Bump the dependencies group across 1 directory with 19 updates by dependabot[bot] · Pull Request #294 · freedomofpress/securedrop-dev-docs

dependabot · 2026-03-30T22:12:23Z

Bumps the dependencies group with 19 updates in the / directory:

Package	From	To
sphinx-autobuild	`2024.10.3`	`2025.8.25`
sphinx-rtd-theme	`3.0.2`	`3.1.0`
anyio	`4.9.0`	`4.13.0`
babel	`2.17.0`	`2.18.0`
certifi	`2025.6.15`	`2026.2.25`
charset-normalizer	`3.4.2`	`3.4.6`
click	`8.2.1`	`8.3.1`
idna	`3.10`	`3.11`
imagesize	`1.4.1`	`1.5.0`
markupsafe	`3.0.2`	`3.0.3`
packaging	`25.0`	`26.0`
pygments	`2.19.2`	`2.20.0`
requests	`2.32.4`	`2.33.1`
roman-numerals-py	`3.1.0`	`4.1.0`
starlette	`0.49.1`	`1.0.0`
typing-extensions	`4.14.0`	`4.15.0`
uvicorn	`0.34.3`	`0.42.0`
watchfiles	`1.1.0`	`1.1.1`
websockets	`15.0.1`	`16.0`

Updates sphinx-autobuild from 2024.10.3 to 2025.8.25

Release notes

Sourced from sphinx-autobuild's releases.

Release 2025.08.25

2025.08.25

Changelog

Sourced from sphinx-autobuild's changelog.

Changelog

unreleased

Set Cache-Control header to no-cache for served files.

2025.08.25 - 2025-08-25

Drop support for Python 3.9-3.10 to match Sphinx.

Declare support for Python 3.14.

Add an optional --post-build flag to run additional commands after building the documentation.

Add support for the SPHINX_AUTOBUILD_DEBUG environment variable to help with debugging.

2024.10.03 - 2024-10-03

Improve error handling for failures in pre-build commands.

2024.10.02 - 2024-10-02

Show the changed paths that triggered the rebuild.

2024.09.19 - 2024-09-19

Fix path filtering on Windows by normalising path separators.

Filter various directories by default (.git, venv, etc).

Serve the correct directory when using make mode (-M).

2024.09.18 - 2024-09-18

Run Sphinx through the Python entry point rather than the binary on PATH.

2024.09.17 - 2024-09-17

Relax checks for paths that aren't required to exist.

2024.09.03 - 2024-09-03

Fix support for Python 3.9.

Fix running sphinx-autobuild via entry point scripts.

... (truncated)

Commits

fd726c5 Release 2025.08.25
f810750 Update pre-commit versions
12e0553 Format pyproject.toml
6d039d4 Declare support for Python 3.14
c4a47b0 Fix name of 'test' nox session in docs (#193)
48fcf5c Fix --help with Python 3.14 and Sphinx 8.2.3 (#199)
0c52892 Add SPHINX_AUTOBUILD_DEBUG to aid debugging (#192)
cc58cc1 Add a --post-build argument (#190)
92bcf10 Require Python 3.11 or newer, to match Sphinx (#189)
See full diff in compare view

Updates sphinx-rtd-theme from 3.0.2 to 3.1.0

Changelog

Sourced from sphinx-rtd-theme's changelog.

3.1.0

Added support for docutils 0.22

Added support for Sphinx 9.x

.. _release-3.1.0rc2:

3.1.0rc2

Added support for docutils 0.22

.. _release-3.1.0rc1:

3.1.0rc1

Added support for Sphinx 9.x

.. _release-3.0.2:

Commits

795de79 Release 3.1.0 (#1676)
66d0fdd Add Python 3.14 to the test suite (#1668)
fbe5e60 3.1.0rc2 with support for docutils 0.22 (#1674)
a76174c Add support for docutils 0.22 (#1671)
20733c3 Add support for Sphinx 9.0.0 (#1666)
71aacd3 Update Code of Conduct URL (#1664)
5a26375 Run tests and build docs with Sphinx 8.2 (#1640)
8d4d394 Sidebar should not be floating on mobile (#1622)
See full diff in compare view

Updates anyio from 4.9.0 to 4.13.0

Release notes

Sourced from anyio's releases.

4.13.0

Dropped support for Python 3.9

Added a ttl parameter to the anyio.functools.lru_cache wrapper (#1073; PR by @Graeme22)

Widened the type annotations of file I/O streams to accept IO[bytes] instead of just BinaryIO (#1078)

Fixed anyio.Path not being compatible with Python 3.15 due to the removal of pathlib.Path.is_reserved() and the addition of pathlib.Path.__vfspath__() (#1061; PR by @veeceey)

Fixed the BrokenResourceError raised by the asyncio SocketStream not having the original exception as its cause (#1055; PR by @veeceey)

Fixed the TypeError raised when using "func" as a parameter name in pytest.mark.parametrize when using the pytest plugin (#1068; PR by @JohnnyDeuss)

Fixed the pytest plugin not running tests that had the anyio marker added programmatically via pytest_collection_modifyitems (#422; PR by @chbndrhnns)

Fixed cancellation exceptions leaking from a CancelScope on asyncio when they are contained in an exception group alongside non-cancellation exceptions (#1091; PR by @gschaffner)

Fixed Condition.wait() not passing on a notification when the task is cancelled but already received a notification

Fixed inverted condition in the process pool shutdown phase which would cause still-running pooled processes not to be terminated (#1074; PR by @bysiber)

4.12.1

Changed all functions currently raising the private NoCurrentAsyncBackend exception (since v4.12.0) to instead raise the public NoEventLoopError exception (#1048)

Fixed anyio.functools.lru_cache not working with instance methods (#1042)

4.12.0

Added support for asyncio's task call graphs on Python 3.14 and later when using AnyIO's task groups (#1025)

Added an asynchronous implementation of the functools module (#1001)

Added support for uvloop=True on Windows via the winloop implementation (#960; PR by @Vizonex)

Added support for use as a context manager to anyio.lowlevel.RunVar (#1003)

Added __all__ declarations to public submodules (anyio.lowlevel etc.) (#1009)

Added the ability to set the token count of a CapacityLimiter to zero (#1019; requires Python 3.10 or later when using Trio)

Added parameters case_sensitive and recurse_symlinks along with support for path-like objects to anyio.Path.glob() and anyio.Path.rglob() (#1033; PR by @northisup)

Dropped sniffio as a direct dependency and added the get_available_backends() function (#1021)

Fixed Process.stdin.send() not raising ClosedResourceError and BrokenResourceError on asyncio. Previously, a non-AnyIO exception was raised in such cases (#671; PR by @gschaffner)

Fixed Process.stdin.send() not checkpointing before writing data on asyncio (#1002; PR by @gschaffner)

Fixed a race condition where cancelling a Future from BlockingPortal.start_task_soon() would sometimes not cancel the async function (#1011; PR by @gschaffner)

Fixed the presence of the pytest plugin causing breakage with older versions of pytest (<= 6.1.2) (#1028; PR by @saper)

Fixed a rarely occurring RuntimeError: Set changed size during iteration while shutting down the process pool when using the asyncio backend (#985)

4.11.0

Added support for cancellation reasons (the reason parameter to CancelScope.cancel()) (#975)

Bumped the minimum version of Trio to v0.31.0

Added the ability to enter the event loop from foreign (non-worker) threads by passing the return value of anyio.lowlevel.current_token() to anyio.from_thread.run() and anyio.from_thread.run_sync() as the token keyword argument (#256)

Added pytest option (anyio_mode = "auto") to make the pytest plugin automatically handle all async tests (#971)

Added the anyio.Condition.wait_for() method for feature parity with asyncio (#974)

Changed the default type argument of anyio.abc.TaskStatus from Any to None (#964)

Fixed TCP listener behavior to guarantee the same ephemeral port is used for all socket listeners when local_port=0 (#857; PR by @11kkw and @agronholm)

Fixed inconsistency between Trio and asyncio where a TCP stream that previously raised a BrokenResourceError on send() would still raise BrokenResourceError after the stream was closed on asyncio, but ClosedResourceError on Trio. They now both raise a ClosedResourceError in this scenario. (#671)

4.10.0

Added the feed_data() method to the BufferedByteReceiveStream class, allowing users to inject data directly into the buffer

Added various class methods to wrap existing sockets as listeners or socket streams:

SocketListener.from_socket()

SocketStream.from_socket()

UNIXSocketStream.from_socket()

UDPSocket.from_socket()

ConnectedUDPSocket.from_socket()

UNIXDatagramSocket.from_socket()

... (truncated)

Commits

afbe93c Bumped up the version
33bdf2e Rearranged the changelog entries
19e09e2 Fixed inverted condition in _forcibly_shutdown_process_pool_on_exit (#1074)
9369d80 Fixed Condition.wait() not handing over notification when cancelled
6f122ab Fixed cancellation exceptions leaking from a CancelScope on asyncio when th...
beaa45a [pre-commit.ci] pre-commit autoupdate (#1097)
602f660 Widened type annotations to accept IO[bytes] in file streams
b5dcd45 Added note about erasing the template
d68670b [pre-commit.ci] pre-commit autoupdate (#1090)
fc17a22 tweak to_thread docs about abandon_on_cancel (#1088)
Additional commits viewable in compare view

Updates babel from 2.17.0 to 2.18.0

Release notes

Sourced from babel's releases.

v2.18.0

Happy 2026! Like last year's release (ahem...), this one too is being made from FOSDEM 2026, in Brussels, Belgium. 🇧🇪 We'll aspire for a less glacial release cycle for 2.19. 😁

Please see CHANGELOG.rst for the detailed change log.

Full Changelog: python-babel/babel@v2.17.0...v2.18.0

Changelog

Sourced from babel's changelog.

Version 2.18.0

Happy 2026! This release is, coincidentally, also being made from FOSDEM.

We will aspire for a slightly less glacial release cadence in this year; there are interesting features in the pipeline.

Features
* Core: Add `babel.core.get_cldr_version()` by @akx in :gh:`1242`
* Core: Use CLDR 47 by @tomasr8 in :gh:`1210`
* Core: Use canonical IANA zone names in zone_territories by @akx in :gh:`1220`
* Messages: Improve extract performance via ignoring directories early during os.walk by @akx in :gh:`968`
* Messages: Merge in per-format keywords and auto_comments by @akx in :gh:`1243`
* Messages: Update keywords for extraction of dpgettext and dnpgettext by @mardiros in :gh:`1235`
* Messages: Validate all plurals in Python format checker by @tomasr8 in :gh:`1188`
* Time: Use standard library `timezone` instead of `FixedOffsetTimezone` by @akx in :gh:`1203`
Bugfixes
Core: Fix formatting for "Empty locale identifier" exception added in #1164 by @akx in :gh:1184

Core: Improve handling of no-inheritance-marker in timezone data by @akx in :gh:1194

Core: Make the number pattern regular expression more efficient by @akx in :gh:1213

Messages: Keep translator comments next to the translation function call by @akx in :gh:1196

Numbers: Fix KeyError that occurred when formatting compact currencies of exactly one thousand in several locales by @bartbroere in :gh:1246

Other improvements
* Core: Avoid unnecessary uses of `map()` by @akx in :gh:`1180`
* Messages: Have init-catalog create directories too by @akx in :gh:`1244`
* Messages: Optimizations for read_po by @akx in :gh:`1200`
* Messages: Use pathlib.Path() in catalog frontend; improve test coverage by @akx in :gh:`1204`
Infrastructure and documentation
CI: Renovate CI & lint tools by @akx in :gh:1228

CI: Tighten up CI with Zizmor by @akx in :gh:1230

CI: make job permissions explicit by @akx in :gh:1227

Docs: Add SECURITY.md by @akx in :gh:1229

Docs: Remove u string prefix from docs by @verhovsky in :gh:1174

Docs: Update dates.rst with current unicode.org tr35 link by @clach04 in :gh:1189

General: Add some PyPI classifiers by @tomasr8 in :gh:1186

General: Apply reformatting by hand and with Ruff by @akx in :gh:1202

General: Test on and declare support for Python 3.14 by @akx in :gh:1233

... (truncated)

Commits

56c63ca Prepare for 2.18.0 (#1248)
73015a1 Add user-agent to CLDR downloader (#1247)
29bd362 Fix formatting compact currencies of exactly one thousand in several locales ...
851db43 Reuse InitCatalog's guts in UpdateCatalog (#1244)
fd00e60 Extract: Merge in per-format keywords and auto_comments (#1243)
12a14b6 Add dpgettext and dnpgettext support (#1235)
7110e62 Use canonical IANA zone names in zone_territories (#1220)
e91c346 Improve extract performance via ignoring directories early during os.walk (#968)
0c4f378 Convert Unittest testcases with setup/teardown to fixtures (#1240)
218c96e Add babel.core.get_cldr_version() (#1242)
Additional commits viewable in compare view

Updates certifi from 2025.6.15 to 2026.2.25

Commits

8571a4b 2026.02.25 (#395)
6f7de00 Bump peter-evans/create-pull-request from 8.0.0 to 8.1.0 (#390)
a1de59b Bump actions/checkout from 6.0.1 to 6.0.2 (#391)
7f5ade5 Bump actions/setup-python from 6.1.0 to 6.2.0 (#392)
c64d9f3 2026.01.04 (#389)
4ac232f Bump actions/download-artifact from 6.0.0 to 7.0.0 (#387)
95ae4b2 Update CI workflow to use Ubuntu 24.04 and Python 3.14 stable (#386)
b72a7b1 Bump dessant/lock-threads from 5.0.1 to 6.0.0 (#385)
ecc2672 Bump actions/upload-artifact from 5.0.0 to 6.0.0 (#384)
6a897db Bump peter-evans/create-pull-request from 7.0.11 to 8.0.0 (#383)
Additional commits viewable in compare view

Updates charset-normalizer from 3.4.2 to 3.4.6

Release notes

Sourced from charset-normalizer's releases.

Version 3.4.6

3.4.6 (2026-03-15)

Changed

Flattened the logic in charset_normalizer.md for higher performance. Removed eligible(..) and feed(...) in favor of feed_info(...).

Raised upper bound for mypy[c] to 1.20, for our optimized version.

Updated UNICODE_RANGES_COMBINED using Unicode blocks v17.

Fixed

Edge case where noise difference between two candidates can be almost insignificant. (#672)

CLI --normalize writing to wrong path when passing multiple files in. (#702)

Misc

Freethreaded pre-built wheels now shipped in PyPI starting with 3.14t. (#616)

Version 3.4.5

3.4.5 (2026-03-06)

Changed

Update setuptools constraint to setuptools>=68,<=82.

Raised upper bound of mypyc for the optional pre-built extension to v1.19.1

Fixed

Add explicit link to lib math in our optimized build. (#692)

Logger level not restored correctly for empty byte sequences. (#701)

TypeError when passing bytearray to from_bytes. (#703)

Misc

Applied safe micro-optimizations in both our noise detector and language detector.

Rewrote the query_yes_no function (inside CLI) to avoid using ambiguous licensed code.

Added cd.py submodule into mypyc optional compilation to reduce further the performance impact.

[!WARNING]
mypyc changed the usual binary output for the optimized wheel. Beware, especially if using PyInstaller or alike. See jawah/charset_normalizer#714

Version 3.4.4

3.4.4 (2025-10-13)

Changed

Bound setuptools to a specific constraint setuptools>=68,<=81.

Raised upper bound of mypyc for the optional pre-built extension to v1.18.2

Removed

setuptools-scm as a build dependency.

Misc

Enforced hashes in dev-requirements.txt and created ci-requirements.txt for security purposes.

Additional pre-built wheels for riscv64, s390x, and armv7l architectures.

Restore multiple.intoto.jsonl in GitHub releases in addition to individual attestation file per wheel.

... (truncated)

Changelog

Sourced from charset-normalizer's changelog.

3.4.6 (2026-03-15)

Changed

Flattened the logic in charset_normalizer.md for higher performance. Removed eligible(..) and feed(...) in favor of feed_info(...).

Raised upper bound for mypy[c] to 1.20, for our optimized version.

Updated UNICODE_RANGES_COMBINED using Unicode blocks v17.

Fixed

Edge case where noise difference between two candidates can be almost insignificant. (#672)

CLI --normalize writing to wrong path when passing multiple files in. (#702)

Misc

Freethreaded pre-built wheels now shipped in PyPI starting with 3.14t. (#616)

3.4.5 (2026-03-06)

Changed

Update setuptools constraint to setuptools>=68,<=82.

Raised upper bound of mypyc for the optional pre-built extension to v1.19.1

Fixed

Add explicit link to lib math in our optimized build. (#692)

Logger level not restored correctly for empty byte sequences. (#701)

TypeError when passing bytearray to from_bytes. (#703)

Misc

Applied safe micro-optimizations in both our noise detector and language detector.

Rewrote the query_yes_no function (inside CLI) to avoid using ambiguous licensed code.

Added cd.py submodule into mypyc optional compilation to reduce further the performance impact.

3.4.4 (2025-10-13)

Changed

Bound setuptools to a specific constraint setuptools>=68,<=81.

Raised upper bound of mypyc for the optional pre-built extension to v1.18.2

Removed

setuptools-scm as a build dependency.

Misc

Enforced hashes in dev-requirements.txt and created ci-requirements.txt for security purposes.

Additional pre-built wheels for riscv64, s390x, and armv7l architectures.

Restore multiple.intoto.jsonl in GitHub releases in addition to individual attestation file per wheel.

3.4.3 (2025-08-09)

Changed

mypy(c) is no longer a required dependency at build time if CHARSET_NORMALIZER_USE_MYPYC isn't set to 1. (#595) (#583)

automatically lower confidence on small bytes samples that are not Unicode in detect output legacy function. (#391)

... (truncated)

Commits

5478b84 Merge pull request #715 from jawah/release-3.4.6
5c0a09e ✔️ add confidence for threading usage, mostly due to lru_cach...
ef826b2 📝 update changelog
5564f1a 📝 update docs accordingly
0f2cf7d 📝 update changelog
54a1894 🐛 fix --normalize writing to wrong path with multiple files
2177e28 📝 update changelog
b2497a5 🐛 edge case where noise difference between two candidates can be almost i...
13a5d0b 🔧 upgrade ci requirements
b9ffbd4 🔧 enable 3.14t nox mypyc session
Additional commits viewable in compare view

Updates click from 8.2.1 to 8.3.1

Release notes

Sourced from click's releases.

8.3.1

This is the Click 8.3.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.3.1/ Changes: https://click.palletsprojects.com/page/changes/#version-8-3-1 Milestone: https://github.com/pallets/click/milestone/28

Don't discard pager arguments by correctly using subprocess.Popen. #3039 #3055

Replace Sentinel.UNSET default values by None as they're passed through the Context.invoke() method. #3066 #3065 #3068

Fix conversion of Sentinel.UNSET happening too early, which caused incorrect behavior for multiple parameters using the same name. #3071 #3079

Fix rendering when prompt and confirm parameter prompt_suffix is empty. #3019 #3021

When Sentinel.UNSET is found during parsing, it will skip calls to type_cast_value. #3069 #3090

Hide Sentinel.UNSET values as None when looking up for other parameters through the context inside parameter callbacks. #3136 #3137

8.3.0

This is the Click 8.3.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecation, or introduce potentially breaking changes.

We encourage everyone to upgrade. You can read more about our Version Support Policy on our website.

PyPI: https://pypi.org/project/click/8.3.0/ Changes: https://click.palletsprojects.com/page/changes/#version-8-3-0 Milestone https://github.com/pallets/click/milestone/27

Improved flag option handling: Reworked the relationship between flag_value and default parameters for better consistency:

The default parameter value is now preserved as-is and passed directly to CLI functions (no more unexpected transformations)

Exception: flag options with default=True maintain backward compatibility by defaulting to their flag_value

The default parameter can now be any type (bool, None, etc.)

Fixes inconsistencies reported in: #1992 #2514 #2610 #3024 #3030

Allow default to be set on Argument for nargs = -1. #2164 #3030

Show correct auto complete value for nargs option in combination with flag option #2813

Show correct auto complete value for nargs option in combination with flag option #2813

Fix handling of quoted and escaped parameters in Fish autocompletion. #2995 #3013

Lazily import shutil. #3023

Properly forward exception information to resources registered with click.core.Context.with_resource(). #2447 #3058

Fix regression related to EOF handling in CliRunner. #2939 #2940

8.2.2

This is the Click 8.2.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/click/8.2.2/

... (truncated)

Changelog

Sourced from click's changelog.

Version 8.3.1

Released 2025-11-15

Don't discard pager arguments by correctly using subprocess.Popen. :issue:3039 :pr:3055

Replace Sentinel.UNSET default values by None as they're passed through the Context.invoke() method. :issue:3066 :issue:3065 :pr:3068

Fix conversion of Sentinel.UNSET happening too early, which caused incorrect behavior for multiple parameters using the same name. :issue:3071 :pr:3079

Hide Sentinel.UNSET values as None when looking up for other parameters through the context inside parameter callbacks. :issue:3136 :pr:3137

Fix rendering when prompt and confirm parameter prompt_suffix is empty. :issue:3019 :pr:3021

When Sentinel.UNSET is found during parsing, it will skip calls to type_cast_value. :issue:3069 :pr:3090

Version 8.3.0

Released 2025-09-17

Improved flag option handling: Reworked the relationship between flag_value and default parameters for better consistency:

The default parameter value is now preserved as-is and passed directly to CLI functions (no more unexpected transformations)

Exception: flag options with default=True maintain backward compatibility by defaulting to their flag_value

The default parameter can now be any type (bool, None, etc.)

Fixes inconsistencies reported in: :issue:1992 :issue:2514 :issue:2610 :issue:3024 :pr:3030

Allow default to be set on Argument for nargs = -1. :issue:2164 :pr:3030

Show correct auto complete value for nargs option in combination with flag option :issue:2813

Fix handling of quoted and escaped parameters in Fish autocompletion. :issue:2995 :pr:3013

Lazily import shutil. :pr:3023

Properly forward exception information to resources registered with click.core.Context.with_resource(). :issue:2447 :pr:3058

Fix regression related to EOF handling in CliRunner. :issue:2939 :pr:2940

Version 8.2.2

Released 2025-07-31

Fix reconciliation of default, flag_value and type parameters for flag options, as well as parsing and normalization of environment variables.

... (truncated)

Commits

1d038f2 release version 8.3.1
03f3889 Fix Ruff UP038 warning (#3141)
3867781 Fix Ruff UP038 warning
b91bb95 Provide altered context to callbacks to hide UNSET values as None (#3137)
437e1e3 Temporarily provide a fake context to the callback to hide UNSET values as ...
ea70da4 Don't test using a file in docs/ (#3102)
e27b307 Make uv run --all-extras pyright --verifytypes click pass (#3072)
a92c573 Fix test_edit to work with BSD sed (#3129)
bd131e1 Fix test_edit to work with BSD sed
0b5c6b7 Add Best practices section (#3127)
Additional commits viewable in compare view

Updates idna from 3.10 to 3.11

Changelog

Sourced from idna's changelog.

3.11 (2025-10-12)

Update to Unicode 16.0.0, including significant changes to UTS46 processing. As a result of Unicode ending support for it, transitional processing no longer has an effect and returns the same result.

Add support for Python 3.14, lowest supported version is Python 3.8.

Various updates to packaging, including PEP 740 support.

Commits

ad949ee Release v3.11
cae4ba7 Second release candidate for 3.11
8adb305 Add space in RST link
74cb2b6 Release candidate for 3.11
05dab09 Format idna-data with ruff
90eac78 Apply ruff formatting
a31ce7e Remove errant test vectors
81f0333 Omit vectors known to be broken in test suite
a0f3257 Merge branch 'master' into unicode-16-uts46-changes
38d9886 Remove extra UTS46 test vector
Additional commits viewable in compare view

Updates imagesize from 1.4.1 to 1.5.0

Commits

0e23fee bump version to 1.5.0
3b791f1 add contributors
fb4cbab add test for BMP
de45472 Merge pull request #67 from flagman/fix-vp8x-dimensions
3cff760 Merge pull request #65 from fuyb1992/master
e59bc03 Merge pull request #60 from ExtReMLapin/patch-2
44c4d1f Merge pull request #56 from gremur/patch-1
a880db5 Fix VP8X WebP dimension parsing bug
3a6b008 Update imagesize.py issuse: #57
178b3c2 added support for signed values thanks to @marcoffee
Additional commits viewable in compare view

Updates markupsafe from 3.0.2 to 3.0.3

Release notes

Sourced from markupsafe's releases.

3.0.3

This is the MarkupSafe 3.0.3 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/MarkupSafe/3.0.3/ Changes: https://markupsafe.palletsprojects.com/page/changes/#version-3-0-3 Milestone: https://github.com/pallets/markupsafe/milestone/15?closed=1

__version__ raises DeprecationWarning instead of UserWarning. #487

Adopt multi-phase initialization PEP 489 for the C extension. #494

Build Windows ARM64 wheels. #485

Build Python 3.14 wheels. #503

Build riscv64 wheels. #505

Changelog

Sourced from markupsafe's changelog.

Version 3.0.3

Released 2025-09-27

__version__ raises DeprecationWarning instead of UserWarning. :issue:487

Adopt multi-phase initialisation (:pep:489) for the C extension. :issue:494

Build Windows ARM64 wheels. :issue:485

Build Python 3.14 wheels. :issue:503

Build riscv64 wheels. :issue:505

Commits

297fc8e release version 3.0.3
7e4e6ce Free-threading: run with pytest-run-paralell (#507)
6100b9c enable riscv64 wheels (#506)
c9d5ecf enable riscv64 wheels
2f9b337 tox for 3.14
78d951a update dev dependencies
bb6744e add entry
65c4134 upgrade cibuildwheel, add cp314 wheels and test on CPython 3.14 (#504)
3a9bd88 add cp314 wheels
aafe44d remove slsa provenance (#501)
Additional commits viewable in compare view

Updates packaging from 25.0 to 26.0

Release notes

Sourced from packaging's releases.

26.0

Read about the performance improvements here: https://iscinumpy.dev/post/packaging-faster.

What's Changed

Features:

PEP 751: support pylock by @sbidoul in pypa/packaging#900

PEP 794: import name metadata by @brettcannon in pypa/packaging#948

Support writing metadata by @henryiii in pypa/packaging#846

Support __replace__ for Version by @henryiii in pypa/packaging#1003

Support positional pattern matching for Version and Specifier by @henryiii in pypa/packaging#1004

Behavior adaptations:

PEP 440 handling of prereleases for Specifier.contains, SpecifierSet.contains, and SpecifierSet.filter by @notatallshaw in pypa/packaging#897

Handle PEP 440 edge case in SpecifierSet.filter by @notatallshaw in pypa/packaging#942

Adjust arbitrary equality intersection preservation in SpecifierSet by @notatallshaw in pypa/packaging#951

Return False instead of raising for .contains with invalid version by @Liam-DeVoe in pypa/packaging#932

Support arbitrary equality on arbitrary strings for Specifier and SpecifierSet's filter and contains method. by @notatallshaw in pypa/packaging#954

Only try to parse as Version on certain marker keys, return False on unequal ordered comparsions by @JP-Ellis in pypa/packaging#939

Fixes:

Update _hash when unpickling Tag() by @dholth in pypa/packaging#860

Correct comment and simplify implicit prerelease handling in Specifier.prereleases by @notatallshaw in pypa/packaging#896

Use explicit _GLibCVersion NamedTuple in _manylinux by @cthoyt in pypa/packaging#868

Detect invalid license expressions containing () by @bwoodsend in pypa/packaging#879

Correct regex for metadata 'name' format by @di in pypa/packaging#925

Improve the message around expecting a semicolon by @pradyunsg in pypa/packaging#833

Support nested parens in license expressions by @Liam-DeVoe in

Bumps the dependencies group with 19 updates in the / directory: | Package | From | To | | --- | --- | --- | | [sphinx-autobuild](https://github.com/sphinx-doc/sphinx-autobuild) | `2024.10.3` | `2025.8.25` | | [sphinx-rtd-theme](https://github.com/readthedocs/sphinx_rtd_theme) | `3.0.2` | `3.1.0` | | [anyio](https://github.com/agronholm/anyio) | `4.9.0` | `4.13.0` | | [babel](https://github.com/python-babel/babel) | `2.17.0` | `2.18.0` | | [certifi](https://github.com/certifi/python-certifi) | `2025.6.15` | `2026.2.25` | | [charset-normalizer](https://github.com/jawah/charset_normalizer) | `3.4.2` | `3.4.6` | | [click](https://github.com/pallets/click) | `8.2.1` | `8.3.1` | | [idna](https://github.com/kjd/idna) | `3.10` | `3.11` | | [imagesize](https://github.com/shibukawa/imagesize_py) | `1.4.1` | `1.5.0` | | [markupsafe](https://github.com/pallets/markupsafe) | `3.0.2` | `3.0.3` | | [packaging](https://github.com/pypa/packaging) | `25.0` | `26.0` | | [pygments](https://github.com/pygments/pygments) | `2.19.2` | `2.20.0` | | [requests](https://github.com/psf/requests) | `2.32.4` | `2.33.1` | | [roman-numerals-py](https://github.com/AA-Turner/roman-numerals) | `3.1.0` | `4.1.0` | | [starlette](https://github.com/Kludex/starlette) | `0.49.1` | `1.0.0` | | [typing-extensions](https://github.com/python/typing_extensions) | `4.14.0` | `4.15.0` | | [uvicorn](https://github.com/Kludex/uvicorn) | `0.34.3` | `0.42.0` | | [watchfiles](https://github.com/samuelcolvin/watchfiles) | `1.1.0` | `1.1.1` | | [websockets](https://github.com/python-websockets/websockets) | `15.0.1` | `16.0` | Updates `sphinx-autobuild` from 2024.10.3 to 2025.8.25 - [Release notes](https://github.com/sphinx-doc/sphinx-autobuild/releases) - [Changelog](https://github.com/sphinx-doc/sphinx-autobuild/blob/main/NEWS.rst) - [Commits](sphinx-doc/sphinx-autobuild@2024.10.03...2025.08.25) Updates `sphinx-rtd-theme` from 3.0.2 to 3.1.0 - [Changelog](https://github.com/readthedocs/sphinx_rtd_theme/blob/master/docs/changelog.rst) - [Commits](readthedocs/sphinx_rtd_theme@3.0.2...3.1.0) Updates `anyio` from 4.9.0 to 4.13.0 - [Release notes](https://github.com/agronholm/anyio/releases) - [Commits](agronholm/anyio@4.9.0...4.13.0) Updates `babel` from 2.17.0 to 2.18.0 - [Release notes](https://github.com/python-babel/babel/releases) - [Changelog](https://github.com/python-babel/babel/blob/master/CHANGES.rst) - [Commits](python-babel/babel@v2.17.0...v2.18.0) Updates `certifi` from 2025.6.15 to 2026.2.25 - [Commits](certifi/python-certifi@2025.06.15...2026.02.25) Updates `charset-normalizer` from 3.4.2 to 3.4.6 - [Release notes](https://github.com/jawah/charset_normalizer/releases) - [Changelog](https://github.com/jawah/charset_normalizer/blob/master/CHANGELOG.md) - [Commits](jawah/charset_normalizer@3.4.2...3.4.6) Updates `click` from 8.2.1 to 8.3.1 - [Release notes](https://github.com/pallets/click/releases) - [Changelog](https://github.com/pallets/click/blob/main/CHANGES.rst) - [Commits](pallets/click@8.2.1...8.3.1) Updates `idna` from 3.10 to 3.11 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.rst) - [Commits](kjd/idna@v3.10...v3.11) Updates `imagesize` from 1.4.1 to 1.5.0 - [Commits](shibukawa/imagesize_py@1.4.1...1.5.0) Updates `markupsafe` from 3.0.2 to 3.0.3 - [Release notes](https://github.com/pallets/markupsafe/releases) - [Changelog](https://github.com/pallets/markupsafe/blob/main/CHANGES.rst) - [Commits](pallets/markupsafe@3.0.2...3.0.3) Updates `packaging` from 25.0 to 26.0 - [Release notes](https://github.com/pypa/packaging/releases) - [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst) - [Commits](pypa/packaging@25.0...26.0) Updates `pygments` from 2.19.2 to 2.20.0 - [Release notes](https://github.com/pygments/pygments/releases) - [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES) - [Commits](pygments/pygments@2.19.2...2.20.0) Updates `requests` from 2.32.4 to 2.33.1 - [Release notes](https://github.com/psf/requests/releases) - [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md) - [Commits](psf/requests@v2.32.4...v2.33.1) Updates `roman-numerals-py` from 3.1.0 to 4.1.0 - [Release notes](https://github.com/AA-Turner/roman-numerals/releases) - [Changelog](https://github.com/AA-Turner/roman-numerals/blob/master/CHANGES.rst) - [Commits](AA-Turner/roman-numerals@v3.1.0...v4.1.0) Updates `starlette` from 0.49.1 to 1.0.0 - [Release notes](https://github.com/Kludex/starlette/releases) - [Changelog](https://github.com/Kludex/starlette/blob/main/docs/release-notes.md) - [Commits](Kludex/starlette@0.49.1...1.0.0) Updates `typing-extensions` from 4.14.0 to 4.15.0 - [Release notes](https://github.com/python/typing_extensions/releases) - [Changelog](https://github.com/python/typing_extensions/blob/main/CHANGELOG.md) - [Commits](python/typing_extensions@4.14.0...4.15.0) Updates `uvicorn` from 0.34.3 to 0.42.0 - [Release notes](https://github.com/Kludex/uvicorn/releases) - [Changelog](https://github.com/Kludex/uvicorn/blob/main/docs/release-notes.md) - [Commits](Kludex/uvicorn@0.34.3...0.42.0) Updates `watchfiles` from 1.1.0 to 1.1.1 - [Release notes](https://github.com/samuelcolvin/watchfiles/releases) - [Commits](samuelcolvin/watchfiles@v1.1.0...v1.1.1) Updates `websockets` from 15.0.1 to 16.0 - [Release notes](https://github.com/python-websockets/websockets/releases) - [Commits](python-websockets/websockets@15.0.1...16.0) --- updated-dependencies: - dependency-name: sphinx-autobuild dependency-version: 2025.8.25 dependency-type: direct:production update-type: version-update:semver-major dependency-group: dependencies - dependency-name: sphinx-rtd-theme dependency-version: 3.1.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: anyio dependency-version: 4.13.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: babel dependency-version: 2.18.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: certifi dependency-version: 2026.2.25 dependency-type: indirect update-type: version-update:semver-major dependency-group: dependencies - dependency-name: charset-normalizer dependency-version: 3.4.6 dependency-type: indirect update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: click dependency-version: 8.3.1 dependency-type: indirect update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: idna dependency-version: '3.11' dependency-type: indirect update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: imagesize dependency-version: 1.5.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: markupsafe dependency-version: 3.0.3 dependency-type: indirect update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: packaging dependency-version: '26.0' dependency-type: indirect update-type: version-update:semver-major dependency-group: dependencies - dependency-name: pygments dependency-version: 2.20.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: requests dependency-version: 2.33.1 dependency-type: indirect update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: roman-numerals-py dependency-version: 4.1.0 dependency-type: indirect update-type: version-update:semver-major dependency-group: dependencies - dependency-name: starlette dependency-version: 1.0.0 dependency-type: indirect update-type: version-update:semver-major dependency-group: dependencies - dependency-name: typing-extensions dependency-version: 4.15.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: uvicorn dependency-version: 0.42.0 dependency-type: indirect update-type: version-update:semver-minor dependency-group: dependencies - dependency-name: watchfiles dependency-version: 1.1.1 dependency-type: indirect update-type: version-update:semver-patch dependency-group: dependencies - dependency-name: websockets dependency-version: '16.0' dependency-type: indirect update-type: version-update:semver-major dependency-group: dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Mar 30, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump the dependencies group across 1 directory with 19 updates#294

Bump the dependencies group across 1 directory with 19 updates#294
dependabot[bot] wants to merge 1 commit intomainfrom
dependabot/pip/dependencies-e0662e5af4

dependabot Bot commented on behalf of github Mar 30, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Mar 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release 2025.08.25

Changelog

unreleased

2025.08.25 - 2025-08-25

2024.10.03 - 2024-10-03

2024.10.02 - 2024-10-02

2024.09.19 - 2024-09-19

2024.09.18 - 2024-09-18

2024.09.17 - 2024-09-17

2024.09.03 - 2024-09-03

3.1.0

3.1.0rc2

3.1.0rc1

4.13.0

4.12.1

4.12.0

4.11.0

4.10.0

v2.18.0

Version 2.18.0

Version 3.4.6

3.4.6 (2026-03-15)

Changed

Fixed

Misc

Version 3.4.5

3.4.5 (2026-03-06)

Changed

Fixed

Misc

Version 3.4.4

3.4.4 (2025-10-13)

Changed

Removed

Misc

3.4.6 (2026-03-15)

Changed

Fixed

Misc

3.4.5 (2026-03-06)

Changed

Fixed

Misc

3.4.4 (2025-10-13)

Changed

Removed

Misc

3.4.3 (2025-08-09)

Changed

8.3.1

8.3.0

8.2.2

Version 8.3.1

Version 8.3.0

Version 8.2.2

3.0.3

Version 3.0.3

26.0

What's Changed

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Mar 30, 2026 •

edited

Loading