Bump the uv group across 2 directories with 4 updates by dependabot[bot] · Pull Request #1273 · Health-Informatics-UoN/carrot-mapper

dependabot · 2026-02-11T01:55:31Z

Bumps the uv group with 4 updates in the /app/airflow directory: apache-airflow, cryptography, protobuf and python-multipart.
Bumps the uv group with 1 update in the /app/api directory: cryptography.

Updates apache-airflow from 3.1.0 to 3.1.6

Release notes

Sourced from apache-airflow's releases.

Apache Airflow 3.1.6

📦 PyPI: https://pypi.org/project/apache-airflow/3.1.6/ 📚 Docs: https://airflow.apache.org/docs/apache-airflow/3.1.6/ 🛠 Release Notes: https://airflow.apache.org/docs/apache-airflow/3.1.6/release_notes.html 🐳 Docker Image: "docker pull apache/airflow:3.1.6" 🚏 Constraints: https://github.com/apache/airflow/tree/constraints-3.1.6

Significant Changes

is_authorized_hitl_task() method now available in auth managers(#59399).

This method is now available in auth managers to check whether a user is authorized to approve a HITL task

proxy and proxies added to DEFAULT_SENSITIVE_FIELDS (#59688)

proxy and proxies have been added to DEFAULT_SENSITIVE_FIELDS in secrets_masker to treat proxy configurations as sensitive by default

Bug Fixes

Protect against hanging thread in aiosqlite 0.22+ (#60217) (#60245)

Fix log task instance sqlalchemy join query (#59973) (#60222)

Fix invalid uri created when extras contains non string elements (#59339) (#60219)

Fix operator template fields via callable serialization that causes unstable DAG serialization (#60065) (#60221)

Fix real-time extra links updates for TriggerDagRunOperator (#59507) (#60225)

Fix signal handling in triggerer job runner (#60190) (#60214)

Added state validation to delete dag run endpoint (#60195) (#60207)

Fix text overflow issue (#60080)

UI: Add toggle functionality to Dags state filters (#59089)

Fix deprecated_options entry for dag_file_processor_timeout (#59181) (#60162)

Fix ApprovalOperator with SimpleAuthManager when all_admins=True (#59399) (#60116)

Record missing ti_failure metrics for tasks (#59731) (#59964)

Fix missing TaskInstanceHistory on scheduler TI resets (#59639) (#59752)

Add proxy and proxies as sensitive fields in DEFAULT_SENSITIVE_FIELDS (#59688) (#59792)

Fix compat deprecation handling for [webserver] base_url (#59659) (#59781)

Fix Execution API refresh token (#58782) (#59713)

Fix eager-loading DagRun asset relationships before creating DagRunContext (#59714) (#59732)

Redact secrets in rendered templates properly when truncating it (#59566) (#59704)

Add Content-Type to request headers in Task SDK calls when missing (#59676) (#59687)

UI: Fix Expand+Collapse Translation Key (#59672) (#59674)

Fix server context for connections (#59624) (#59652)

Fix clear task instance dialog tasks states (#59363) (#59580)

Add log record when listening dag is partitioned but run has no key (#59375) (#59582)

Fix Dag Processor logging crash (#59317) (#59581)

Flush session before processing Event Buffer in dag test (#59314) (#59559)

Add task group ID filtering support to task instance query (#58092) (#59511)

Fix message of _read_from_logs_server when status_code is 403 (#59489) (#59504)

Fix import errors not cleared for files without Dags (#58242) (#59500)

Fix backfill run_on_latest_version defaulting to False instead of True (#59304) (#59328)

Add toaster notifications for Connection Test (#59354) (#59368)

Fix .airflowignore negation not working in subfolders (#58740) (#59305)

... (truncated)

Commits

d6a009b Update RELEASE_NOTES.rst
8a0cfb1 Update version to 3.1.6
f28d275 [v3-1-test] Protect against hanging thread in aiosqlite 0.22+ (#60217) (#60245)
562a463 [v3-1-test] Fix log task instance join (#59973) (#60222)
bdf0b11 [v3-1-test] Finish commiter status onboarding - Dheeraj Turaga (#60228) (#60233)
1089cef [v3-1-test] Fix/RE:Invalid uri created when extras contains non string elemen...
e4d791b [v3-1-test] Operator template fields via callable serialization causes unstab...
2841580 [v3-1-test] fix: Enable real-time extra links updates for TriggerDagRunOperat...
87e6b2e [v3-1-test] Fix signal handling in triggerer job runner (#60190) (#60214)
5904a4c Close TR Translation Gaps in v3-1 (#60191)
Additional commits viewable in compare view

Updates cryptography from 44.0.2 to 46.0.5

Changelog

Sourced from cryptography's changelog.

46.0.5 - 2026-02-10


* An attacker could create a malicious public key that reveals portions of your
  private key when using certain uncommon elliptic curves (binary curves).
  This version now includes additional security checks to prevent this attack.
  This issue only affects binary elliptic curves, which are rarely used in
  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and
  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.
  **CVE-2026-26007**
* Support for ``SECT*`` binary elliptic curves is deprecated and will be
  removed in the next release.
.. v46-0-4:
46.0.4 - 2026-01-27

Dropped support for win_arm64 wheels_.
Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.

.. _v46-0-3:

46.0.3 - 2025-10-15

* Fixed compilation when using LibreSSL 4.2.0. .. _v46-0-2:

46.0.2 - 2025-09-30

Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.4.

.. _v46-0-1:

46.0.1 - 2025-09-16

* Fixed an issue where users installing via ``pip`` on Python 3.14 development versions would not properly install a dependency. * Fixed an issue building the free-threaded macOS 3.14 wheels. .. _v46-0-0:

46.0.0 - 2025-09-16

BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been removed.

... (truncated)

Commits

06e120e bump version for 46.0.5 release (#14289)
0eebb9d EC check key on cofactor > 1 (#14287)
bedf6e1 fix openssl version on 46 branch (#14220)
e6f44fc bump for 46.0.4 and drop win arm64 due to CI issues (#14217)
c0af4dd release 46.0.3 (#13681)
99efe5a bump version for 46.0.2 (#13531)
e735cfc release 46.0.1 (#13450)
4e457ff Explicitly specify python in mac uv build invocation (#13447)
2726efd Depend on CFFI 2.0.0 or newer on Python > 3.8 (#13448)
6223062 release 46.0.0 (#13446)
Additional commits viewable in compare view

Updates protobuf from 5.29.5 to 5.29.6

Release notes

Sourced from protobuf's releases.

Protocol Buffers v34.0-rc1

Announcements

This version includes breaking changes to: C++, Objective-C, PHP, Python.

[Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

[C++] Make generator headers private (protocolbuffers/protobuf@3a2af35)

[C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (protocolbuffers/protobuf@7a75898)

[C++] Add [[nodiscard]] to many APIs. (protocolbuffers/protobuf@a70115f)

[C++] Make the arena-enabled constructors of RepeatedField, RepeatedPtrField, and Map private. (protocolbuffers/protobuf@ef890c3)

[C++] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[C++] Removes proto2::util::MessageDifferencer::AddIgnoreCriteria that takes a raw pointer as an argument in favor of the overload that takes a unique_ptr. Remove macro PROTOBUF_FUTURE_REMOVE_ADD_IGNORE_CRITERIA (protocolbuffers/protobuf@b115358)

[C++] Remove deprecated FieldDescriptor::has_optional_keyword() in OSS. Use is_repeated() or has_presence() instead (protocolbuffers/protobuf@68346ec)

[C++] Remove AddUnusedImportTrackFile() and ClearUnusedImportTrackFiles(). Remove PROTOBUF_FUTURE_RENAME_ADD_UNUSED_IMPORT (protocolbuffers/protobuf@837a2cd)

[C++] Remove deprecated FieldDescriptor::is_optional() in OSS. Use (!is_required() && !is_repeated()) instead (protocolbuffers/protobuf@9dbc5d4)

[C++] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

[C++] All entity names have length limit (2afb0dc)

[ObjC] Remove generate_minimal_imports generation option warning (protocolbuffers/protobuf@45b1297)

[ObjC] Fix nullability annotations on some GPB*Dictionary types. (protocolbuffers/protobuf@ea67d6d)

[ObjC] Remove -[GPBFieldDescriptor optional] (protocolbuffers/protobuf@3414dc1)

[Other] Remove deprecated flag for enabling MSVC support (protocolbuffers/protobuf@97c979b)

[PHP] Remove deprecated PHP APIs (protocolbuffers/protobuf@9c45014)

[PHP] Remove deprecated PHP APIs FieldDescriptor getLabel, use IsRepeated or isRequired instead. (protocolbuffers/protobuf@4208121, protocolbuffers/protobuf@cd76e67, protocolbuffers/protobuf@4208121)

[PHP] Add PHP typehints for setters and remove redundant GPBUtil checks (protocolbuffers/protobuf#25296) (protocolbuffers/protobuf@aee03b7)

[PHP] support default values for editions/proto2 (protocolbuffers/protobuf#25161) (protocolbuffers/protobuf@b01099d)

[Python] Raise errors in OSS when assign bool to int/enum field in Python Proto. (protocolbuffers/protobuf@5b116fe)

[Python] Remove float_format/double_format from python proto text_format (protocolbuffers/protobuf@e4854a1)

[Python] Raise TypeError when convert non-timedelta to Duration, or convert non-datetime to Timestamp in python proto. (Original code may raise ArributeError) (protocolbuffers/protobuf@00aaca1)

[Python] Remove float_precision from python proto json_format (protocolbuffers/protobuf@f027f1f)

[Python] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[Python] Remove deprecated FieldDescriptor.label (protocolbuffers/protobuf@0a8ff55)

[Python] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

Protobuf News may include additional announcements or pre-announcements for upcoming changes.

Migration Guide may include additional guidance for breaking changes.

Bazel

Fix: cc_toolchain should prefer protoc when prebuilt flag is flipped. (#25168) (protocolbuffers/protobuf@8c857c3)

Breaking change: Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

Feat(bazel): wire up prebuilt protoc toolchain (#24115) (protocolbuffers/protobuf@cc23698)

Migrate proto_descriptor_set (#23369) (protocolbuffers/protobuf@8d4dfdd)

Compiler

Ruby codegen: support generation of rbs files (#15633) (protocolbuffers/protobuf@6ebdf85)

Avoid collision name problems between a message named Xyz and a direct sibling enum named XyzView (protocolbuffers/protobuf@eba53e8)

Generalizing and implementing ValidateFeatureSupport for both Options and Features during proto parsing (protocolbuffers/protobuf@ed3c571)

Fix a bug with custom features outside of the pb package. (protocolbuffers/protobuf@872d3ce)

Fix import option handling when include_imports isn't set. (protocolbuffers/protobuf@9ef9e80)

Fix a bug in STRICT check of namespaced enums to properly check for 'reserved 1 to max' (protocolbuffers/protobuf@1229d4a)

Prevent accidental stripping of debug_redact options via import option. (protocolbuffers/protobuf@f58b098)

C++

Add EnumerateEnumValues function. (protocolbuffers/protobuf@397d5d9)

... (truncated)

Commits

See full diff in compare view

Updates python-multipart from 0.0.21 to 0.0.22

Release notes

Sourced from python-multipart's releases.

Version 0.0.22

What's Changed

Drop directory path from filename in File 9433f4b.

Full Changelog: Kludex/python-multipart@0.0.21...0.0.22

Changelog

Sourced from python-multipart's changelog.

0.0.22 (2026-01-25)

Drop directory path from filename in File 9433f4b.

Commits

bea7bbb Version 0.0.22 (#222)
0fb59a9 chore: add return type on test (#221)
9433f4b Merge commit from fork
d5c91ec Bump the github-actions group with 2 updates (#219)
5a90631 bump uv (#218)
See full diff in compare view

Updates cryptography from 44.0.1 to 46.0.5

Changelog

Sourced from cryptography's changelog.

46.0.5 - 2026-02-10


* An attacker could create a malicious public key that reveals portions of your
  private key when using certain uncommon elliptic curves (binary curves).
  This version now includes additional security checks to prevent this attack.
  This issue only affects binary elliptic curves, which are rarely used in
  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and
  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.
  **CVE-2026-26007**
* Support for ``SECT*`` binary elliptic curves is deprecated and will be
  removed in the next release.
.. v46-0-4:
46.0.4 - 2026-01-27

Dropped support for win_arm64 wheels_.
Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.

.. _v46-0-3:

46.0.3 - 2025-10-15

* Fixed compilation when using LibreSSL 4.2.0. .. _v46-0-2:

46.0.2 - 2025-09-30

Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.4.

.. _v46-0-1:

46.0.1 - 2025-09-16

* Fixed an issue where users installing via ``pip`` on Python 3.14 development versions would not properly install a dependency. * Fixed an issue building the free-threaded macOS 3.14 wheels. .. _v46-0-0:

46.0.0 - 2025-09-16

BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been removed.

... (truncated)

Commits

06e120e bump version for 46.0.5 release (#14289)
0eebb9d EC check key on cofactor > 1 (#14287)
bedf6e1 fix openssl version on 46 branch (#14220)
e6f44fc bump for 46.0.4 and drop win arm64 due to CI issues (#14217)
c0af4dd release 46.0.3 (#13681)
99efe5a bump version for 46.0.2 (#13531)
e735cfc release 46.0.1 (#13450)
4e457ff Explicitly specify python in mac uv build invocation (#13447)
2726efd Depend on CFFI 2.0.0 or newer on Python > 3.8 (#13448)
6223062 release 46.0.0 (#13446)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps the uv group with 4 updates in the /app/airflow directory: [apache-airflow](https://github.com/apache/airflow), [cryptography](https://github.com/pyca/cryptography), [protobuf](https://github.com/protocolbuffers/protobuf) and [python-multipart](https://github.com/Kludex/python-multipart). Bumps the uv group with 1 update in the /app/api directory: [cryptography](https://github.com/pyca/cryptography). Updates `apache-airflow` from 3.1.0 to 3.1.6 - [Release notes](https://github.com/apache/airflow/releases) - [Changelog](https://github.com/apache/airflow/blob/main/docker-stack-docs/changelog.rst) - [Commits](apache/airflow@3.1.0...3.1.6) Updates `cryptography` from 44.0.2 to 46.0.5 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@44.0.2...46.0.5) Updates `protobuf` from 5.29.5 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `python-multipart` from 0.0.21 to 0.0.22 - [Release notes](https://github.com/Kludex/python-multipart/releases) - [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md) - [Commits](Kludex/python-multipart@0.0.21...0.0.22) Updates `cryptography` from 44.0.1 to 46.0.5 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@44.0.2...46.0.5) --- updated-dependencies: - dependency-name: apache-airflow dependency-version: 3.1.6 dependency-type: direct:production dependency-group: uv - dependency-name: cryptography dependency-version: 46.0.5 dependency-type: indirect dependency-group: uv - dependency-name: protobuf dependency-version: 5.29.6 dependency-type: indirect dependency-group: uv - dependency-name: python-multipart dependency-version: 0.0.22 dependency-type: indirect dependency-group: uv - dependency-name: cryptography dependency-version: 46.0.5 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-02-19T12:17:49Z

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Feb 11, 2026

dependabot Bot requested review from AndrewThien and AndyRae as code owners February 11, 2026 01:55

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Feb 11, 2026

github-actions Bot added Area: Backend Area: Airflow and removed dependencies Pull requests that update a dependency file labels Feb 11, 2026

AndyRae closed this Feb 19, 2026

dependabot Bot deleted the dependabot/uv/app/airflow/uv-ebbc34ef4f branch February 19, 2026 12:17

Navigation Menu

Uh oh!

Bump the uv group across 2 directories with 4 updates - #1273

Bump the uv group across 2 directories with 4 updates#1273
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/app/airflow/uv-ebbc34ef4f

dependabot Bot commented on behalf of github Feb 11, 2026

Uh oh!

dependabot Bot commented on behalf of github Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Feb 11, 2026

Apache Airflow 3.1.6

Significant Changes

is_authorized_hitl_task() method now available in auth managers(#59399).

proxy and proxies added to DEFAULT_SENSITIVE_FIELDS (#59688)

Bug Fixes

Protocol Buffers v34.0-rc1

Announcements

Bazel

Compiler

C++

Version 0.0.22

What's Changed

0.0.22 (2026-01-25)

Uh oh!

dependabot Bot commented on behalf of github Feb 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

`is_authorized_hitl_task()` method now available in auth managers(#59399).

`proxy` and `proxies` added to `DEFAULT_SENSITIVE_FIELDS` (#59688)