Upgrade: Bump the dependencies group across 1 directory with 11 updates #184

dependabot · 2025-12-01T03:19:05Z

Bumps the dependencies group with 11 updates in the / directory:

Package	From	To
certifi	`2025.6.15`	`2025.11.12`
charset-normalizer	`3.4.2`	`3.4.4`
click	`8.1.8`	`8.3.1`
flask	`3.1.1`	`3.1.2`
idna	`3.10`	`3.11`
markupsafe	`3.0.2`	`3.0.3`
openttd-helpers	`1.4.0`	`2.0.0`
requests	`2.32.4`	`2.32.5`
sentry-sdk	`2.30.0`	`2.46.0`
urllib3	`2.4.0`	`2.5.0`
werkzeug	`3.1.3`	`3.1.4`

Updates certifi from 2025.6.15 to 2025.11.12

Commits

37ea150 2025.11.12 (#375)
2fa50bb Bump actions/upload-artifact from 4.6.2 to 5.0.0 (#374)
6cadb53 Bump actions/download-artifact from 5.0.0 to 6.0.0 (#373)
fb14ac4 2025.10.05 (#371)
2c7c7ee Add Python 3.14 classifier in setup.py
1a5cb7b Bump actions/setup-python from 5.6.0 to 6.0.0 (#367)
dea5960 Bump pypa/gh-action-pypi-publish from 1.12.4 to 1.13.0 (#366)
83566b7 Bump actions/checkout from 4.2.2 to 5.0.0
ca2e121 Bump actions/download-artifact from 4.3.0 to 5.0.0
a97d9ad 2025.08.03 (#362)
Additional commits viewable in compare view

Updates charset-normalizer from 3.4.2 to 3.4.4

Release notes

Sourced from charset-normalizer's releases.

Version 3.4.4

3.4.4 (2025-10-13)

Changed

Bound setuptools to a specific constraint setuptools>=68,<=81.

Raised upper bound of mypyc for the optional pre-built extension to v1.18.2

Removed

setuptools-scm as a build dependency.

Misc

Enforced hashes in dev-requirements.txt and created ci-requirements.txt for security purposes.

Additional pre-built wheels for riscv64, s390x, and armv7l architectures.

Restore multiple.intoto.jsonl in GitHub releases in addition to individual attestation file per wheel.

Version 3.4.3

3.4.3 (2025-08-09)

Changed

mypy(c) is no longer a required dependency at build time if CHARSET_NORMALIZER_USE_MYPYC isn't set to 1. (#595) (#583)

automatically lower confidence on small bytes samples that are not Unicode in detect output legacy function. (#391)

Added

Custom build backend to overcome inability to mark mypy as an optional dependency in the build phase.

Support for Python 3.14

Fixed

sdist archive contained useless directories.

automatically fallback on valid UTF-16 or UTF-32 even if the md says it's noisy. (#633)

Misc

SBOM are automatically published to the relevant GitHub release to comply with regulatory changes. Each published wheel comes with its SBOM. We choose CycloneDX as the format.

Prebuilt optimized wheel are no longer distributed by default for CPython 3.7 due to a change in cibuildwheel.

Changelog

Sourced from charset-normalizer's changelog.

3.4.4 (2025-10-13)

Changed

Bound setuptools to a specific constraint setuptools>=68,<=81.

Raised upper bound of mypyc for the optional pre-built extension to v1.18.2

Removed

setuptools-scm as a build dependency.

Misc

Enforced hashes in dev-requirements.txt and created ci-requirements.txt for security purposes.

Additional pre-built wheels for riscv64, s390x, and armv7l architectures.

Restore multiple.intoto.jsonl in GitHub releases in addition to individual attestation file per wheel.

3.4.3 (2025-08-09)

Changed

mypy(c) is no longer a required dependency at build time if CHARSET_NORMALIZER_USE_MYPYC isn't set to 1. (#595) (#583)

automatically lower confidence on small bytes samples that are not Unicode in detect output legacy function. (#391)

Added

Custom build backend to overcome inability to mark mypy as an optional dependency in the build phase.

Support for Python 3.14

Fixed

sdist archive contained useless directories.

automatically fallback on valid UTF-16 or UTF-32 even if the md says it's noisy. (#633)

Misc

SBOM are automatically published to the relevant GitHub release to comply with regulatory changes. Each published wheel comes with its SBOM. We choose CycloneDX as the format.

Prebuilt optimized wheel are no longer distributed by default for CPython 3.7 due to a change in cibuildwheel.

Commits

b30ffdc 🔧 fix checksum step in cd.yml
d3fbfcf 🔧 fix cd.yml
dafbb95 Release 3.4.4 (#658)
1f18ffa ⬆️ raise mypy upper bound to 1.18.2
ef4ac69 Merge branch 'release-3.4.4' of github.com:jawah/charset_normalizer into rele...
4b35dda 📝 write changelog for 3.4.4
0ec6452 🔧 update cd.yml workflow (add riscv64, s390x and armv7l)
f341ede ⬆️ upgrade dependencies (dev, ci)
a308841 📝 write changelog for 3.4.4
9c906da 🔧 update cd.yml workflow (add riscv64, s390x and armv7l)
Additional commits viewable in compare view

Updates click from 8.1.8 to 8.3.1

Release notes

Sourced from click's releases.

8.3.1

This is the Click 8.3.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.3.1/ Changes: https://click.palletsprojects.com/page/changes/#version-8-3-1 Milestone: https://github.com/pallets/click/milestone/28

Don't discard pager arguments by correctly using subprocess.Popen. #3039 #3055

Replace Sentinel.UNSET default values by None as they're passed through the Context.invoke() method. #3066 #3065 #3068

Fix conversion of Sentinel.UNSET happening too early, which caused incorrect behavior for multiple parameters using the same name. #3071 #3079

Fix rendering when prompt and confirm parameter prompt_suffix is empty. #3019 #3021

When Sentinel.UNSET is found during parsing, it will skip calls to type_cast_value. #3069 #3090

Hide Sentinel.UNSET values as None when looking up for other parameters through the context inside parameter callbacks. #3136 #3137

8.3.0

This is the Click 8.3.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.3.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-3-0 Milestone https://github.com/pallets/click/milestone/27

Improved flag option handling: Reworked the relationship between flag_value and default parameters for better consistency:

The default parameter value is now preserved as-is and passed directly to CLI functions (no more unexpected transformations)

Exception: flag options with default=True maintain backward compatibility by defaulting to their flag_value

The default parameter can now be any type (bool, None, etc.)

Fixes inconsistencies reported in: #1992 #2514 #2610 #3024 #3030

Allow default to be set on Argument for nargs = -1. #2164 #3030

Show correct auto complete value for nargs option in combination with flag option #2813

Show correct auto complete value for nargs option in combination with flag option #2813

Fix handling of quoted and escaped parameters in Fish autocompletion. #2995 #3013

Lazily import shutil. #3023

Properly forward exception information to resources registered with click.core.Context.with_resource(). #2447 #3058

Fix regression related to EOF handling in CliRunner. #2939 #2940

8.2.2

This is the Click 8.2.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.2.2/

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.3.1

Released 2025-11-15

Don't discard pager arguments by correctly using subprocess.Popen. :issue:3039 :pr:3055

Replace Sentinel.UNSET default values by None as they're passed through the Context.invoke() method. :issue:3066 :issue:3065 :pr:3068

Fix conversion of Sentinel.UNSET happening too early, which caused incorrect behavior for multiple parameters using the same name. :issue:3071 :pr:3079

Hide Sentinel.UNSET values as None when looking up for other parameters through the context inside parameter callbacks. :issue:3136 :pr:3137

Fix rendering when prompt and confirm parameter prompt_suffix is empty. :issue:3019 :pr:3021

When Sentinel.UNSET is found during parsing, it will skip calls to type_cast_value. :issue:3069 :pr:3090

Version 8.3.0

Released 2025-09-17

Improved flag option handling: Reworked the relationship between flag_value and default parameters for better consistency:

The default parameter value is now preserved as-is and passed directly to CLI functions (no more unexpected transformations)

Exception: flag options with default=True maintain backward compatibility by defaulting to their flag_value

The default parameter can now be any type (bool, None, etc.)

Fixes inconsistencies reported in: :issue:1992 :issue:2514 :issue:2610 :issue:3024 :pr:3030

Allow default to be set on Argument for nargs = -1. :issue:2164 :pr:3030

Show correct auto complete value for nargs option in combination with flag option :issue:2813

Fix handling of quoted and escaped parameters in Fish autocompletion. :issue:2995 :pr:3013

Lazily import shutil. :pr:3023

Properly forward exception information to resources registered with click.core.Context.with_resource(). :issue:2447 :pr:3058

Fix regression related to EOF handling in CliRunner. :issue:2939 :pr:2940

Version 8.2.2

Released 2025-07-31

Fix reconciliation of default, flag_value and type parameters for flag options, as well as parsing and normalization of environment variables.

... (truncated)

Commits

1d038f2 release version 8.3.1
03f3889 Fix Ruff UP038 warning (#3141)
3867781 Fix Ruff UP038 warning
b91bb95 Provide altered context to callbacks to hide UNSET values as None (#3137)
437e1e3 Temporarily provide a fake context to the callback to hide UNSET values as ...
ea70da4 Don't test using a file in docs/ (#3102)
e27b307 Make uv run --all-extras pyright --verifytypes click pass (#3072)
a92c573 Fix test_edit to work with BSD sed (#3129)
bd131e1 Fix test_edit to work with BSD sed
0b5c6b7 Add Best practices section (#3127)
Additional commits viewable in compare view

Updates flask from 3.1.1 to 3.1.2

Release notes

Sourced from flask's releases.

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

stream_with_context does not fail inside async views. #5774

When using follow_redirects in the test client, the final state of session is correct. #5786

Relax type hint for passing bytes IO to send_file. #5776

Changelog

Sourced from flask's changelog.

Version 3.1.2

Released 2025-08-19

stream_with_context does not fail inside async views. :issue:5774

When using follow_redirects in the test client, the final state of session is correct. :issue:5786

Relax type hint for passing bytes IO to send_file. :issue:5776

Commits

2c1b30d release version 3.1.2
1292419 Update GitHub Actions workflow for artifact handling (#5795)
4dd52ca Update GitHub Actions workflow for artifact handling
55c6255 update dev dependencies
d8259eb use Jinja name consistently
38b4c1e refactor stream_with_context for async views (#5799)
9822a03 refactor stream_with_context for async views
49b7e7b security docs for TRUSTED_HOSTS (#5798)
b228ca3 security docs for TRUSTED_HOSTS
ff64079 update flask-talisman link
Additional commits viewable in compare view

Updates idna from 3.10 to 3.11

Changelog

Sourced from idna's changelog.

3.11 (2025-10-12)

Update to Unicode 16.0.0, including significant changes to UTS46 processing. As a result of Unicode ending support for it, transitional processing no longer has an effect and returns the same result.

Add support for Python 3.14, lowest supported version is Python 3.8.

Various updates to packaging, including PEP 740 support.

Commits

ad949ee Release v3.11
cae4ba7 Second release candidate for 3.11
8adb305 Add space in RST link
74cb2b6 Release candidate for 3.11
05dab09 Format idna-data with ruff
90eac78 Apply ruff formatting
a31ce7e Remove errant test vectors
81f0333 Omit vectors known to be broken in test suite
a0f3257 Merge branch 'master' into unicode-16-uts46-changes
38d9886 Remove extra UTS46 test vector
Additional commits viewable in compare view

Updates markupsafe from 3.0.2 to 3.0.3

Release notes

Sourced from markupsafe's releases.

3.0.3

This is the MarkupSafe 3.0.3 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/MarkupSafe/3.0.3/ Changes: https://markupsafe.palletsprojects.com/page/changes/#version-3-0-3 Milestone: https://github.com/pallets/markupsafe/milestone/15?closed=1

__version__ raises DeprecationWarning instead of UserWarning. #487

Adopt multi-phase initialization PEP 489 for the C extension. #494

Build Windows ARM64 wheels. #485

Build Python 3.14 wheels. #503

Build riscv64 wheels. #505

Changelog

Sourced from markupsafe's changelog.

Version 3.0.3

Released 2025-09-27

__version__ raises DeprecationWarning instead of UserWarning. :issue:487

Adopt multi-phase initialisation (:pep:489) for the C extension. :issue:494

Build Windows ARM64 wheels. :issue:485

Build Python 3.14 wheels. :issue:503

Build riscv64 wheels. :issue:505

Commits

297fc8e release version 3.0.3
7e4e6ce Free-threading: run with pytest-run-paralell (#507)
6100b9c enable riscv64 wheels (#506)
c9d5ecf enable riscv64 wheels
2f9b337 tox for 3.14
78d951a update dev dependencies
bb6744e add entry
65c4134 upgrade cibuildwheel, add cp314 wheels and test on CPython 3.14 (#504)
3a9bd88 add cp314 wheels
aafe44d remove slsa provenance (#501)
Additional commits viewable in compare view

Updates openttd-helpers from 1.4.0 to 2.0.0

Release notes

Sourced from openttd-helpers's releases.

2.0.0

What's Changed

Change: drop support for Python 3.8 .. 3.10 by @TrueBrain in OpenTTD/py-helpers#42

Full Changelog: OpenTTD/py-helpers@1.4.0...2.0.0

Commits

286cb58 Fix: replace OpenTTD/actions/checkout action (#46)
8c80a2b Fix: replace upload-release-asset action (#45)
21b6bfe Fix: remove unused (and broken) shields in README (#44)
8ed7f80 Upgrade: Bump the regression group across 1 directory with 9 updates (#41)
d31de25 Change: drop support for Python 3.8 .. 3.10 (#42)
f2a0e2a Upgrade: Bump the regression group across 1 directory with 2 updates (#36)
7bce22a Upgrade: Bump the regression group across 1 directory with 4 updates (#34)
5fc44cb Upgrade: Bump the regression group in /regression_runner with 4 updates (#27)
2594034 Upgrade: Bump the actions group with 4 updates (#29)
f821e90 Add: [Dependabot] introduce Dependabot to keep our workflows up-to-date (#28)
Additional commits viewable in compare view

Updates requests from 2.32.4 to 2.32.5

Release notes

Sourced from requests's releases.

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.

Dropped support for Python 3.8 following its end of support.

Changelog

Sourced from requests's changelog.

2.32.5 (2025-08-18)

Bugfixes

The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

Added support for Python 3.14.

Dropped support for Python 3.8 following its end of support.

Commits

b25c87d v2.32.5
131e506 Merge pull request #7010 from psf/dependabot/github_actions/actions/checkout-...
b336cb2 Bump actions/checkout from 4.2.0 to 5.0.0
46e939b Update publish workflow to use artifact-id instead of name
4b9c546 Merge pull request #6999 from psf/dependabot/github_actions/step-security/har...
7618dbe Bump step-security/harden-runner from 2.12.0 to 2.13.0
2edca11 Add support for Python 3.14 and drop support for Python 3.8 (#6993)
fec96cd Update Makefile rules (#6996)
d58d8aa docs: clarify timeout parameter uses seconds in Session.request (#6994)
91a3eab Bump github/codeql-action from 3.28.5 to 3.29.0
Additional commits viewable in compare view

Updates sentry-sdk from 2.30.0 to 2.46.0

Release notes

Sourced from sentry-sdk's releases.

2.46.0

Various fixes & improvements

Preserve metadata on wrapped coroutines (#5105) by @alexander-alderman-webb

Make imports defensive to avoid ModuleNotFoundError in Pydantic AI integration (#5135) by @alexander-alderman-webb

Fix OpenAI agents integration mistakenly enabling itself (#5132) by @sentrivana

Add instrumentation to embedding functions for various backends (#5120) by @constantinius

Improve embeddings support for OpenAI (#5121) by @constantinius

Enhance input handling for embeddings in LiteLLM integration (#5127) by @constantinius

Expect exceptions when re-raised (#5125) by @alexander-alderman-webb

Remove MagicMock from mocked ModelResponse (#5126) by @alexander-alderman-webb

2.45.0

Various fixes & improvements
OTLPIntegration (#4877) by @sl0thentr0py

Enable the new OTLP integration with the code snippet below, and your OpenTelemetry instrumentation will be automatically sent to Sentry's OTLP ingestion endpoint.
  import sentry_sdk
  from sentry_sdk.integrations.otlp import OTLPIntegration
sentry_sdk.init(
dsn="<your-dsn>",
# Add data like inputs and responses;
# see https://docs.sentry.io/platforms/python/data-management/data-collected/ for more info
send_default_pii=True,
integrations=[
OTLPIntegration(),
],
)
Under the hood, this will setup:

A SpanExporter that will automatically set up the OTLP ingestion endpoint from your DSN

A Propagator that ensures Distributed Tracing works

Trace/Span linking for all other Sentry events such as Errors, Logs, Crons and Metrics

If you were using the SentrySpanProcessor before, we recommend migrating over to OTLPIntegration since it's a much simpler setup.
feat(integrations): implement context management for invoke_agent spans (#5089) by @constantinius

feat(loguru): Capture extra (#5096) by @sentrivana

feat: Attach server.address to metrics (#5113) by @alexander-alderman-webb

fix: Cast message and detail attributes before appending exception notes (#5114) by @alexander-alderman-webb

fix(integrations): ensure that GEN_AI_AGENT_NAME is properly set for GEN_AI spans under an invoke_agent span (#5030) by @constantinius

fix(logs): Update sentry.origin (#5112) by @sentrivana

chore: Deprecate description truncation option for Redis spans (#5073) by @alexander-alderman-webb

chore: Deprecate max_spans LangChain parameter (#5074) by @alexander-alderman-webb

chore(toxgen): Check availability of pip and add detail to exceptions (#5076) by @alexander-alderman-webb

... (truncated)

Changelog

Sourced from sentry-sdk's changelog.

2.46.0

Various fixes & improvements

Preserve metadata on wrapped coroutines (#5105) by @alexander-alderman-webb

Make imports defensive to avoid ModuleNotFoundError in Pydantic AI integration (#5135) by @alexander-alderman-webb

Fix OpenAI agents integration mistakenly enabling itself (#5132) by @sentrivana

Add instrumentation to embedding functions for various backends (#5120) by @constantinius

Improve embeddings support for OpenAI (#5121) by @constantinius

Enhance input handling for embeddings in LiteLLM integration (#5127) by @constantinius

Expect exceptions when re-raised (#5125) by @alexander-alderman-webb

Remove MagicMock from mocked ModelResponse (#5126) by @alexander-alderman-webb

2.45.0

Various fixes & improvements
OTLPIntegration (#4877) by @sl0thentr0py

Enable the new OTLP integration with the code snippet below, and your OpenTelemetry instrumentation will be automatically sent to Sentry's OTLP ingestion endpoint.
  import sentry_sdk
  from sentry_sdk.integrations.otlp import OTLPIntegration
sentry_sdk.init(
dsn="<your-dsn>",
# Add data like inputs and responses;
# see https://docs.sentry.io/platforms/python/data-management/data-collected/ for more info
send_default_pii=True,
integrations=[
OTLPIntegration(),
],
)
Under the hood, this will setup:

A SpanExporter that will automatically set up the OTLP ingestion endpoint from your DSN

A Propagator that ensures Distributed Tracing works

Trace/Span linking for all other Sentry events such as Errors, Logs, Crons and Metrics

If you were using the SentrySpanProcessor before, we recommend migrating over to OTLPIntegration since it's a much simpler setup.
feat(integrations): implement context management for invoke_agent spans (#5089) by @constantinius

feat(loguru): Capture extra (#5096) by @sentrivana

feat: Attach server.address to metrics (#5113) by @alexander-alderman-webb

fix: Cast message and detail attributes before appending exception notes (#5114) by @alexander-alderman-webb

fix(integrations): ensure that GEN_AI_AGENT_NAME is properly set for GEN_AI spans under an invoke_agent span (#5030) by @constantinius

fix(logs): Update sentry.origin (#5112) by @sentrivana

chore: Deprecate description truncation option for Redis spans (#5073) by @alexander-alderman-webb

... (truncated)

Commits

d3375bc Update CHANGELOG.md
23abfe2 release: 2.46.0
ca19d63 feat: Preserve metadata on wrapped coroutines (#5105)
cf165e3 build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#5136)
b8d6a57 build(deps): bump actions/create-github-app-token from 2.1.4 to 2.2.0 (#5137)
c0c28b8 build(deps): bump supercharge/redis-github-action from 1.8.0 to 1.8.1 (#5138)
fb18c21 fix(pydantic-ai): Make imports defensive to avoid ModuleNotFoundError (#5135)
f945e38 Fix openai-agents import (#5132)
8596f89 fix(integrations): enhance input handling for embeddings in LiteLLM integrati...
0e6e808 test(openai-agents): Remove MagicMock from mocked ModelResponse (#5126)
Additional commits viewable in compare view

Updates urllib3 from 2.4.0 to 2.5.0

Release notes

Sourced from urllib3's releases.

2.5.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security issues

urllib3 2.5.0 fixes two moderate security issues:

Pool managers now properly control redirects when retries is passed — CVE-2025-50181 reported by @sandumjacob (5.3 Medium, GHSA-pq67-6m6q-mj2v)

Redirects are now controlled by urllib3 in the Node.js runtime — CVE-2025-50182 (5.3 Medium, GHSA-48p4-8xcf-vxj5)

Features

Added support for the compression.zstd module that is new in Python 3.14. See PEP 784 for more information. (#3610)

Added support for version 0.5 of hatch-vcs (#3612)

Bugfixes

Raised exception for HTTPResponse.shutdown on a connection already released to the pool. (#3581)

Fixed incorrect CONNECT statement when using an IPv6 proxy with connection_from_host. Previously would not be wrapped in []. (#3615)

Changelog

Sourced from urllib3's changelog.

2.5.0 (2025-06-18)

Features

Added support for the compression.zstd module that is new in Python 3.14. See PEP 784 <https://peps.python.org/pep-0784/>_ for more information. ([#3610](https://github.com/urllib3/urllib3/issues/3610) <https://github.com/urllib3/urllib3/issues/3610>__)

Added support for version 0.5 of hatch-vcs ([#3612](https://github.com/urllib3/urllib3/issues/3612) <https://github.com/urllib3/urllib3/issues/3612>__)

Bugfixes

Fixed a security issue where restricting the maximum number of followed redirects at the urllib3.PoolManager level via the retries parameter did not work.

Made the Node.js runtime respect redirect parameters such as retries and redirects.

Raised exception for HTTPResponse.shutdown on a connection already released to the pool. ([#3581](https://github.com/urllib3/urllib3/issues/3581) <https://github.com/urllib3/urllib3/issues/3581>__)

Fixed incorrect CONNECT statement when using an IPv6 proxy with connection_from_host. Previously would not be wrapped in []. ([#3615](https://github.com/urllib3/urllib3/issues/3615) <https://github.com/urllib3/urllib3/issues/3615>__)

Commits

aaab4ec Release 2.5.0
7eb4a2a Merge commit from fork
f05b132 Merge commit from fork
d03fe32 Fix HTTP tunneling with IPv6 in older Python versions
11661e9 Bump github/codeql-action from 3.28.0 to 3.29.0 (#3624)
6a0ecc6 Update v2 migration guide to 2.4.0 (#3621)
8e32e60 Raise exception for shutdown on a connection already released to the pool (#3...
9996e0f Fix emscripten CI for Chrome 137+ (#3599)
4fd1a99 Bump RECENT_DATE (#3617)
c4b5917 Add support for the new compression.zstd module in Python 3.14 (#3611)
Additional commits viewable in compare view

Updates werkzeug from 3.1.3 to 3.1.4

Release notes

Sourced from werkzeug's releases.

3.1.4

This is the Werkzeug 3.1.4 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Werkzeug/3.1.4/ Changes: https://werkzeug.palletsprojects.com/page/changes/#version-3-1-4 Milestone: https://github.com/pallets/werkzeug/milestone/42?closed=1

safe_join on Windows does not allow special device names. This prevents reading from these when using send_from_directory. secure_filename already prevented writing to these. ghsa-hgf8-39gv-g3f2

The debugger pin fails after 10 attempts instead of 11. #3020

The multipart form parser handles a \r\n sequence at a chunk boundary. #3065

Improve CPU usage during Watchdog reloader. #3054

Request.json annotation is more accurate. #3067

Traceback rendering handles when the line number is beyond the available source lines. #3044

HTTPException.get_response annotation and doc better conveys the distinction between WSGI and sans-IO responses. #3056

Changelog

Sourced from werkzeug's changelog.

Version 3.1.4

Released 2025-11-28

safe_join on Windows does not allow special device names. This prevents reading from these when using send_from_directory. secure_filename already prevented writing to these. :ghsa:hgf8-39gv-g3f2

The debugger pin fails after 10 attempts instead of 11. :pr:3020

The multipart form parser handles a \r\n sequence at a chunk boundary. :issue:3065

Improve CPU usage during Watchdog reloader. :issue:3054

Request.json annotation is more accurate. :issue:3067

Traceback rendering handles when the line number is beyond the available source lines. :issue:3044

HTTPException.get_response annotation and doc better conveys the distinction between WSGI and sans-IO responses. :issue:3056

Commits

1c7beb6 release version 3.1.4
9c8b754 install less to run tox
474e22f update dev dependencies
4b83337 Merge commit from fork
9bdec46 safe_join prevents windows special device names
b11713e better HTTPException.get_response annotation (#3072)
1131dbd distinguish wsgi and sansio response annotation
5d9a403 skip rendering missing source (#3071)
60ea32c...
Description has been truncated

Bumps the dependencies group with 11 updates in the / directory: | Package | From | To | | --- | --- | --- | | [certifi](https://github.com/certifi/python-certifi) | `2025.6.15` | `2025.11.12` | | [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.2` | `3.4.4` | | [click](https://github.com/pallets/click) | `8.1.8` | `8.3.1` | | [flask](https://github.com/pallets/flask) | `3.1.1` | `3.1.2` | | [idna](https://github.com/kjd/idna) | `3.10` | `3.11` | | [markupsafe](https://github.com/pallets/markupsafe) | `3.0.2` | `3.0.3` | | [openttd-helpers](https://github.com/OpenTTD/py-helpers) | `1.4.0` | `2.0.0` | | [requests](https://github.com/psf/requests) | `2.32.4` | `2.32.5` | | [sentry-sdk](https://github.com/getsentry/sentry-python) | `2.30.0` | `2.46.0` | | [urllib3](https://github.com/urllib3/urllib3) | `2.4.0` | `2.5.0` | | [werkzeug](https://github.com/pallets/werkzeug) | `3.1.3` | `3.1.4` | Updates `certifi` from 2025.6.15 to 2025.11.12 - [Commits](certifi/python-certifi@2025.06.15...2025.11.12) Updates `charset-normalizer` from 3.4.2 to 3.4.4 - [Release notes](https://github.com/jawah/charset_normalizer/releases) - [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md) - [Commits](jawah/charset_normalizer@3.4.2...3.4.4) Updates `click` from 8.1.8 to 8.3.1 - [Release notes](https://github.com/pallets/click/releases) - [Changelog](https://github.com/pallets/click/blob/main/CHANGES.rst) - [Commits](pallets/click@8.1.8...8.3.1) Updates `flask` from 3.1.1 to 3.1.2 - [Release notes](https://github.com/pallets/flask/releases) - [Changelog](https://github.com/pallets/flask/blob/main/CHANGES.rst) - [Commits](pallets/flask@3.1.1...3.1.2) Updates `idna` from 3.10 to 3.11 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst) - [Commits](kjd/idna@v3.10...v3.11) Updates `markupsafe` from 3.0.2 to 3.0.3 - [Release notes](https://github.com/pallets/markupsafe/releases) - [Changelog](https://github.com/pallets/markupsafe/blob/main/CHANGES.rst) - [Commits](pallets/markupsafe@3.0.2...3.0.3) Updates `openttd-helpers` from 1.4.0 to 2.0.0 - [Release notes](https://github.com/OpenTTD/py-helpers/releases) - [Commits](OpenTTD/py-helpers@1.4.0...2.0.0) Updates `requests` from 2.32.4 to 2.32.5 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.4...v2.32.5) Updates `sentry-sdk` from 2.30.0 to 2.46.0 - [Release notes](https://github.com/getsentry/sentry-python/releases) - [Changelog](https://github.com/getsentry/sentry-python/blob/master/CHANGELOG.md) - [Commits](getsentry/sentry-python@2.30.0...2.46.0) Updates `urllib3` from 2.4.0 to 2.5.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.4.0...2.5.0) Updates `werkzeug` from 3.1.3 to 3.1.4 - [Release notes](https://github.com/pallets/werkzeug/releases) - [Changelog](https://github.com/pallets/werkzeug/blob/main/CHANGES.rst) - [Commits](pallets/werkzeug@3.1.3...3.1.4) --- updated-dependencies: - dependency-name: certifi dependency-version: 2025.11.12 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: charset-normalizer dependency-version: 3.4.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: click dependency-version: 8.3.1 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: flask dependency-version: 3.1.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: idna dependency-version: '3.11' dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: markupsafe dependency-version: 3.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: openttd-helpers dependency-version: 2.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: requests dependency-version: 2.32.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: sentry-sdk dependency-version: 2.46.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: urllib3 dependency-version: 2.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: werkzeug dependency-version: 3.1.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: dependencies ... Signed-off-by: dependabot[bot] <[email protected]>

dependabot bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Dec 1, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Upgrade: Bump the dependencies group across 1 directory with 11 updates #184

Upgrade: Bump the dependencies group across 1 directory with 11 updates #184

Uh oh!

dependabot bot commented on behalf of github Dec 1, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Upgrade: Bump the dependencies group across 1 directory with 11 updates #184

Are you sure you want to change the base?

Upgrade: Bump the dependencies group across 1 directory with 11 updates #184

Uh oh!

Conversation

dependabot bot commented on behalf of github Dec 1, 2025

Version 3.4.4

3.4.4 (2025-10-13)

Changed

Removed

Misc

Version 3.4.3

3.4.3 (2025-08-09)

Changed

Added

Fixed

Misc

3.4.4 (2025-10-13)

Changed

Removed

Misc

3.4.3 (2025-08-09)

Changed

Added

Fixed

Misc

8.3.1

8.3.0

8.2.2

Version 8.3.1

Version 8.3.0

Version 8.2.2

3.1.2

Version 3.1.2

3.0.3

Version 3.0.3

2.0.0

What's Changed

v2.32.5

2.32.5 (2025-08-18)

2.32.5 (2025-08-18)

2.46.0

Various fixes & improvements

2.45.0

Various fixes & improvements

2.46.0

Various fixes & improvements

2.45.0

Various fixes & improvements

2.5.0

🚀 urllib3 is fundraising for HTTP/2 support

Security issues

Features

Bugfixes

2.5.0 (2025-06-18)

Features

Bugfixes

3.1.4

Version 3.1.4

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant