Bump the uv group across 1 directory with 10 updates by dependabot[bot] · Pull Request #127 · QCLovers/PyTDSCF

dependabot · 2026-08-31T12:57:16Z

Bumps the uv group with 10 updates in the / directory:

Package	From	To
jupyterlab	`4.5.7`	`4.5.10`
bleach	`6.3.0`	`6.4.0`
idna	`3.11`	`3.15`
jupyter-server	`2.17.0`	`2.20.0`
mistune	`3.2.0`	`3.3.0`
pillow	`12.2.0`	`12.3.0`
setuptools	`82.0.1`	`83.0.0`
soupsieve	`2.8.3`	`2.8.4`
tornado	`6.5.5`	`6.5.7`
urllib3	`2.6.3`	`2.7.0`

Updates jupyterlab from 4.5.7 to 4.5.10

Release notes

Sourced from jupyterlab's releases.

v4.5.10

4.5.10

(Full Changelog)

Security patches

GHSA-gx64-gj6p-pc4c

GHSA-89vp-jrxv-24w8

GHSA-h5v5-8746-g7mm

GHSA-pppj-hq3g-57pj

GHSA-whvh-wf3x-g77j

Bugs fixed

Backport of security patches to 4.5.x branch #19186 (@krassowski, @MUFFANUJ)

Maintenance and upkeep improvements

Reconfigure 4.5.x branch (4.6.x is new stable) #19060 (@krassowski)

Split external link checks and only run if diff includes a URL #19029 (@MUFFANUJ)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@krassowski (activity) | @MUFFANUJ (activity)

v4.5.9

4.5.9

(Full Changelog)

Bugs fixed

Fix jupyter labextension build crash on webpack ≥ 5.107 #19021 (@Darshan808, @krassowski)

Backport PR #18992: Fix hidden cells after moving collapsed headings #19016 (@MUFFANUJ, @krassowski)

Forbid relative URLs in extensionmanager #19013 (@Yann-P)

Fix XSS in extension manager's homepage_url #19003 (@Yann-P)

Fix toolbar popup row clipping in Safari #18998 (@arun-357)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review.

... (truncated)

Commits

af5f5b3 [ci skip] Publish 4.5.10
be9303f Backport of security patches to 4.5.x branch (#19186)
a555fe1 Reconfigure 4.5.x branch (4.6.x is new stable) (#19060)
8d8cb6d Backport PR #19029 on branch 4.5.x (Split external link checks and only run i...
dd65403 [ci skip] Publish 4.5.9
2693672 Backport PR #18992: Fix hidden cells after moving collapsed headings (#19016)
360c176 Backport PR #18998 on branch 4.5.x (Fix toolbar popup row clipping in Safari)...
e9db010 Fix jupyter labextension build crash on webpack ≥ 5.107 (#19021)
3b8428c Backport PR #19013 on branch 4.5.x (Forbid relative URLs in extensionmanager)...
3c84a84 Backport PR #19003 on branch 4.5.x (Fix XSS in extension manager's `homepage_...
Additional commits viewable in compare view

Updates bleach from 6.3.0 to 6.4.0

Changelog

Sourced from bleach's changelog.

Version 6.4.0 (June 5th, 2026)

NOTE: 2026-06-05: Bleach is no longer maintained. There will be no future releases including for security issues. See issue: <https://github.com/mozilla/bleach/issues/698>__

Backwards incompatible changes

Dropped support for pypy 3.10. (#764)

Security fixes

Fix bug 2023812 / GHSA-8rfp-98v4-mmr6.

Fix XSS issue with sanitize_uri_value where disallowed schemes with Unicode invisible characters wouldn't be rejected.

For example::

import bleach payload1 = 'Click' result1 = bleach.clean(payload1) print(repr(result1))

outputs::

'Click'

See the advisory for details.

Fix GHSA-gj48-438w-jh9v.

Fix issue where URI sanitization wasn't happening in formaction attributes.

See the advisory for details.

Bug fixes

Add support for pypy 3.11. (#764)

Drop version max in tinycss2 pin. (#772)

This removes one of the things we had to keep checking and updating. Users now own the responsibility for correctness with the version of tinycss2 they're using.

Commits

f0355a7 fix: fix last release date in CHANGES
ae4e8a2 chore: bleach 6.4.0 and final release
970df58 fix: uri-sanitization in formaction attributes
7c4867c fix: xss bypass in allowed protocol test using unicode invisible characters
913ab75 fix: reduce redundancy in workflow jobs
218c15a fix: rework pip caching
4f0b097 fix: fix tox platform restrictions
e95a79d chore: update pytest
91539d4 Bump actions/cache from 5.0.3 to 5.0.4
cd47b4c fix: handle left-angle-bracket that's not a tag (#733)
Additional commits viewable in compare view

Updates idna from 3.11 to 3.15

Changelog

Sourced from idna's changelog.

3.15 (2026-05-12)

Enforce DNS-length cap on individual labels early in check_label, short-circuiting contextual-rule processing for oversized input while staying compatible with UTS 46 usage.

Tidy core helpers: hoist bidi category sets to module-level frozensets (avoiding per-codepoint list construction), simplify length checks, and reuse the shared _unicode_dots_re from idna.core in the codec module.

Use raise ... from err for proper exception chaining and switch internal string formatting to f-strings.

Allow flit_core 4.x in the build backend.

Expand the ruff lint set (flake8-bugbear, flake8-simplify, pyupgrade, perflint) and apply the surfaced fixes; pin lint CI to Python 3.14.

Add Dependabot configuration for GitHub Actions.

Convert README and HISTORY from reStructuredText to Markdown.

Reference CVE-2026-45409 for the 3.14 advisory in place of the initial GHSA identifier.

Thanks to Felix Yan, Stan Ulbrych, and metsw24-max for contributions to this release.

3.14 (2026-05-10)

Removed opportunity to process long inputs into quadratic time by rejecting oversize inputs up-front. Closes a bypass of the CVE-2024-3651 mitigation. [CVE-2026-45409]

Thanks to Stan Ulbrych for reporting the issue.

3.13 (2026-04-22)

Correct classification error for codepoint U+A7F1

3.12 (2026-04-21)

Update to Unicode 17.0.0.

Issue a deprecation warning for the transitional argument.

Added lazy-loading to provide some performance improvements.

Removed vestiges of code related to Python 2 support, including segmentation of data structures specific to Jython.

Thanks to Rodrigo Nogueira for contributions to this release.

Commits

af30a09 Release 3.15
30314d4 Pre-release 3.15rc0
05d4b21 Merge pull request #237 from kjd/convert-docs-to-markdown
2987fdb Convert README and HISTORY from reStructuredText to Markdown
59fa800 Merge pull request #236 from kjd/dependabot/github_actions/actions-f3e34333ea
def6983 Merge branch 'master' into dependabot/github_actions/actions-f3e34333ea
bbd8004 Merge pull request #234 from StanFromIreland/patch-1
edd07c0 Bump github/codeql-action from 3.35.2 to 4.35.2 in the actions group
5557db0 Merge branch 'master' into patch-1
f11746c Merge pull request #235 from StanFromIreland/patch-2
Additional commits viewable in compare view

Updates jupyter-server from 2.17.0 to 2.20.0

Release notes

Sourced from jupyter-server's releases.

v2.20.0

2.20.0

(Full Changelog)

Security fixes

CVE-2026-44727 GHSA-fcw5-x6j4-ccmp

Enhancements made

Fix confusing terminal output when using ServerApp.ip=0.0.0.0 #1643 (@Yann-P, @minrk)

Add a toggle to enable curve encryption for all kernels that support it #1638 (@krassowski, @Carreau, @ianthomas23, @minrk)

Bugs fixed

Grab the port from bind_sockets in case its different #1651 (@choldgraf, @krassowski)

Maintenance and upkeep improvements

Fix test_authorizer having a spurious comma in params #1664 (@krassowski)

Add a reminder to merge GHSA before release #1659 (@Yann-P, @Carreau)

Exclude problematic pywinpty 3.0.4 version #1658 (@krassowski)

ci: explicitly pass base-setup inputs to fix strict validation failures #1626 (@Carreau, @Copilot)

Documentation improvements

Align docs for curve encryption with latest JEP version #1660 (@krassowski, @Carreau)

Remove PGP key from docs #1653 (@Yann-P, @krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@Carreau (activity) | @choldgraf (activity) | @Copilot (activity) | @ianthomas23 (activity) | @krassowski (activity) | @minrk (activity) | @Yann-P (activity)

v2.19.0

2.19.0

(Full Changelog)

Enhancements made

... (truncated)

Changelog

Sourced from jupyter-server's changelog.

2.20.0

(Full Changelog)

Enhancements made

Fix confusing terminal output when using ServerApp.ip=0.0.0.0 #1643 (@Yann-P, @minrk)

Add a toggle to enable curve encryption for all kernels that support it #1638 (@krassowski, @Carreau, @ianthomas23, @minrk)

Bugs fixed

Grab the port from bind_sockets in case its different #1651 (@choldgraf, @krassowski)

Maintenance and upkeep improvements

Fix test_authorizer having a spurious comma in params #1664 (@krassowski)

Add a reminder to merge GHSA before release #1659 (@Yann-P, @Carreau)

Exclude problematic pywinpty 3.0.4 version #1658 (@krassowski)

ci: explicitly pass base-setup inputs to fix strict validation failures #1626 (@Carreau, @Copilot)

Documentation improvements

Align docs for curve encryption with latest JEP version #1660 (@krassowski, @Carreau)

Remove PGP key from docs #1653 (@Yann-P, @krassowski)

Contributors to this release

The following people contributed discussions, new ideas, code and documentation contributions, and review. See our definition of contributors.

(GitHub contributors page for this release)

@Carreau (activity) | @choldgraf (activity) | @Copilot (activity) | @ianthomas23 (activity) | @krassowski (activity) | @minrk (activity) | @Yann-P (activity)

2.19.0

(Full Changelog)

Enhancements made

Return unresolved stanza when kernel scope is unavailable for resolvePath (instead of failing with 404) #1641 (@MUFFANUJ, @Carreau, @krassowski)

Bugs fixed

Recreate notary store on failure to prevent save deadlock and data loss #1640 (@krassowski, @Carreau)

Maintenance and upkeep improvements

Restore the test skip marks with updated compatibility reason #1646 (@krassowski, @Carreau)

Drop Python 3.9 #1644 (@krassowski, @Zsailer)

... (truncated)

Commits

05a78ad Publish 2.20.0
6cbee8d Merge commit from fork
333e700 Fix test_authorizer having a spurious comma in params (#1664)
cccd543 Fix CI: explicitly pass base-setup inputs to avoid strict validation failures
cd16d71 Align docs for curve encryption with latest JEP version (#1660)
e458061 Add a toggle to enable curve encryption for all kernels that support it (#1638)
0ceeb4f Add note in RELEASE.md
b13f8a2 Markdown does not work.
e885b10 Add GHSA reminder in prep-release
0e28c90 Exclude problematic pywinpty 3.0.4 version (#1658)
Additional commits viewable in compare view

Updates mistune from 3.2.0 to 3.3.0

Release notes

Sourced from mistune's releases.

v3.3.0

   🐞 Bug Fixes

Resolve O(n^2) DoS in parse_link_text (CWE-400) - by bhanugoudm041 (b6b49)

Resolve O(n^2) DoS in parse_link_text (CWE-400)-Type handling/testing done - by bhanugoudm041 (b3af8)

block: Avoid quadratic ref link scans - by @lepture (2b04d)

cli: Add entrypoint and utf-8 output - by @lepture (2f244)

directives: Constrain include targets - by @lepture (1bef3)

formatting: Avoid quadratic marker scans - by @lepture (96d0f)

image: Validate figure width option - by @lepture (e3e51)

inline: Avoid bracket parsing DoS - by @lepture (25f25)

math: Reject currency patterns and cross-line matches in inline math - by @geopanther (566e1)

math: Support display and backtick math - by @lepture (1141e)

renderer: Render plugin list and table nodes - by @lepture (614b0)

renderer: Block encoded unsafe URL schemes - by @lepture (c7101)

toc: Avoid generated id collisions - by @lepture (c4093)

   🏎 Performance

Improve performance - by @lepture (bf95c)

    View changes on GitHub

v3.2.1

   🐞 Bug Fixes

Resolve Windows compatibility issues in file inclusion and tests - by @Yuki9814 (25471)

Escape html text - by @lepture (a3cb6)

Update link reference - by @lepture (85eb5)

Handle escaped dollar signs in inline math - by @saschabuehrle in lepture/mistune#370 (7bd57)

Escape id of toc - by @lepture (04880)

Escape id of headings - by @lepture (28556)

Remove double-encoding of image alt text - by @lawrence3699 (0d6f3)

Escape xml for math plugin - by @lepture (5fa09)

Use strict regex for image's height and width - by @lepture (8d0cb)

    View changes on GitHub

Changelog

Sourced from mistune's changelog.

Version 3.3.0

Released on Jun 21, 2026

Improve CommonMark compatibility and parser performance.

Add command line entrypoint with UTF-8 output.

Support display and backtick math.

Render plugin list and table nodes in Markdown renderer.

Escape leading block markers in Markdown renderer.

Fix RST renderer for block quotes nested in lists.

Avoid generated heading ID collisions in TOC.

Harden URL, image, figure, and include directive handling.

Fix quadratic scans in inline links, reference links, and formatting markers.

Fix math escaping, currency pattern matching, and cross-line matching.

Version 3.2.1

Released on May 3, 2026

Escape link in render_toc_ul.

Escape text in math plugin.

Fix regex for math plugin.

Escape heading's ID attribute.

Fix LINK_TITLE_RE to prevent DoS.

Escape class attribute for admonition directive.

Remove double-encoding of image alt text.

Escape class attribute for image directive.

Fix width/height attribute for image directive.

Commits

15c3b79 chore: release 3.3.0
bdc01ad tests: increase run time on pypy
7cf1814 tests: increase run time for pypy
6dfdc3d tests: add more tests
17c50f6 chore: fix mypy issues
63abe4b chore: use ruff check and format
e6c1b18 chore: resolve mypy issues
dcf8902 test(math): cover escaped math output
c4093c4 fix(toc): avoid generated id collisions
e3e51de fix(image): validate figure width option
Additional commits viewable in compare view

Updates pillow from 12.2.0 to 12.3.0

Release notes

Sourced from pillow's releases.

12.3.0

https://pillow.readthedocs.io/en/stable/releasenotes/12.3.0.html

Removals

Remove non-image ImageCms modes #9697 [@radarhere]

Documentation

Add release notes for SBOM and performance improvements #9747 [@radarhere]

Add security release notes #9741 [@radarhere]

Add release notes for Python 3.15 beta wheels #9696 [@radarhere]

ImageFont can also be used with ImageText #9597 [@radarhere]

Additional guidelines for security reports #9659 [@wiredfool]

Fixed typo #9636 [@radarhere]

Added CVEs to 12.2.0 release notes #9591 [@radarhere]

Revise development support information in README #9583 [@aclark4life]

Add INCIDENT_RESPONSE.md #9555 [@aclark4life]

Add STRIDE threat model to security docs #9562 [@aclark4life]

Add CVEs to 12.2.0 release notes #9556 [@radarhere]

Update README with revised security policy #9553 [@radarhere]

Update security policy #9552 [@aclark4life]

Update macOS tested Python versions #9534 [@radarhere]

Dependencies

Update dependency harfbuzz to v14.2.1 #9720 [@renovate[bot]]

Update dependency mypy to v2 #9653 [@renovate[bot]]

Update dependency cibuildwheel to v4 #9665 [@renovate[bot]]

Update github-actions #9655 [@renovate[bot]]

Update dependency libavif to v1.4.2 #9652 [@renovate[bot]]

Update dependency lcms2 to v2.19.1 #9651 [@renovate[bot]]

Update dependency check-jsonschema to v0.37.2 #9650 [@renovate[bot]]

Update google/oss-fuzz digest to d872252 #9614 [@renovate[bot]]

Update dependency lcms2 to v2.19 #9609 [@renovate[bot]]

Update dependency libpng to v1.6.58 - autoclosed #9608 [@renovate[bot]]

Update dependency harfbuzz to v14 #9610 [@renovate[bot]]

Update dependency mypy to v1.20.2 #9599 [@renovate[bot]]

Update github-actions #9611 [@renovate[bot]]

Update dependency cibuildwheel to v3.4.1 #9607 [@renovate[bot]]

Move dependency versions to single JSON and enable Renovate #9559 [@hugovk]

Updated raqm to 0.10.5 #9557 [@radarhere]

Update dependency cibuildwheel to v3.4.0 #9532 [@renovate[bot]]

Testing

Remove matrix.os from benchmark #9735 [@radarhere]

Remove references to libavif patch #9734 [@radarhere]

Add benchmark tests #9654 [@akx]

Use reshape() instead of setting NumPy array shape directly #9728 [@radarhere]

... (truncated)

Commits

bb1d8e8 12.3.0 version bump
e63fc48 Add release notes for SBOM and performance improvements (#9747)
13b701b Add release notes for #9679
5564ca7 List methods
a0920fd Speed up ImageChops operations (#9738)
07e9a6c Speed up Image.filter() (#9736)
a94578c Speed up Image.getchannel(), Image.merge(), Image.putalpha() and `Image...
53e02c4 Speed up Image.fill(), Image.linear_gradient() and `Image.radial_gradient...
af03747 Speed up Image.resample() (#9739)
5c9ca56 Speed up alpha_composite, matrix, negative, quantize (#9740)
Additional commits viewable in compare view

Updates setuptools from 82.0.1 to 83.0.0

Changelog

Sourced from setuptools's changelog.

v83.0.0

Features

Require Python 3.10 or later.

Bugfixes

MANIFEST.in matching (via FileList) is now insensitive to Unicode normalization form. A pattern authored in one form (e.g. NFC, as typically saved by editors) now matches a file whose name is stored on disk in another (e.g. NFD, as produced by macOS APFS/HFS+). Previously an exclude, global-exclude, recursive-exclude, or prune rule could silently fail to drop a non-ASCII-named file from the source distribution, publishing it despite the exclusion -- see GHSA-h35f-9h28-mq5c.

Deprecations and Removals

pypa/distutils#334

Commits

6519f72 Bump version: 82.0.1 → 83.0.0
d1151b1 Merge pull request #5250 from pypa/feature/distutils-d7633fbed
a2df31e Capture removal of dry_run parameter in changelog.
00144dc Moved newsfragment to the release where it occurred.
a4a5a2b Add news fragment.
77470c2 Merge https://github.com/pypa/distutils into feature/distutils-d7633fbed
3c43897 Merge pull request #5247 from pypa/copilot/fix-pypy-version-issue
bb6ea66 Bump PyPy from 3.10 to 3.11 in CI workflow
a2bc3ac Fix broken intersphinx reference to build's installation docs
2d6a739 Use stacked parametrize decorators instead of itertools.product
Additional commits viewable in compare view

Updates soupsieve from 2.8.3 to 2.8.4

Release notes

Sourced from soupsieve's releases.

2.8.4

FIX: Fix another inefficient attribute pattern (@mauriceng98).

FIX: Limit total number of selectors processed in a pattern to prevent massive selector requests (@mauriceng98).

Commits

28108ab Limit excessive selectors
ef18872 Fix test for Windows
eb43976 Merge commit from fork
3a661b2 Fix typo in pseudo-classes.md (#294)
0cb533d Update hatchling version requirement in pyproject.toml (#290)
See full diff in compare view

Updates tornado from 6.5.5 to 6.5.7

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2 releases/v4.0.1 releases/v4.0.0 releases/v3.2.2

... (truncated)

Commits

48fc2d4 Merge pull request #3633 from bdarnell/curl-reset-65
4ae1ddd Release notes and version bump for 6.5.7
3154caa curl_httpclient: Reset the curl object before putting it on the freelist
7d869c0 Merge pull request #3631 from bdarnell/cve-links
288241f docs: Use the correct link syntax
8da981c docs: Add CVE links to 6.5.6 release notes
aba2569 Merge pull request #3626 from bdarnell/fixes-656
a24b260 httpclient_test: Accept an additional error message variant
a74240a Release notes and version bump for 6.5.6.
e8fc7ed simple_httpclient: Strip auth headers on cross-origin redirects
Additional commits viewable in compare view

Updates urllib3 from 2.6.3 to 2.7.0

Release notes

Sourced from urllib3's releases.

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

urllib3 is raising ~$40,000 USD to release HTTP/2 support and ensure long-term sustainable maintenance of the project after a sharp decline in financial support. If your company or organization uses Python and would benefit from HTTP/2 support in Requests, pip, cloud SDKs, and thousands of other projects please consider contributing financially to ensure HTTP/2 support is developed sustainably and maintained for the long-haul.

Thank you for your support.

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially. (Reported by @Cycloctane)

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli library. (Reported by @kimkou2024)

See GHSA-mf9v-mfxr-j63j for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc reported by @christos-spearbit)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. (urllib3/urllib3#3763)

Removed support for end-of-life Python 3.9. (urllib3/urllib3#3720)

Removed support for end-of-life PyPy3.10. (urllib3/urllib3#4979)

Bumped the minimum supported pyOpenSSL version to 19.0.0. (urllib3/urllib3#3777)

Bugfixes

Fixed a bug where HTTPResponse.read(amt=None) was ignoring decompressed data buffered from previous partial reads. (urllib3/urllib3#3636)

Fixed a bug where HTTPResponse.read() could cache only part of the response after a partial read when cache_content=True. (urllib3/urllib3#4967)

Fixed HTTPResponse.stream() and HTTPResponse.read_chunked() to handle amt=0. (urllib3/urllib3#3793)

Updated _TYPE_BODY type alias to include missing Iterable[str], matching the documented and runtime behavior of chunked request bodies. (urllib3/urllib3#3798)

Fixed LocationParseError when paths resembling schemeless URIs were passed to HTTPConnectionPool.urlopen(). (urllib3/urllib3#3352)

Fixed BaseHTTPResponse.readinto() type annotation to accept memoryview in addition to bytearray, matching the io.RawIOBase.readinto contract and enabling use with io.BufferedReader without type errors. (urllib3/urllib3#3764)

Changelog

Sourced from urllib3's changelog.

2.7.0 (2026-05-07)

Security

Addressed high-severity security issues. Impact was limited to specific use cases detailed in the accompanying advisories; overall user exposure was estimated to be marginal.

Decompression-bomb safeguards of the streaming API were bypassed:

When HTTPResponse.drain_conn() was called after the response had been read and decompressed partially.

During the second HTTPResponse.read(amt=N) or HTTPResponse.stream(amt=N) call when the response was decompressed using the official Brotli <https://pypi.org/project/brotli/>__ library.

See GHSA-mf9v-mfxr-j63j <https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j>__ for details.

HTTP pools created using ProxyManager.connection_from_url did not strip sensitive headers specified in Retry.remove_headers_on_redirect when redirecting to a different host. (GHSA-qccp-gfcp-xxvc <https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc>__)

Deprecations and Removals

Used FutureWarning instead of DeprecationWarning for better visibility of existing deprecation notices. Rescheduled the removal of deprecated features to version 3.0. ([#3763](https://github.com/urllib3/urllib3/issues/3763) <https://github.com/urllib3/urllib3/issues/3763>__)

Removed support for end-of-life Python 3.9. ([#3720](https://github.com/urllib3/urllib3/issues/3720) <https://github.com/urllib3/urllib3/issues/3720>__)

Removed support for end-of-life PyPy3.10. ([#4979](https://github.com/urllib3/urllib3/issues/4979) <https://github.com/urllib3/urllib3/issues/4979>__)

Bumped the minimum supported pyOpenSSL version to 19.0.0. ([#3777](https://github.com/urllib3... Description has been truncated

Bumps the uv group with 10 updates in the / directory: | Package | From | To | | --- | --- | --- | | [jupyterlab](https://github.com/jupyterlab/jupyterlab) | `4.5.7` | `4.5.10` | | [bleach](https://github.com/mozilla/bleach) | `6.3.0` | `6.4.0` | | [idna](https://github.com/kjd/idna) | `3.11` | `3.15` | | [jupyter-server](https://github.com/jupyter-server/jupyter_server) | `2.17.0` | `2.20.0` | | [mistune](https://github.com/lepture/mistune) | `3.2.0` | `3.3.0` | | [pillow](https://github.com/python-pillow/Pillow) | `12.2.0` | `12.3.0` | | [setuptools](https://github.com/pypa/setuptools) | `82.0.1` | `83.0.0` | | [soupsieve](https://github.com/facelessuser/soupsieve) | `2.8.3` | `2.8.4` | | [tornado](https://github.com/tornadoweb/tornado) | `6.5.5` | `6.5.7` | | [urllib3](https://github.com/urllib3/urllib3) | `2.6.3` | `2.7.0` | Updates `jupyterlab` from 4.5.7 to 4.5.10 - [Release notes](https://github.com/jupyterlab/jupyterlab/releases) - [Changelog](https://github.com/jupyterlab/jupyterlab/blob/main/RELEASE.md) - [Commits](https://github.com/jupyterlab/jupyterlab/compare/@jupyterlab/lsp@4.5.7...@jupyterlab/lsp@4.5.10) Updates `bleach` from 6.3.0 to 6.4.0 - [Changelog](https://github.com/mozilla/bleach/blob/main/CHANGES) - [Commits](mozilla/bleach@v6.3.0...v6.4.0) Updates `idna` from 3.11 to 3.15 - [Release notes](https://github.com/kjd/idna/releases) - [Changelog](https://github.com/kjd/idna/blob/master/HISTORY.md) - [Commits](kjd/idna@v3.11...v3.15) Updates `jupyter-server` from 2.17.0 to 2.20.0 - [Release notes](https://github.com/jupyter-server/jupyter_server/releases) - [Changelog](https://github.com/jupyter-server/jupyter_server/blob/main/CHANGELOG.md) - [Commits](jupyter-server/jupyter_server@v2.17.0...v2.20.0) Updates `mistune` from 3.2.0 to 3.3.0 - [Release notes](https://github.com/lepture/mistune/releases) - [Changelog](https://github.com/lepture/mistune/blob/main/docs/changes.rst) - [Commits](lepture/mistune@v3.2.0...v3.3.0) Updates `pillow` from 12.2.0 to 12.3.0 - [Release notes](https://github.com/python-pillow/Pillow/releases) - [Changelog](https://github.com/python-pillow/Pillow/blob/main/CHANGES.rst) - [Commits](python-pillow/Pillow@12.2.0...12.3.0) Updates `setuptools` from 82.0.1 to 83.0.0 - [Release notes](https://github.com/pypa/setuptools/releases) - [Changelog](https://github.com/pypa/setuptools/blob/main/NEWS.rst) - [Commits](pypa/setuptools@v82.0.1...v83.0.0) Updates `soupsieve` from 2.8.3 to 2.8.4 - [Release notes](https://github.com/facelessuser/soupsieve/releases) - [Commits](facelessuser/soupsieve@2.8.3...2.8.4) Updates `tornado` from 6.5.5 to 6.5.7 - [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst) - [Commits](tornadoweb/tornado@v6.5.5...v6.5.7) Updates `urllib3` from 2.6.3 to 2.7.0 - [Release notes](https://github.com/urllib3/urllib3/releases) - [Changelog](https://github.com/urllib3/urllib3/blob/main/CHANGES.rst) - [Commits](urllib3/urllib3@2.6.3...2.7.0) --- updated-dependencies: - dependency-name: jupyterlab dependency-version: 4.5.10 dependency-type: direct:development dependency-group: uv - dependency-name: bleach dependency-version: 6.4.0 dependency-type: indirect dependency-group: uv - dependency-name: idna dependency-version: '3.15' dependency-type: indirect dependency-group: uv - dependency-name: jupyter-server dependency-version: 2.20.0 dependency-type: indirect dependency-group: uv - dependency-name: mistune dependency-version: 3.3.0 dependency-type: indirect dependency-group: uv - dependency-name: pillow dependency-version: 12.3.0 dependency-type: indirect dependency-group: uv - dependency-name: setuptools dependency-version: 83.0.0 dependency-type: indirect dependency-group: uv - dependency-name: soupsieve dependency-version: 2.8.4 dependency-type: indirect dependency-group: uv - dependency-name: tornado dependency-version: 6.5.7 dependency-type: indirect dependency-group: uv - dependency-name: urllib3 dependency-version: 2.7.0 dependency-type: indirect dependency-group: uv ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file python:uv Pull requests that update python:uv code labels Aug 31, 2026

Navigation Menu

Bump the uv group across 1 directory with 10 updates - #127

Bump the uv group across 1 directory with 10 updates#127
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/uv/uv-9079cbcae6

dependabot Bot commented on behalf of github Aug 31, 2026

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Aug 31, 2026

v4.5.10

4.5.10

Security patches

Bugs fixed

Maintenance and upkeep improvements

Contributors to this release

v4.5.9

4.5.9

Bugs fixed

Contributors to this release

Version 6.4.0 (June 5th, 2026)

3.15 (2026-05-12)

3.14 (2026-05-10)

3.13 (2026-04-22)

3.12 (2026-04-21)

v2.20.0

2.20.0

Security fixes

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

v2.19.0

2.19.0

Enhancements made

2.20.0

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

Documentation improvements

Contributors to this release

2.19.0

Enhancements made

Bugs fixed

Maintenance and upkeep improvements

v3.3.0

🐞 Bug Fixes

🏎 Performance

View changes on GitHub

v3.2.1

🐞 Bug Fixes

View changes on GitHub

Version 3.3.0

Version 3.2.1

12.3.0

Removals

Documentation

Dependencies

Testing

v83.0.0

Features

Bugfixes

Deprecations and Removals

2.8.4

Release notes

2.7.0

🚀 urllib3 is fundraising for HTTP/2 support

Security

Deprecations and Removals

Bugfixes

2.7.0 (2026-05-07)

Security

Deprecations and Removals

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants