Skip to content

Bump the uv group across 2 directories with 5 updates - #1287

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/app/airflow/uv-124d0a20bc
Closed

Bump the uv group across 2 directories with 5 updates#1287
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/app/airflow/uv-124d0a20bc

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Feb 19, 2026

Copy link
Copy Markdown
Contributor

Bumps the uv group with 5 updates in the /app/airflow directory:

Package From To
apache-airflow 3.1.0 3.1.7
cryptography 44.0.2 46.0.5
protobuf 5.29.5 5.29.6
python-multipart 0.0.21 0.0.22
sqlparse 0.5.3 0.5.4

Bumps the uv group with 2 updates in the /app/api directory: cryptography and sqlparse.

Updates apache-airflow from 3.1.0 to 3.1.7

Release notes

Sourced from apache-airflow's releases.

Apache Airflow 3.1.7

📦 PyPI: https://pypi.org/project/apache-airflow/3.1.7/ 📚 Docs: https://airflow.apache.org/docs/apache-airflow/3.1.7/ 🛠 Release Notes: https://airflow.apache.org/docs/apache-airflow/3.1.7/release_notes.html 🐳 Docker Image: "docker pull apache/airflow:3.1.7" 🚏 Constraints: https://github.com/apache/airflow/tree/constraints-3.1.7

Significant Changes

No significant changes.

Bug Fixes

  • Fix JWT token generation with unset issuer/audience config (#61331)
  • Fix callback files losing priority during queue resort (#61232) (#61243)
  • Fix Dag callback for versioned bundles in the processor (#60734) (#61230)
  • Add 404 handling for non-existent Dag (#61131) (#61225)
  • Add guardrail to handle Dag deserialization errors in scheduler (#61162) (#61210)
  • Fix asset scheduling for stale Dags (#59337) (#60022) (#61106)
  • Fix unnecessary Dag version churn when Dag file paths change (#60799)
  • Fix missing warning when Bundle path may not be accessible to impersonated user (#60278)
  • Fix TriggerDagRunOperator deferring when wait_for_completion=False (#60052)
  • Fix NoneType error when updating serialized Dag (#56422)
  • Fix Pool API slots validation (#61071) (#61114)
  • Fix DagBag parsing by adding bundle_path temporarily to sys.path (#55894) (#61053)
  • Fix API to respect maximum page limit (#60989) (#61073)
  • Prevent Triggerer from crashing when a trigger event isn't serializable (#60152) (#60981)
  • Fix permissions on get_event_logs endpoint (#60936) (#60958)
  • Fix Dag access control for dag_id in query param (#60935) (#60959)
  • Fix root logger to use log_level instead of hardcoded INFO level (#60784) (#60970)
  • Fix Dag processor OOM by Avoid loading all TaskInstances when checking DagVersion in write_dag (#60937) (#60962)
  • Fix worker startup Dag load failures by rescheduling tasks instead of exiting (#59604) (#60926)
  • Fix permissions check in import error APIs (#60801) (#60884)
  • Fix refresh-token invalidation by logging out the user (#60781) (#60881)
  • Fix connection test API to restore masked password/extra from existing connections (#59643) (#60873)
  • Fix Dag processor overhead by applying gc.freeze (#60505) (#60845)
  • Fix Dag processor crashing due to MySQL deadlock errors (#60166) (#60418)
  • Ensure unique run_id across manually triggered Dags with schedules (#59477) (#60468)
  • UI: Avoid gantt annotation error during resize (#60877)
  • UI: Fix react apps plugins router (#61206)
  • UI: Reset pagination on search in all pages (#61169)
  • UI: Explicitly set UI table ordering (#60609) (#61216)
  • UI: Plugins pagination fix #61055 (#61059) (#61129)
  • UI: Fix ui get dags permission endpoint for user without Dag run permissions (#60979) (#60988)
  • UI: Convert Tasks Table from card to table mode (#60830) (#60874)
  • UI: Fix slow log scrolling for large task logs (#60806) (#60875)
  • UI: Grey out trigger button on API 403 (#60648) (#60777)
  • UI: Remove API error from disabling submit (#60473) (#60658)
  • UI: Added toasters for permission denied (#57966) (#58016) (#60646)
  • UI: Move row count and display toggle into DataTable (#57680) (#60639)
  • UI: Fix/backfill permission error handling (#60582) (#60587)

... (truncated)

Commits
  • 83ff6ec Update RELEASE_NOTES.rst for rc2
  • caa0571 [v3-1-test] Fix JWT token generation with unset issuer/audience config (#6127...
  • d82bb10 Update RELEASE_NOTES.rst
  • d24ec9a Update Airflow Version to 3.1.7
  • 08a5859 [v3-1-test] Fix callback files losing priority during queue resort (#61232) (...
  • 3b41866 dag_processing: initialize versioned bundles for callbacks (#52040) (#60734) ...
  • c34d2c3 [v3-1-test] Add 404 handling for non-existent Dag (#61131) (#61225)
  • dd1a865 Fix import errors not showing on UI (#61163) (#61213)
  • 52b7aea [v3-1-test] Explicitly set table ordering (#60609) (#61216)
  • 5a2b240 [v3-1-test] Add guardrail to handle DAG deserialization errors in scheduler (...
  • Additional commits viewable in compare view

Updates cryptography from 44.0.2 to 46.0.5

Changelog

Sourced from cryptography's changelog.

46.0.5 - 2026-02-10


* An attacker could create a malicious public key that reveals portions of your
  private key when using certain uncommon elliptic curves (binary curves).
  This version now includes additional security checks to prevent this attack.
  This issue only affects binary elliptic curves, which are rarely used in
  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and
  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.
  **CVE-2026-26007**
* Support for ``SECT*`` binary elliptic curves is deprecated and will be
  removed in the next release.

.. v46-0-4:


46.0.4 - 2026-01-27

  • Dropped support for win_arm64 wheels_.
  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.

.. _v46-0-3:

46.0.3 - 2025-10-15


* Fixed compilation when using LibreSSL 4.2.0.

.. _v46-0-2:


46.0.2 - 2025-09-30

  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.4.

.. _v46-0-1:

46.0.1 - 2025-09-16


* Fixed an issue where users installing via ``pip`` on Python 3.14 development
  versions would not properly install a dependency.
* Fixed an issue building the free-threaded macOS 3.14 wheels.

.. _v46-0-0:


46.0.0 - 2025-09-16

  • BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been removed.

... (truncated)

Commits

Updates protobuf from 5.29.5 to 5.29.6

Release notes

Sourced from protobuf's releases.

Protocol Buffers v34.0-rc1

Announcements

Bazel

Compiler

C++

... (truncated)

Commits

Updates python-multipart from 0.0.21 to 0.0.22

Release notes

Sourced from python-multipart's releases.

Version 0.0.22

What's Changed

  • Drop directory path from filename in File 9433f4b.

Full Changelog: Kludex/python-multipart@0.0.21...0.0.22

Changelog

Sourced from python-multipart's changelog.

0.0.22 (2026-01-25)

  • Drop directory path from filename in File 9433f4b.
Commits

Updates sqlparse from 0.5.3 to 0.5.4

Changelog

Sourced from sqlparse's changelog.

Release 0.5.4 (Nov 28, 2025)

Enhancements

  • Add support for Python 3.14.
  • Add type annotations to top-level API functions and include py.typed marker for PEP 561 compliance, enabling type checking with mypy and other tools (issue756).
  • Add pre-commit hook support. sqlparse can now be used as a pre-commit hook to automatically format SQL files. The CLI now supports multiple files and an --in-place flag for in-place editing (issue537).
  • Add ATTACH and DETACH to PostgreSQL keywords (pr808).
  • Add INTERSECT to close keywords in WHERE clause (pr820).
  • Support REGEXP BINARY comparison operator (pr817).

Bug Fixes

  • Add additional protection against denial of service attacks when parsing very large lists of tuples. This enhances the existing recursion protections with configurable limits for token processing to prevent DoS through algorithmic complexity attacks. The new limits (MAX_GROUPING_DEPTH=100, MAX_GROUPING_TOKENS=10000) can be adjusted or disabled (by setting to None) if needed for legitimate large SQL statements.
  • Remove shebang from cli.py and remove executable flag (pr818).
  • Fix strip_comments not removing all comments when input contains only comments (issue801, pr803 by stropysh).
  • Fix splitting statements with IF EXISTS/IF NOT EXISTS inside BEGIN...END blocks (issue812).
  • Fix splitting on semicolons inside BEGIN...END blocks (issue809).
Commits
  • 14e300b Bump version.
  • 96a67e2 Code cleanup.
  • 1a3bfbd Fix handling of semicolons inside BEGIN...END blocks (fixes #809).
  • e92a032 Fix handling of IF EXISTS statements in BEGIN...END blocks (fixes #812).
  • 149bebf Update Changelog.
  • 561a67e Update AUTHORS.
  • 73c8ba3 bugfix ISSUE_801; Remove all comments when only comments
  • 1b32387 Update action to run on all prs.
  • 31903e0 Add pre-commit hook support (fixes #537)
  • 1357726 docs: add AGENTS.md for project guidance and development commands
  • Additional commits viewable in compare view

Updates cryptography from 44.0.1 to 46.0.5

Changelog

Sourced from cryptography's changelog.

46.0.5 - 2026-02-10


* An attacker could create a malicious public key that reveals portions of your
  private key when using certain uncommon elliptic curves (binary curves).
  This version now includes additional security checks to prevent this attack.
  This issue only affects binary elliptic curves, which are rarely used in
  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and
  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.
  **CVE-2026-26007**
* Support for ``SECT*`` binary elliptic curves is deprecated and will be
  removed in the next release.

.. v46-0-4:


46.0.4 - 2026-01-27

  • Dropped support for win_arm64 wheels_.
  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.

.. _v46-0-3:

46.0.3 - 2025-10-15


* Fixed compilation when using LibreSSL 4.2.0.

.. _v46-0-2:


46.0.2 - 2025-09-30

  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.4.

.. _v46-0-1:

46.0.1 - 2025-09-16


* Fixed an issue where users installing via ``pip`` on Python 3.14 development
  versions would not properly install a dependency.
* Fixed an issue building the free-threaded macOS 3.14 wheels.

.. _v46-0-0:


46.0.0 - 2025-09-16

  • BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been removed.

... (truncated)

Commits

Updates sqlparse from 0.5.3 to 0.5.4

Changelog

Sourced from sqlparse's changelog.

Release 0.5.4 (Nov 28, 2025)

Enhancements

  • Add support for Python 3.14.
  • Add type annotations to top-level API functions and include py.typed marker for PEP 561 compliance, enabling type checking with mypy and other tools (issue756).
  • Add pre-commit hook support. sqlparse can now be used as a pre-commit hook to automatically format SQL files. The CLI now supports multiple files and an --in-place flag for in-place editing (issue537).
  • Add ATTACH and DETACH to PostgreSQL keywords (pr808).
  • Add INTERSECT to close keywords in WHERE clause (pr820).
  • Support REGEXP BINARY comparison operator (pr817).

Bug Fixes

  • Add additional protection against denial of service attacks when parsing very large lists of tuples. This enhances the existing recursion protections with configurable limits for token processing to prevent DoS through algorithmic complexity attacks. The new limits (MAX_GROUPING_DEPTH=100, MAX_GROUPING_TOKENS=10000) can be adjusted or disabled (by setting to None) if needed for legitimate large SQL statements.
  • Remove shebang from cli.py and remove executable flag (pr818).
  • Fix strip_comments not removing all comments when input contains only comments (issue801, pr803 by stropysh).
  • Fix splitting statements with IF EXISTS/IF NOT EXISTS inside BEGIN...END blocks (issue812).
  • Fix splitting on semicolons inside BEGIN...END blocks (issue809).
Commits
  • 14e300b Bump version.
  • 96a67e2 Code cleanup.
  • 1a3bfbd Fix handling of semicolons inside BEGIN...END blocks (fixes #809).
  • e92a032 Fix handling of IF EXISTS statements in BEGIN...END blocks (fixes #812).
  • 149bebf Update Changelog.
  • 561a67e Update AUTHORS.
  • 73c8ba3 bugfix ISSUE_801; Remove all comments when only comments
  • 1b32387 Update action to run on all prs.
  • 31903e0 Add pre-commit hook support (fixes #537)
  • 1357726 docs: add AGENTS.md for project guidance and development commands
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
Bump the uv group across 2 directories with 5 updates
69e673b 
Bumps the uv group with 5 updates in the /app/airflow directory:

| Package | From | To |
| --- | --- | --- |
| [apache-airflow](https://github.com/apache/airflow) | `3.1.0` | `3.1.7` |
| [cryptography](https://github.com/pyca/cryptography) | `44.0.2` | `46.0.5` |
| [protobuf](https://github.com/protocolbuffers/protobuf) | `5.29.5` | `5.29.6` |
| [python-multipart](https://github.com/Kludex/python-multipart) | `0.0.21` | `0.0.22` |
| [sqlparse](https://github.com/andialbrecht/sqlparse) | `0.5.3` | `0.5.4` |

Bumps the uv group with 2 updates in the /app/api directory: [cryptography](https://github.com/pyca/cryptography) and [sqlparse](https://github.com/andialbrecht/sqlparse).


Updates `apache-airflow` from 3.1.0 to 3.1.7
- [Release notes](https://github.com/apache/airflow/releases)
- [Changelog](https://github.com/apache/airflow/blob/main/docker-stack-docs/changelog.rst)
- [Commits](apache/airflow@3.1.0...3.1.7)

Updates `cryptography` from 44.0.2 to 46.0.5
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@44.0.2...46.0.5)

Updates `protobuf` from 5.29.5 to 5.29.6
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Commits](https://github.com/protocolbuffers/protobuf/commits)

Updates `python-multipart` from 0.0.21 to 0.0.22
- [Release notes](https://github.com/Kludex/python-multipart/releases)
- [Changelog](https://github.com/Kludex/python-multipart/blob/master/CHANGELOG.md)
- [Commits](Kludex/python-multipart@0.0.21...0.0.22)

Updates `sqlparse` from 0.5.3 to 0.5.4
- [Changelog](https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG)
- [Commits](andialbrecht/sqlparse@0.5.3...0.5.4)

Updates `cryptography` from 44.0.1 to 46.0.5
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@44.0.2...46.0.5)

Updates `sqlparse` from 0.5.3 to 0.5.4
- [Changelog](https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG)
- [Commits](andialbrecht/sqlparse@0.5.3...0.5.4)

---
updated-dependencies:
- dependency-name: apache-airflow
  dependency-version: 3.1.7
  dependency-type: direct:production
  dependency-group: uv
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: indirect
  dependency-group: uv
- dependency-name: protobuf
  dependency-version: 5.29.6
  dependency-type: indirect
  dependency-group: uv
- dependency-name: python-multipart
  dependency-version: 0.0.22
  dependency-type: indirect
  dependency-group: uv
- dependency-name: sqlparse
  dependency-version: 0.5.4
  dependency-type: indirect
  dependency-group: uv
- dependency-name: cryptography
  dependency-version: 46.0.5
  dependency-type: indirect
  dependency-group: uv
- dependency-name: sqlparse
  dependency-version: 0.5.4
  dependency-type: indirect
  dependency-group: uv
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Feb 19, 2026
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Feb 19, 2026
@github-actions github-actions Bot added Area: Backend Area: Airflow and removed dependencies Pull requests that update a dependency file labels Feb 19, 2026
@dependabot @github

dependabot Bot commented on behalf of github Feb 20, 2026

Copy link
Copy Markdown
Contributor Author

Superseded by #1288.

@dependabot dependabot Bot closed this Feb 20, 2026
@dependabot
dependabot Bot deleted the dependabot/uv/app/airflow/uv-124d0a20bc branch February 20, 2026 22:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@AndyRae AndyRae Awaiting requested review from AndyRae AndyRae is a code owner
@AndrewThien AndrewThien Awaiting requested review from AndrewThien AndrewThien is a code owner

Assignees

No one assigned

Labels

Area: Airflow Area: Backend python:uv Pull requests that update python:uv code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants