fix(deps): update minor dependencies by renovate[bot] · Pull Request #5438 · HHS/OPRE-OPS

renovate · 2026-04-06T17:36:42Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update	Pending
authlib	`==1.6.11` → `==1.7.0`	packages	minor
cypress (source)	`15.13.1` → `15.14.1`	devDependencies	minor
docker/build-push-action	`v7.0.0` → `v7.1.0`	action	minor
docker/login-action	`v4.0.0` → `v4.1.0`	action	minor
esbuild	`0.27.7` → `0.28.0`	devDependencies	minor
eslint-plugin-cypress	`6.2.2` → `6.3.1`	devDependencies	minor
globals	`17.4.0` → `17.5.0`	devDependencies	minor
gunicorn (changelog)	`==25.2.0` → `==25.3.0`	packages	minor
ipython	`==9.11.0` → `==9.12.0`	dev-packages	minor	`9.13.0`
ipython	`==9.11.0` → `==9.12.0`	packages	minor	`9.13.0`
json5 (changelog)	`==0.13.0` → `==0.14.0`	packages	minor
marshmallow-sqlalchemy (changelog)	`==1.4.2` → `==1.5.0`	packages	minor
mypy (changelog)	`==1.19.1` → `==1.20.2`	packages	minor
nox	`==2026.2.9` → `==2026.4.10`	dev-packages	minor
renovatebot/pre-commit-hooks	`43.91.4` → `43.139.0`	repository	minor	`43.141.2` (+10)
sass	`1.98.0` → `1.99.0`	dependencies	minor
styled-components (source)	`6.3.12` → `6.4.1`	dependencies	minor
trufflesecurity/trufflehog	`v3.94.3` → `v3.95.2`	action	minor
vite-plugin-svgr	`5.0.0` → `5.2.0`	devDependencies	minor

Note: The pre-commit manager in Renovate is not supported by the pre-commit maintainers or community. Please do not report any problems there, instead create a Discussion in the Renovate repository if you have any questions.

Release Notes

authlib/authlib (authlib)

`v1.7.0`

Compare Source

What's Changed

Authorization and token endpoints request empty scope parameter management by @azmeuk in #847
Support from Python 3.10 to 3.14 by @azmeuk in #850
Allow composition of AuthorizationServerMetadata by @azmeuk in #853
Make require_oauth parenthesis optional by @azmeuk in #855
Fix expires_at behavior when its value is 0 by @azmeuk in #854
Migration to joserfc by @lepture in #852
RP-initiated logout by @frohrlich in #849
Fix get_jwt_config by @lepture in #858
chore(ci): Update PyPy version from 3.10 to 3.11 by @cclauss in #863
fix: remove "none" from default authlib.jose.jwt algorithms by @lepture in #860
fix: normalize resolve_client_public_key method by @lepture in #861
Implement rfc9700 PKCE downgrade countermeasure by @azmeuk in #864
Use correct syntax for tox.requires in tox.ini by @alex-ball in #868
Set client session User-Agent when fetching server metadata and JWKs by @alex-ball in #867
fix: use the real application object for Flask by @nblock in #869
Accept the issuer URL as a valid audience by @azmeuk in #865
Don't nest InvalidTokenError extra attribute by @azmeuk in #872
Documentation overhaul by @azmeuk in #875
Update README.md docs.authlib.org/en/latest => docs.authlib.org/en/stable by @guillett in #876
Merge release/1.6 branch by @lepture in #877

New Contributors

@frohrlich made their first contribution in #849
@cclauss made their first contribution in #863
@alex-ball made their first contribution in #868
@nblock made their first contribution in #869
@guillett made their first contribution in #876

Full Changelog: authlib/authlib@v1.6.10...v1.7.0

cypress-io/cypress (cypress)

`v15.14.1`

Compare Source

Changelog: https://docs.cypress.io/app/references/changelog#15-14-1

`v15.14.0`

Compare Source

Changelog: https://docs.cypress.io/app/references/changelog#15-14-0

docker/build-push-action (docker/build-push-action)

`v7.1.0`

Compare Source

Git context query format support by @crazy-max in #1505
Bump @docker/actions-toolkit from 0.79.0 to 0.87.0 by @crazy-max in #1505
Bump brace-expansion from 1.1.12 to 1.1.13 in #1500
Bump fast-xml-parser from 5.4.2 to 5.5.7 in #1489
Bump flatted from 3.3.3 to 3.4.2 in #1491
Bump glob from 10.3.12 to 10.5.0 in #1490
Bump handlebars from 4.7.8 to 4.7.9 in #1497
Bump lodash from 4.17.23 to 4.18.1 in #1510
Bump picomatch from 4.0.3 to 4.0.4 in #1496
Bump undici from 6.23.0 to 6.24.1 in #1486
Bump vite from 7.3.1 to 7.3.2 in #1509

Full Changelog: docker/build-push-action@v7.0.0...v7.1.0

docker/login-action (docker/login-action)

`v4.1.0`

Compare Source

Fix scoped Docker Hub cleanup path when registry is omitted by @crazy-max in #945
Bump @aws-sdk/client-ecr and @aws-sdk/client-ecr-public to 3.1020.0 in #930
Bump @docker/actions-toolkit from 0.77.0 to 0.86.0 in #932 #936
Bump brace-expansion from 1.1.12 to 1.1.13 in #952
Bump fast-xml-parser from 5.3.4 to 5.3.6 in #942
Bump flatted from 3.3.3 to 3.4.2 in #944
Bump glob from 10.3.12 to 10.5.0 in #940
Bump handlebars from 4.7.8 to 4.7.9 in #949
Bump http-proxy-agent and https-proxy-agent to 8.0.0 in #937
Bump lodash from 4.17.23 to 4.18.1 in #958
Bump minimatch from 3.1.2 to 3.1.5 in #941
Bump picomatch from 4.0.3 to 4.0.4 in #948
Bump undici from 6.23.0 to 6.24.1 in #938

Full Changelog: docker/login-action@v4.0.0...v4.1.0

evanw/esbuild (esbuild)

`v0.28.0`

Compare Source

cypress-io/eslint-plugin-cypress (eslint-plugin-cypress)

`v6.3.1`

Compare Source

Bug Fixes

deps: update dependency globals to ^17.5.0 (#326) (257d0ec)

`v6.3.0`

Compare Source

Features

added no-and rule to ensure .and() follows certain commands (#310) (c0b7e3b)

`v6.2.3`

Compare Source

Bug Fixes

no-unnecessary-waiting flag identifiers defined in object/array patterns (#308) (f5ccf77)

sindresorhus/globals (globals)

`v17.5.0`

Compare Source

benoitc/gunicorn (gunicorn)

`v25.3.0`: Gunicorn 25.3.0

Compare Source

Bug Fixes

HTTP/2 ASGI Body Duplication: Fix request body being received twice in HTTP/2
ASGI requests, causing JSON parsing errors with "Extra data" messages
(#3558)
ASGI Chunked EOF Handling: Add finish() method to callback parser to handle
chunked encoding edge case where connection closes before final CRLF after zero-chunk
HTTP/2 Documentation: Fix http_protocols examples to use comma-separated string
instead of list syntax (#3561)
Chunked Encoding: Reject chunk extensions containing bare CR bytes per RFC 9112
(#3556)
Request Line Limit: Fix --limit-request-line 0 to mean unlimited as documented,
instead of using default maximum. Works with both Python and fast C parser.
(#3563)

Security

ASGI Parser Header Validation: Add security checks per RFC 9110/9112:
- Reject duplicate Content-Length headers
- Reject requests with both Content-Length and Transfer-Encoding
- Reject chunked transfer encoding in HTTP/1.0
- Reject stacked chunked encoding
- Validate Transfer-Encoding values
- Strict chunk size validation

Changes

Fast HTTP Parser: Update to gunicorn_h1c >= 0.6.3 for asgi_headers property
and InvalidChunkExtension validation for bare CR rejection
ASGI PROXY Protocol: Add PROXY protocol v1/v2 support to callback parser
Docker Images: Update to Python 3.14

ipython/ipython (ipython)

`v9.12.0`

Compare Source

dpranke/pyjson5 (json5)

`v0.14.0`

Compare Source

marshmallow-code/marshmallow-sqlalchemy (marshmallow-sqlalchemy)

`v1.5.0`

Compare Source

python/mypy (mypy)

`v1.20.2`

Compare Source

`v1.20.1`

Compare Source

Always disable sync in SQLite cache (Ivan Levkivskyi, PR 21184)
Temporarily skip few base64 tests (Ivan Levkivskyi, PR 21193)
Revert dict.__or__ typeshed change (Ivan Levkivskyi, PR 21186)
Fix narrowing for match case with variadic tuples (Shantanu, PR 21192)
Avoid narrowing type[T] in type calls (Shantanu, PR 21174)
Fix regression for catching empty tuple in except (Shantanu, PR 21153)
Fix reachability for frozenset and dict view narrowing (Shantanu, PR 21151)
Fix narrowing with chained comparison (Shantanu, PR 21150)
Avoid narrowing to unreachable at module level (Shantanu, PR 21144)
Allow dangerous identity comparisons to Any typed variables (Shantanu, PR 21142)
--warn-unused-config should not be a strict flag (Ivan Levkivskyi, PR 21139)

`v1.20.0`

Compare Source

wntrblm/nox (nox)

`v2026.4.10`

Compare Source

renovatebot/pre-commit-hooks (renovatebot/pre-commit-hooks)

github-actions · 2026-04-09T13:00:40Z

🤖 Auto-formatting applied!

I detected that this PR was edited via the GitHub web UI and had some formatting issues. I automatically applied fixes using:

Prettier (frontend)
Black + isort (backend)

The fixes have been committed to this branch. For future contributions, consider setting up the local development environment to run formatters before pushing - it avoids this extra round-trip.

github-actions · 2026-04-09T17:18:38Z

🤖 Auto-formatting applied!

I detected that this PR was edited via the GitHub web UI and had some formatting issues. I automatically applied fixes using:

Prettier (frontend)
Black + isort (backend)

The fixes have been committed to this branch. For future contributions, consider setting up the local development environment to run formatters before pushing - it avoids this extra round-trip.

github-actions · 2026-04-25T01:01:58Z

🎉 This PR is included in version 1.371.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

renovate Bot requested review from fpigeonjr, johndeange and rajohnson90 as code owners April 6, 2026 17:36

renovate Bot added the dependencies Pull requests that update a dependency file label Apr 6, 2026

renovate Bot requested review from Santi-3rd, josbell and weimiao67 as code owners April 6, 2026 17:36

renovate Bot force-pushed the renovate/all-minor branch 18 times, most recently from 4c186af to 890f516 Compare April 9, 2026 12:58

renovate Bot force-pushed the renovate/all-minor branch from 293e84b to f607a36 Compare April 9, 2026 17:16

renovate Bot force-pushed the renovate/all-minor branch 2 times, most recently from 26200a2 to 64b5a95 Compare April 22, 2026 06:13

renovate Bot force-pushed the renovate/all-minor branch 3 times, most recently from e1a1e21 to 6b628b5 Compare April 22, 2026 15:11

jonnalley mentioned this pull request Apr 22, 2026

Fix msw breaking changes #5561

Merged

11 tasks

renovate Bot force-pushed the renovate/all-minor branch 20 times, most recently from dc02e37 to c6c6bac Compare April 24, 2026 20:22

fix(deps): update minor dependencies

204c419

renovate Bot force-pushed the renovate/all-minor branch from c6c6bac to 204c419 Compare April 24, 2026 22:47

renovate Bot merged commit 35958c3 into main Apr 25, 2026
60 checks passed

renovate Bot deleted the renovate/all-minor branch April 25, 2026 01:01

github-actions Bot added the released label Apr 25, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update minor dependencies#5438

fix(deps): update minor dependencies#5438
renovate[bot] merged 1 commit intomainfrom
renovate/all-minor

renovate Bot commented Apr 6, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Apr 9, 2026

Uh oh!

github-actions Bot commented Apr 9, 2026

Uh oh!

Uh oh!

github-actions Bot commented Apr 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

What's Changed

New Contributors

Bug Fixes

Features

Bug Fixes

v25.3.0: Gunicorn 25.3.0

Bug Fixes

Security

Changes

renovate Bot commented Apr 6, 2026 •

edited

Loading

`v25.3.0`: Gunicorn 25.3.0