Skip to content

chore(deps): bump the documentation group in /docs with 19 updates - #42

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/docs/documentation-c1bf99ae18
Open

chore(deps): bump the documentation group in /docs with 19 updates#42
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/docs/documentation-c1bf99ae18

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps the documentation group in /docs with 19 updates:

Package From To
babel 2.17.0 2.18.0
markupsafe 3.0.2 3.0.3
pygments 2.19.1 2.20.0
sphinx 7.4.7 9.1.0
certifi 2025.1.31 2026.6.17
chardet 5.2.0 7.4.3
commonmark 0.9.1 0.9.2
docutils 0.20.1 0.23
idna 3.10 3.18
imagesize 1.4.1 2.0.0
myst-parser 3.0.1 5.1.0
packaging 25.0 26.2
pyparsing 3.2.3 3.3.2
pytz 2025.2 2026.2
requests 2.32.3 2.34.2
snowballstemmer 2.2.0 3.1.1
sphinx-rtd-theme 3.0.2 3.1.0
sphinxext-rediraffe 0.2.7 0.3.0
urllib3 2.4.0 2.7.0

Updates babel from 2.17.0 to 2.18.0

Release notes

Sourced from babel's releases.

v2.18.0

Happy 2026! Like last year's release (ahem...), this one too is being made from FOSDEM 2026, in Brussels, Belgium. 🇧🇪 We'll aspire for a less glacial release cycle for 2.19. 😁

Please see CHANGELOG.rst for the detailed change log.

Full Changelog: python-babel/babel@v2.17.0...v2.18.0

Changelog

Sourced from babel's changelog.

Version 2.18.0

Happy 2026! This release is, coincidentally, also being made from FOSDEM.

We will aspire for a slightly less glacial release cadence in this year; there are interesting features in the pipeline.

Features


* Core: Add `babel.core.get_cldr_version()` by @akx in :gh:`1242`
* Core: Use CLDR 47 by @tomasr8 in :gh:`1210`
* Core: Use canonical IANA zone names in zone_territories by @akx in :gh:`1220`
* Messages: Improve extract performance via ignoring directories early during os.walk by @akx in :gh:`968`
* Messages: Merge in per-format keywords and auto_comments by @akx in :gh:`1243`
* Messages: Update keywords for extraction of dpgettext and dnpgettext by @mardiros in :gh:`1235`
* Messages: Validate all plurals in Python format checker by @tomasr8 in :gh:`1188`
* Time: Use standard library `timezone` instead of `FixedOffsetTimezone` by @akx in :gh:`1203`

Bugfixes

  • Core: Fix formatting for "Empty locale identifier" exception added in #1164 by @​akx in :gh:1184
  • Core: Improve handling of no-inheritance-marker in timezone data by @​akx in :gh:1194
  • Core: Make the number pattern regular expression more efficient by @​akx in :gh:1213
  • Messages: Keep translator comments next to the translation function call by @​akx in :gh:1196
  • Numbers: Fix KeyError that occurred when formatting compact currencies of exactly one thousand in several locales by @​bartbroere in :gh:1246

Other improvements


* Core: Avoid unnecessary uses of `map()` by @akx in :gh:`1180`
* Messages: Have init-catalog create directories too by @akx in :gh:`1244`
* Messages: Optimizations for read_po by @akx in :gh:`1200`
* Messages: Use pathlib.Path() in catalog frontend; improve test coverage by @akx in :gh:`1204`

Infrastructure and documentation

  • CI: Renovate CI & lint tools by @​akx in :gh:1228
  • CI: Tighten up CI with Zizmor by @​akx in :gh:1230
  • CI: make job permissions explicit by @​akx in :gh:1227
  • Docs: Add SECURITY.md by @​akx in :gh:1229
  • Docs: Remove u string prefix from docs by @​verhovsky in :gh:1174
  • Docs: Update dates.rst with current unicode.org tr35 link by @​clach04 in :gh:1189
  • General: Add some PyPI classifiers by @​tomasr8 in :gh:1186
  • General: Apply reformatting by hand and with Ruff by @​akx in :gh:1202
  • General: Test on and declare support for Python 3.14 by @​akx in :gh:1233

... (truncated)

Commits
  • 56c63ca Prepare for 2.18.0 (#1248)
  • 73015a1 Add user-agent to CLDR downloader (#1247)
  • 29bd362 Fix formatting compact currencies of exactly one thousand in several locales ...
  • 851db43 Reuse InitCatalog's guts in UpdateCatalog (#1244)
  • fd00e60 Extract: Merge in per-format keywords and auto_comments (#1243)
  • 12a14b6 Add dpgettext and dnpgettext support (#1235)
  • 7110e62 Use canonical IANA zone names in zone_territories (#1220)
  • e91c346 Improve extract performance via ignoring directories early during os.walk (#968)
  • 0c4f378 Convert Unittest testcases with setup/teardown to fixtures (#1240)
  • 218c96e Add babel.core.get_cldr_version() (#1242)
  • Additional commits viewable in compare view

Updates markupsafe from 3.0.2 to 3.0.3

Release notes

Sourced from markupsafe's releases.

3.0.3

This is the MarkupSafe 3.0.3 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/MarkupSafe/3.0.3/ Changes: https://markupsafe.palletsprojects.com/page/changes/#version-3-0-3 Milestone: https://github.com/pallets/markupsafe/milestone/15?closed=1

  • __version__ raises DeprecationWarning instead of UserWarning. #487
  • Adopt multi-phase initialization PEP 489 for the C extension. #494
  • Build Windows ARM64 wheels. #485
  • Build Python 3.14 wheels. #503
  • Build riscv64 wheels. #505
Changelog

Sourced from markupsafe's changelog.

Version 3.0.3

Released 2025-09-27

  • __version__ raises DeprecationWarning instead of UserWarning. :issue:487
  • Adopt multi-phase initialisation (:pep:489) for the C extension. :issue:494
  • Build Windows ARM64 wheels. :issue:485
  • Build Python 3.14 wheels. :issue:503
  • Build riscv64 wheels. :issue:505
Commits

Updates pygments from 2.19.1 to 2.20.0

Release notes

Sourced from pygments's releases.

2.20.0

  • New lexers:

  • Updated lexers:

    • archetype: Fix catastrophic backtracking in GUID and ID patterns (#3064)
    • ASN.1: Recognize minus sign and fix range operator (#3014, #3060)
    • C++: Add C++26 keywords (#2955), add integer literal suffixes (#2966)
    • ComponentPascal: Fix analyse_text (#3028, #3032)
    • Coq renamed to Rocq (#2883, #2908)
    • Cython: Various improvements (#2932, #2933)
    • Debian control: Improve architecture parsing (#3052)
    • Devicetree: Add support for overlay/fragments (#3021), add bytestring support (#3022), fix catastrophic backtracking (#3057)
    • Fennel: Various improvements (#2911)
    • Haskell: Handle escape sequences in character literals (#3069, #1795)
    • Java: Add module keywords (#2955)
    • Lean4: Add operators ]', ]?, ]! (#2946)
    • LESS: Support single-line comments (#3005)
    • LilyPond: Update to 2.25.29 (#2974)
    • LLVM: Support C-style comments (#3023, #2978)
    • Lua(u): Fix catastrophic backtracking (#3047)
    • Macaulay2: Update to 1.25.05 (#2893), 1.25.11 (#2988)
    • Mathematica: Various improvements (#2957)
    • meson: Add additional operators (#2919)
    • MySQL: Update keywords (#2970)
    • org-Mode: Support both schedule and deadline (#2899)
    • PHP: Add __PROPERTY__ magic constant (#2924), add reserved keywords (#3002)
    • PostgreSQL: Add more keywords (#2985)
    • protobuf: Fix namespace tokenization (#2929)
    • Python: Add t-string support (#2973, #3009, #3010)
    • Tablegen: Fix infinite loop (#2972, #2940)
    • Tera Term macro: Add commands introduced in v5.3 through v5.6 (#2951)
    • TOML: Support TOML 1.1.0 (#3026, #3027)
    • Turtle: Allow empty comment lines (#2980)
    • XML: Added .xbrl as file ending (#2890, #2891)

  • Drop Python 3.8, and add Python 3.14 as a supported version (#2987, #3012)

  • Various improvements to autopygmentize (#2894)

  • Update onedark style to support more token types (#2977)

  • Update rtt style to support more token types (#2895)

  • Cache entry points to improve performance (#2979)

  • Fix xterm-256 color table (#3043)

  • Fix kwargs dictionary getting mutated on each call (#3044)

2.19.2

  • Lua: Fix regression introduced in 2.19.0 (#2882, #2839)
Changelog

Sourced from pygments's changelog.

Version 2.20.0

(released March 29th, 2026)

  • New lexers:

  • Updated lexers:

    • archetype: Fix catastrophic backtracking in GUID and ID patterns (#3064)
    • ASN.1: Recognize minus sign and fix range operator (#3014, #3060)
    • C++: Add C++26 keywords (#2955), add integer literal suffixes (#2966)
    • ComponentPascal: Fix analyse_text (#3028, #3032)
    • Coq renamed to Rocq (#2883, #2908)
    • Cython: Various improvements (#2932, #2933)
    • Debian control: Improve architecture parsing (#3052)
    • Devicetree: Add support for overlay/fragments (#3021), add bytestring support (#3022), fix catastrophic backtracking (#3057)
    • Fennel: Various improvements (#2911)
    • Haskell: Handle escape sequences in character literals (#3069, #1795)
    • Java: Add module keywords (#2955)
    • Lean4: Add operators ]', ]?, ]! (#2946)
    • LESS: Support single-line comments (#3005)
    • LilyPond: Update to 2.25.29 (#2974)
    • LLVM: Support C-style comments (#3023, #2978)
    • Lua(u): Fix catastrophic backtracking (#3047)
    • Macaulay2: Update to 1.25.05 (#2893), 1.25.11 (#2988)
    • Mathematica: Various improvements (#2957)
    • meson: Add additional operators (#2919)
    • MySQL: Update keywords (#2970)
    • org-Mode: Support both schedule and deadline (#2899)
    • PHP: Add __PROPERTY__ magic constant (#2924), add reserved keywords (#3002)
    • PostgreSQL: Add more keywords (#2985)
    • protobuf: Fix namespace tokenization (#2929)
    • Python: Add t-string support (#2973, #3009, #3010)
    • Tablegen: Fix infinite loop (#2972, #2940)
    • Tera Term macro: Add commands introduced in v5.3 through v5.6 (#2951)
    • TOML: Support TOML 1.1.0 (#3026, #3027)
    • Turtle: Allow empty comment lines (#2980)
    • XML: Added .xbrl as file ending (#2890, #2891)

  • Drop Python 3.8, and add Python 3.14 as a supported version (#2987, #3012)

  • Various improvements to autopygmentize (#2894)

  • Update onedark style to support more token types (#2977)

  • Update rtt style to support more token types (#2895)

  • Cache entry points to improve performance (#2979)

  • Fix xterm-256 color table (#3043)

  • Fix kwargs dictionary getting mutated on each call (#3044)

Version 2.19.2

... (truncated)

Commits
  • 708197d Fix underline length.
  • 1d4538a Prepare 2.20 release.
  • 2ceaee4 Update CHANGES.
  • e3a3c54 Fix Haskell lexer: handle escape sequences in character literals (#3069)
  • d7c3453 Merge pull request #3071 from pygments/harden-html-formatter
  • 0f97e7c Harden the HTML formatter against CSS.
  • 9f981b2 Update CHANGES.
  • 1d88915 Update CHANGES.
  • c3d93ad Fix ASN.1 lexer: recognize minus sign and fix range operator (#3060)
  • 4f06bcf fix bad behaving backtracking regex in CommonLispLexer
  • Additional commits viewable in compare view

Updates sphinx from 7.4.7 to 9.1.0

Release notes

Sourced from sphinx's releases.

Sphinx 9.1.0

Changelog: https://www.sphinx-doc.org/en/master/changes.html

Dependencies

  • #14153: Drop Python 3.11 support.
  • #12555: Drop Docutils 0.20 support. Patch by Adam Turner

Features added

  • Add add_static_dir() for copying static assets from extensions to the build output. Patch by Jared Dillard

Bugs fixed

  • #14189: autodoc: Fix duplicate :no-index-entry: for modules. Patch by Adam Turner
  • #13713: Fix compatibility with MyST-Parser. Patch by Adam Turner
  • Fix tests for Python 3.15. Patch by Adam Turner
  • #14089: autodoc: Fix default option parsing. Patch by Adam Turner
  • Remove incorrect static typing assertions. Patch by Adam Turner
  • #14050: LaTeXTranslator fails to build documents using the "acronym" standard role. Patch by Günter Milde
  • LaTeX: Fix rendering for grid filled merged vertical cell. Patch by Tim Nordell
  • #14228: LaTeX: Fix overrun footer for cases of merged vertical table cells. Patch by Tim Nordell
  • #14207: Fix creating HTMLThemeFactory objects in third-party extensions. Patch by Adam Turner
  • #3099: LaTeX: PDF build crashes if a code-block contains more than circa 1350 codelines (about 27 a4-sized pages at default pointsize). Patch by Jean-François B.
  • #14064: LaTeX: TABs ending up in sphinxVerbatim fail to obey tab stops. Patch by Jean-François B.
  • #14089: autodoc: Improve support for non-weakreferencable objects. Patch by Adam Turner
  • LaTeX: Fix accidental removal at 3.5.0 (#8854) of the documentation of literalblockcappos key of sphinxsetup. Patch by Jean-François B.

... (truncated)

Changelog

Sourced from sphinx's changelog.

Release 9.1.0 (released Dec 31, 2025)

Dependencies

  • #14153: Drop Python 3.11 support.
  • #12555: Drop Docutils 0.20 support. Patch by Adam Turner

Features added

  • Add :meth:~sphinx.application.Sphinx.add_static_dir for copying static assets from extensions to the build output. Patch by Jared Dillard

Bugs fixed

  • #14189: autodoc: Fix duplicate :no-index-entry: for modules. Patch by Adam Turner
  • #13713: Fix compatibility with MyST-Parser. Patch by Adam Turner
  • Fix tests for Python 3.15. Patch by Adam Turner
  • #14089: autodoc: Fix default option parsing. Patch by Adam Turner
  • Remove incorrect static typing assertions. Patch by Adam Turner
  • #14050: LaTeXTranslator fails to build documents using the "acronym" standard role. Patch by Günter Milde
  • LaTeX: Fix rendering for grid filled merged vertical cell. Patch by Tim Nordell
  • #14228: LaTeX: Fix overrun footer for cases of merged vertical table cells. Patch by Tim Nordell
  • #14207: Fix creating HTMLThemeFactory objects in third-party extensions. Patch by Adam Turner
  • #3099: LaTeX: PDF build crashes if a code-block contains more than circa 1350 codelines (about 27 a4-sized pages at default pointsize). Patch by Jean-François B.
  • #14064: LaTeX: TABs ending up in sphinxVerbatim fail to obey tab stops. Patch by Jean-François B.
  • #14089: autodoc: Improve support for non-weakreferencable objects. Patch by Adam Turner
  • LaTeX: Fix accidental removal at 3.5.0 (#8854) of the documentation of literalblockcappos key of :ref:'sphinxsetup' <latexsphinxsetup>. Patch by Jean-François B.
Commits
  • cc7c6f4 Bump to 9.1.0 final
  • b127b94 Add app.add_static_dir() for copying extension static files (#14219)
  • 20f1c46 LaTeX: Inhibit breaks for rows with merged vertical cells (#14227)
  • 3c85411 Polish CHANGES.rst (#14225)
  • 9ee5446 LaTeX: restore 1.7 documentation of literalblockcappos (#14224)
  • d75d602 LaTeX: improve (again...) some code comments in time for 9.1.0 (#14222)
  • 8dca61d Improve some LaTeX code comments (#14220)
  • 8ab9600 Bump to 9.1.0 candidate 2
  • d59b237 autodoc: Improve support for non-weakreferencable objects
  • 964424b Use the correct reference for using existing extensions (#14157)
  • Additional commits viewable in compare view

Updates certifi from 2025.1.31 to 2026.6.17

Commits

Updates chardet from 5.2.0 to 7.4.3

Release notes

Sourced from chardet's releases.

7.4.3

Patch release: fixes a crash when input contains null bytes inside a <meta charset> declaration.

Bug Fixes

  • Fixed ValueError: embedded null character crash when input contained a <meta charset> declaration with a null byte in the encoding name (e.g. b'<meta charset="\x00utf-8">'). codecs.lookup() raises ValueError on embedded nulls, and lookup_encoding() was only catching LookupError. Also added defensive ValueError catches in _validate_bytes() and _to_utf8() for completeness. (#369, thanks @​DRMacIver for the report)

Full Changelog: chardet/chardet@7.4.2...7.4.3

7.4.2

Patch release: fixes a crash on short inputs and closes a bunch of WHATWG/IANA alias gaps.

Bug Fixes

  • Fixed RuntimeError: pipeline must always return at least one result on ~2% of all possible two-byte inputs (e.g. b"\xf9\x92"). Multi-byte encodings like CP932 and Johab could score above the structural confidence threshold on very short inputs, but then statistical scoring would return nothing, leaving an empty result list instead of falling through to the fallback. (#367, #368, thanks @​jasonwbarnett)

Improvements

  • Added ~90 encoding aliases from the WHATWG Encoding Standard and IANA Character Sets registry so that <meta charset> labels like x-cp1252, x-sjis, dos-874, csUTF8, and the cswindows* family all resolve correctly through the markup detection stage. Every alias was driven by a failing spec-compliance test, not speculative. (#366)
  • Added a spec-compliance test suite covering Python decode round-trips for all 86 registry encodings, WHATWG label resolution, IANA preferred MIME names, and Unicode/RFC conformance (BOM sniffing, UTF-8 boundary cases, UTF-16 surrogate pairs). This is the test suite that would have caught the 7.4.1 BOM bug before release. (#366)

Full Changelog: chardet/chardet@7.4.1...7.4.2

7.4.1

Bug Fixes

  • BOM-prefixed UTF-16/32 input now returns utf-16/utf-32 instead of utf-16-le/utf-16-be/utf-32-le/utf-32-be. The endian-specific codecs don't strip the BOM on decode, so callers were getting a stray U+FEFF at the start of their text. BOM-less detection is unchanged. (#364, #365)

Full Changelog: chardet/chardet@7.4.0...7.4.1

chardet 7.4.0 brings accuracy up to 99.3% (from 98.6% in 7.3.0) and significantly faster cold start thanks to a new dense model format.

What's New

Performance:

  • New dense zlib-compressed model format (v2) drops cold start (import + first detect) from ~75ms to ~13ms with mypyc

Accuracy (98.6% → 99.3%):

  • Eliminated train/test data overlap via content fingerprinting
  • Added MADLAD-400 and Wikipedia as supplemental training sources
  • Improved non-ASCII bigram scoring: high-byte bigrams are now preserved during training and weighted by per-bigram IDF
  • Encoding-aware substitution filtering (substitutions only apply for characters the target encoding can't represent)
  • Increased training samples from 15K to 25K per language/encoding pair

Bug fixes:

  • Added dedicated structural analyzers for CP932, CP949, and Big5-HKSCS (these were previously sharing their base encoding's byte-range analyzer, missing extended ranges)

Metrics

| | chardet 7.4.0 (mypyc) | chardet 6.0.0 | charset-normalizer 3.4.6 |

... (truncated)

Changelog

Sourced from chardet's changelog.

7.4.3 (2026-04-13)

Bug Fixes:

  • Fixed ValueError: embedded null character crash when input contained a <meta charset> declaration with a null byte in the encoding name (e.g. b'<meta charset="\x00utf-8">'). codecs.lookup() raises ValueError on embedded nulls, and lookup_encoding() was only catching LookupError. Also added defensive ValueError catches in _validate_bytes() and _to_utf8() for completeness. (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude, [#369](https://github.com/chardet/chardet/issues/369) <https://github.com/chardet/chardet/issues/369>_)

7.4.2 (2026-04-12)

Bug Fixes:

  • Fixed RuntimeError: pipeline must always return at least one result on ~2% of all possible two-byte inputs (e.g. b"\xf9\x92"). Multi-byte encodings like CP932 and Johab could score above the structural confidence threshold on very short inputs, but then statistical scoring would return nothing, leaving the pipeline with an empty result list instead of falling through to the no_match_encoding fallback. (Jason Barnett <https://github.com/jasonwbarnett>_ via Claude, [#367](https://github.com/chardet/chardet/issues/367) <https://github.com/chardet/chardet/issues/367>, [#368](https://github.com/chardet/chardet/issues/368) <https://github.com/chardet/chardet/pull/368>)

Improvements:

  • Added ~90 encoding aliases from the WHATWG Encoding Standard and IANA Character Sets registry so that <meta charset> labels like x-cp1252, x-sjis, dos-874, csUTF8, and the cswindows* family all resolve correctly through the markup detection stage. Every alias was driven by a failing spec-compliance test. (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude, [#366](https://github.com/chardet/chardet/issues/366) <https://github.com/chardet/chardet/pull/366>_)
  • Added a spec-compliance test suite covering Python decode round-trips for all 86 registry encodings, WHATWG web-platform label resolution, IANA preferred MIME names, and Unicode/RFC conformance (BOM sniffing, UTF-8 boundary cases, UTF-16 surrogate pairs). This is the test suite that would have caught the 7.4.1 BOM bug before release. (Dan Blanchard <https://github.com/dan-blanchard>_ via Claude, [#366](https://github.com/chardet/chardet/issues/366) <https://github.com/chardet/chardet/pull/366>_)

7.4.1 (2026-04-07)

... (truncated)

Commits
  • 8f404a5 docs: set 7.4.3 release date to 2026-04-13
  • 7a6667f docs: fix changelog attribution for #369
  • a1fc986 docs: changelog for 7.4.3
  • 0af01d6 Fix ValueError crash on null bytes in charset declarations (#369)
  • 08e4ebc ci: parallelize riscv64 builds across 5 RISE runners
  • 2f6e1e9 ci: use python3 -m pip on riscv64 runner
  • 204623d ci: invoke cibuildwheel manually on riscv64 runner
  • 78c1d20 ci: use native runners for aarch64/riscv64 instead of QEMU
  • 3cc0960 docs: changelog for 7.4.2
  • 9079efc Fix RuntimeError on ~2% of two-byte inputs (#368)
  • Additional commits viewable in compare view

Updates commonmark from 0.9.1 to 0.9.2

Release notes

Sourced from commonmark's releases.

0.9.2

  • Deprecate package. Use markdown-it-py instead.
  • Remove testing on python 3.4.
Changelog

Sourced from commonmark's changelog.

0.9.2 (2026-05-28)

  • Deprecate package. Use markdown-it-py instead.
  • Remove testing on python 3.4.
Commits
  • df7dcb7 Deprecation release 0.9.2
  • 8467297 Update metadata
  • c9faf44 Fix wording
  • 48a37b2 Update README to show project is unmaintained.
  • d031003 Merge pull request #303 from readthedocs/dependabot/add-v2-config-file
  • 63e3279 Merge pull request #305 from readthedocs/dependabot/pip/flake8-3.9.2
  • b5784ab Bump flake8 from 3.8.4 to 3.9.2
  • 789b0b0 Upgrade to GitHub-native Dependabot
  • 2440e8e Merge pull request #268 from readthedocs/dependabot/pip/flake8-3.8.4
  • 05ecde2 Bump flake8 from 3.8.3 to 3.8.4
  • Additional commits viewable in compare view

Updates docutils from 0.20.1 to 0.23

Commits

Updates idna from 3.10 to 3.18

Changelog

Sourced from idna's changelog.

3.18 (2026-06-02)

  • When decoding a domain, add a display argument that will pass through invalid labels rather than raising an exception.

3.17 (2026-05-28)

  • Substantial 75% reduction in memory usage through new data structures and some optimization in processing speed.
  • Added a general 1024-character input length cap to the public validation, conversion, and codec entry points. This is well above any legitimate domain or label and guards against pathological inputs.

3.16 (2026-05-22)

  • Add a command-line interface (python -m idna, also available as the idna script). Encodes or decodes one or more domains supplied as arguments or on standard input, with options to select A-label or U-label output and control error handling.
  • Raise the minimum supported Python version to 3.9
  • Various code quality improvements

3.15 (2026-05-12)

  • Enforce DNS-length cap on individual labels early in check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.
  • Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.
  • Use raise ... from err for proper exception chaining and switch internal string formatting to f-strings.
  • Allow flit_core 4.x in the build backend.
  • Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.
  • Add Dependabot configuration for GitHub Actions.
  • Convert README and HISTORY from reStructuredText to Markdown.
  • Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.

3.14 (2026-05-10)

  • Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass

... (truncated)

Commits
  • f39ea90 Release 3.18
  • 40f4e40 Pre-release 3.18rc0
  • 1a5bf80 Merge pull request #253 from kjd/lenient-decode
  • 5bbb26f Merge branch 'master' into lenient-decode
  • c532bae Rename decode() lenient= option to display= (issue #248)
  • 0b1758b Merge pull request #252 from kjd/release-3.17
  • f48619c Release 3.17
  • 7421ba8 Pre-release 3.17rc0
  • 22ebb73 Merge pull request #251 from kjd/structure-optimizations
  • 2a7ac0a Drop redundant parallel-arrays comment from uts46data
  • Additional commits viewable in compare view

Updates imagesize from 1.4.1 to 2.0.0

Commits
  • 5ab28d4 bump module version to 2.0
  • 63d6afb Merge pull request #82 from shibukawa/codex/update-readme-and-setup-instructi...
  • 2946066 docs: clarify EXIF orientation formats in v2.0 notes
  • 53eff2e Merge pull request #81 from shibukawa/codex/refactor-code-to-reduce-duplication
  • ac14f2a Refactor duplicated JPEG segment parsing logic
  • 48ab954 Merge pull request #80 from shibukawa/codex/add-avif-exif-rotation-support
  • 5cada10 Add AVIF EXIF rotation support
  • 232c6d5 Merge pull request #79 from shibukawa/codex/add-heic/heif-support-and-rotation
  • 324c970 Add HEIC/HEIF size and rotation support
  • 7b7bb5f Merge pull request #78 from shibukawa/codex/add-pypi-link-and-python-version-...
  • Additional commits viewable in compare view

Updates myst-parser from 3.0.1 to 5.1.0

Release notes

Sourced from myst-parser's releases.

v5.1.0

✨ New Features

👌 Improvements

  • 👌 Update myst_gfm_only mode to use the unified gfm_plugin, which now includes GFM autolinks, alerts, and improved strikethrough/tasklist handling by @​chrisjsewell in #1128
  • 👌 Improve MathJax 4 compatibility for Sphinx 9 by @​chrisjsewell in #1110
  • 👌 Stop directive-option parsing at colon fences, fixing nested colon fence directives by @​chrisjsewell in #1133

🐛 Bug Fixes

⬆️ Dependency Upgrades

@dependabot
chore(deps): bump the documentation group in /docs with 19 updates
a5fd098 
Bumps the documentation group in /docs with 19 updates:

| Package | From | To |
| --- | --- | --- |
| [babel](https://github.com/python-babel/babel) | `2.17.0` | `2.18.0` |
| [markupsafe](https://github.com/pallets/markupsafe) | `3.0.2` | `3.0.3` |
| [pygments](https://github.com/pygments/pygments) | `2.19.1` | `2.20.0` |
| [sphinx](https://github.com/sphinx-doc/sphinx) | `7.4.7` | `9.1.0` |
| [certifi](https://github.com/certifi/python-certifi) | `2025.1.31` | `2026.6.17` |
| [chardet](https://github.com/chardet/chardet) | `5.2.0` | `7.4.3` |
| [commonmark](https://github.com/rtfd/commonmark.py) | `0.9.1` | `0.9.2` |
| [docutils](https://github.com/rtfd/recommonmark) | `0.20.1` | `0.23` |
| [idna](https://github.com/kjd/idna) | `3.10` | `3.18` |
| [imagesize](https://github.com/shibukawa/imagesize_py) | `1.4.1` | `2.0.0` |
| [myst-parser](https://github.com/executablebooks/MyST-Parser) | `3.0.1` | `5.1.0` |
| [packaging](https://github.com/pypa/packaging) | `25.0` | `26.2` |
| [pyparsing](https://github.com/pyparsing/pyparsing) | `3.2.3` | `3.3.2` |
| [pytz](https://github.com/stub42/pytz) | `2025.2` | `2026.2` |
| [requests](https://github.com/psf/requests) | `2.32.3` | `2.34.2` |
| [snowballstemmer](https://github.com/snowballstem/snowball) | `2.2.0` | `3.1.1` |
| [sphinx-rtd-theme](https://github.com/readthedocs/sphinx_rtd_theme) | `3.0.2` | `3.1.0` |
| [sphinxext-rediraffe](https://github.com/sphinx-doc/sphinxext-rediraffe) | `0.2.7` | `0.3.0` |
| [urllib3](https://github.com/urllib3/urllib3) | `2.4.0` | `2.7.0` |


Updates `babel` from 2.17.0 to 2.18.0
- [Release notes](https://github.com/python-babel/babel/releases)
- [Changelog](https://github.com/python-babel/babel/blob/master/CHANGES.rst)
- [Commits](python-babel/babel@v2.17.0...v2.18.0)

Updates `markupsafe` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/pallets/markupsafe/releases)
- [Changelog](https://github.com/pallets/markupsafe/blob/main/CHANGES.rst)
- [Commits](pallets/markupsafe@3.0.2...3.0.3)

Updates `pygments` from 2.19.1 to 2.20.0
- [Release notes](https://github.com/pygments/pygments/releases)
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES)
- [Commits](pygments/pygments@2.19.1...2.20.0)

Updates `sphinx` from 7.4.7 to 9.1.0
- [Release notes](https://github.com/sphinx-doc/sphinx/releases)
- [Changelog](https://github.com/sphinx-doc/sphinx/blob/master/CHANGES.rst)
- [Commits](sphinx-doc/sphinx@v7.4.7...v9.1.0)

Updates `certifi` from 2025.1.31 to 2026.6.17
- [Commits](certifi/python-certifi@2025.01.31...2026.06.17)

Updates `chardet` from 5.2.0 to 7.4.3
- [Release notes](https://github.com/chardet/chardet/releases)
- [Changelog](https://github.com/chardet/chardet/blob/main/docs/changelog.rst)
- [Commits](chardet/chardet@5.2.0...7.4.3)

Updates `commonmark` from 0.9.1 to 0.9.2
- [Release notes](https://github.com/rtfd/commonmark.py/releases)
- [Changelog](https://github.com/readthedocs/commonmark.py/blob/master/CHANGELOG.md)
- [Commits](readthedocs/commonmark.py@0.9.1...0.9.2)

Updates `docutils` from 0.20.1 to 0.23
- [Changelog](https://github.com/readthedocs/recommonmark/blob/master/CHANGELOG.md)
- [Commits](https://github.com/rtfd/recommonmark/commits)

Updates `idna` from 3.10 to 3.18
- [Release notes](https://github.com/kjd/idna/releases)
- [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md)
- [Commits](kjd/idna@v3.10...v3.18)

Updates `imagesize` from 1.4.1 to 2.0.0
- [Commits](shibukawa/imagesize_py@1.4.1...2.0.0)

Updates `myst-parser` from 3.0.1 to 5.1.0
- [Release notes](https://github.com/executablebooks/MyST-Parser/releases)
- [Changelog](https://github.com/executablebooks/MyST-Parser/blob/master/CHANGELOG.md)
- [Commits](executablebooks/MyST-Parser@v3.0.1...v5.1.0)

Updates `packaging` from 25.0 to 26.2
- [Release notes](https://github.com/pypa/packaging/releases)
- [Changelog](https://github.com/pypa/packaging/blob/main/CHANGELOG.rst)
- [Commits](pypa/packaging@25.0...26.2)

Updates `pyparsing` from 3.2.3 to 3.3.2
- [Release notes](https://github.com/pyparsing/pyparsing/releases)
- [Changelog](https://github.com/pyparsing/pyparsing/blob/master/CHANGES)
- [Commits](pyparsing/pyparsing@3.2.3...3.3.2)

Updates `pytz` from 2025.2 to 2026.2
- [Release notes](https://github.com/stub42/pytz/releases)
- [Commits](stub42/pytz@release_2025.2...release_2026.2)

Updates `requests` from 2.32.3 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.32.3...v2.34.2)

Updates `snowballstemmer` from 2.2.0 to 3.1.1
- [Changelog](https://github.com/snowballstem/snowball/blob/main/NEWS)
- [Commits](snowballstem/snowball@v2.2.0...v3.1.1)

Updates `sphinx-rtd-theme` from 3.0.2 to 3.1.0
- [Changelog](https://github.com/readthedocs/sphinx_rtd_theme/blob/master/docs/changelog.rst)
- [Commits](readthedocs/sphinx_rtd_theme@3.0.2...3.1.0)

Updates `sphinxext-rediraffe` from 0.2.7 to 0.3.0
- [Release notes](https://github.com/sphinx-doc/sphinxext-rediraffe/releases)
- [Commits](sphinx-doc/sphinxext-rediraffe@v0.2.7...v0.3.0)

Updates `urllib3` from 2.4.0 to 2.7.0
- [Release notes](https://github.com/urllib3/urllib3/releases)
- [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst)
- [Commits](urllib3/urllib3@2.4.0...2.7.0)

---
updated-dependencies:
- dependency-name: babel
  dependency-version: 2.18.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: documentation
- dependency-name: markupsafe
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: documentation
- dependency-name: pygments
  dependency-version: 2.20.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: documentation
- dependency-name: sphinx
  dependency-version: 9.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: documentation
- dependency-name: certifi
  dependency-version: 2026.6.17
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: documentation
- dependency-name: chardet
  dependency-version: 7.4.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: documentation
- dependency-name: commonmark
  dependency-version: 0.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: documentation
- dependency-name: docutils
  dependency-version: '0.23'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: documentation
- dependency-name: idna
  dependency-version: '3.18'
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: documentation
- dependency-name: imagesize
  dependency-version: 2.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: documentation
- dependency-name: myst-parser
  dependency-version: 5.1.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: documentation
- dependency-name: packaging
  dependency-version: '26.2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: documentation
- dependency-name: pyparsing
  dependency-version: 3.3.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: documentation
- dependency-name: pytz
  dependency-version: '2026.2'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: documentation
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: documentation
- dependency-name: snowballstemmer
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: documentation
- dependency-name: sphinx-rtd-theme
  dependency-version: 3.1.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: documentation
- dependency-name: sphinxext-rediraffe
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: documentation
- dependency-name: urllib3
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: documentation
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update dependencies python Pull requests that update python code labels Jul 18, 2026
@dependabot
dependabot Bot requested a review from junioryono as a code owner July 18, 2026 18:24
@dependabot dependabot Bot added dependencies Pull requests that update dependencies python Pull requests that update python code labels Jul 18, 2026
@github-actions github-actions Bot added the type: maintenance Refactoring, dependencies, or chores label Jul 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@junioryono junioryono Awaiting requested review from junioryono junioryono is a code owner

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update dependencies python Pull requests that update python code type: maintenance Refactoring, dependencies, or chores

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants