Bump the pip group across 1 directory with 2 updates

[dependabot]

Bumps the pip group with 2 updates in the /requirements directory: django-filter and wheel.

Updates django-filter from 1.0.4 to 2.4.0

Release notes

Sourced from django-filter's releases.

Version 2.4.0

• SECURITY: Added a MaxValueValidator to the form field for NumberFilter. This prevents a potential DoS attack if numbers with very large exponents were subsequently converted to integers.

  The default limit value for the validator is 1e50.

  The new NumberFilter.get_max_validator() allows customising the used validator, and may return None to disable the validation entirely.

• Added testing against Django 3.1 and Python 3.9.

  In addition tests against Django main development branch are now required to pass.

Version 2.3.0

https://github.com/carltongibson/django-filter/blob/master/CHANGES.rst#version-230-2020-6-5

Version 2.2

Highlights:

• Added DjangoFilterBackend.get_schema_operation_parameters() for DRF 3.10+ OpenAPI schema generation. (#1086)
• Added lookup_expr to MultipleChoiceFilter (#1054)
• Dropped support for EOL Python 3.4

Version 2.1.0

• Fixed a regression in FilterView introduced in 2.0. An empty QuerySet was incorrectly used whenever the FilterSet was unbound (i.e. when there were no GET parameters). The correct, pre-2.0 behaviour is now restored.

  A workaround was to set strict=False on the FilterSet. This is no longer necessary, so you may restore strict behaviour as desired.

• Added IsoDateTimeFromToRangeFilter. Allows From-To filtering using ISO-8601 formatted dates.

Version 2.0

2.0 introduced a number of small changes and tidy-ups. Please see the migration guide:

https://django-filter.readthedocs.io/en/master/guide/migration.html#migrating-to-2-0

• Added testing for Python 3.7 (#944)
• Improve exception message for invalid filter result (#943)
• Test QueryDict against CSV filters (#937)
• Add renderer argument to render() method of BooleanWidget (#923)
• Fix lookups for reverse relationships (#915)
• Refactor backend filterset instantiation (#865)
• Improve view-related attribute name consistency (#867)

... (truncated)

Changelog

Sourced from django-filter's changelog.

Version 2.4.0 (2020-9-27)

• SECURITY: Added a MaxValueValidator to the form field for NumberFilter. This prevents a potential DoS attack if numbers with very large exponents were subsequently converted to integers.

  The default limit value for the validator is 1e50.

  The new NumberFilter.get_max_validator() allows customising the used validator, and may return None to disable the validation entirely.

• Added testing against Django 3.1 and Python 3.9.

  In addition tests against Django main development branch are now required to pass.

Version 2.3.0 (2020-6-5)

• Fixed import of FieldDoesNotExist. (#1127)
• Added testing against Django 3.0. (#1125)
• Declared support for, and added testing against, Python 3.8. (#1138)
• Fix filterset multiple inheritance bug (#1131)
• Allowed customising default lookup expression. (#1129)
• Drop Django 2.1 and below (#1180)
• Fixed IsoDateTimeRangeFieldTests for Django 3.1
• Require tests to pass against Django master.

Version 2.2 (2019-7-16)

• Added DjangoFilterBackend.get_schema_operation_parameters() for DRF 3.10+ OpenAPI schema generation. (#1086)
• Added lookup_expr to MultipleChoiceFilter (#1054)
• Dropped support for EOL Python 3.4

Version 2.1 (2019-1-20)

• Fixed a regression in FilterView introduced in 2.0. An empty QuerySet was incorrectly used whenever the FilterSet was unbound (i.e. when there were no GET parameters). The correct, pre-2.0 behaviour is now restored.

  A workaround was to set strict=False on the FilterSet. This is no longer necessary, so you may restore strict behaviour as desired.

... (truncated)

Commits

• 7821072 Postpone move to CalVer.
• fd5824e Restore version declaration in setup.py.
• c9daa68 Version 20.9.0.
• c045bbe Droped using bumpversion.
• b1f56ed Use single version reference from main module.
• 451d372 Update docs copyright year.
• 82c9a42 Added MaxValueValidator to NumberFilter.
• 2ebce74 Confirmed compatibility with Python 3.9. (#1270)
• 85c9572 Run tests with GitHub Actions
• d9f389f Update Jinja test dependency.
• Additional commits viewable in compare view

Updates wheel from 0.29.0 to 0.46.2

Release notes

Sourced from wheel's releases.

0.46.2

• Restored the bdist_wheel command for compatibility with setuptools older than v70.1
• Importing wheel.bdist_wheel now emits a FutureWarning instead of a DeprecationWarning
• Fixed wheel unpack potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)

0.46.1

• Temporarily restored the wheel.macosx_libfile module (#659)

0.46.0

• Dropped support for Python 3.8
• Removed the bdist_wheel setuptools command implementation and entry point. The wheel.bdist_wheel module is now just an alias to setuptools.command.bdist_wheel, emitting a deprecation warning on import.
• Removed vendored packaging in favor of a run-time dependency on it
• Made the wheel.metadata module private (with a deprecation warning if it's imported
• Made the wheel.cli package private (no deprecation warning)
• Fixed an exception when calling the convert command with an empty description field

0.45.1

• Fixed pure Python wheels converted from eggs and wininst files having the ABI tag in the file name

0.45.0

• Refactored the convert command to not need setuptools to be installed

• Don't configure setuptools logging unless running bdist_wheel

• Added a redirection from wheel.bdist_wheel.bdist_wheel to setuptools.command.bdist_wheel.bdist_wheel to improve compatibility with setuptools' latest fixes.

  Projects are still advised to migrate away from the deprecated module and import the setuptools' implementation explicitly. (PR by @​abravalheri)

0.44.0

• Canonicalized requirements in METADATA file (PR by Wim Jeantine-Glenn)
• Deprecated the bdist_wheel module, as the code was migrated to setuptools itself

0.43.0

• Dropped support for Python 3.7
• Updated vendored packaging to 24.0

0.42.0

• Allowed removing build tag with wheel tags --build ""
• Fixed wheel pack and wheel tags writing updated WHEEL fields after a blank line, causing other tools to ignore them
• Fixed wheel pack and wheel tags writing WHEEL with CRLF line endings or a mix of CRLF and LF
• Fixed wheel pack --build-number "" not removing build tag from WHEEL (above changes by Benjamin Gilbert)

0.41.3

• Updated vendored packaging to 23.2
• Fixed ABI tag generation for CPython 3.13a1 on Windows (PR by Sam Gross)

Changelog

Sourced from wheel's changelog.

Release Notes

0.46.3 (2026-01-22)

• Fixed ImportError: cannot import name '_setuptools_logging' from 'wheel' when installed alongside an old version of setuptools and running the bdist_wheel command ([#676](https://github.com/pypa/wheel/issues/676) <https://github.com/pypa/wheel/issues/676>_)

0.46.2 (2026-01-22)

• Restored the bdist_wheel command for compatibility with setuptools older than v70.1
• Importing wheel.bdist_wheel now emits a FutureWarning instead of a DeprecationWarning
• Fixed wheel unpack potentially altering the permissions of files outside of the destination tree with maliciously crafted wheels (CVE-2026-24049)

0.46.1 (2025-04-08)

• Temporarily restored the wheel.macosx_libfile module ([#659](https://github.com/pypa/wheel/issues/659) <https://github.com/pypa/wheel/issues/659>_)

0.46.0 (2025-04-03)

• Dropped support for Python 3.8
• Removed the bdist_wheel setuptools command implementation and entry point. The wheel.bdist_wheel module is now just an alias to setuptools.command.bdist_wheel, emitting a deprecation warning on import.
• Removed vendored packaging in favor of a run-time dependency on it
• Made the wheel.metadata module private (with a deprecation warning if it's imported
• Made the wheel.cli package private (no deprecation warning)
• Fixed an exception when calling the convert command with an empty description field

0.45.1 (2024-11-23)

• Fixed pure Python wheels converted from eggs and wininst files having the ABI tag in the file name

0.45.0 (2024-11-08)

• Refactored the convert command to not need setuptools to be installed

• Don't configure setuptools logging unless running bdist_wheel

• Added a redirection from wheel.bdist_wheel.bdist_wheel to setuptools.command.bdist_wheel.bdist_wheel to improve compatibility with setuptools' latest fixes.

  Projects are still advised to migrate away from the deprecated module and import

... (truncated)

Commits

• eba4036 Updated the version number for v0.46.2
• 557fb54 Created a new release
• 7a7d2de Fixed security issue around wheel unpack (#675)
• 41418fa Fixed test failures due to metadata normalization changes
• c1d442b [pre-commit.ci] pre-commit autoupdate (#674)
• 0bac882 Update github actions environments (#673)
• be9f45b [pre-commit.ci] pre-commit autoupdate (#667)
• 6244f08 Update pre-commit ruff legacy alias (#668)
• 15b7577 PEP 639 compliance (#670)
• fc8cb41 Revert "Removed redundant Python version from the publish workflow (#666)"
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.