chore: bump the python group across 2 directories with 28 updates

[dependabot]

Bumps the python group with 27 updates in the / directory:

Package	From	To
python-gitlab	4.5.0	6.4.0
flask	3.0.3	3.1.2
kubernetes	30.1.0	34.1.0
gunicorn	22.0.0	23.0.0
requests	2.32.3	2.32.5
pyyaml	6.0.1	6.0.3
urllib3	2.2.2	2.3.0
sentry-sdk	2.5.1	2.39.0
gevent	24.2.1	25.9.1
apispec-webframeworks	1.1.0	1.2.0
webargs	8.4.0	8.7.0
pyjwt	2.8.0	2.10.1
marshmallow	3.21.3	4.0.1
apispec	6.6.1	6.8.4
importlib-metadata	7.1.0	8.7.0
dataconf	3.2.0	3.6.0
python-ulid	2.7.0	3.1.0
cryptography	42.0.8	46.0.2
chartpress	2.2.0	2.3.0
pytest	8.2.2	8.4.2
pre-commit	3.7.1	4.3.0
pytest-cov	5.0.0	7.0.0
pytest-mock	3.14.0	3.15.1
typing-extensions	4.12.2	4.15.0
semver	3.0.2	3.0.4
ruff	0.4.9	0.13.3
responses	0.25.3	0.25.8

Bumps the python group with 6 updates in the /git_services directory:

Package	From	To
gunicorn	22.0.0	23.0.0
sentry-sdk	2.5.1	2.39.0
gevent	24.2.1	25.9.1
pytest-mock	3.14.0	3.15.1
ruff	0.4.9	0.13.3
renku	2.9.2	2.9.4

Updates python-gitlab from 4.5.0 to 6.4.0

Release notes

Sourced from python-gitlab's releases.

v6.4.0 (2025-09-28)

This release is published under the LGPL-3.0-or-later License.

Chores

• deps: Update actions/setup-python action to v6 (89cdb78)

• deps: Update actions/stale action to v10 (1cc8cad)

• deps: Update all non-major dependencies (0c56567)

• deps: Update all non-major dependencies (06f62a2)

• deps: Update all non-major dependencies (9d4ee07)

Features

• users: Implement missing arguments in users 'list' (99923d4)

• users: Sort 'user list' arguments against documentation (99923d4)

---

Detailed Changes: v6.3.0...v6.4.0

v6.3.0 (2025-08-28)

This release is published under the LGPL-3.0-or-later License.

Chores

• deps: Update actions/checkout action to v5 (36629a4)

• deps: Update actions/download-artifact action to v5 (397cf39)

• deps: Update all non-major dependencies (d40d5d2)

• deps: Update all non-major dependencies (2fce144)

• deps: Update all non-major dependencies (2dd2e8e)

• deps: Update all non-major dependencies (bf7a60a)

• deps: Update all non-major dependencies (18c946f)

Features

• Add sync method to force remote mirror updates (f3c6678)

... (truncated)

Changelog

Sourced from python-gitlab's changelog.

CHANGELOG

v5.6.0 (2025-01-28)

Features

• group: Add support for group level MR approval rules (304bdd0)

v5.5.0 (2025-01-28)

Chores

• Add deprecation warning for mirror_pull functions (7f6fd5c)

• Relax typing constraints for response action (f430078)

• tests: Catch deprecation warnings (0c1af08)

Documentation

• Add usage of pull mirror (9b374b2)

• Remove old pull mirror implementation (9e18672)

Features

• functional: Add pull mirror test (3b31ade)

• projects: Add pull mirror class (2411bff)

• unit: Add pull mirror tests (5c11203)

v5.4.0 (2025-01-28)

Bug Fixes

• api: Make type ignores more specific where possible (e3cb806)

... (truncated)

Commits

• 40d8131 chore: release v6.4.0
• 0c56567 chore(deps): update all non-major dependencies
• 06f62a2 chore(deps): update all non-major dependencies
• 1cc8cad chore(deps): update actions/stale action to v10
• 99923d4 feat(users): implement missing arguments in users 'list'
• 9d4ee07 chore(deps): update all non-major dependencies
• 89cdb78 chore(deps): update actions/setup-python action to v6
• a7ef3b4 chore: release v6.3.0
• d40d5d2 chore(deps): update all non-major dependencies
• 36629a4 chore(deps): update actions/checkout action to v5
• Additional commits viewable in compare view

Updates flask from 3.0.3 to 3.1.2

Release notes

Sourced from flask's releases.

3.1.2

This is the Flask 3.1.2 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.2/ Changes: https://flask.palletsprojects.com/page/changes/#version-3-1-2 Milestone: https://github.com/pallets/flask/milestone/38?closed=1

• stream_with_context does not fail inside async views. #5774
• When using follow_redirects in the test client, the final state of session is correct. #5786
• Relax type hint for passing bytes IO to send_file. #5776

3.1.1

This is the Flask 3.1.1 fix release, which fixes bugs but does not otherwise change behavior and should not result in breaking changes compared to the latest feature release.

PyPI: https://pypi.org/project/Flask/3.1.1/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-1 Milestone https://github.com/pallets/flask/milestone/36?closed=1

• Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. GHSA-4grg-w6v8-c28g
• Fix type hint for cli_runner.invoke. #5645
• flask --help loads the app and plugins first to make sure all commands are shown. #5673
• Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. #5659

3.1.0

This is the Flask 3.1.0 feature release. A feature release may include new features, remove previously deprecated code, add new deprecations, or introduce potentially breaking changes. We encourage everyone to upgrade, and to use a tool such as pip-tools to pin all dependencies and control upgrades. Test with warnings treated as errors to be able to adapt to deprecation warnings early.

PyPI: https://pypi.org/project/Flask/3.1.0/ Changes: https://flask.palletsprojects.com/en/stable/changes/#version-3-1-0 Milestone: https://github.com/pallets/flask/milestone/33?closed=1

• Drop support for Python 3.8. #5623
• Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. #5624, #5633
• Provide a configuration option to control automatic option responses. #5496
• Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. #5504
• Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation about resource limits to the security page. #5625
• Add support for the Partitioned cookie attribute (CHIPS), with the SESSION_COOKIE_PARTITIONED config. #5472
• -e path takes precedence over default .env and .flaskenv files. load_dotenv loads default files in addition to a path unless load_defaults=False is passed. #5628
• Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to add support. #5621
• Fix how setting host_matching=True or subdomain_matching=False interacts with SERVER_NAME. Setting SERVER_NAME no longer restricts requests to only that domain. #5553
• Request.trusted_hosts is checked during routing, and can be set through the TRUSTED_HOSTS config. #5636

Changelog

Sourced from flask's changelog.

Version 3.1.2

Released 2025-08-19

• stream_with_context does not fail inside async views. :issue:5774
• When using follow_redirects in the test client, the final state of session is correct. :issue:5786
• Relax type hint for passing bytes IO to send_file. :issue:5776

Version 3.1.1

Released 2025-05-13

• Fix signing key selection order when key rotation is enabled via SECRET_KEY_FALLBACKS. :ghsa:4grg-w6v8-c28g
• Fix type hint for cli_runner.invoke. :issue:5645
• flask --help loads the app and plugins first to make sure all commands are shown. :issue:5673
• Mark sans-io base class as being able to handle views that return AsyncIterable. This is not accurate for Flask, but makes typing easier for Quart. :pr:5659

Version 3.1.0

Released 2024-11-13

• Drop support for Python 3.8. :pr:5623
• Update minimum dependency versions to latest feature releases. Werkzeug >= 3.1, ItsDangerous >= 2.2, Blinker >= 1.9. :pr:5624,5633
• Provide a configuration option to control automatic option responses. :pr:5496
• Flask.open_resource/open_instance_resource and Blueprint.open_resource take an encoding parameter to use when opening in text mode. It defaults to utf-8. :issue:5504
• Request.max_content_length can be customized per-request instead of only through the MAX_CONTENT_LENGTH config. Added MAX_FORM_MEMORY_SIZE and MAX_FORM_PARTS config. Added documentation about resource limits to the security page. :issue:5625
• Add support for the Partitioned cookie attribute (CHIPS), with the SESSION_COOKIE_PARTITIONED config. :issue:5472
• -e path takes precedence over default .env and .flaskenv files. load_dotenv loads default files in addition to a path unless load_defaults=False is passed. :issue:5628
• Support key rotation with the SECRET_KEY_FALLBACKS config, a list of old secret keys that can still be used for unsigning. Extensions will need to

... (truncated)

Commits

• 2c1b30d release version 3.1.2
• 1292419 Update GitHub Actions workflow for artifact handling (#5795)
• 4dd52ca Update GitHub Actions workflow for artifact handling
• 55c6255 update dev dependencies
• d8259eb use Jinja name consistently
• 38b4c1e refactor stream_with_context for async views (#5799)
• 9822a03 refactor stream_with_context for async views
• 49b7e7b security docs for TRUSTED_HOSTS (#5798)
• b228ca3 security docs for TRUSTED_HOSTS
• ff64079 update flask-talisman link
• Additional commits viewable in compare view

Updates kubernetes from 30.1.0 to 34.1.0

Release notes

Sourced from kubernetes's releases.

Kubernetes Python Client v34.1.0 Stable Release

Getting started:

pip install --pre --upgrade kubernetes

Or from source, download attached zip file, then

unzip client-python-v34.1.0.zip
cd client-python-v34.1.0
python setup.py install

Then follow examples in https://github.com/kubernetes-client/python/tree/release-34.0/examples

Changelog: https://github.com/kubernetes-client/python/blob/release-34.0/CHANGELOG.md

Kubernetes Python Client v34.1.0 Beta 1 Release

Getting started:

pip install --pre --upgrade kubernetes

Or from source, download attached zip file, then

unzip client-python-v34.1.0b1.zip
cd client-python-v34.1.0b1
python setup.py install

Then follow examples in https://github.com/kubernetes-client/python/tree/release-34.0/examples

Changelog: https://github.com/kubernetes-client/python/blob/release-34.0/CHANGELOG.md

Kubernetes Python Client v34.1.0 Alpha 1 Release

Getting started:

pip install --pre --upgrade kubernetes

Or from source, download attached zip file, then

unzip client-python-v34.1.0a1.zip
cd client-python-v34.1.0a1
</tr></table> 

... (truncated)

Changelog

Sourced from kubernetes's changelog.

v34.1.0b1

Kubernetes API Version: v1.34.1

v34.1.0a1

Kubernetes API Version: v1.34.1

API Change

• Added omitempty and opt tag to the API v1beta2 AdminAccess type in the DeviceRequestAllocationResult struct. (kubernetes/kubernetes#132338, @​PatrickLaabs)

• Added a runtime.ApplyConfiguration interface implemented by all generated apply configuration types. (kubernetes/kubernetes#132194, @​alvaroaleman) [SIG API Machinery and Instrumentation]

• Added a detailed event for in-place pod vertical scaling completed, improving cluster management and debugging. (kubernetes/kubernetes#130387, @​shiya0705) [SIG API Machinery, Apps, Autoscaling, Node, Scheduling and Testing]

• Added a mechanism for configurable container restarts: container-level restart rules. This was an alpha feature behind the ContainerRestartRules feature gate. (kubernetes/kubernetes#132642, @​yuanwang04) [SIG API Machinery, Apps, Node and Testing]

• Added a new FileKeyRef field to containers, allowing them to load variables from files by setting this field.

  Introduced the EnvFiles feature gate to govern activation of this functionality. (kubernetes/kubernetes#132626, @​HirazawaUi) [SIG API Machinery, Apps, Node and Testing]

• Added driver-owned fields in ResourceSlice to mark whether the device was shareable among multiple resource claims (or requests) and to specify how each capacity could be shared between different requests.

  • Added user-owned fields in ResourceClaim to specify resource requirements against each device capacity.
  • Added scheduler-owned field in ResourceClaim.Status to specify how much device capacity is reserved for a specific request.
  • Added an additional identifier to ResourceClaim.Status for the device supports multiple allocations.
  • Added a new constraint type to enforce uniqueness of specified attributes across all allocated devices. (kubernetes/kubernetes#132522, @​sunya-ch) [SIG API Machinery, Apps, Architecture, CLI, Cluster Lifecycle, Network, Node, Release, Scheduling and Testing]

• Added new optional APIs in ResouceSlice.Basic and ResourceClaim.Status.AllocatedDeviceStatus. (kubernetes/kubernetes#130160, @​KobayashiD27) [SIG API Machinery, Apps, Architecture, Node, Release, Scheduling and Testing]

• Added support for specifying controlplane or cluster egress selectors in JWT authenticators via the issuer.egressSelectorType field in the AuthenticationConfiguration.jwt array. If unset, the previous behavior of using no egress selector is preserved. This functionality requires the StructuredAuthenticationConfigurationEgressSelector beta feature gate (enabled by default). (kubernetes/kubernetes#132768, @​enj) [SIG API Machinery, Auth and Testing]

• Added support in the Kubelet for monitoring the health of devices allocated via Dynamic Resource Allocation (DRA) and report it in the pod.status.containerStatuses.allocatedResourcesStatus field. This required the DRA plugin to implement the new v1alpha1 NodeHealth gRPC service. This feature was controlled by the ResourceHealthStatus feature gate. (kubernetes/kubernetes#130606, @​Jpsassine) [SIG Apps, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Etcd, Network, Node, Release, Scheduling, Storage and Testing]

• Added support in the kubelet's image pull credential tracking for service account-based verification. When an image was pulled using service account credentials via external credential providers, subsequent Pods using the same service account (UID, name, and namespace) could access the cached image without re-authentication for the lifetime of that service account. (kubernetes/kubernetes#132771, @​aramase) [SIG Auth, Node and Testing]

• Added validation to reject Pods using the PodLevelResources feature on Windows OS due to lack of support. The API server rejected Pods with pod-level resources and a Pod.spec.os.name targeting Windows. Kubelet on nodes running Windows also rejected Pods with pod-level resources at the admission phase. (kubernetes/kubernetes#133046, @​toVersus) [SIG Apps and Node]

• Added warnings when creating headless service with set loadBalancerIP,externalIPs and/or SessionAffinity. (kubernetes/kubernetes#132214, @​Peac36)

• Allowed pvc.spec.VolumeAttributesClassName to change from non-nil to nil. (kubernetes/kubernetes#132106, @​AndrewSirenko)

• Allowed setting the hostnameOverride field in PodSpec to specify any RFC 1123 DNS subdomain as the pod's hostname. The HostnameOverride feature gate was introduced to control enablement of this functionality. (kubernetes/kubernetes#132558, @​HirazawaUi) [SIG API Machinery, Apps, Network, Node and Testing]

• Changed underlying logic for Eviction Manager helper functions. (kubernetes/kubernetes#132277, @​KevinTMtz) [SIG Node, Scheduling and Testing]

• Changed underlying logic to propagate pod-level hugepage cgroup to containers when they did not specify hugepage resources.

  • Added validation to enforce the hugepage aggregated container limits to be smaller than or equal to pod-level limits. This was already enforced with the defaulted requests from the specified limits, however it did not make it clear about both hugepage requests and limits. (kubernetes/kubernetes#131089, @​KevinTMtz) [SIG Apps, Node and Testing]

• Corrected the documentation to clarify that podSelector is optional and described its default behavior. (kubernetes/kubernetes#131354, @​tomoish)

• DRA API: resource.k8s.io/v1alpha3 now only contains DeviceTaintRule. All other types got removed because they became obsolete when introducing the v1beta1 API in 1.32. before updating a cluster where resourceclaims, resourceclaimtemplates, deviceclasses, or resourceslices might have been stored using Kubernetes < 1.32, delete all of those resources before updating and recreate them as needed while running Kubernetes >= 1.32. (kubernetes/kubernetes#132000, @​pohly) [SIG Etcd, Node, Scheduling and Testing]

• DRA: Starting with Kubernetes 1.34, the alpha-level resource.k8s.io/admin-access label has been updated to resource.kubernetes.io/admin-access. Admins using the alpha feature and updating from 1.33 can set both labels, upgrade, then remove resource.k8s.io/admin-access when no downgrade is going to happen anymore. (kubernetes/kubernetes#131996, @​ritazh) [SIG Node and Testing]

• DRA: The scheduler plugin prevented abnormal filter runtimes by timing out after 10 seconds. This was configurable via the plugin configuration's FilterTimeout. Setting it to zero disabled the timeout and restored the behavior of Kubernetes <= 1.33. (kubernetes/kubernetes#132033, @​pohly) [SIG Node, Scheduling and Testing]

• DRA: When the prioritized list feature was used in a request and the resulting number of allocated devices exceeded the number of allowed devices per claim, the scheduler aborted the attempt to allocate devices early. Previously, it tried to many different combinations, which could take a long time. (kubernetes/kubernetes#130593, @​mortent) [SIG Apps, Node, Scheduling and Testing]

• DRA: removed support for the v1alpha4 kubelet gRPC API (added in 1.31, superseded in 1.32). DRA drivers using the helper package from Kubernetes >= 1.32 use the v1beta1 API and continue to be supported. (kubernetes/kubernetes#132574, @​pohly)

• Deprecated StreamingConnectionIdleTimeout field of the kubelet config. (kubernetes/kubernetes#131992, @​lalitc375)

• Dynamic Resource Allocation: Graduated core functionality to general availability (GA). This newly stable feature uses the structured parameters flavor of DRA. (kubernetes/kubernetes#132706, @​pohly) [SIG API Machinery, Apps, Auth, Autoscaling, Etcd, Node, Scheduling and Testing]

• Enabled kube-apiserver support for PodCertificateRequest and PodCertificate projected volumes (behind the PodCertificateRequest feature gate). (kubernetes/kubernetes#128010, @​ahmedtd) [SIG API Machinery, Apps, Auth, Cloud Provider, Etcd, Node, Storage and Testing]

• Extended resources backed by DRA feature allowed cluster operator to specify extendedResourceName in DeviceClass, and application operator to continue using extended resources in pod's requests to request for DRA devices matching the DeviceClass.

  NodeResourcesFit plugin scoring didn't work for extended resources backed by DRA. (kubernetes/kubernetes#130653, @​yliaog) [SIG API Machinery, Apps, Auth, Node, Scheduling and Testing]

• Extended the NodePorts scheduling plugin to consider hostPorts used by restartable init containers. (kubernetes/kubernetes#132040, @​avrittrohwer) [SIG Scheduling and Testing]

• Fixed a 1.33 regression that causes a nil panic in kube-scheduler when aggregating resource requested across container's spec and status. (kubernetes/kubernetes#132895, @​yue9944882) [SIG Node and Scheduling]

• Fixed prerelease lifecycle for PodCertificateRequest. (kubernetes/kubernetes#133350, @​carlory)

• Introduced OpenAPI format support for k8s-short-name and k8s-long-name in CustomResourceDefinition schemas. (kubernetes/kubernetes#132504, @​jpbetz) [SIG API Machinery, Architecture, Auth, CLI, Cloud Provider, Cluster Lifecycle, Instrumentation, Network, Node, Scheduling and Storage]

... (truncated)

Commits

• 5b23a44 Merge pull request #2455 from yliaog/automated-release-of-34.1.0-upstream-rel...
• 8866972 Updated the compatibility matrix and maintenance status
• 9bb2014 generated client change
• efa2b26 update changelog
• b374f2e update version constants for 34.1.0 release
• 9d14e9f Merge pull request #2452 from yliaog/automated-release-of-34.1.0b1-upstream-r...
• 749ec15 generated client change
• 14901c6 update changelog
• fe16bed update version constants for 34.1.0b1 release
• c66f45a Merge pull request #2448 from yliaog/automated-release-of-34.1.0a1-upstream-r...
• Additional commits viewable in compare view

Updates gunicorn from 22.0.0 to 23.0.0

Release notes

Sourced from gunicorn's releases.

23.0.0

Gunicorn 23.0.0 has been released. This version improve HTTP 1.1. support and which improve safety

You're invited to upgrade asap your own installation.

23.0.0 - 2024-08-10

• minor docs fixes (:pr:3217, :pr:3089, :pr:3167)
• worker_class parameter accepts a class (:pr:3079)
• fix deadlock if request terminated during chunked parsing (:pr:2688)
• permit receiving Transfer-Encodings: compress, deflate, gzip (:pr:3261)
• permit Transfer-Encoding headers specifying multiple encodings. note: no parameters, still (:pr:3261)
• sdist generation now explicitly excludes sphinx build folder (:pr:3257)
• decode bytes-typed status (as can be passed by gevent) as utf-8 instead of raising TypeError (:pr:2336)
• raise correct Exception when encounting invalid chunked requests (:pr:3258)
• the SCRIPT_NAME and PATH_INFO headers, when received from allowed forwarders, are no longer restricted for containing an underscore (:pr:3192)
• include IPv6 loopback address [::1] in default for :ref:forwarded-allow-ips and :ref:proxy-allow-ips (:pr:3192)

** NOTE **

• The SCRIPT_NAME change mitigates a regression that appeared first in the 22.0.0 release
• Review your :ref:forwarded-allow-ips setting if you are still not seeing the SCRIPT_NAME transmitted
• Review your :ref:forwarder-headers setting if you are missing headers after upgrading from a version prior to 22.0.0

** Breaking changes **

• refuse requests where the uri field is empty (:pr:3255)
• refuse requests with invalid CR/LR/NUL in heade field values (:pr:3253)
• remove temporary --tolerate-dangerous-framing switch from 22.0 (:pr:3260)
• If any of the breaking changes affect you, be aware that now refused requests can post a security problem, especially so in setups involving request pipe-lining and/or proxies.

Fix CVE-2024-1135

Commits

• 411986d fix doc
• 334392e Merge pull request #2559 from laggardkernel/bugfix/reexec-env
• e75c353 Merge pull request #3189 from pajod/patch-py36
• 9357b28 keep document user in access_log_format setting
• 79fdef0 bump to 23.0.0
• 3acd9fb Merge pull request #2620 from talkerbox/improve-access-log-format-docs
• 3f56d76 Merge pull request #3192 from pajod/patch-allowed-script-name
• 256d474 docs: revert duped directive
• ffa48b5 test: default change was intentional
• 52538ca docs: recommend SCRIPT_NAME=/subfolder
• Additional commits viewable in compare view

Updates requests from 2.32.3 to 2.32.5

Release notes

Sourced from requests's releases.

v2.32.5

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

v2.32.4

2.32.4 (2025-06-10)

Security

• CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file. (#6965)

Improvements

• Numerous documentation improvements

Deprecations

• Added support for pypy 3.11 for Linux and macOS. (#6926)
• Dropped support for pypy 3.9 following its end of support. (#6926)

Changelog

Sourced from requests's changelog.

2.32.5 (2025-08-18)

Bugfixes

• The SSLContext caching feature originally introduced in 2.32.0 has created a new class of issues in Requests that have had negative impact across a number of use cases. The Requests team has decided to revert this feature as long term maintenance of it is proving to be unsustainable in its current iteration.

Deprecations

• Added support for Python 3.14.
• Dropped support for Python 3.8 following its end of support.

2.32.4 (2025-06-10)

Security

• CVE-2024-47081 Fixed an issue where a maliciously crafted URL and trusted environment will retrieve credentials for the wrong hostname/machine from a netrc file.

Improvements

• Numerous documentation improvements

Deprecations

• Added support for pypy 3.11 for Linux and macOS.
• Dropped support for pypy 3.9 following its end of support.

Commits

• b25c87d v2.32.5
• 131e506 Merge pull request #7010 from psf/dependabot/github_actions/actions/checkout-...
• b336cb2 Bump actions/checkout from 4.2.0 to 5.0.0
• 46e939b Update publish workflow to use artifact-id instead of name
• 4b9c546 Merge pull request #6999 from psf/dependabot/github_actions/step-security/har...
• 7618dbe Bump step-security/harden-runner from 2.12.0 to 2.13.0
• 2edca11 Add support for Python 3.14 and drop support for Python 3.8 (#6993)
• fec96cd Update Makefile rules (#6996)
• d58d8aa docs: clarify timeout parameter uses seconds in Session.request (#6994)
• 91a3eab Bump github/codeql-action from 3.28.5 to 3.29.0
• Additional commits viewable in compare view

Updates pyyaml from 6.0.1 to 6.0.3

Release notes

Sourced from pyyaml's releases.

6.0.3

What's Changed

• Support for Python 3.14 and free-threading (experimental).

Full Changelog: yaml/pyyaml@6.0.2...6.0.3

6.0.2

What's Changed

• Support for Cython 3.x and Python 3.13.

Full Changelog: yaml/pyyaml@6.0.1...6.0.2

6.0.2rc1

• Support for extension build with Cython 3.x
• Support for Python 3.13
• Added PyPI wheels for musllinux on aarch64

Changelog

Sourced from pyyaml's changelog.

6.0.3 (2025-09-25)

• yaml/pyyaml#864 -- Support for Python 3.14 and free-threading (experimental)

6.0.2 (2024-08-06)

• yaml/pyyaml#808 -- Support for Cython 3.x and Python 3.13

Commits

• 49790e7 Release 6.0.3 (#889)
• 41309b0 Release 6.0.2 (#819)
• dd9f0e1 6.0.2rc1 (#809)
• f5527a2 disable CI trigger on PR edits
• b4d80a7 Python 3.12 + musllinux_1_1_x86_64 wheel support
• See full diff in compare view

Updates urllib3 from 2.2.2 to 2.3.0

Release notes

Sourced from urllib3's releases.

2.3.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Features

• Added HTTPResponse.shutdown() to stop any ongoing or future reads for a specific response. It calls shutdown(SHUT_RD) on the underlying socket. This feature was sponsored by LaunchDarkly. (urllib3/urllib3#2868)
• Added support for JavaScript Promise Integration on Emscripten. This enables more efficient WebAssembly requests and streaming, and makes it possible to use in Node.js if you launch it as node --experimental-wasm-stack-switching. (urllib3/urllib3#3400)
• Added the proxy_is_tunneling property to HTTPConnection and HTTPSConnection. (urllib3/urllib3#3285)
• Added pickling support to NewConnectionError and NameResolutionError. (urllib3/urllib3#3480)

Bugfixes

• Fixed an issue in debug logs where the HTTP version was rendering as "HTTP/11" instead of "HTTP/1.1". (urllib3/urllib3#3489)

Deprecations and Removals

• Removed support for Python 3.8. (urllib3/urllib3#3492)

Full Changelog: urllib3/urllib3@2.2.3...2.3.0

2.2.3

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support for 2023. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Features

• Added support for Python 3.13. (#3473)

Bugfixes

• Fixed the default encoding of chunked request bodies to be UTF-8 instead of ISO-8859-1. All other methods of supplying a request body already use UTF-8 starting in urllib3 v2.0. (#3053)
• Fixed ResourceWarning on CONNECT with Python < 3.11.4 by backporting python/cpython#103472. (`#3252)
• Adjust tolerance for floating-point comparison on Windows to avoid flakiness in CI (#3413)
• Fixed a crash where certain standard library hash functions were absent in restricted environments. (#3432)
• Fixed mypy error when adding to HTTPConnection.default_socket_options. (#3448)

HTTP/2 (experimental)

HTTP/2 support is still in early development.

• Excluded Transfer-Encoding: chunked from HTTP/2 request body (#3425)
• Added version checking for h2 (https://pypi.org/project/h2/) usage. Now only accepting supported h2 major version 4.x.x. (#3290)
• Added a probing mechanism for determining whether a given target origin supports HTTP/2 via ALPN. (#3301)

... (truncated)

Changelog

Sourced from urllib3's changelog.

2.3.0 (2024-12-22)

Features

• Added HTTPResponse.shutdown() to stop any ongoing or future reads for a specific response. It calls shutdown(SHUT_RD) on the underlying socket. This feature was sponsored by LaunchDarkly <https://opencollective.com/urllib3/contributions/815307>. ([#2868](https://github.com/urllib3/urllib3/issues/2868) <https://github.com/urllib3/urllib3/issues/2868>)
• Added support for JavaScript Promise Integration on Emscripten. This enables more efficient WebAssembly requests and streaming, and makes it possible to use in Node.js if you launch it as node --experimental-wasm-stack-switching. ([#3400](https://github.com/urllib3/urllib3/issues/3400) <https://github.com/urllib3/urllib3/issues/3400>__)
• Added the proxy_is_tunneling property to HTTPConnection and HTTPSConnection. ([#3285](https://github.com/urllib3/urllib3/issues/3285) <https://github.com/urllib3/urllib3/issues/3285>__)
• Added pickling support to NewConnectionError and NameResolutionError. ([#3480](https://github.com/urllib3/urllib3/issues/3480) <https://github.com/urllib3/urllib3/issues/3480>__)

Bugfixes

• Fixed an issue in debug logs where the HTTP version was rendering as "HTTP/11" instead of "HTTP/1.1". ([#3489](https://github.com/urllib3/urllib3/issues/3489) <https://github.com/urllib3/urllib3/issues/3489>__)

Deprecations and Removals

• Removed support for Python 3.8. ([#3492](https://github.com/urllib3/urllib3/issues/3492) <https://github.com/urllib3/urllib3/issues/3492>__)

2.2.3 (2024-09-12)

Features

• Added support for Python 3.13. ([#3473](https://github.com/urllib3/urllib3/issues/3473) <https://github.com/urllib3/urllib3/issues/3473>__)

Bugfixes

• Fixed the default encoding of chunked request bodies to be UTF-8 instead of ISO-8859-1. All other methods of supplying a request body already use UTF-8 starting in urllib3 v2.0. ([#3053](https://github.com/urllib3/urllib3/issues/3053) <https://github.com/urllib3/urllib3/issues/3053>__)
• Fixed ResourceWarning on CONNECT with Python < 3.11.4 by backporting python/cpython#103472. ([#3252](https://github.com/urllib3/urllib3/issues/3252) <https://github.com/urllib3/urllib3/issues/3252>__)
• Adjust tolerance for floating-point comparison on Windows to avoid flakiness in CI ([#3413](https://github.com/urllib3/urllib3/issues/3413) <https://github.com/urllib3/urllib3/issues/3413>__)
• Fixed a crash where certain standard library hash functions were absent in restricted environments. ([#3432](https://github.com/urllib3/urllib3/issues/3432) <https://github.com/urllib3/urllib3/issues/3432>__)
• Fixed mypy error when adding to HTTPConnection.default_socket_options. ([#3448](https://github.com/urllib3/urllib3/issues/3448) <https://github.com/urllib3/urllib3/issues/3448>__)

HTTP/2 (experimental)

HTTP/2 support is still in early development.

• Excluded Transfer-Encoding: chunked from HTTP/2 request body ([#3425](https://github.com/urllib3/urllib3/issues/3425) <https://github.com/urllib3/urllib3/issues/3425>__)
• Added version checking for h2 (https://pypi.org/project/h2/) usage.

... (truncated)

Commits

• 2f68c53 Release 2.3.0
• f7bcf69 Add HTTPResponse.shutdown() to stop blocking reads (#3527)
• e942249 Update .readthedocs.yml addressing a deprecation (#3534)
• 905549d Upgrade Python pre-commit tools (#3529)
• 716d834 Fix PyPI publish with Core metadata 2.4 (#3531)
• 7ab935c Address zizmor issues
• 181357e Bump Quart to fix CI (#3524)
• 0e7e0df Start testing with Python 3.14
• d67d09b Bump mypy version
• 20032ec Drop unneeded dependency pins and a warning filter
• Additional commits viewable in compare view

Updates sentry-sdk from 2.5.1 to 2.39.0

Release notes

Sourced from sentry-sdk's releases.

2.39.0

Various fixes & improvements

• Fix(AI): Make agents integrations set the span status in case of error (#4820) by @​antonpirker
• Fix(dedupe): Use weakref in dedupe where possible (

[dependabot]

Superseded by #2047.