Bump the pip-production-dependencies group across 9 directories with 24 updates

[dependabot]

Updates the requirements on grpcio-health-checking, openfeature-hooks-opentelemetry, openfeature-provider-flagd, opentelemetry-distro, opentelemetry-exporter-otlp-proto-grpc, psutil, python-dotenv, python-json-logger, psycopg2-binary, openai, simplejson, flask, locust-plugins, openfeature-provider-ofrep, opentelemetry-api, opentelemetry-instrumentation-jinja2, opentelemetry-instrumentation-requests, opentelemetry-instrumentation-system-metrics, opentelemetry-instrumentation-urllib3, opentelemetry-sdk, opentelemetry-semantic-conventions, opentelemetry-instrumentation-logging, requests and google-generativeai to permit the latest version.
Updates grpcio-health-checking from 1.71.0 to 1.81.1

Updates openfeature-hooks-opentelemetry from 0.2.0 to 0.3.1

Release notes

Sourced from openfeature-hooks-opentelemetry's releases.

openfeature-hooks-opentelemetry: v0.3.1

0.3.1 (2026-02-17)

🐛 Bug Fixes

• Align TracingHook with spec (#342) (2a2127d)
• replace project.scripts with poethepoet (#335) (61add22)

openfeature-hooks-opentelemetry: v0.3.0

0.3.0 (2025-12-16)

⚠ BREAKING CHANGES

• update opentelemetry hook to latest version of semantic conventions (#326)

✨ New Features

• migrate to uv (#293) (9590554)
• update opentelemetry hook to latest version of semantic conventions (#326) (a2ec682)

Commits

• 83926de chore(main): release openfeature-hooks-opentelemetry 0.3.1 (#337)
• 2a2127d fix: Align TracingHook with spec (#342)
• c08b414 chore: align unleash pyproject.toml to others (#341)
• 8239b83 feat(provider): add aws-ssm provider (#331)
• 61add22 fix: replace project.scripts with poethepoet (#335)
• a835c77 chore: relax types-requests and update grpcio version constraints (#334)
• a345ef9 chore(main): release openfeature-provider-flagd 0.2.7 (#290)
• b9c164a fix(security): update dependency protobuf to v6.33.5 [security] (#333)
• 2feabd5 chore(main): release openfeature-provider-unleash 0.1.1 (#332)
• dcb8fad chore: add component owners
• Additional commits viewable in compare view

Updates openfeature-provider-flagd from 0.2.3 to 0.5.0

Release notes

Sourced from openfeature-provider-flagd's releases.

openfeature-provider-flagd: v0.5.0

0.5.0 (2026-06-02)

⚠ BREAKING CHANGES

• DISABLED is a successful evaluation (still defaults) (#395)

✨ New Features

• DISABLED is a successful evaluation (still defaults) (#395) (e7d1d34)
• make use of flagd-selector header in RPC mode (#396) (e1c3c6a)

openfeature-provider-flagd: v0.4.1

0.4.1 (2026-04-30)

🐛 Bug Fixes

• various custom operator conformance fixes (#386) (c119a77)

✨ New Features

• flagd: extract evaluator into api, core, and testkit packages (#377) (1995534)

openfeature-provider-flagd: v0.4.0

0.4.0 (2026-04-01)

⚠ BREAKING CHANGES

• fractional bucketing improvements (#373)
• drop Python 3.9 support (#364)

chore

• drop Python 3.9 support (#364) (0ecd1d4)

✨ New Features

• fractional bucketing improvements (#373) (83c3e48)
• introduce list for fatal status codes (#362) (96a88ad)

openfeature-provider-flagd: v0.3.0

0.3.0 (2026-03-11)

⚠ BREAKING CHANGES

... (truncated)

Commits

• 9c493b8 chore(main): release openfeature-provider-flagd 0.5.0 (#397)
• e7d1d34 feat!: DISABLED is a successful evaluation (still defaults) (#395)
• e1c3c6a feat: make use of flagd-selector header in RPC mode (#396)
• c4b4257 chore: resolve open dependabot security alerts (#394)
• daafd73 chore: resolve open dependabot security alerts (#392)
• f084e84 chore: resolve open dependabot security alerts (#389)
• 4ef1019 chore(main): release openfeature-provider-ofrep 0.3.0 (#338)
• 5857f45 chore(main): release openfeature-provider-flagd 0.4.1 (#384)
• 3197e02 chore(main): release openfeature-flagd-api 1.0.0 (#382)
• 4f95c87 chore(main): release openfeature-flagd-core 1.0.0 (#385)
• Additional commits viewable in compare view

Updates opentelemetry-distro from 0.59b0 to 0.63b1

Changelog

Sourced from opentelemetry-distro's changelog.

Version 1.42.1/0.63b1 (2026-05-21)

No significant changes.

Version 1.42.0/0.63b0 (2026-05-19)

Added

• opentelemetry-exporter-richconsole: Add support for suppressing resource information (#3898)
• opentelemetry-instrumentation: Add experimental metrics attributes Labeler utility (#4288)
• opentelemetry-instrumentation-logging: Add OTEL_PYTHON_LOG_HANDLER_LEVEL and OTEL_PYTHON_LOG_FORMAT environment variables to configure the log level and formatter of the auto-instrumented LoggingHandler. (#4298)
• opentelemetry-instrumentation-sqlite3: Add uninstrument, error status, suppress, and no-op tests (#4335)
• Add BaggageLogProcessor to opentelemetry-processor-baggage (#4371)
• opentelemetry-instrumentation-system-metrics: Add support for process.disk.io metric in system-metrics instrumentation (#4397)
• opentelemetry-instrumentation: Register OTEL_SEMCONV_STABILITY_OPT_IN in environment_variables.py so opentelemetry-instrument exposes a --semconv_stability_opt_in CLI argument (#4438)
• Expand AGENTS.md with instrumentation/GenAI guidance and add PR review instructions. (#4457)
• opentelemetry-instrumentation: update auto-instrumentation to re-inject instrumentation path after init (#4469)
• opentelemetry-instrumentation-dbapi: Add Database client operation duration and returned rows metrics (#4481)

Changed

• Remove redundant pylint: disable=attribute-defined-outside-init comments and add rule to global .pylintrc disable list (#3839)
• Bump pylint to 4.0.5 (#4244)
• opentelemetry-instrumentation-logging: Use LogRecord.getMessage() to format and extract each log record's body text to more closely match the expected usage of the logging system. As a result, all OTel log record bodies

... (truncated)

Commits

• See full diff in compare view

Updates opentelemetry-exporter-otlp-proto-grpc from 1.38.0 to 1.42.1

Changelog

Sourced from opentelemetry-exporter-otlp-proto-grpc's changelog.

Version 1.42.1/0.63b1 (2026-05-21)

Fixed

• Preserve the random trace ID flag when creating child spans instead of always setting the random trace id bit depending on the available trace id generator. (#5241)

Version 1.42.0/0.63b0 (2026-05-19)

Added

• opentelemetry-api, opentelemetry-sdk: add support for 'random-trace-id' flags in W3C traceparent header trace flags. Implementations of IdGenerator that do randomly generate the 56 least significant bits, should also implement a is_trace_id_random methods that returns True. (#4854)
• logs: add exception support to Logger emit and LogRecord attributes (#4908)
• opentelemetry-exporter-otlp-proto-grpc: make retryable gRPC error codes configurable for gRPC exporters (#4917)
• opentelemetry-sdk: Add create_logger_provider/configure_logger_provider to declarative file configuration, enabling LoggerProvider instantiation from config files without reading env vars (#4990)
• opentelemetry-exporter-otlp-json-common: add 'opentelemetry-exporter-otlp-json-common' package for OTLP JSON exporters (#4996)
• opentelemetry-sdk: Add service resource detector support to declarative file configuration via detection_development.detectors[].service (#5003)
• opentelemetry-docker-tests: add docker-tests coverage of opentelemetry-exporter-otlp-proto-grpc and opentelemetry-exporter-otlp-proto-http metrics export (#5030)
• Add registry keyword argument to PrometheusMetricReader to allow passing a custom Prometheus registry (#5055)
• Add WeaverLiveCheck test util (#5088)
• opentelemetry-sdk: add load_entry_point shared utility to declarative file configuration for loading plugins via entry points; refactor propagator loading to use it (#5093)
• opentelemetry-sdk: add sampler plugin loading to declarative file configuration via the opentelemetry_sampler entry point group, matching the spec's PluginComponentProvider mechanism (#5095)

... (truncated)

Commits

• 367e14d Prepare release 1.42.1/0.63b1 (#5243)
• fd8e504 Preserve random trace ID flag for child spans (#5241) (#5242)
• 013045e [release/v1.42.x-0.63bx] Prepare release 1.42.0/0.63b0 (#5225)
• 1731583 ci: Enable GitHub Merge Queue support (#5209)
• 7fab34d fix(config): allow deflate for OTLP HTTP exporters (#5075)
• 0b690d2 ci: validate changelog fragment filenames (#5212)
• d4fabb4 feat(config): exporter plugin loading via entry points for declarative config...
• e19d346 feat(config): generic resource detector plugin loading for declarative config...
• 1d69bd2 sdk/metrics: copy attributes dict to prevent post-recording mutation (#5106)
• 990a611 feat(config): propagator plugin loading via entry points for declarative conf...
• Additional commits viewable in compare view

Updates psutil from 7.0.0 to 7.2.2

Changelog

Sourced from psutil's changelog.

7.2.2 — 2026-01-28 ^^^^^^^^^^^^^^^^^^

Enhancements

• :gh:2705: [Linux]: :meth:Process.wait now uses pidfd_open() + poll() (no busy loop). Requires Linux >= 5.3 and Python >= 3.9.
• :gh:2705: [macOS], [BSD]: :meth:Process.wait now uses kqueue() (no busy loop).

Bug fixes

• :gh:2701, [macOS]: fix compilation error on macOS < 10.7. (patch by :user:Sergey Fedorov <barracuda156>)
• :gh:2707, [macOS]: fix potential memory leaks in error paths of :meth:Process.memory_full_info and :meth:Process.threads.
• :gh:2708, [macOS]: :meth:Process.cmdline and :meth:Process.environ may fail with OSError: [Errno 0] Undefined error (from sysctl(KERN_PROCARGS2)). They now raise :exc:AccessDenied instead.

7.2.1 — 2025-12-29 ^^^^^^^^^^^^^^^^^^

Bug fixes

• :gh:2699, [FreeBSD], [NetBSD]: :func:heap_info does not detect small allocations (<= 1K). In order to fix that, we now flush internal jemalloc cache before fetching the metrics.

7.2.0 — 2025-12-23 ^^^^^^^^^^^^^^^^^^

Enhancements

• :gh:1275: new :func:heap_info and :func:heap_trim functions, providing direct access to the platform's native C :term:heap allocator (glibc, mimalloc, libmalloc). Useful to create tools to detect memory leaks.
• :gh:2403, [Linux]: publish wheels for Linux musl.
• :gh:2680: unit tests are no longer installed / part of the distribution. They now live under tests/ instead of psutil/tests.

Bug fixes

• :gh:2684, [FreeBSD], [critical]: compilation fails on FreeBSD 14 due to missing include.
• :gh:2691, [Windows]: fix memory leak in :func:net_if_stats due to missing Py_CLEAR.

Compatibility notes

... (truncated)

Commits

• 9eea97d Pre-release
• 938ac64 Rm sphinxcontrib.googleanalytics; override layout.html
• 9dcbb7e Add sphinxcontrib-googleanalytics to requirements.txt
• 76eaf9a Try to add google analytics to doc
• de1cafa Update doc mentioning Process.wait() internal details
• bb30943 Refact can_use_pidfd_open() and can_use_kqueue()
• a571717 #2708, macos / cmdline / environ; raise AD instead of OSError(0) (#2709)
• 8b98c3e Pre-release
• 700b7e6 [macOS] fix potential leaks in error paths (#2707)
• 7cc7923 Windows / cmdline(): be more defensive in free()ing in case of error
• Additional commits viewable in compare view

Updates python-dotenv from 1.2.1 to 1.2.2

Release notes

Sourced from python-dotenv's releases.

v1.2.2

Added

• Support for Python 3.14, including the free-threaded (3.14t) build. (#)

Changed

• The dotenv run command now forwards flags directly to the specified command by @​bbc2 in theskumar/python-dotenv#607
• Improved documentation clarity regarding override behavior and the reference page.
• Updated PyPy support to version 3.11.
• Documentation for FIFO file support.
• Support for Python 3.9.

Fixed

• Improved set_key and unset_key behavior when interacting with symlinks by @​bbc2 in #790c5
• Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by @​JYOuyang in theskumar/python-dotenv#590

Breaking Changes

• dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

• In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

• dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

Misc

• skip 000 permission tests for root user by @​burnout-projects in theskumar/python-dotenv#561
• Bump actions/checkout from 5 to 6 in the github-actions group by @​dependabot[bot] in theskumar/python-dotenv#593
• Add Windows testing to CI by @​bbc2 in theskumar/python-dotenv#604
• Improve workflow efficiency with best practices by @​theskumar in theskumar/python-dotenv#609
• Remove the use of sh in tests by @​bbc2 in theskumar/python-dotenv#612

New Contributors

• @​JYOuyang made their first contribution in theskumar/python-dotenv#590
• @​burnout-projects made their first contribution in theskumar/python-dotenv#561
• @​cpackham-atlnz made their first contribution in theskumar/python-dotenv#597

Full Changelog: theskumar/python-dotenv@v1.2.1...v1.2.2

Changelog

Sourced from python-dotenv's changelog.

[1.2.2] - 2026-03-01

Added

• Support for Python 3.14, including the free-threaded (3.14t) build. (#588)

Changed

• The dotenv run command now forwards flags directly to the specified command by [@​bbc2] in #607
• Improved documentation clarity regarding override behavior and the reference page.
• Updated PyPy support to version 3.11.
• Documentation for FIFO file support.
• Dropped Support for Python 3.9.

Fixed

• Improved set_key and unset_key behavior when interacting with symlinks by [@​bbc2] in [790c5c0]
• Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by [@​JYOuyang] in #590

Breaking Changes

• dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

• In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

• dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

Commits

• 36004e0 Bump version: 1.2.1 → 1.2.2
• eb20252 docs: update changelog for v1.2.2
• 790c5c0 Merge commit from fork
• 43340da Remove the use of sh in tests (#612)
• 09d7cee docs: clarify override behavior and document FIFO support (#610)
• c8de288 ci: improve workflow efficiency with best practices (#609)
• 7bd9e3d Add Windows testing to CI (#604)
• 1baaf04 Drop Python 3.9 support and update to PyPy 3.11 (#608)
• 4a22cf8 ci: enable testing on Python 3.14t (free-threaded) (#588)
• e2e8e77 Fix license specifier (#597)
• Additional commits viewable in compare view

Updates python-json-logger from 4.0.0 to 4.1.0

Release notes

Sourced from python-json-logger's releases.

4.1.0

4.1.0 - 2026-03-29

Added

• Add support for Python 3.14, PyPy 3.11

Removed

• Remove support for Python 3.8, 3.9 (includes PyPy versions).

Changelog

Sourced from python-json-logger's changelog.

4.1.0 - 2026-03-29

Added

• Add support for Python 3.14, PyPy 3.11

Removed

• Remove support for Python 3.8, 3.9 (includes PyPy versions).

Commits

• d80c68d Release v4.1.0
• b589b2a [pyproject] Update license table to PEP 639 format
• 2bb784a Update code unlocked by Python 3.10 minimum version
• 79599b5 Drop python 3.8, 3.9 support
• 622650c [docs.contributing] Update unsupported JSON encoders
• 06165bb [tests.test_formatters] Add non-printable bytes to test_common_types_encoded
• 61f88a9 [docs.contributing] Clarify which packages have been considered and rejected
• 0add524 [docs.contributing] Clarify when we will add support for new third-party pack...
• eee9505 [pylint] Remove old command
• 8045926 [mypy] Don't ignore orjson
• Additional commits viewable in compare view

Updates psycopg2-binary from 2.9.11 to 2.9.12

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.14.
• Avoid a segfault passing more arguments than placeholders if Python is built with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
• Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 18.
• Drop support for Python 3.8.

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.13.
• Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
• ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
• Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Add support for Python 3.12.
• Drop support for Python 3.6.

What's new in psycopg 2.9.8 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Wheel package bundled with PostgreSQL 16 libpq in order to add support for recent features, such as sslcertmode.

What's new in psycopg 2.9.7 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

• Fix propagation of exceptions raised during module initialization (:ticket:[#1598](https://github.com/psycopg/psycopg2/issues/1598)).

... (truncated)

Commits

• 3a6d9d6 ci: include almalinux in whieel building
• ebca6bf chore: bump to version 3.9.12
• 0196f02 build(deps): bump pypa/cibuildwheel from 3.3.1 to 3.4.0
• d157bdc build(deps): bump docker/setup-qemu-action from 3 to 4
• 7fccc0f build(deps): bump actions/upload-artifact from 6 to 7
• d52a61e chore: bump dependency libraries
• b231d72 chore: fix building binary images
• 6d76e84 Merge pull request #1836 from psycopg/fix-1835
• f7e314c fix: overflow in malformed interval
• eb905c1 docs: replace bare except clause with except Exception
• Additional commits viewable in compare view

Updates openai from 2.8.1 to 2.42.0

Release notes

Sourced from openai's releases.

v2.42.0

2.42.0 (2026-06-16)

Full Changelog: v2.41.1...v2.42.0

Features

• api: admin spend_alerts (6134198)
• api: manual updates (f337bf4)
• api: update OpenAPI spec or Stainless config (7015158)

Build System

• fix release workflow permissions (#3389) (a526ee8)
• Use CI environment for examples API key (#3394) (d64d811)

v2.41.1

2.41.1 (2026-06-05)

Full Changelog: v2.41.0...v2.41.1

Build System

• Remove scheduled release workflow trigger (#3366) (2a91011)

v2.41.0

2.41.0 (2026-06-03)

Full Changelog: v2.40.0...v2.41.0

Features

• api: responses.moderation and chat_completions.moderation (87e46c2)

v2.40.0

2.40.0 (2026-06-01)

Full Changelog: v2.39.0...v2.40.0

Features

• api: Add Amazon Bedrock Responses support

Bug Fixes

• api: allow setting bedrock api keys on the client directly (4d5bfde)

v2.39.0

2.39.0 (2026-06-01)

... (truncated)

Changelog

Sourced from openai's changelog.

2.42.0 (2026-06-16)

Full Changelog: v2.41.1...v2.42.0

Features

• api: admin spend_alerts (6134198)
• api: manual updates (f337bf4)
• api: update OpenAPI spec or Stainless config (7015158)

Build System

• fix release workflow permissions (#3389) (a526ee8)
• Use CI environment for examples API key (#3394) (d64d811)

2.41.1 (2026-06-05)

Full Changelog: v2.41.0...v2.41.1

Build System

• Remove scheduled release workflow trigger (#3366) (2a91011)

2.41.0 (2026-06-03)

Full Changelog: v2.40.0...v2.41.0

Features

• api: responses.moderation and chat_completions.moderation (87e46c2)

2.40.0 (2026-06-01)

Full Changelog: v2.39.0...v2.40.0

Features

• api: Add Amazon Bedrock Responses support

Bug Fixes

• api: allow setting bedrock api keys on the client directly (4d5bfde)

2.39.0 (2026-06-01)

Full Changelog: v2.38.0...v2.39.0

Features

• api: workload identity in audit logs, additional_tools item in responses, fix ActionSearch.query to be optional. (ab60d7a)

... (truncated)

Commits

• 2bba15e release: 2.42.0
• 1ec3e82 codegen metadata
• 93c2eca feat(api): manual updates
• b269f88 codegen metadata
• ee821d6 feat(api): admin spend_alerts
• 60002e5 feat(api): update OpenAPI spec or Stainless config
• d64d811 build: Use CI environment for examples API key (#3394)
• a526ee8 build: fix release workflow permissions (#3389)
• 7198756 release: 2.41.1
• 3842a5e ci: use PyPI trusted publishing (#3365)
• Additional commits viewable in compare view

Updates simplejson from 3.20.2 to 4.1.1

Release notes

Sourced from simplejson's releases.

v4.1.1

What's Changed

• Add Python 2.7 wheel builds for Windows platforms by @​etrepum in simplejson/simplejson#378

Full Changelog: simplejson/simplejson@v4.1.0...v4.1.1

v4.1.0

What's Changed

• Accelerate indented encoding in the C extension; release 4.1.0 by @​etrepum in simplejson/simplejson#376

Full Changelog: simplejson/simplejson@v4.0.1...v4.1.0

v4.0.1

What's Changed

• Exclude Pyodide wheels from PyPI uploads by @​etrepum in simplejson/simplejson#375

Full Changelog: simplejson/simplejson@v4.0.0...v4.0.1

v4.0.0

What's Changed

Version 4.0.0 released 2026-04-18

• simplejson 4 requires Python 2.7 or Python 3.8+. Older Python versions (2.5, 2.6, 3.0-3.7) are no longer supported. pip will not install simplejson 4 on unsupported versions.

• The C extension now uses heap types and per-module state instead of static types and global state. This is required for free-threading support and sub-interpreter isolation. The Python-level API is unchanged.

• Full support for Python 3.13+ free-threading (PEP 703). The C extension is now safe to use with the GIL disabled (python3.14t):

  • Converted all static types to heap types with per-module state
  • Added per-object critical sections to scanner and encoder
  • Added free-threading-safe dict operations for Python 3.13+
  • Unified per-module state management and templated parser simplejson/simplejson#363 simplejson/simplejson#364 simplejson/simplejson#365 simplejson/simplejson#367 simplejson/simplejson#369

• Numerous C extension memory safety fixes:

  • Fix use-after-free and leak in encoder ident handling
  • Fix NULL dereferences on OOM in module init and static string init

... (truncated)

Changelog

Sourced from simplejson's changelog.

Version 4.1.1 released 2026-04-24

• The build_wheels_py27 CI job now also builds Python 2.7 wheels for Windows AMD64 and Windows x86, joining the existing Py2.7 manylinux1 / manylinux2010 x86_64 wheels. This unblocks offline / --no-index installs on Py2.7-on-Windows (the original reporter's case), which previously had no matching binary wheel on PyPI, fell through to the sdist, and failed on the PEP 517 isolated-build step complaining that setuptools>=42 was not in the wheelhouse. simplejson/simplejson#377

Version 4.1.0 released 2026-04-22

• The C extension now accelerates encoding when indent= is set. Previously the encoder fell back to the pure-Python implementation whenever a non-None indent was passed; now the C encoder emits the newline-plus-indent prefix, the level-aware item separator, and the closing indent directly. A representative nested-dict workload benchmarks about 4-5x faster end-to-end, and the indent=0 and empty-container edge cases continue to match the Python output byte-for-byte.

• The C extension now emits PEP 678 exc.add_note() annotations on serialization failures, matching the pure-Python encoder. A chained error on {'a': [1, object(), 3]} produces the same three notes (when serializing object object, when serializing list item 1, when serializing dict item 'a') whether the speedups are loaded or not, so the add_note assertions in test_errors.py no longer need indent=2 to force the Python path.

Version 4.0.1 released 2026-04-18

• Skip uploading Pyodide/wasm wheels to PyPI, which rejects them with "unsupported platform tag 'pyodide_2024_0_wasm32'". The wheels are still built in CI and preserved as workflow artifacts. simplejson/simplejson#375

Version 4.0.0 released 2026-04-18

• simplejson 4 requires Python 2.7 or Python 3.8+. Older Python versions (2.5, 2.6, 3.0-3.7) are no longer supported. pip will not install simplejson 4 on unsupported versions.

• The C extension now uses heap types and per-module state instead of static types and global state. This is required for free-threading support and sub-interpreter isolation. The Python-level API is unchanged.

• Full support for Python 3.13+ free-threading (PEP 703). The C

... (truncated)

Commits

• 639b2ee Add Python 2.7 wheel builds for Windows platforms (#378)
• 0fd3185 Accelerate indented encoding in the C extension; release 4.1.0 (#376)
• 19b5f94 Exclude Pyodide wheels from PyPI uploads (#375)
• 1608c05 Use JSONDecodeError for out-of-range end indices in C scanstring (#374)
• 3bba179 Encoder parity fixes (for_json/_asdict) and TSan stress CI job (#373)
• 7b22d65 Error parity for the C and Python scanstring in surrogate and truncated strin...
• 825100a Release version 4.0.0: free-threading, CPython json parity, Python 2.7 fixes ...
• 0dbb9d8 C extension: dead code cleanup, fast paths for dict/list/string encoding, cor...
• e2e5f0b Add Python 3.13+ free-threading support to dict operations (#369)
• e817370 Fix free-threading (3.14t) crashes: heap types, unified per-module state, tem...
• Additional commits viewable in compare view

Updates flask from 3.1.2 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

• The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

• The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Commits

• 22d9247 release version 3.1.3
• 089cb86 Merge commit from fork
• c17f379 request context tracks session access
• 27be933 start version 3.1.3
• 4e652d3 Abort if the instance folder cannot be created (#5903)
• 3d03098 Abort if the instance folder cannot be created
• 407eb76 document using gevent for async (#5900)
• ac5664d document using gevent for async
• Description has been truncated

[dependabot]

Superseded by #323.