Skip to content

Update All non-major dependencies - #386

Open
renovate[bot] wants to merge 1 commit into
developfrom
renovate/minor-or-patch
Open

Update All non-major dependencies#386
renovate[bot] wants to merge 1 commit into
developfrom
renovate/minor-or-patch

Conversation

@renovate

@renovate renovate Bot commented Aug 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence Type Update
django-allauth (changelog) ==65.18.0 → ==65.19.1 age confidence project.dependencies minor
django-cms (changelog) ==5.1.0 → ==5.1.1 age confidence project.dependencies patch
django-debug-toolbar (changelog) ==7.0.0 → ==7.1.1 age confidence dependency-groups minor
djangocms-text ==0.9.10 → ==0.9.11 age confidence project.dependencies patch
djangocms-versioning ==2.6.1 → ==2.7.0 age confidence project.dependencies minor
djangorestframework (changelog) ==3.17.2 → ==3.18.0 age confidence project.dependencies minor
ghcr.io/astral-sh/uv 0.12.2 → 0.12.5 age confidence final patch
gunicorn (changelog) ==26.0.0 → ==26.1.0 age confidence project.dependencies minor
python-dotenv ==1.2.2 → ==1.2.3 age confidence project.dependencies patch
reportlab ==5.0.0 → ==5.0.1 age confidence project.dependencies patch
ruff (source, changelog) ==0.16.1 → ==0.16.4 age confidence dependency-groups patch
sentry_sdk (changelog) ==2.66.1 → ==2.68.0 age confidence project.dependencies minor
svglib ==2.1.0 → ==2.2.0 age confidence project.dependencies minor

Release Notes

allauth/django-allauth (django-allauth)

v65.19.1

Compare Source

v65.19.0

Compare Source

django-cms/django-cms (django-cms)

v5.1.1

Compare Source

What's Changed

Full Changelog: django-cms/django-cms@5.1.0...5.1.1

django-commons/django-debug-toolbar (django-debug-toolbar)

v7.1.1

Compare Source

Changelog

  • Serialize TaskResult in the Tasks panel to accommodate the storage mechanism.
  • Removed whitespace on Task panel’s kwargs column.

What's Changed

Full Changelog: django-commons/django-debug-toolbar@7.1.0...7.1.1

v7.1.0

Compare Source

Changelog

  • Added a Tasks panel that shows tasks queued during the request via Django’s built-in tasks framework (django.tasks, Django 6.0+). On older versions of Django, the panel explains that upgrading is required.
  • Fixed the Django version check in the SQL panel test suite for Django’s boolean parameter handling.
  • Fixed show_toolbar_with_docker on Docker runtimes such as OrbStack that can resolve host.docker.internal to an address outside the container network.
  • Restored the select and explain buttons for queries that run without parameters.
  • Fixed the error shown when panel content fails to load, which could not find the toolbar window inside the shadow root.
  • Stopped the history panel buttons from submitting their form when clicked before the panel script has loaded, which navigated away from the page.
  • Added support for Django 6.1.

What's Changed

New Contributors

Full Changelog: django-commons/django-debug-toolbar@7.0.0...7.1.0

django-cms/djangocms-text (djangocms-text)

v0.9.11

Compare Source

===================

django-cms/djangocms-versioning (djangocms-versioning)

v2.7.0

Compare Source

==================

What's Changed

Full Changelog: django-cms/djangocms-versioning@2.6.1...2.7.0

encode/django-rest-framework (djangorestframework)

v3.18.0

Compare Source

What's Changed

Breaking changes
Features
Bug fixes
Other changes

New Contributors

Full Changelog: encode/django-rest-framework@3.17.1...3.18.0

astral-sh/uv (ghcr.io/astral-sh/uv)

v0.12.5

Compare Source

Released on 2026-08-14.

Python
  • Add CPython 3.10.21, 3.11.16, and 3.12.14 (#​21138)
  • Prefer newer versions and standard variants when selecting between equally prioritized Python interpreters (#​21134)
Enhancements
  • Simplify errors and hints for invalid editable requirements, and redact credentials in requirement URLs (#​21130)
Preview features
  • Allow --index and --default-index to select configured package indexes by name with the index-by-name preview feature (#​17455)
  • Include distribution artifact URLs and hashes in CycloneDX SBOM exports by default (#​21131)
  • Fall back to logical file sizes when using cache-physical-space on filesystems that do not support physical-space accounting (#​21133)
Bug fixes
  • Resolve relative package index paths in PEP 723 scripts against the script directory (#​21097)

v0.12.4

Compare Source

Released on 2026-08-13.

Enhancements
  • Prefer post-quantum key exchange and enable opt-in TLS diagnostics (#​21054)
  • Accept whitespace before versions in noncompliant wildcard comparisons such as Requires-Python: >= 3.5.* (#​21012)
  • Report a specific error when a PEP 723 closing tag contains trailing whitespace or other content (#​20944)
  • Omit source-span carets from diagnostics for empty PEP 508 requirements (#​21094)
Preview features
  • Add uv check --no-install-project and respect UV_NO_INSTALL_PROJECT to install dependencies without building or installing the project (#​21085)
  • Make the ty subprocess invoked by uv check honor uv's color and progress settings, including quiet mode (#​21086)
Performance
  • Speed up resolutions with long runs of unavailable package versions by coalescing gaps in the resolver's version ranges (#​20804)
  • Speed up Simple API parsing by deserializing PyPI and Pyx file metadata directly (#​21041)
Bug fixes
  • Use windowed pythonw.exe launchers for virtual environments created from managed Python minor-version links (#​19235)
  • Allow uv lock to proceed when .venv is an unusable project environment (#​21068)
  • Respect fork-strategy when ordering forks created from environments or existing lockfile resolution-markers (#​21000)
  • Preserve consecutive wildcard Python minor-version exclusions such as !=3.11.*, !=3.12.* in uv.lock (#​21045)
  • Preserve inline comments on the final item in dependency arrays when uv add updates it (#​21008)
  • Recover from stale base-interpreter cache metadata when an existing virtual environment exposes a version mismatch (#​21073)
  • Prevent interpreter cache reuse across different PYTHONEXECUTABLE and __PYVENV_LAUNCHER__ overrides (#​21075)
  • Show standard styling, usage guidance, and line termination for invalid uv version --bump values (#​21076)

v0.12.3

Compare Source

Released on 2026-08-07.

Python
Preview features
  • Add --output-format to select automatic, human-readable, or raw-byte output for uv cache size (#​20992)
  • Preserve JSON output from uv workspace metadata --quiet while suppressing diagnostics (#​20991)
  • Reduce memory usage for large workspaces by streaming uv workspace metadata JSON output (#​20990)
Performance
  • Reduce Linux startup latency by initializing the workspace cache before spawning another thread (#​20989)
  • Reuse compiled workspace exclusion patterns during workspace discovery (#​20988)
  • Speed up conflict-heavy resolutions by avoiding materialized range complements (#​20982)
  • Avoid slow procfs reads during Python interpreter discovery on Linux (#​20987)
Documentation
  • Add PEP 740 attestations to the GitHub Actions publishing example (#​20986)
  • Restrict the GitHub Actions publishing example to Python version tags (#​20973)
  • Correct --python-pin to --pin-python in the uv init --bare example (#​20876)
benoitc/gunicorn (gunicorn)

v26.1.0: gunicorn 26.1.0

Compare Source

New Features
  • Glob patterns in reload_extra_files: entries containing *, ? or [
    are treated as patterns, so ui/*/config.json watches every view's config
    without listing them one by one. Patterns are re-expanded on every reload
    check rather than once at startup, so a file created later starts being
    watched without restarting gunicorn, and ** recurses. A pattern matching
    nothing warns instead of failing, since with live expansion it may match later
    (#​1643,
    #​3662).
Security
  • Dependency floors raised past known advisories: every declared floor was
    checked against the advisory database. tornado, h2, setuptools and
    pymdown-extensions permitted vulnerable versions and now require the first
    clean release; pytest and httpx were unpinned and now carry floors. The
    tornado example pinned tornado<6, which was both the source of several
    advisories and older than the >=6.5.0 the tornado worker needs, so the
    example could not run as pinned.
Bug Fixes

  • SIGHUP did not reload the logger configuration: Arbiter.reload()
    re-read the configuration file but kept using the logger built at startup,
    calling only reopen_files() on its existing handlers. Changes to
    logconfig, logconfig_dict, logconfig_json and loglevel were ignored
    until a full restart, which in containers meant replacing the pod. The
    existing logger now re-runs its setup on reload, so new handlers, formats
    and levels take effect while the process identity and its listeners are
    preserved, and re-running the setup no longer stacks duplicate syslog
    handlers. An invalid log configuration on reload is not fatal either: the
    error is reported on stderr, the previous working configuration is restored
    and the master keeps running with it
    (#​3353).

  • Truncated chunked bodies accepted: RFC 9112 section 7.1.2 ends a chunked
    body with 0 CRLF CRLF, the second CRLF being the mandatory empty trailer
    section. ChunkedReader.parse_chunk_size() swallowed the NoMoreData raised
    while scanning for it, so a body cut short right after the last chunk line was
    treated as complete instead of rejected. It now raises
    ChunkMissingTerminator
    (#​3382,
    #​3685).

  • --spew crashed on dynamically generated code: the trace hook indexed the
    2-tuple returned by inspect.getsourcelines() by line number rather than
    indexing the list of lines, so a frame with no __file__ raised
    AttributeError: 'int' object has no attribute 'rstrip' on line 1 and
    IndexError beyond it. The tuple is now unpacked and offset by the source's
    starting line (#​3344,
    #​3495).

  • Duplicate Host and Content-Type headers accepted: RFC 9110 section 5.3
    allows only one of each, and a repeat cannot be merged into a list, so the
    message means different things to gunicorn and to anything downstream. Both
    are now rejected with InvalidHeader. The check lives in the policy hook
    shared by both parsers, so the pure-Python and fast parsers agree. Duplicate
    Content-Length was already rejected and is unchanged
    (#​3366,
    #​3548).

  • Non-worker children reported as failed workers: reap_workers() reaps
    every child through waitpid(-1), including processes the kernel reparented
    onto gunicorn when it runs as PID 1 in a container, but it logged the exit
    status before checking whether the pid was ever a worker. An unrelated process
    produced Worker (pid:N) exited with code M and triggered alerts. More
    seriously, such a process exiting with code 3 or 4 raised HaltServer and shut
    the server down. Ownership is now established first: the dirty arbiter is
    reported as itself, unknown children are reaped silently at debug level, and
    only real workers can halt the server
    (#​3220,
    #​3566).

  • Dirty arbiter exits were invisible on SIGCHLD: handle_chld() called
    reap_workers() first, whose waitpid(-1) claimed the dirty arbiter before
    reap_dirty_arbiter() could identify it, so the latter always hit ECHILD and
    its reporting never ran. The dirty arbiter is now reaped first, and
    reap_workers() recognises it if it exits mid-loop.

  • Dirty arbiter returned stale responses after a worker timeout: when a
    request reached dirty_timeout the arbiter answered the client with a timeout
    error but kept the worker connection open. The worker's late response was then
    the first message waiting on that socket, so the next request routed to the
    same worker received the previous request's result, and every request after it
    stayed one response behind. The connection is now closed on timeout, so the
    late answer is discarded with it
    (#​3626).

  • ASGI connection count leaked on server-initiated close: nr_conns was
    only decremented in connection_lost(), behind a guard keyed on the same
    flag _close_transport() sets first. Every close the server started (a
    Connection: close response, a keepalive timeout, an error abort) leaked one
    count, so ASGIWorker._shutdown() ran the full graceful_timeout and warned
    about connections that were already gone. The guard now uses its own flag, so
    the decrement and the rest of the cleanup run exactly once whichever side
    closes first (#​3661).

  • Inotify reloader on cwd-relative extra files: reload_extra_files entries
    with no directory part (for example .env) produced an empty dirname, and
    watching it raised InotifyError with ENOENT. The current directory is now
    watched as . (#​3377,
    #​3667).

  • StatsD zero-valued metrics: gauges, counters, histograms and timers
    reporting 0 were silently dropped because the value was tested for
    truthiness. Only None is skipped now
    (#​3676).

  • Spurious no-body warning from sendfile(): a HEAD, 204 or 304 response
    served through sendfile() warned about dropped body bytes even when the
    file was empty and nothing was dropped. It now warns only when there are
    bytes to drop, matching write()
    (#​3684).

  • Bare except in the gevent websocket example: narrowed to
    except Exception (#​3683).

  • ASGI receive() cancellation: Let asyncio.CancelledError propagate
    from BodyReceiver instead of swallowing it and returning
    http.disconnect. Frameworks that cancel their disconnect listener after
    the response completes (Django) no longer see the cancel masked, so
    request_finished fires and close_old_connections() runs. Fixes idle
    database connections leaking since 25.1.0
    (#​3627,
    #​3654).

  • Control socket leak on SIGHUP reload: The control thread is now marked
    ready once its loop and server are live, and the stop paths wait on that
    readiness before scheduling shutdown. Reloads no longer leak one thread and
    its selector fd plus unix socket per worker, which eventually raised
    "too many open files"
    (#​3648).

  • WSGI body framing on HEAD/1xx/204/304: Mirror the ASGI strip-and-warn
    behavior on the WSGI path. Content-Length is stripped on 1xx/204 per
    RFC 9110 section 6.4.2, body bytes are dropped for no-body responses in
    both write() and sendfile(), and a single warning is logged per request
    (#​3413).

Refactoring
  • Pass log arguments to the logger instead of pre-formatting the worker
    termination message in Arbiter.reap_workers()
    (#​3678).
Changes

  • packaging is no longer a runtime dependency: it was only ever imported by
    the gevent worker, to compare gevent's version. It moved to the gevent and
    testing extras, so a plain pip install gunicorn pulls in nothing
    (#​3643).

  • Fast HTTP Parser: Require gunicorn_h1c >= 0.6.6, which rejects duplicate
    Host and Content-Type headers in the C parser itself. Gunicorn already
    refuses them on both the WSGI and ASGI paths, so this changes nothing that is
    reachable; it moves the rejection to where the bytes are read and lets the
    ASGI corpus exercise those cases against the fast parser directly.

Full changelog: https://gunicorn.org/2026-news/

theskumar/python-dotenv (python-dotenv)

v1.2.3

Compare Source

Fixed
  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in [#​640]
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in [#​680]
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in [#​606]
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in [#​638]
astral-sh/ruff (ruff)

v0.16.4

Compare Source

Released on 2026-08-20.

Preview features
  • [flake8-use-pathlib] Add autofix for PTH116 (#​26460)
  • [refurb] Restrict delete-full-slice to lists (FURB131) (#​27711)
  • [refurb] Skip FURB101 and FURB103 when the open argument is a file descriptor (#​27643)
Bug fixes
  • Fix InvalidInstruction on Windows CPUs that do not support POPCNT (#​27803)
  • [pyflakes] Emit semantic syntax errors in string type definitions as F722 (#​27835)
  • [pylint] Allow os._exit imports in import-private-name (PLC2701) (#​27738)
Rule changes
  • [syntax-errors] Align mixed t-string/bytes error message with CPython 3.14 (#​27766)
  • [ruff] Add ctypes.LittleEndianStructure and related types to existing exception (RUF012) (#​27753)
  • [syntax-errors] Detect duplicate keyword arguments (#​17804)
  • [syntax-errors] Detect parameters declared nonlocal (#​27628)
Server
  • Offer display-only fixes and mark safe fixes preferred (#​27807)
  • Support pull diagnostics for notebook cells (#​27779)
Documentation
  • Add default indicator to rules table (#​27724)
  • Fix broken link to Python docs (#​27757)
Other changes
  • Fix s390x stacker assembly in release builds (#​27776)
  • Guarantee minimum stack size when parsing a module, standalone expression, and suites (#​25464)
  • Reduce configuration deserialization code size (#​27924)
  • Check packed AST index bounds (#​27849)
Contributors

v0.16.3

Compare Source

Released on 2026-08-13.

Preview features
  • [pylint] Fix false negatives on negative numbers (PLR6104) (#​27251)
  • [pyupgrade] Add rule to replace while 1 with while True (UP048) (#​27190)
Bug fixes
  • [flake8-bandit] Also check keyword arguments (S602, S603, S607, S609) (#​27687)
  • [pylint] Allow continue in finally on Python 3.8 (#​27626)
  • [pylint] Fix PLE1307 false positive with bools (#​27651)
  • [pylint] Fix false positives and negatives with %b format character (PLE1300, PLE1307) (#​27560)
  • [pylint] Improve handling of concatenated strings (PLE1300) (#​27659)
Rule changes
  • [numpy] Make np.chararray autofix backwards-compatible (NPY201) (#​27527)
Performance
  • Enable PGO for Linux x86-64 Ruff releases (#​27570)
  • Enable PGO for Linux ARM64 Ruff releases (#​27574)
  • Enable PGO for Windows x86-64 Ruff releases (#​27573)
  • Enable PGO for macOS ARM64 Ruff releases (#​27572)
  • Reduce Expr size to 64 bytes (#​27591)
CLI
  • Hyperlink rule codes in ruff check --statistics output (#​27646)
Documentation
  • [ruff] Also suggest asyncio.TaskGroup (RUF006) (#​27461)
Other changes
Contributors

v0.16.2

Compare Source

Released on 2026-08-06.

Bug fixes
  • [flake8-pyi] Avoid false positives on singledispatch functions (PYI041) (#​27335)
Server
  • Register formatting capabilities dynamically to exclude TOML files (#​27332)
Contributors
getsentry/sentry-python (sentry_sdk)

v2.68.0

Compare Source

Important

  • We're making enable_logs and enable_metrics no-op with this release (#​7177), and they'll be dropped in the next major.

    Previously, enable_logs also controlled automatic logs collection from the logging and Loguru integrations. These integrations now get an integration-level capture_sentry_logs boolean option to allow for more control over the auto-collection. These options are False by default, i.e., nothing is auto-collected without your explicit opt-in.

Action Needed

If you had enable_logs set to True:

  • If you were using the sentry_sdk.logger.X API, no action necessary, the API will just work.
  • If you were auto-collecting logs from either LoggingIntegration or LoguruIntegration, the auto-collection will be turned off in this release. You can switch auto-collection on explicitly with:
import sentry_sdk
from sentry_sdk.integrations.logging import LoggingIntegration
from sentry_sdk.integrations.loguru import LoguruIntegration

sentry_sdk.init(
    integrations=[
        LoggingIntegration(capture_sentry_logs=True),
        LoguruIntegration(capture_sentry_logs=True),
    ],
)

If you had enable_logs set to False:

  • If you were using it to gate usages of the sentry_sdk.logger.X API, you'll need to remove the calls entirely or define a before_send_log callback to filter out unwanted logs.

If you has enable_metrics set to False:

  • Any metrics emitted using the metrics API will be emitted. You'll need to drop them in a before_send_metric or remove the calls to the API.
Why We're Doing This

We recognize this is a disruptive change for some folks and want to make it clear this is a one-off. We're removing the options because they were an unnecessary hurdle that one had to jump through to be able to use logs and metrics, and it was confusing why the logging API would not just work on its own. On the other hand, we wanted to give you more fine-grained control over automatic collection.

New Features ✨
Other
Bug Fixes 🐛
Internal Changes 🔧
HTTPX, HTTPX2
Other

v2.67.1

Compare Source

Bug Fixes 🐛

v2.67.0

Compare Source

New Features ✨
Batcher
Integrations
Langchain
Openai
  • Set gen_ai.tool.definitions for the Responses API by @​alexander-alderman-webb in #​6951
  • Set gen_ai.tool.definitions for the Chat Completions API by [@​alexander-alderman-we

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 6am on the first day of the week"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/minor-or-patch branch 8 times, most recently from 9060411 to d4e7cea Compare August 16, 2026 18:38
@renovate
renovate Bot force-pushed the renovate/minor-or-patch branch 3 times, most recently from 1100cdb to f050de8 Compare August 20, 2026 14:54
@renovate
renovate Bot force-pushed the renovate/minor-or-patch branch from f050de8 to 793b676 Compare August 20, 2026 19:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants