[pyup-bot]

Update Sphinx from 9.1.0 to 9.2.0.

Changelog

9.2.0

=====================================

Dependencies
------------

* 14762: Drop Python 3.12 support.
Patch by Adam Turner.
* 14767: Support `Docutils 0.23`_. Patch by Adam Turner.

.. _Docutils 0.23: https://docutils.sourceforge.io/RELEASE-NOTES.html#release-0-23-2026-05-27

9.1.1

=====================================

Bugs fixed
----------

* 14465: LaTeX: PDF build crash since LaTeX June 2026 release if tables are
styled with ``'colorrows'`` (which is the default).
Patch by Jean-François B.
* 14229: Fix JavaScript search for languages whose stemmer class name
does not match the language name, such as Chinese (which reuses the
English stemmer) and Dutch (which uses the Dutch Porter stemmer).
Patch by Hugo van Kemenade
* Fixed support for Python 3.16 alpha 0 (changes in the ``enum`` module).
Patch by Adam Turner

Links

• PyPI: https://pypi.org/project/sphinx
• Changelog: https://data.safetycli.com/changelogs/sphinx/

Update pip from 26.2.1 to 26.2.2.

Changelog

26.2.2

===================

Vendored Libraries
------------------

- Upgrade certifi to 2026.10.19

Links

• PyPI: https://pypi.org/project/pip
• Changelog: https://data.safetycli.com/changelogs/pip/

Update setuptools from 84.0.0 to 84.2.1.

Changelog

84.2.1

=======

Bugfixes
--------

- Changed wheel tags and stable-ABI validation to use sysconfig data. (5360)
- Fixed unimportable extensions on free-threaded Python 3.13 and 3.14 when
``Extension.py_limited_api`` is enabled. These builds now use their
version-specific extension suffix instead of using the unsupported ``.abi3t``
suffix. (5363)


Improved Documentation
----------------------

- Replaced broken link to Python Eggs documentation with an archived version from the Wayback Machine. (1929)

84.2.0

=======

Features
--------

- Added support for building abi3t extensions and abi3.abi3t wheels on Python
3.15 and newer. See :pep:`803` and the `Python 3.15 "What's New" entry
<https://docs.python.org/3.15/whatsnew/3.15.html#pep-803-abi3t-stable-abi-for-free-threaded-builds>`_
for more details. (5193)
- Updated vendored packaging version to 26.3, which adds support for the
``abi3t`` tag from :pep:`803`. (5361)


Bugfixes
--------

- Use target sysconfig data for stable-ABI extension filenames. (5351)

84.1.0

=======

Features
--------

- ``setuptools.archive_util`` now raises the new ``UnsafeMember`` exception when
an archive member would be extracted outside of the extraction directory,
where previously such a member was silently skipped. Aborting makes a
malicious or malformed archive visible to the caller instead of yielding a
quietly incomplete extraction, and matches the behavior of the standard
library's ``tarfile`` extraction filters.


Bugfixes
--------

- ``Wheel.install_as_egg`` no longer creates namespace package directories
outside of the destination egg directory. Entries in a wheel's
``namespace_packages.txt`` were split on ``.`` and passed straight to
``os.path.join``, so an entry that was absolute, drive-qualified, or UNC
discarded the destination and placed an ``__init__.py`` at a path chosen by
the wheel. Namespace entries are now validated as dotted module names on
every platform -- see GHSA-xmj3-9gf7-h52w.

This code path is reached only by the deprecated ``setup_requires``
mechanism when ``setup()`` is invoked outside a PEP 517 frontend; the
setuptools build backend never reaches it.
- ``setuptools.archive_util`` no longer extracts archive members outside of the
requested extraction directory. Both the tar and zip formats specify ``/`` as
the only path separator, but the guard against ``..`` components split member
names on ``/`` alone, so a name such as ``..\escaped.txt`` was treated as a
single component and then resolved as a traversal by the filesystem on
Windows. Member names containing a backslash, a drive letter, or a UNC prefix
are now rejected on every platform, as are members whose resolved destination
falls outside the extraction directory -- see GHSA-grgh-hr87-3jpw.

Links

• PyPI: https://pypi.org/project/setuptools
• Changelog: https://data.safetycli.com/changelogs/setuptools/

Update certifi from 2026.7.22 to 2026.10.23.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/certifi
• Repo: https://github.com/certifi/python-certifi

Update chardet from 7.6.0 to 7.7.0.

Changelog

7.7.0

------------------

**Features:**

- Added a ``-m``/``--mime-type`` flag to the ``chardetect`` CLI, which
shows the detected MIME type next to the encoding, like ``file -i``.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude,
`384 <https://github.com/chardet/chardet/issues/384>`_)

**Accuracy:**

- Visual-order Hebrew is now detected.  The ISO-8859-8 model trains on
both bidi conventions, so 1990s visual-order pages come back as
ISO-8859-8 while logical-order text still prefers Windows-1255.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- cp864 Arabic now trains on contextually shaped text in visual order,
the way real cp864 systems stored it, instead of isolated letter
forms in logical order.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)

**Performance:**

- Raising ``max_bytes`` on large inputs no longer gets slow.  On the
compiled build, ``detect(data, max_bytes=len(data))`` on 272 MiB takes
about 0.23s for cp1252 and 0.56s for Shift_JIS, down from several
seconds.  UTF-8 validation and a final decode of the winner still read
the whole window, so the answer still decodes it.  The other stages
stop at a 256 KB evidence cap, which sits above the default
``max_bytes``, so default calls are unchanged, and the default 200 KB
cap is still the fastest path.  ADR-0006 has the design.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- The UTF-7 ``+`` scan is no longer quadratic on line-wrapped base64
like PEM certificates, MIME attachments, and JWTs.  128 KiB of it went
from 5.4 seconds to 1.2 milliseconds.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- A head full of unclosed ``<meta`` or ``<?xml`` tags no longer makes the
markup scan quadratic, taking it from about 5 ms to about 20 µs.  A
literal ``<`` inside an attribute value now hides that one tag.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- An EBCDIC ``charset=`` or ``encoding=`` followed by whitespace and no
value no longer makes the declaration scan backtrack quadratically.
A crafted 4 KB document used to cost ``detect()`` about 60 ms.
(`Samina <https://github.com/Samin061>`_,
`403 <https://github.com/chardet/chardet/pull/403>`_)
- The pure-Python install on CPython scores bigram models with
``operator.itemgetter`` instead of a Python loop, making ``detect()``
about 1.25x faster and ``detect_all()`` about 1.35x faster across the
test corpus.  Compiled builds and PyPy keep their existing paths.
(`Afonso Ribeiro <https://github.com/deadstrobe5>`_)

**Bug Fixes:**

- Language labels on Unicode text no longer tilt toward accent-heavy
languages, so a French paragraph with a few accents stops coming back
as Hungarian.  Models and input are now scored in the same
IDF-weighted space.  Mislabels on the corpus's Unicode files fall from
140 to 104 of 1587 (French from 20 to 4), and encodings, confidences,
and MIME types do not move.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Null-separated ASCII records with short fields, like ``find -print0``
output, no longer come back as UTF-16-LE at 0.95 with Chinese as the
language.  They get the answer longer records already got: binary, or
ASCII when the nulls are sparse.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Every answer now decodes the examined window under the name the
caller receives.  A BOM, a BOM-less UTF-16/32 null pattern, an ISO-2022
or HZ escape designation, or a ``<meta charset>``/``<?xml encoding>``
declaration was trusted without decoding the rest of the window, so a
confident answer could raise further in.  Each now has to decode the
whole window, and the 5.x/6.x display names ``EUC-JP``, ``SHIFT_JIS``,
``Big5``, and ``ISO-2022-JP`` are used only when those narrower codecs
decode it too.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude;
`Samina <https://github.com/Samin061>`_,
`394 <https://github.com/chardet/chardet/pull/394>`_,
`396 <https://github.com/chardet/chardet/pull/396>`_)
- A ``charset=`` inside another attribute, like a refresh URL, no longer
beats a real ``<meta charset>``, and a declaration naming an unknown
encoding no longer hides a later one that works.  A repeated attribute
now keeps its first value, and a ``<meta`` tag that never closes is
ignored.
(`Sash <https://github.com/SashaMIT>`_,
`389 <https://github.com/chardet/chardet/pull/389>`_)
- The ``charset`` parameter of a ``content`` attribute may now be quoted
or have spaces around its ``=``.
(`Huanyi Xie <https://github.com/xiehuanyi>`_,
`398 <https://github.com/chardet/chardet/pull/398>`_)
- Markup declarations are read the way the WHATWG prescan reads them.
Declarations inside ``<!-- -->`` comments are ignored, ``x-user-defined``
means Windows-1252, and a UTF-16 or UTF-32 label in ASCII markup means
UTF-8, so an ASCII page declaring ``utf-16le`` no longer comes back as
UTF-16-LE at 0.95.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- PEP 263 cookies are resolved the way ``tokenize.detect_encoding``
resolves them, so ``iso-latin-1`` and similar spellings now work,
``utf-8-sig`` means UTF-8, and a long first line no longer hides a
cookie on line 2.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- A PEP 263 cookie on line 2 counts only when line 1 is blank or a
comment, as in Python, so a ``coding=`` comment after a line of code
is ignored.
(`Huanyi Xie <https://github.com/xiehuanyi>`_,
`391 <https://github.com/chardet/chardet/pull/391>`_)
- An EBCDIC ``<?xml encoding="...">`` declaration now reports
``text/xml`` instead of ``text/html``, which fixes the MIME type for
ten EBCDIC RSS feeds in the test corpus.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- ``detect_all(prefer_superset=True)`` no longer lists the same name
twice.  Greek text came back as ``Windows-1253`` at two confidences;
each name now appears once, at its higher confidence.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- ``prefer_superset=True`` no longer swaps in a Windows code page that
cannot decode the data, like Windows-1252 for ISO-8859-1 text holding
0x81.  ``apply_preferred_superset`` takes an optional ``data``
argument for the check.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- ``prefer_superset=True`` now respects ``include_encodings`` and
``exclude_encodings``, keeping the detected name when the filters rule
out its superset.
(`00200200 <https://github.com/00200200>`_,
`393 <https://github.com/chardet/chardet/pull/393>`_)
- ``chardetect`` now reads one byte past its 200 KB cap, so a multi-byte
sequence cut at the cap is treated as truncated input instead of the
end of the file.
(`00200200 <https://github.com/00200200>`_,
`392 <https://github.com/chardet/chardet/pull/392>`_)
- ``lookup_encoding``'s cache is now capped at 1024 entries.  Charset
names come from untrusted markup, so a stream of distinct spellings
could grow it without limit.
(`Samina <https://github.com/Samin061>`_,
`390 <https://github.com/chardet/chardet/pull/390>`_)
- ``UniversalDetector`` no longer treats a buffer filled to exactly
``max_bytes`` as the whole stream, which could turn a correct
``utf-8`` answer into a single-byte codec when a multi-byte sequence
was cut at the boundary.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- A UTF-32 file with a BOM no longer comes back as UTF-16, or as
``utf-32-be`` with the BOM left in, when ``max_bytes`` ends the window
partway through a code unit.  The default cap is a multiple of four,
so only custom caps hit this.
(`Aryan R. Ganjoo <https://github.com/AryanRG>`_,
`405 <https://github.com/chardet/chardet/pull/405>`_)
- ``detect_all()`` no longer puts a demoted niche Latin encoding back
near the top.  The demoted entry now takes the confidence of the
candidate it sits behind, so the ranking is ordered by confidence as
documented.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Language detection now honors ``max_bytes`` instead of always reading
up to 2 KB.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- The deprecated ``chardet.equivalences`` shim is reachable again after a
bare ``import chardet``, resolves every name the old module had, and
passes patches through to the module that owns each name, so
``mock.patch.object`` on it restores cleanly.  It warns when a name is
used rather than at import, so importing it no longer fails under
``-W error::DeprecationWarning``.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- A mostly-ASCII Windows-1252 file with a single ``Ö`` or ``ö`` no
longer detects as HP-Roman8.  The niche Latin demotion now compares
the candidate and its replacement on the bytes they read differently,
so one Welsh ``ŵ`` still keeps ISO-8859-14 and a Kven ``đ`` in Finnish
still keeps ISO-8859-10.  Some corpus files that came back as
ISO-8859-1 now come back as Windows-1252, an accepted superset.
(`António Afonso <https://github.com/aadsm>`_ via Claude,
`383 <https://github.com/chardet/chardet/pull/383>`_)
- An English file whose only non-ASCII letter is a capital ``É``,
``À``, or ``Ó`` no longer detects as MacRoman, which reads those
bytes as the ellipsis and curly quotes.  The era-prevalence prior now
compares the two readings on the bytes they disagree on instead of
standing down.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude,
`383 <https://github.com/chardet/chardet/pull/383>`_)

**Deprecations:**

- ``EncodingInfo.is_multibyte`` is now ``is_multibyte_cjk``, since the
flag marks CJK byte structure rather than width and is off for UTF-8,
UTF-16 and UTF-32.  The old attribute still works with a
``DeprecationWarning`` and will be removed in 8.0.  ``EncodingInfo``
is internal and never reaches ``detect()`` callers.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)

**Documentation:**

- The supported encodings table no longer lists UTF-8, UTF-16, UTF-32
and UTF-7 as single-byte.  The multi-byte column used to copy the
registry flag that marks CJK byte structure for the structural stage,
which is off for the Unicode encodings on purpose.  The generator now
asks each codec whether any character takes more than one byte.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)

**Build:**

- ``pipeline/markup.py`` is now compiled by mypyc (15 modules), so the
markup superset promotion that moved there no longer runs interpreted
in compiled wheels.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- Test coverage is back to 100%, and CI now enforces it.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- The ``models.bin``, ``rowmax.bin``, ``idf.bin``, and ``langnorm.bin``
formats now have one owner, ``chardet.models._format``, shared by the
trainer and the runtime loader.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)
- ``scripts/verify_no_overlap.py --require-provenance`` fails unless the
training metadata records an exclusion set matching the current test
data.  The shipped models record none until the next full retrain.
(`Dan Blanchard <https://github.com/dan-blanchard>`_ via Claude)

Links

• PyPI: https://pypi.org/project/chardet
• Changelog: https://data.safetycli.com/changelogs/chardet/

Update numpy from 2.5.3 to 2.5.4.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/numpy
• Changelog: https://data.safetycli.com/changelogs/numpy/

Update pandas from 3.0.6 to 3.1.0.

The bot wasn't able to find a changelog for this release. Got an idea?

Links

• PyPI: https://pypi.org/project/pandas

Update python-dateutil from 2.9.0.post0 to 3.0.0.

Changelog

3.0.0

==========================

**This is the last major version of** ``dateutil`` **that will support any
version of Python older than 3.11.** The next release will be the 4.x series,
which will support Python 3.11 and later. We may release fixes for serious bugs
in the 3.0.x series, but there are no plans for new features there.

The biggest change in this release is a rewrite of ``tz.tzfile``, which affects
nearly every user of ``dateutil.tz`` and changes the UTC offset of
nonexistent times (see below). ``dateutil`` also now depends on the ``tzdata``
package, and no longer ships its own time zone database.


Data updates
------------

- ``dateutil`` no longer bundles a copy of the IANA time zone database. Time
zone data now comes from the system (see ``dateutil.tz.TZPATH``) or, failing
that, from the new ``tzdata`` dependency, so the data version is whatever
version of ``tzdata`` is installed. (gh pr 1130)


Features
--------

- Rewrote ``tz.tzfile`` based on a backport of the ``zoneinfo`` module's pure-Python
implementation. This adds support for Version 2 and Version 3 ``tzfile(5)`` binaries,
resolving issues with timestamps beyond 2038 and "slim" format binaries. (gh issues 462, 1059, gh pr 1130)
- Added ``dateutil.tz.TZPATH`` and ``dateutil.tz.reset_tzpath`` to allow for
runtime configuration of the IANA time zone data search path. These replace the
mutable ``dateutil.tz.TZPATHS`` list, which has been removed. (gh pr 1130)
- ``dateutil`` now depends on the ``tzdata`` package, which ``gettz`` consults after the search
path and before the Windows registry. On Windows this means that names that are
both IANA keys and Windows time zone names, such as ``"UTC"``, now return a
``tzfile`` rather than a ``tzwin``. (gh pr 1130)


Bugfixes
--------

- ``tz.tzfile`` now follows PEP 495 for times that fall in a gap: with ``fold=0``
it uses the offset from before the transition, and with ``fold=1`` the offset
from after it. Previously it always used the offset from after the transition,
so for example ``datetime(2003, 4, 6, 2, 30, tzinfo=tz.gettz("America/New_York"))``
had a UTC offset of -04:00, where it now has -05:00, the same as with
``zoneinfo``. (gh pr 1130)
- ``tz.tzfile`` objects for fixed-offset zones, such as ``tz.gettz("UTC")``, now
return their offset, DST offset and abbreviation when ``utcoffset``, ``dst``
and ``tzname`` are called with ``None``, as ``tz.tzutc``, ``tz.tzoffset`` and
``zoneinfo.ZoneInfo`` do. This means that ``datetime.time`` objects with such
a zone attached are now aware: ``time(12, tzinfo=tz.gettz("UTC")).isoformat()``
is now ``"12:00:00+00:00"`` rather than ``"12:00:00"``. (gh pr 1130)
- ``tz.tzfile`` now infers ``dst()`` from the standard time on both sides of
each DST period, rather than only the one before it, and does so for each
transition rather than for each local time type. This fixes ``dst()`` for
double summer time (e.g. in ``Europe/London`` in the 1940s), for half-hour DST
(e.g. in ``Pacific/Rarotonga``) and where the standard offset changed at the
same time as a DST transition (e.g. in ``America/Bahia_Banderas`` in 2010).
Against the standard offsets in the tz database source, the only remaining
errors are in ``Europe/Paris`` in 1944 and 1945. (gh pr 1130)
- Fixed ``rrulestr`` raising ``ValueError`` on experimental ``X-`` parameters in
an ``RRULE`` line (such as GNOME Evolution's ``X-EVOLUTION-ENDDATE``); these are
now ignored as RFC 5545 permits. Fixed by yajo (gh pr 1374)
- Enabled pickling and deepcopy of cached ``rrule`` and ``rruleset`` instances.
The cache setting is preserved, and cached results are regenerated on demand
without copying locks or generators. Reported by niccokunzmann (gh issue 1369).
Fixed by Jay1023CN (gh pr 1600).
- Fixed ``relativedelta.__ne__`` raising ``TypeError`` when comparing against an
unsupported type such as ``None``; it now returns ``True``. Reported and fixed
by kevinkt1 (gh issue 1157, gh pr 1158)
- Raised the minimum version of ``six`` to 1.6, fixing ``No module named
'six.moves'`` errors with older versions. Reported by skytreader (gh issue 1415),
fixed by jdarias3 (gh pr 1424).


Deprecations
------------

- Deprecated the ``dateutil.zoneinfo`` module. The module now acts as a wrapper
around the ``tzdata`` package and will be removed in a future version. Users are
encouraged to migrate to ``dateutil.tz.gettz`` or the standard library's
``zoneinfo`` module. ``dateutil.zoneinfo.rebuild.rebuild`` no longer does
anything, and by default raises ``RebuildDeprecationWarning`` as an error;
filter the warning to call it as a no-op. (gh pr 1130)
- Deprecated passing ``gettz`` a relative key that refers to a file outside of
every directory on ``TZPATH``, such as ``"../../etc/localtime"``. By default
this now raises ``dateutil.tz.DeprecatedTzKeyWarning`` as an error; filter the
warning to keep the old behavior for now, or pass an absolute path instead.
(gh pr 1130)


Documentation changes
---------------------

- Added intersphinx to the docs build and cleaned up some broken links. (gh pr 1463)


Misc
----

- Releases are now uploaded to PyPI using trusted publishing, and the built
sdist and wheel are tested on all supported platforms before upload.
(gh pr 1619, 1622)
- Changes to CI, tests and release tooling that do not affect users of the
package: gh pr 1417, 1462, 1464, 1465, 1466, 1467, 1468, 1469, 1470,
1499, 1501, 1504, 1576, 1577, 1578, 1581, 1585.

Links

• PyPI: https://pypi.org/project/python-dateutil
• Changelog: https://data.safetycli.com/changelogs/python-dateutil/
• Repo: https://github.com/dateutil/dateutil