Bump the uv group across 2 directories with 10 updates by dependabot[bot] · Pull Request #1298 · Health-Informatics-UoN/carrot-mapper

dependabot · 2026-03-10T01:30:02Z

Bumps the uv group with 7 updates in the /app/airflow directory:

Package	From	To
apache-airflow	`2.11.0`	`3.1.7`
apache-airflow-providers-amazon	`9.7.0`	`9.22.0`
apache-airflow-providers-http	`5.2.1`	`6.0.0`
cryptography	`44.0.2`	`46.0.5`
flask	`2.2.5`	`3.1.3`
protobuf	`5.29.5`	`5.29.6`
sqlparse	`0.5.3`	`0.5.4`

Bumps the uv group with 3 updates in the /app/api directory: cryptography, sqlparse and django-allauth.

Updates apache-airflow from 2.11.0 to 3.1.7

Release notes

Sourced from apache-airflow's releases.

Apache Airflow 3.1.7

📦 PyPI: https://pypi.org/project/apache-airflow/3.1.7/ 📚 Docs: https://airflow.apache.org/docs/apache-airflow/3.1.7/ 🛠 Release Notes: https://airflow.apache.org/docs/apache-airflow/3.1.7/release_notes.html 🐳 Docker Image: "docker pull apache/airflow:3.1.7" 🚏 Constraints: https://github.com/apache/airflow/tree/constraints-3.1.7

Significant Changes

No significant changes.

Bug Fixes

Fix JWT token generation with unset issuer/audience config (#61331)

Fix callback files losing priority during queue resort (#61232) (#61243)

Fix Dag callback for versioned bundles in the processor (#60734) (#61230)

Add 404 handling for non-existent Dag (#61131) (#61225)

Add guardrail to handle Dag deserialization errors in scheduler (#61162) (#61210)

Fix asset scheduling for stale Dags (#59337) (#60022) (#61106)

Fix unnecessary Dag version churn when Dag file paths change (#60799)

Fix missing warning when Bundle path may not be accessible to impersonated user (#60278)

Fix TriggerDagRunOperator deferring when wait_for_completion=False (#60052)

Fix NoneType error when updating serialized Dag (#56422)

Fix Pool API slots validation (#61071) (#61114)

Fix DagBag parsing by adding bundle_path temporarily to sys.path (#55894) (#61053)

Fix API to respect maximum page limit (#60989) (#61073)

Prevent Triggerer from crashing when a trigger event isn't serializable (#60152) (#60981)

Fix permissions on get_event_logs endpoint (#60936) (#60958)

Fix Dag access control for dag_id in query param (#60935) (#60959)

Fix root logger to use log_level instead of hardcoded INFO level (#60784) (#60970)

Fix Dag processor OOM by Avoid loading all TaskInstances when checking DagVersion in write_dag (#60937) (#60962)

Fix worker startup Dag load failures by rescheduling tasks instead of exiting (#59604) (#60926)

Fix permissions check in import error APIs (#60801) (#60884)

Fix refresh-token invalidation by logging out the user (#60781) (#60881)

Fix connection test API to restore masked password/extra from existing connections (#59643) (#60873)

Fix Dag processor overhead by applying gc.freeze (#60505) (#60845)

Fix Dag processor crashing due to MySQL deadlock errors (#60166) (#60418)

Ensure unique run_id across manually triggered Dags with schedules (#59477) (#60468)

UI: Avoid gantt annotation error during resize (#60877)

UI: Fix react apps plugins router (#61206)

UI: Reset pagination on search in all pages (#61169)

UI: Explicitly set UI table ordering (#60609) (#61216)

UI: Plugins pagination fix #61055 (#61059) (#61129)

UI: Fix ui get dags permission endpoint for user without Dag run permissions (#60979) (#60988)

UI: Convert Tasks Table from card to table mode (#60830) (#60874)

UI: Fix slow log scrolling for large task logs (#60806) (#60875)

UI: Grey out trigger button on API 403 (#60648) (#60777)

UI: Remove API error from disabling submit (#60473) (#60658)

UI: Added toasters for permission denied (#57966) (#58016) (#60646)

UI: Move row count and display toggle into DataTable (#57680) (#60639)

UI: Fix/backfill permission error handling (#60582) (#60587)

... (truncated)

Commits

83ff6ec Update RELEASE_NOTES.rst for rc2
caa0571 [v3-1-test] Fix JWT token generation with unset issuer/audience config (#6127...
d82bb10 Update RELEASE_NOTES.rst
d24ec9a Update Airflow Version to 3.1.7
08a5859 [v3-1-test] Fix callback files losing priority during queue resort (#61232) (...
3b41866 dag_processing: initialize versioned bundles for callbacks (#52040) (#60734) ...
c34d2c3 [v3-1-test] Add 404 handling for non-existent Dag (#61131) (#61225)
dd1a865 Fix import errors not showing on UI (#61163) (#61213)
52b7aea [v3-1-test] Explicitly set table ordering (#60609) (#61216)
5a2b240 [v3-1-test] Add guardrail to handle DAG deserialization errors in scheduler (...
Additional commits viewable in compare view

Updates apache-airflow-providers-amazon from 9.7.0 to 9.22.0

Commits

05ea74a Prepare provider's documentation 2026-03-03 (#62752)
1199dc5 Consolidate SkipMixin imports through common-compat layer (#62776)
483d84c Add iceberg support to AnalyticsOperator (#62754)
f4ab338 [main] Upgrade important CI environment (#62770)
2feda38 Partition enhancements for peripheral features (#62463)
c7cbced Move SkipMixin and BranchMixIn to Task SDK (#62749)
b5eb427 Refactor DataTable to handle internal scrolling and fix overflow on narrow vi...
f6b289a Fix DagRan typo in DagRun.set_state docstring (#61788)
5d9b5df Fix: Restore task_instance_history sequence on downgrade (#61976)
39d23c2 Fix flaky calendar e2e test (#62718)
Additional commits viewable in compare view

Updates apache-airflow-providers-http from 5.2.1 to 6.0.0

Commits

a1ddf31 Prepare documentation for next release of providers (2026-02-24) (#62495)
d4f7a22 Exclude translation skills from codespell (#62508)
67a86d5 Make the gunicorn API server respect GUNICORN_CMD_ARGS again (#62522)
15fce01 feat(airflowctl): support on headless environments (#62217)
76679f6 Cap gunicorn below 25.1.0 to avoid API server startup deadlocks (#62524)
93144ab Add end-to-end feature checklist to Execution API AGENTS.md (#62481)
7205e26 Regulatory update to prek hook that checks core imports in sdk (#62513)
ba2384a chore(deps): bump rollup (#62507)
4dc0883 Return files destination uris in GoogleDriverToGCSOperator and `SheetsToGCS...
6e8fbd8 Migrate trino/cohere connection UI metadata to YAML (#62390)
Additional commits viewable in compare view

Updates cryptography from 44.0.2 to 46.0.5

Changelog

Sourced from cryptography's changelog.

46.0.5 - 2026-02-10


* An attacker could create a malicious public key that reveals portions of your
  private key when using certain uncommon elliptic curves (binary curves).
  This version now includes additional security checks to prevent this attack.
  This issue only affects binary elliptic curves, which are rarely used in
  real-world applications. Credit to **XlabAI Team of Tencent Xuanwu Lab and
  Atuin Automated Vulnerability Discovery Engine** for reporting the issue.
  **CVE-2026-26007**
* Support for ``SECT*`` binary elliptic curves is deprecated and will be
  removed in the next release.
.. v46-0-4:
46.0.4 - 2026-01-27

Dropped support for win_arm64 wheels_.
Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.

.. _v46-0-3:

46.0.3 - 2025-10-15

* Fixed compilation when using LibreSSL 4.2.0. .. _v46-0-2:

46.0.2 - 2025-09-30

Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.4.

.. _v46-0-1:

46.0.1 - 2025-09-16

* Fixed an issue where users installing via ``pip`` on Python 3.14 development versions would not properly install a dependency. * Fixed an issue building the free-threaded macOS 3.14 wheels. .. _v46-0-0:

46.0.0 - 2025-09-16

BACKWARDS INCOMPATIBLE: Support for Python 3.7 has been removed.

... (truncated)

Commits

06e120e bump version for 46.0.5 release (#14289)
0eebb9d EC check key on cofactor > 1 (#14287)
bedf6e1 fix openssl version on 46 branch (#14220)
e6f44fc bump for 46.0.4 and drop win arm64 due to CI issues (#14217)
c0af4dd release 46.0.3 (#13681)
99efe5a bump version for 46.0.2 (#13531)
e735cfc release 46.0.1 (#13450)
4e457ff Explicitly specify python in mac uv build invocation (#13447)
2726efd Depend on CFFI 2.0.0 or newer on Python > 3.8 (#13448)
6223062 release 46.0.0 (#13446)
Additional commits viewable in compare view

Updates flask from 2.2.5 to 3.1.3

Release notes

Sourced from flask's releases.

3.1.3

This is the Flask 3.1.3 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.3/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-3

The session is marked as accessed for operations that only access the keys but not the values, such as in and len. GHSA-68rp-wp8r-4726

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

stream_with_context does not fail inside async views. #5774

When using follow_redirects in the test client, the final state of session is correct. #5786

Relax type hint for passing bytes IO to send_file. #5776

3.1.1

This is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.1/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1 Milestone https://github.com/pallets/flask/milestone/36?closed=1

Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g

Fix type hint for cli_runner.invoke. #5645

flask --help loads the app and plugins first to make sure all commands are shown. #5673

Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. #5659

3.1.0

This is the Flask 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

PyPI: https://pypi.org/project/Flask/3.1.0/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-0 Milestone: https://github.com/pallets/flask/milestone/33?closed=1

Drop support for Python 3.8. #5623

Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. #5624, #5633

Provide a configuration option to control automatic option responses. #5496

Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. #5504

Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation about resource limits to the security page. #5625

Add support for the Partitioned cookie attribute (CHIPS), with the SESSION_COOKIE_PARTITIONED config. #5472

-e path takes precedence over default .env and .flaskenv files. load_dotenv loads default files in addition to a path unless load_defaults=False is passed. #5628

Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support. #5621

Fix how setting host_matching=True or subdomain_matching=False interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts requests to only that domain. #5553

Request.trusted_hosts is checked during routing, and can be set through the TRUSTED_HOSTS config. #5636

3.0.3

... (truncated)

Changelog

Sourced from flask's changelog.

Version 3.1.3

Released 2026-02-18

The session is marked as accessed for operations that only access the keys but not the values, such as in and len. :ghsa:68rp-wp8r-4726

Version 3.1.2

Released 2025-08-19

stream_with_context does not fail inside async views. :issue:5774

When using follow_redirects in the test client, the final state of session is correct. :issue:5786

Relax type hint for passing bytes IO to send_file. :issue:5776

Version 3.1.1

Released 2025-05-13

Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g

Fix type hint for cli_runner.invoke. :issue:5645

flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673

Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659

Version 3.1.0

Released 2024-11-13

Drop support for Python 3.8. :pr:5623

Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633

Provide a configuration option to control automatic option responses. :pr:5496

Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. :issue:5504

Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added

... (truncated)

Commits

22d9247 release version 3.1.3
089cb86 Merge commit from fork
c17f379 request context tracks session access
27be933 start version 3.1.3
4e652d3 Abort if the instance folder cannot be created (#5903)
3d03098 Abort if the instance folder cannot be created
407eb76 document using gevent for async (#5900)
ac5664d document using gevent for async
4f79d5b Increase required flit_core version to 3.11 (#5865)
fe3b215 Increase required flit_core version to 3.11
Additional commits viewable in compare view

Updates flask-appbuilder from 4.5.3 to 5.2.0

Release notes

Sourced from flask-appbuilder's releases.

5.2.0

What's Changed

feat: Add security model signals for User, Role, and Group CRUD operations by @dpgaspar in dpgaspar/Flask-AppBuilder#2432

ci: add py3.13 to the test matrix by @jnahmias in dpgaspar/Flask-AppBuilder#2419

feat: add API key authentication support by @aminghadersohi in dpgaspar/Flask-AppBuilder#2431

New Contributors

@aminghadersohi made their first contribution in dpgaspar/Flask-AppBuilder#2431

Full Changelog: dpgaspar/Flask-AppBuilder@v5.1.0...v5.2.0

5.1.0

What's Changed

fix: update user.changed_on when roles are modified by @Alok-kumar-priyadarshi in dpgaspar/Flask-AppBuilder#2423

feat: SAML Authentication by @dpgaspar in dpgaspar/Flask-AppBuilder#2426

release: 5.1.0 by @dpgaspar in dpgaspar/Flask-AppBuilder#2428

New Contributors

@Alok-kumar-priyadarshi made their first contribution in dpgaspar/Flask-AppBuilder#2423

Full Changelog: dpgaspar/Flask-AppBuilder@v5.0.2...v5.1.0

5.0.2

What's Changed

chore(username): Expand username length by @Antonio-RiveroMartnez in dpgaspar/Flask-AppBuilder#2409

fix(translations) : French PO has been fully reviewed and modified to correspond with the POT dated 21/01/2025 (Update messages.po) by @xavier-GitHub76 in dpgaspar/Flask-AppBuilder#2371

fix: check user is active with is_active by @dpgaspar in dpgaspar/Flask-AppBuilder#2410

fix: setup pkg filename by @dpgaspar in dpgaspar/Flask-AppBuilder#2412

fix: fix pkg name to comply with pypi by @dpgaspar in dpgaspar/Flask-AppBuilder#2413

New Contributors

@Antonio-RiveroMartnez made their first contribution in dpgaspar/Flask-AppBuilder#2409

@xavier-GitHub76 made their first contribution in dpgaspar/Flask-AppBuilder#2371

Full Changelog: dpgaspar/Flask-AppBuilder@v5.0.1...v5.0.2

5.0.1

What's Changed

docs: improve 5.0.0 version migration by @dpgaspar in dpgaspar/Flask-AppBuilder#2392

chore: apply APPLICATION_ROOT to swagger URL by @eschutho in dpgaspar/Flask-AppBuilder#2394

fix(ci): move ldap to bitnami legacy by @dpgaspar in dpgaspar/Flask-AppBuilder#2402

feat: support JSON columns by @betodealmeida in dpgaspar/Flask-AppBuilder#2383

fix: Import RequestLimit from public namespace by @alisaifee in dpgaspar/Flask-AppBuilder#2398

release: 5.0.1 by @dpgaspar in dpgaspar/Flask-AppBuilder#2404

New Contributors

@eschutho made their first contribution in dpgaspar/Flask-AppBuilder#2394

@alisaifee made their first contribution in dpgaspar/Flask-AppBuilder#2398

Full Changelog: dpgaspar/Flask-AppBuilder@v5.0.0...v5.0.1

... (truncated)

Changelog

Sourced from flask-appbuilder's changelog.

Improvements and Bug fixes on 5.2.0

feat: add API key authentication support (#2431) [Amin Ghadersohi]

ci: add py3.13 to the test matrix (#2419) [jnahmias]

feat: Add security model signals for User, Role, and Group CRUD operations (#2432) [Daniel Vaz Gaspar]

Improvements and Bug fixes on 5.1.0

feat: SAML Authentication (#2426) [Daniel Vaz Gaspar]

fix: update user.changed_on when roles are modified (#2423) [alok kumar priyadarshi]

Improvements and Bug fixes on 5.0.2

fix: fix pkg name to comply with pypi (#2413) [Daniel Vaz Gaspar]

fix: setup pkg filename (#2412) [Daniel Vaz Gaspar]

fix: check user is active with is_active (#2410) [Daniel Vaz Gaspar]

chore: French translations update messages.po (#2371) [xavier-GitHub76]

chore(username): Expand username length (#2409) [Antonio Rivero]

Improvements and Bug fixes on 5.0.1

Import RequestLimit from public namespace (#2398) [Ali-Akber Saifee]

feat: support JSON columns (#2383) [Beto Dealmeida]

fix(ci): move ldap to bitnami legacy (#2402) [Daniel Vaz Gaspar]

chore: apply APPLICATION_ROOT to swagger URL (#2394) [Elizabeth Thompson]

docs: improve 5.0.0 version migration (#2392) [Daniel Vaz Gaspar]

Improvements and Bug fixes on 5.0.0

chore: remove mongodb and openid support (v2) (#2390) [Daniel Vaz Gaspar]

fix: Add missing items types get_list_schema (#2389) [Kamil Gabryjelski]

chore: support sqlalchemy 2.x and flask-sqlalchemy 3 (breaking) (#2241) [Daniel Vaz Gaspar]

fix: openapi list permissions return type (#2388) [jfo]

Improvements and Bug fixes on 4.8.1

fix: don't register reset my password when not on AUTH_DB (#2384) [Daniel Vaz Gaspar]

fix: Correct is_pk_composite method to return False instead of raising an error. False is not a base exception (#2378) [Kyle Lagerquist]

Improvements and Bug fixes on 4.8.0

feat: Support the select_columns arg on the Get Item method (#2372) [Vitor Avila]

... (truncated)

Commits

5099b21 release: 5.2.0 (#2436)
eefc219 feat: add API key authentication support (#2431)
3aa0e41 ci: add py3.13 to the test matrix (#2419)
ca5bdfd feat: Add security model signals for User, Role, and Group CRUD operations (#...
b69c8f1 release: 5.1.0 (#2428)
1598de4 feat: SAML Authentication (#2426)
c1314c7 fix: update user.changed_on when roles are modified (#2423)
f4a8cfd release: 5.0.2 (#2415)
3628356 fix: fix pkg name to comply with pypi (#2413)
04e9781 fix: setup pkg filename (#2412)
Additional commits viewable in compare view

Updates protobuf from 5.29.5 to 5.29.6

Release notes

Sourced from protobuf's releases.

Protocol Buffers v34.0-rc1

Announcements

This version includes breaking changes to: C++, Objective-C, PHP, Python.

[Bazel] Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

[C++] Make generator headers private (protocolbuffers/protobuf@3a2af35)

[C++] Add a debug check that the target of CopyFrom is not a descendant of the source. (protocolbuffers/protobuf@7a75898)

[C++] Add [[nodiscard]] to many APIs. (protocolbuffers/protobuf@a70115f)

[C++] Make the arena-enabled constructors of RepeatedField, RepeatedPtrField, and Map private. (protocolbuffers/protobuf@ef890c3)

[C++] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[C++] Removes proto2::util::MessageDifferencer::AddIgnoreCriteria that takes a raw pointer as an argument in favor of the overload that takes a unique_ptr. Remove macro PROTOBUF_FUTURE_REMOVE_ADD_IGNORE_CRITERIA (protocolbuffers/protobuf@b115358)

[C++] Remove deprecated FieldDescriptor::has_optional_keyword() in OSS. Use is_repeated() or has_presence() instead (protocolbuffers/protobuf@68346ec)

[C++] Remove AddUnusedImportTrackFile() and ClearUnusedImportTrackFiles(). Remove PROTOBUF_FUTURE_RENAME_ADD_UNUSED_IMPORT (protocolbuffers/protobuf@837a2cd)

[C++] Remove deprecated FieldDescriptor::is_optional() in OSS. Use (!is_required() && !is_repeated()) instead (protocolbuffers/protobuf@9dbc5d4)

[C++] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

[C++] All entity names have length limit (2afb0dc)

[ObjC] Remove generate_minimal_imports generation option warning (protocolbuffers/protobuf@45b1297)

[ObjC] Fix nullability annotations on some GPB*Dictionary types. (protocolbuffers/protobuf@ea67d6d)

[ObjC] Remove -[GPBFieldDescriptor optional] (protocolbuffers/protobuf@3414dc1)

[Other] Remove deprecated flag for enabling MSVC support (protocolbuffers/protobuf@97c979b)

[PHP] Remove deprecated PHP APIs (protocolbuffers/protobuf@9c45014)

[PHP] Remove deprecated PHP APIs FieldDescriptor getLabel, use IsRepeated or isRequired instead. (protocolbuffers/protobuf@4208121, protocolbuffers/protobuf@cd76e67, protocolbuffers/protobuf@4208121)

[PHP] Add PHP typehints for setters and remove redundant GPBUtil checks (protocolbuffers/protobuf#25296) (protocolbuffers/protobuf@aee03b7)

[PHP] support default values for editions/proto2 (protocolbuffers/protobuf#25161) (protocolbuffers/protobuf@b01099d)

[Python] Raise errors in OSS when assign bool to int/enum field in Python Proto. (protocolbuffers/protobuf@5b116fe)

[Python] Remove float_format/double_format from python proto text_format (protocolbuffers/protobuf@e4854a1)

[Python] Raise TypeError when convert non-timedelta to Duration, or convert non-datetime to Timestamp in python proto. (Original code may raise ArributeError) (protocolbuffers/protobuf@00aaca1)

[Python] Remove float_precision from python proto json_format (protocolbuffers/protobuf@f027f1f)

[Python] Remove deprecated FieldDescriptor::label() in OSS. Use is_repeated() or is_required() instead (protocolbuffers/protobuf@b76faa9)

[Python] Remove deprecated FieldDescriptor.label (protocolbuffers/protobuf@0a8ff55)

[Python] Remove deprecated UseDeprecatedLegacyJsonFieldConflicts() (protocolbuffers/protobuf@c301c2c)

Protobuf News may include additional announcements or pre-announcements for upcoming changes.

Migration Guide may include additional guidance for breaking changes.

Bazel

Fix: cc_toolchain should prefer protoc when prebuilt flag is flipped. (#25168) (protocolbuffers/protobuf@8c857c3)

Breaking change: Remove deprecated ProtoInfo.transitive_imports. Use equivalent transitive_sources instead (protocolbuffers/protobuf@0a5c2f6)

Feat(bazel): wire up prebuilt protoc toolchain (#24115) (protocolbuffers/protobuf@cc23698)

Migrate proto_descriptor_set (#23369) (protocolbuffers/protobuf@8d4dfdd)

Compiler

Ruby codegen: support generation of rbs files (#15633) (protocolbuffers/protobuf@6ebdf85)

Avoid collision name problems between a message named Xyz and a direct sibling enum named XyzView (protocolbuffers/protobuf@eba53e8)

Generalizing and implementing ValidateFeatureSupport for both Options and Features during proto parsing (protocolbuffers/protobuf@ed3c571)

Fix a bug with custom features outside of the pb package. (protocolbuffers/protobuf@872d3ce)

Fix import option handling when include_imports isn't set. (protocolbuffers/protobuf@9ef9e80)

Fix a bug in STRICT check of namespaced enums to properly check for 'reserved 1 to max' (protocolbuffers/protobuf@1229d4a)

Prevent accidental stripping of debug_redact options via import option. (protocolbuffers/protobuf@f58b098)

C++

Add EnumerateEnumValues function. (protocolbuffers/protobuf@397d5d9)

... (truncated)

Commits

See full diff in compare view

Updates sqlparse from 0.5.3 to 0.5.4

Changelog

Sourced from sqlparse's changelog.

Release 0.5.4 (Nov 28, 2025)

Enhancements

Add support for Python 3.14.

Add type annotations to top-level API functions and include py.typed marker for PEP 561 compliance, enabling type checking with mypy and other tools (issue756).

Add pre-commit hook support. sqlparse can now be used as a pre-commit hook to automatically format SQL files. The CLI now supports multiple files and an --in-place flag for in-place editing (issue537).

Add ATTACH and DETACH to PostgreSQL keywords (pr808).

Add INTERSECT to close keywords in WHERE clause (pr820).

Support REGEXP BINARY comparison operator (pr817).

Bug Fixes

Add additional protection against denial of service attacks when parsing very large lists of tuples. This enhances the existing recursion protections with configurable limits for token processing to prevent DoS through algorithmic complexity attacks. The new limits (MAX_GROUPING_DEPTH=100, MAX_GROUPING_TOKENS=10000) can be adjusted or disabled (by setting to None) if needed for legitimate large SQL statements.

Remove shebang from cli.py and remove executable flag (pr818).

Fix strip_comments not removing all comments when input contains only comments (issue801, pr803 by stropysh).

Fix splitting statements with IF EXISTS/IF NOT EXISTS inside BEGIN...END blocks (issue812).

Fix splitting on semicolons inside BEGIN...END blocks (issue809).

Commits

14e300b Bump version.
96a67e2 Code cleanup.
1a3bfbd Fix handling of semicolons inside BEGIN...END blocks (fixes #809).
e92a032 Fix handling of IF EXISTS statements in BEGIN...END blocks (fixes #812).
149bebf Update Changelog.
561a67e Update AUTHORS.
73c8ba3 bugfix ISSUE_801; Remove all comments when only comments
1b32387 Update action to run on all prs.
31903e0 Add pre-commit hook support (fixes #537)
1357726 docs: add AGENTS.md for project guidance and development commands
Additional commits viewable in compare view

Updates werkzeug from 2.2.3 to 3.1.6

Release notes

Sourced from werkzeug's releases.

3.1.6

This is the Werkzeug 3.1.6 security fix release, which fixes a security issue but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.6/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-6

safe_join on Windows does not allow special devices names in multi-segment paths.

Bumps the uv group with 7 updates in the /app/airflow directory: | Package | From | To | | --- | --- | --- | | [apache-airflow](https://github.com/apache/airflow) | `2.11.0` | `3.1.7` | | [apache-airflow-providers-amazon](https://github.com/apache/airflow) | `9.7.0` | `9.22.0` | | [apache-airflow-providers-http](https://github.com/apache/airflow) | `5.2.1` | `6.0.0` | | [cryptography](https://github.com/pyca/cryptography) | `44.0.2` | `46.0.5` | | [flask](https://github.com/pallets/flask) | `2.2.5` | `3.1.3` | | [protobuf](https://github.com/protocolbuffers/protobuf) | `5.29.5` | `5.29.6` | | [sqlparse](https://github.com/andialbrecht/sqlparse) | `0.5.3` | `0.5.4` | Bumps the uv group with 3 updates in the /app/api directory: [cryptography](https://github.com/pyca/cryptography), [sqlparse](https://github.com/andialbrecht/sqlparse) and [django-allauth](https://github.com/sponsors/pennersr). Updates `apache-airflow` from 2.11.0 to 3.1.7 - [Release notes](https://github.com/apache/airflow/releases) - [Changelog](https://github.com/apache/airflow/blob/main/docker-stack-docs/changelog.rst) - [Commits](apache/airflow@2.11.0...3.1.7) Updates `apache-airflow-providers-amazon` from 9.7.0 to 9.22.0 - [Release notes](https://github.com/apache/airflow/releases) - [Changelog](https://github.com/apache/airflow/blob/main/docker-stack-docs/changelog.rst) - [Commits](apache/airflow@providers-slack/9.7.0...providers-amazon/9.22.0) Updates `apache-airflow-providers-http` from 5.2.1 to 6.0.0 - [Release notes](https://github.com/apache/airflow/releases) - [Changelog](https://github.com/apache/airflow/blob/main/docker-stack-docs/changelog.rst) - [Commits](apache/airflow@providers-http/5.2.1...providers-http/6.0.0) Updates `cryptography` from 44.0.2 to 46.0.5 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@44.0.2...46.0.5) Updates `flask` from 2.2.5 to 3.1.3 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@2.2.5...3.1.3) Updates `flask-appbuilder` from 4.5.3 to 5.2.0 - [Release notes](https://github.com/dpgaspar/flask-appbuilder/releases) - [Changelog](https://github.com/dpgaspar/Flask-AppBuilder/blob/master/CHANGELOG.rst) - [Commits](dpgaspar/Flask-AppBuilder@v4.5.3...v5.2.0) Updates `protobuf` from 5.29.5 to 5.29.6 - [Release notes](https://github.com/protocolbuffers/protobuf/releases) - [Commits](https://github.com/protocolbuffers/protobuf/commits) Updates `sqlparse` from 0.5.3 to 0.5.4 - [Changelog](https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG) - [Commits](andialbrecht/sqlparse@0.5.3...0.5.4) Updates `werkzeug` from 2.2.3 to 3.1.6 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@2.2.3...3.1.6) Updates `cryptography` from 44.0.1 to 46.0.5 - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@44.0.2...46.0.5) Updates `sqlparse` from 0.5.3 to 0.5.4 - [Changelog](https://github.com/andialbrecht/sqlparse/blob/master/CHANGELOG) - [Commits](andialbrecht/sqlparse@0.5.3...0.5.4) Updates `django-allauth` from 65.13.0 to 65.14.1 - [Commits](https://github.com/sponsors/pennersr/commits) --- updated-dependencies: - dependency-name: apache-airflow dependency-version: 3.1.7 dependency-type: direct:production dependency-group: uv - dependency-name: apache-airflow-providers-amazon dependency-version: 9.22.0 dependency-type: direct:production dependency-group: uv - dependency-name: apache-airflow-providers-http dependency-version: 6.0.0 dependency-type: indirect dependency-group: uv - dependency-name: cryptography dependency-version: 46.0.5 dependency-type: indirect dependency-group: uv - dependency-name: flask dependency-version: 3.1.3 dependency-type: indirect dependency-group: uv - dependency-name: flask-appbuilder dependency-version: 5.2.0 dependency-type: indirect dependency-group: uv - dependency-name: protobuf dependency-version: 5.29.6 dependency-type: indirect dependency-group: uv - dependency-name: sqlparse dependency-version: 0.5.4 dependency-type: indirect dependency-group: uv - dependency-name: werkzeug dependency-version: 3.1.6 dependency-type: indirect dependency-group: uv - dependency-name: cryptography dependency-version: 46.0.5 dependency-type: indirect dependency-group: uv - dependency-name: sqlparse dependency-version: 0.5.4 dependency-type: indirect dependency-group: uv - dependency-name: django-allauth dependency-version: 65.14.1 dependency-type: direct:production dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-03-26T13:45:48Z

Superseded by #1303.

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Mar 10, 2026

dependabot Bot requested review from AndrewThien and AndyRae as code owners March 10, 2026 01:30

dependabot Bot mentioned this pull request Mar 10, 2026

Bump the uv group across 2 directories with 9 updates #1297

Closed

github-actions Bot added Area: Backend Area: Airflow labels Mar 10, 2026

dependabot Bot closed this Mar 26, 2026

dependabot Bot deleted the dependabot/uv/app/airflow/uv-e839ce7f41 branch March 26, 2026 13:45

Navigation Menu

Uh oh!

Bump the uv group across 2 directories with 10 updates - #1298

Bump the uv group across 2 directories with 10 updates#1298
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/app/airflow/uv-e839ce7f41

dependabot Bot commented on behalf of github Mar 10, 2026

Uh oh!

dependabot Bot commented on behalf of github Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Mar 10, 2026

Apache Airflow 3.1.7

Significant Changes

Bug Fixes

3.1.3

3.1.2

3.1.1

3.1.0

3.0.3

Version 3.1.3

Version 3.1.2

Version 3.1.1

Version 3.1.0

5.2.0

What's Changed

New Contributors

5.1.0

What's Changed

New Contributors

5.0.2

What's Changed

New Contributors

5.0.1

What's Changed

New Contributors

Improvements and Bug fixes on 5.2.0

Improvements and Bug fixes on 5.1.0

Improvements and Bug fixes on 5.0.2

Improvements and Bug fixes on 5.0.1

Improvements and Bug fixes on 5.0.0

Improvements and Bug fixes on 4.8.1

Improvements and Bug fixes on 4.8.0

Protocol Buffers v34.0-rc1

Announcements

Bazel

Compiler

C++

Release 0.5.4 (Nov 28, 2025)

3.1.6

Uh oh!

dependabot Bot commented on behalf of github Mar 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants