ
  dependency-version: 0.14.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: django-health-check
  dependency-version: 4.4.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: django-jazzmin
  dependency-version: 3.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: faker
  dependency-version: 40.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
- dependency-name: nh3
  dependency-version: 0.3.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: redis
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: python
- dependency-name: servestatic
  dependency-version: 4.3.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: python
- dependency-name: uvicorn
  dependency-version: 0.49.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: python
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Jul 1, 2026
@djperrefort
djperrefort merged commit bfd7559 into main Jul 1, 2026
17 checks passed
@djperrefort
djperrefort deleted the dependabot/pip/python-5e4d235e8a branch July 1, 2026 17:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@djperrefort