[dependabot]

Bumps the python-dependencies group with 38 updates:

Package	From	To
asgiref	3.12.1	3.13.0
charset-normalizer	3.5.1	3.5.2
django	6.1.1	6.1.2
django-bootstrap5	26.3	26.4
django-import-export	4.4.1	4.4.4
django-stubs-ext	6.1.1	6.1.2
markdown	3.11	3.11.2
coverage	7.16.2	7.17.0
distlib	0.4.3	0.4.4
django-stubs	6.1.1	6.1.2
djlint	1.46.2	1.47.1
filelock	4.2.1	4.2.4
iniconfig	2.3.0	2.3.1
json5	0.15.0	0.17.3
librt	0.15.0	0.16.0
mypy	2.3.1	2.4.1
pip-tools	7.6.1	7.6.2
platformdirs	4.12.1	4.14.0
pluggy	1.6.0	1.7.0
pre-commit	4.6.2	4.7.0
pytest	9.1.1	9.2.0
pytest-mock	3.16.0	3.17.0
python-discovery	1.6.1	1.6.7
regex	2026.9.10	2026.9.29
ruff	0.16.9	0.17.3
soupsieve	2.10	3.0.4
types-markdown	3.10.2.20260712	3.11.2.20261029
types-requests	2.33.0.20260906	2.33.0.20261006
virtualenv	21.14.13	21.15.1
backrefs	8.0	8.1
griffelib	2.3.0	2.4.1
markupsafe	3.0.3	3.0.4
mkdocs-autorefs	1.4.4	1.4.5
mkdocs-material	9.7.7	9.8.0
mkdocstrings	1.0.6	1.0.8
mkdocstrings-python	2.0.9	2.0.10
pymdown-extensions	12.1	12.3
python-dateutil	2.9.0.post0	3.0.0

Updates asgiref from 3.12.1 to 3.13.0

Changelog

Sourced from asgiref's changelog.

3.13.0 (2026-10-23)

• It is now possible to nest ThreadSensitiveContext by providing an explicit executor for thread-sensitive tasks. This enables moving a block of such work away from the parent context's shared worker. (#596)

  The provided executor must run work sequentially and on a single thread, as per ThreadPoolExecutor(max_workers=1), and the calling code is responsible for managing the executor's lifecycle.

  See the README for more details.

• Local attribute access is now 2-3x faster. Local(...) now uses one of two internal specialisations, selected by thread_critical, instead of checking the mode on every access. (#551)

  As a result Local is now marked @final and raises TypeError if subclassed. Subclassing was never supported, and could not have worked correctly with the specialised implementations.

• asgiref.timeout.timeout is deprecated, and will be removed in a future release. Move to use asyncio.timeout() instead.

• Added support for Python 3.15.

• Dropped support for EOL Python 3.10.

Commits

• 03dcd19 Releasing 3.13.0
• 8c185a0 Allow nesting ThreadSensitiveContext. (#596)
• 9f2a6c0 Speed up Local (#551)
• 3ae6e47 Deprecate custom timeout in favour of asyncio.timeout. (#598)
• 97d7e63 Compare contextvars by identity in _restore_context (#577)
• e9a34ef Handle scope["server"] = None in build_environ. (#553)
• 0c85f40 Block assigning _data onto Local. (#576)
• 1318084 Prefer client certificate chains in the TLS extension (#590)
• 0bd8efe Document HTTP/3 support (#589)
• cf94d8e Add support for Python 3.15 and drop 3.10 (#581)
• Additional commits viewable in compare view

Updates charset-normalizer from 3.5.1 to 3.5.2

Release notes

Sourced from charset-normalizer's releases.

Version 3.5.2

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Changelog

Sourced from charset-normalizer's changelog.

3.5.2 (2026-09-29)

Changed

• Raised the Cython upper bound to <3.4 for native builds. The bound remains <3.3 for abi3 builds to preserve compatibility with the Python 3.7 Limited API.

Fixed

• Valid UTF-8 Chinese JSON incorrectly detected as PTCP154 due to excessive noise penalties for uncommon CJK characters. (#796)
• Supported encodings without aliases failing name resolution or being ignored in charset declarations. (#800)

Commits

• 935c29a Release 3.5.2 (#805)
• 9d3238a test: disable traefik in downstream niquests
• b4c0368 docs: write changelog entry for 3.5.2
• 717da31 chore: bump version to 3.5.2
• 264895d chore: update pypa/cibuildwheel and pypa/gh-action-pypi-publish
• 41e28b6 chore: raise Cython upper bound to 3.3
• b130b7d Fix valid UTF-8 Chinese JSON misdetected as PTCP154 (#796)
• f6afd31 Make the IANA_NO_ALIASES encodings resolvable by name (#800)
• See full diff in compare view

Updates django from 6.1.1 to 6.1.2

Commits

• 2212534 [6.1.x] Bumped version for 6.1.2 release.
• 75d401a [6.1.x] Refs CVE-2026-15830 -- Fixed WKB geometry collection limit bypasses.
• cce6c57 [6.1.x] Fixed CVE-2026-87975 -- Prevented forging actions in model formsets w...
• 4e77ef1 [6.1.x] Fixed CVE-2026-87890 -- Blocked bytes in spatial lookups.
• de56dee [6.1.x] Fixed CVE-2026-84429 -- Simplified parse_header_parameters by leverag...
• 7e878b0 [6.1.x] Fixed CVE-2026-77050 -- Prevented memory exhaustion in get_supported_...
• d8cf296 [6.1.x] Fixed #37322 -- Avoided transforms on spatial fields with srid=None.
• 71084d6 [6.1.x] Fixed #37377 -- Fixed JSONField __in crash/wrong result for Value() p...
• e34d776 [6.1.x] Fixed #37386 -- Observed delete_confirmation_max_display=0 for inlines.
• 25872ef [6.1.x] Fixed #37361 -- Fixed permission renames for chained RenameModel oper...
• Additional commits viewable in compare view

Updates django-bootstrap5 from 26.3 to 26.4

Changelog

Sourced from django-bootstrap5's changelog.

26.4 (2026-10-11)

• Breaking: Drop support for Python 3.10, end of life since 2026-10-01. The floor is now Python 3.11.
• Breaking: Remove django_bootstrap5.text.text_concat. It is a general string helper, not a Bootstrap concern, and nothing in the package has ever called it: its one caller joined an icon to a button label and went away when icon support was removed, before this package was forked. It was never documented. If you import it, the replacement is three lines (#889).
• Remove BaseRenderer.get_size_class, which nothing called. The module-level get_size_class in django_bootstrap5.size is the one in use, and the method shadowed its name inside the class body.
• Fix a template_name set on a RadioSelect, CheckboxSelectMultiple or ClearableFileInput subclass being overwritten by this package's own widget template (#388). Widgets that still carry Django's default template are unaffected.
• Accept a non-string URL value in css_url, javascript_url and theme_url, so a lazy static() value can be used directly instead of only inside the dict form (#616). Passing one raised ValueError: dictionary update sequence element [#0](https://github.com/zostera/django-bootstrap5/issues/0) has length 1; 2 is required, because anything that was not a str was treated as a dict of attributes. The docs now cover serving Bootstrap from your own static files, which needs the URL resolved at render time so ManifestStaticFilesStorage can supply the hashed filename.
• Recognize week, search and color input-type widgets as form-control widgets, so addon_before/addon_after work on them, and warn instead of silently dropping addons on a widget that cannot have them (#743, #872). Floating labels stay unsupported for color, where Bootstrap sizes the swatch itself.
• Add the documented inline_field_class setting to BOOTSTRAP5_DEFAULTS, where it was missing. Its effective default is unchanged.
• Store src/django_bootstrap5/widgets.py with LF line endings, like every other file and as .editorconfig requires. It was the only file in the repository with CRLF.
• Support addon_before/addon_after on fields with layout="floating" (#866). The form-floating element is now nested inside the input-group, as Bootstrap's floating-label input-group markup requires, instead of the two being alternatives. This removes the warning added in 26.3 (#833), which existed because the combination was unsupported.
• Add a system check that warns about keys in the BOOTSTRAP5 setting that the package does not read, such as a setting removed in an earlier release or one carried over from django-bootstrap3 or django-bootstrap4 (django_bootstrap5.W001, #867). Silence it with SILENCED_SYSTEM_CHECKS if you keep extra keys deliberately.
• Harden the release and Dependabot workflows, and write down the dependency update policy in MAINTAINING.md. The Dependabot auto-merge job gated on github.actor, which is spoofable in a pull_request_target context, and now gates on the pull request author, with fetch-metadata as a second check. The publishing job no longer restores a build cache, so a poisoned entry cannot reach what is uploaded to PyPI. Every job in every workflow now carries timeout-minutes, and ci.yml declares permissions: contents: read.
• Fail just lint on invisible and bidirectional control characters, which can make source read differently to a human than to the compiler (Trojan Source, CVE-2021-42574).
• Cover every statement and branch in the test suite, and hold it there with fail_under = 100, checked by a coverage report step in CI. Until that step existed the floor was set but never run.
• Fail the CI gate when any job fails, not only the test matrix. A failing docs or packaging build could previously be merged.
• Test on Python 3.15 against Django 6.1 and main. The job is non-blocking and 3.15 is not advertised as supported, because no Django release claims it yet.
• Drop a duplicate coverage[toml] entry from the test dependency group and sort it alphabetically.
• Add just release-check to list src/ changes against changelog entries before a release.
• Show commits that touch nothing in src/ in just release-check as a second group, instead of hiding them. Tooling, CI and documentation changes belong in the release notes too, and the old output read as a complete list while being a filtered one.
• Fail just build when uv.lock does not name the version in pyproject.toml, and add just relock to fix it. uv sync --frozen does not check the project's own version, so a stale lock passed every packaging check.
• Add the shared AI assistance policy to CONTRIBUTING.md. Using an AI assistant is fine; saying so when it wrote a meaningful part of a change is the requirement, and it is not held against you.
• Document migrating from django-bootstrap3 in MIGRATE.md: renamed settings and their changed defaults, the removed buttons, bootstrap_icon and bootstrap_message_classes, renamed tag arguments, and the Bootstrap class changes that take most of the work.
• Cover jQuery in the migration guide: what replaces the jquery_url setting and the jQuery tags, and that django-bootstrap3's default pointed at a CDN alias still serving jQuery 1.11.1, so choosing a version is likely a jump of two majors. Also say to delete the old BOOTSTRAP3 block, since W001 only inspects BOOTSTRAP5 and a leftover block reads like live configuration with nothing warning about it.
• Fix the release process in MAINTAINING.md: the version bump goes through a PR, not a direct push to protected main.
• Say in MAINTAINING.md that just release-check reporting no Unreleased entries straight after a cut means nothing is pending, not that the changelog was lost.
• Note in MAINTAINING.md why the Django dependency carries no upper bound.

Commits

• 2c7bf18 release: 26.4 (#895)
• 209aeb2 Sync the release preflight from django-marina (#896)
• 601049e Drop support for Python 3.10 (EOL) (#894)
• 2cba47c docs: cover jQuery and the stale settings block in the migration guide (#893)
• 2a0cf12 Document migrating from django-bootstrap3 (#892)
• 8d52ca5 Remove text_concat (#890)
• f16f424 Check coverage against the floor in CI (#888)
• e24cecc Harden the workflows, and write down the dependency update policy (#887)
• 7dd4834 Cover every statement and branch, and hold the line at 100% (#886)
• 643c82e Un-cut 26.4: fold the section back into Unreleased and return to 26.3 (#885)
• Additional commits viewable in compare view

Updates django-import-export from 4.4.1 to 4.4.4

Release notes

Sourced from django-import-export's releases.

4.4.4

• Changelog

4.4.3

This release contains a security patch. Users are encouraged to update as soon as possible.

Changelog

4.4.2

This release contains a security and data integrity patch. Users are encouraged to update as soon as possible.

Changelog

Changelog

Sourced from django-import-export's changelog.

4.4.4 (2026-10-27)

• Fixed CSV being omitted from the default formats on Python 3.15 because tablib 3.10+ lazily imports tablib.core, leaving the format registry empty when the first is_available() check runs (2210 <https://github.com/django-import-export/django-import-export/issues/2210>_)
• Fixed django.utils.functional.cached_property is deprecated warning on Django 6.2 by using functools.cached_property
• Fixed ExportActionMixin.get_actions() for Django 6.1, which deprecates overriding it without the new action_location parameter and, with the old signature, disables all change form actions on the admin. See :ref:release notes <release_notes_export_admin_action> if you override export_admin_action(). (2214 <https://github.com/django-import-export/django-import-export/pull/2214>_)

4.4.3 (2026-10-19)

• Fixed a denial-of-service issue where importing a crafted large-magnitude integer value could stall the process during conversion to a Python integer. See :ref:release notes <release_notes_integer_widget_dos> for details and mitigations. (GHSA-fcgw-hjjv-4rh6 <https://github.com/django-import-export/django-import-export/security/advisories/GHSA-fcgw-hjjv-4rh6>, CVE-2026-111437 <https://www.cve.org/CVERecord?id=CVE-2026-111437>)

4.4.2 (2026-10-15)

• Fixed a security and data integrity issue where an import row classified as "new" could silently overwrite an existing database row. See :ref:release notes <release_notes_force_insert_on_create> for details and mitigations. (GHSA-8xvj-4m4r-g62h <https://github.com/django-import-export/django-import-export/security/advisories/GHSA-8xvj-4m4r-g62h>_)

Commits

• c1c4100 Shorten the get_actions changelog entry
• c8b6058 Support the Django 6.1 action_location parameter in ExportActionMixin.get_act...
• 67bbfca Use functools.cached_property instead of the Django alias
• 54f2b62 Fix CSV missing from default formats on Python 3.15 (#2211)
• 72f6c1b updated docs
• 46d6099 Link 4.4.2 changelog entry to the security advisory
• 6c991f2 corrected text
• e0935a3 Clarify affected configurations in 4.4.2 release note
• a6bcb88 updated changelog and release notes
• 255acd6 Fix import row classified as "new" overwriting an existing database row
• Additional commits viewable in compare view

Updates django-stubs-ext from 6.1.1 to 6.1.2

Commits

• fa03b48 Version 6.1.2 release (#3681)
• 3568355 Update dependency mypy to >=1.13,<2.5 (#3680)
• 46cd7de Update dependency pyrefly to v1.3.2 (#3677)
• de0b49c [pre-commit.ci] pre-commit autoupdate (#3675)
• c7b59a0 Update dependency ty to v0.0.83 (#3671)
• e3a1189 Update astral-sh/setup-uv action to v10.2.0 (#3672)
• f0a186a Update int128/hide-comment-action action to v1.75.0 (#3669)
• 63161ef [pre-commit.ci] pre-commit autoupdate (#3667)
• dc01854 Update dependency psycopg to v3.3.6 (#3668)
• d563832 Update dependency ty to v0.0.82 (#3665)
• Additional commits viewable in compare view

Updates markdown from 3.11 to 3.11.2

Release notes

Sourced from markdown's releases.

Release 3.11.2

Fixed

• Sanitize attribute names in the fenced_code and legacy_attrs extensions so an attribute name cannot break out of its tag and inject markup (#1663).
• For backwards compatibility, revert the enforcement of CommonMark style punctuation rules (#1657).

Release 3.11.1

Fixed

• Update serializer to be non-recursive (#1644).
• Improve ancestor handling in the inline Treeprocessor (#1646).
• Keep a raw HTML comment inside an inline HTML element that closes in the same paragraph, instead of splitting the paragraph around it (#1643).
• Fix issue where inline HTML attributes were rejected if they had < or > in the attribute (#1647).
• Fix issue where an unterminated end tag (</foo) could cause all remaining content to be dropped (#1651).
• Complete rework of emphasis handling to improve nested emphasis handling better (#1632).

Changelog

Sourced from markdown's changelog.

[3.11.2] - 2026-10-19

Fixed

• Sanitize attribute names in the fenced_code and legacy_attrs extensions so an attribute name cannot break out of its tag and inject markup (#1663).
• For backwards compatibility, revert the enforcement of CommonMark style punctuation rules (#1657).

[3.11.1] - 2026-10-13

Fixed

• Update serializer to be non-recursive (#1644).
• Improve ancestor handling in the inline Treeprocessor (#1646).
• Keep a raw HTML comment inside an inline HTML element that closes in the same paragraph, instead of splitting the paragraph around it (#1643).
• Fix issue where inline HTML attributes were rejected if they had < or > in the attribute (#1647).
• Fix issue where an unterminated end tag (</foo) could cause all remaining content to be dropped (#1651).
• Complete rework of emphasis handling to improve nested emphasis handling better (#1632).

[3.11.0] - 2026-09-25

Changed

• Inline processors now resume searching after the previous match, improving performance for repeated inline patterns (#1619).
• Officially support Python 3.15 and drop support for Python 3.10
• Walk backtick runs in BacktickInlineProcessor without a regex (#1620).
• Switch static site generator for documentation from MkDocs to Zensical (#1627, #1635, #1637, and #1638).

Fixed

• Ensure removing Abbreviations does not raise an error (#1634).
• Fix an issue with excessive backtracking when matching inline code blocks (#1617).
• md_in_html now honors tags added to Markdown.block_level_elements after the extension is loaded (#1246).
• Fix quadratic-time regex backtracking in ReferenceProcessor when a link reference definition has no URL, e.g. a line consisting only of [id]: followed by many trailing spaces (#798).
• Document attr_list usage for def_list (#1123).

[3.10.3] - 2026-07-30

Fixed

• Fix SetextHeaderProcessor regex to prevent mixed = and - chars in setext-style headers (#1606).
• Add AI Policy to Contributing Guide.
• Officially document all included extensions as being in maintenance mode.

... (truncated)

Commits

• b41e0aa Bump version to 3.11.2
• 934c53e Add checklist of parts to PR template
• 2249ffd Update AI Policy
• a27428b Sanitize attribute names in fenced_code and legacy_attrs
• 90cdcf5 Add fixed category to changelog
• 97233ef Revert enforcement of CommonMark punctuation rules
• 2258b48 Bump version to 3.11.1
• 6f825aa Rewrite emphasis handling
• 0bf535b Keep a comment inside raw inline HTML in the same paragraph
• 3ade80d Add playground to docs
• Additional commits viewable in compare view

Updates coverage from 7.16.2 to 7.17.0

Release notes

Sourced from coverage's releases.

7.17.0

Version 7.17.0 — 2026-10-22

• Dropped support for Python 3.10.
• Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.
• Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987.
• Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314.
• Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.
• Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.
• Fix: The “Can’t combine statement coverage data with branch data” error now names the two data files it couldn’t combine. The error description in the docs now lists common causes and how to find the process that wrote the file.
• Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293 and issue 2294.
• Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338.
• Fixes for obscure but legal file names:
  • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and coverage debug data replace non-printable characters in names. Printable names are unchanged.
  • A file pattern (from include, omit, or a [paths] alias) containing a newline sent the glob-to-regex translation into an infinite loop, hanging the process. Newlines in patterns are now handled like any other character.
• Fixes in the implementation of the C tracer:
  • If a plugin’s dynamic_source_filename method raised an exception, lines in that function could be recorded as belonging to a different file. Also fixed some minor memory leaks in the C tracer.
  • The refcount of None was mismanaged during function calls, including comprehensions. This was unlikely to cause an actual problem, but is now fixed. Thanks, Andrew Dalke.
  • The C tracer held borrowed references to dictionary values, which was unsafe on free-threaded Python. Now it takes its own references.
  • An internal error while recording a new file could be reported as a confusing SystemError instead of the actual exception.
• Performance: the text summary report (coverage report) held on to every file’s parsed source until it finished, so its memory use grew with the size of the project: ten times or more what 7.14 used on large projects. Now it keeps only what it needs to print. Fixes issue 2277.
• Performance: HTML reports should be about 5% faster to produce.
• Kept the political banner in the README. Closes issue 2344.

➡️  PyPI page: coverage 7.17.0. :arrow_right:  To install: python3 -m pip install coverage==7.17.0

Changelog

Sourced from coverage's changelog.

Version 7.17.0 — 2026-10-22

• Dropped support for Python 3.10.

• Binary wheels are now provided for iOS and Android. This allows the use of the optimized C tracer on mobile platforms.

• Fix: three or more levels of nested with statements could make a with line look like a branch with an exit that can never happen. Using the sys.monitoring core, these phantom branches were reported as partial. Other cores hid the problem but still counted the phantom branches in the total. Closes issue 1987_.

• Fix: a comment or string that merely mentioned if True: or while True: could mark its line as a branch that is known to be partial, so a branch that never ran was reported as taken. These built-in patterns now only match at the start of the statement. Closes issue 2314_.

• Fix: region detection missed functions defined in unusual places, such as else and except clauses. This is now fixed.

• Fix: recent versions of the lcov tool complain if the same function name appears more than once in a report. Python can have multiple same-named functions in a few ways, for example, getters/setters or conditionally defined functions. These are now disambiguated by adding a @<line number> suffix to the function name. Fixes issue 2335.

• Fix: The "Can't combine statement coverage data with branch data" error now names the two data files it couldn't combine. The :ref:error description <error_cant_combine> in the docs now lists common causes and how to find the process that wrote the file.

• Fix: at coverage totals close to 0 or 100, the XML report could get incorrect line-rate values like 8.333e-05 or 1. This is now fixed, closing issue 2293_ and issue 2294_.

• Fix: a parallel data file saved more than once kept the hash of its first save in its file name. Combining could then skip it as a duplicate of another file that had the same data at that point, and delete it, losing the data recorded after the first save. Each save now updates the hash. This had been a problem since 7.13.1. Fixes issue 2338_.

• Fixes for obscure but legal file names:

  • File names (and plugin names) can contain control characters, which are legal in POSIX paths but unsafe in reports: in XML 1.0 they make the document non-well-formed, and in a terminal they act as escape sequences (colors, title/clipboard sequences, cursor moves that forge output). Now the XML report, the text and Markdown summary reports, and ``coverage debug

... (truncated)

Commits

• 393ac71 docs: prep for 7.17.0
• 14257d3 test: check that 100% files haven't lost coverage
• db056ac docs: keep the ukraine banner #2344
• 6033660 fix: update the data file hash when a parallel data file is saved again (#2339)
• 99024b5 fix: clamp rate in XML report to prevent false 1.0/0.0 rounding and scientifi...
• ff62a02 refactor: remove unused caching branches
• 24d0b67 fix: KeyError for a with statement at the end of a finally clause (#2336)
• 934f5b8 chore: upgrade pip==26.2.2 certifi==2026.10.19
• f95c980 fix: triply nested with statements don't cause false branch misses #1987
• 6aaa858 docs: more changelog gardening
• Additional commits viewable in compare view

Updates distlib from 0.4.3 to 0.4.4

Changelog

Sourced from distlib's changelog.

0.4.4

Released: 2026-10-16


compat

Fixed a missing import. Thanks to Andrej730 for the patch.



markers

Fixed #273: Enforce compatible-release bounds in environment markers.
Thanks to Luochenchen for the patch.



metadata

Fix #194: Add an urls property to expose project and home URLs. Thanks to
Sinkleberg for the patch.



scripts


Raise the correct exception when a launcher can't be written. Thanks to
candygoogy for the patch.


Fix #144: Detect shell-script Python executables in ScriptMaker shebangs.
Thanks to Alex Chen for the patch.




util


Improve performance of export entry search to take linear time. Thanks to
Brian Willows for the patch.


Use tarfile.data_filter rather than tarfile.tar_filter in unarchive()
when extraction filters are available, matching the Python 3.14 default. Path and
link containment checks now use os.path.realpath and no longer fail with
IndexError for members such as . or ./. Thanks to Kobain for the patch.


unarchive() now resolves member paths through symlinks seen earlier in the
same archive, so a chain of individually harmless-looking links cannot be used
to write outside the destination on Pythons without extraction filters. Thanks to
Kobain for the patch.




version


Improve NormalizedVersion by addressing correctness and performance gaps
found by comparison with packaging. Thanks to Damian Shaw for the patch.


Improve SemanticVersion by comparing numeric prerelease identifiers,
including those longer than 8 digits. Thanks to Muneeb Sheikh for the
patch.

Commits

• 25eed06 Changes for 0.4.4.
• 8ffee6f Resolve member paths through earlier archive symlinks in unarchive()
• ef4a390 Test that data_filter rejects absolute symlinks with check=False
• 380b6a9 Use data_filter and realpath containment checks in unarchive()
• 7b7c572 fix: enforce compatible-release bounds in markers (#274)
• 38811dd Detect shell-script Python executables in ScriptMaker shebangs (#144) (#264)
• 06ddb5d Compare numeric prerelease identifiers without a digit limit (#270)
• e54dd8c Raise the original error when a launcher can't be written (#269)
• c6270e3 Fix NormalizedVersion gaps found by comparison with packaging (#271)
• 5b3092b Search export entries in linear time (#266)
• Additional commits viewable in compare view

Updates django-stubs from 6.1.1 to 6.1.2

Commits

• fa03b48 Version 6.1.2 release (#3681)
• 3568355 Update dependency mypy to >=1.13,<2.5 (#3680)
• 46cd7de Update dependency pyrefly to v1.3.2 (#3677)
• de0b49c [pre-commit.ci] pre-commit autoupdate (#3675)
• c7b59a0 Update dependency ty to v0.0.83 (#3671)
• e3a1189 Update astral-sh/setup-uv action to v10.2.0 (#3672)
• f0a186a Update int128/hide-comment-action action to v1.75.0 (#3669)
• 63161ef [pre-commit.ci] pre-commit autoupdate (#3667)
• dc01854 Update dependency psycopg to v3.3.6 (#3668)
• d563832 Update dependency ty to v0.0.82 (#3665)
• Additional commits viewable in compare view

Updates djlint from 1.46.2 to 1.47.1

Release notes

Sourced from djlint's releases.

v1.47.1

Fix

• preserve-inline in the js setting brace_style takes effect, so { bubbles: true } stays on one line in a <script> or in an attribute formatted with --format-attribute-js-json. It used to be dropped before the code was formatted.
• The json schema allows any option under css and js, so a strict validator such as Tombi no longer reports indent_size there.

v1.47.0

Feature

• New option --sort-load-tags / sort_load_tags sorts the libraries in a {% load %} tag and drops the ones written twice, so {% load static i18n %} becomes {% load i18n static %}. In {% load a b from library %} the names before from are sorted. It is off by default: where two libraries define a tag or filter of the same name, the one loaded last wins, so sorting can change which one a template uses.
• The formatter drops the spaces H012 reports around an attribute's =, so <div class = "a"> becomes <div class="a">.

Changed

• H010 reports the names the formatter lowercases, in any mix of case, so Width="3" is now reported. A framework binding such as :itemID or @ID and a longer name such as data-ID no longer are, since the formatter leaves their case alone.
• H018 is not reported under --close-void-tags, since the formatter then writes the /> ending the rule reports. --ignore-case already worked this way for H009 and H010.

Fix

• H020 reports an empty pair whose end tag has whitespace before its >, such as <div></div\n>.
• H026 reports a class or id holding only whitespace, such as class=" ", and one written with spaces around the =.
• H033 reports an action padded at both ends once. It used to report it twice, unless an attribute before action happened to make the two reports look the same.
• Markup written inside an attribute value, as in <p title="<img src='a'>">, is text, and H005, H008, H010, H012, D018, J018, H024, H026, H029 and H033 no longer report it. H046 and H051 read tabindex and role from the tag's own attributes, so tabindex=1 written in a value or in the page text is not reported either.
• T001 and T027 read a tag holding a dict, such as {{ f({"a": {"b": 1}}) }}, up to the }} that closes it rather than the first }} inside it.
• T032 steps over an escaped quote in a string, so the spaces in {{ x|default:"a \"b c\"" }} are not reported.
• H015 reports a heading followed by a tag on the same line anywhere in the file. It used to look only at the last line.
• The rules that read a tag's attributes step over a template tag written in it, including a handlebars {{{attrs}}} and a dict as in {{ {'class': 'x'}|xmlattr }}, so <img {{ attrs }} src='a'> is reported by H008, which used to stop reading at the {{.
• T038 steps over a string in a block tag, so the {% in {% with a="{%" %} does not cut the tag short.

Performance

• The rules that read a tag's attributes stop at a stray <, and H015, H030, H036, T001, T027, T038 and T039 no longer read the rest of the document again for each tag. A file holding thousands of unclosed tags or headings on one line is linted in a fraction of a second, where it used to take minutes.

v1.46.6

Packaging

• Ship the license of the mypyc runtime, which the binary wheels include, in LICENSE-THIRD-PARTY.
• Upload PEP 740 attestations to PyPI, so you can verify that the distributions were published from the GitHub Actions workflow of this repository.

v1.46.5

Packaging

• Drop support for EoL Python 3.10.

v1.46.4

Fix

• A line that opens a template block now indents the lines inside it when the rest of the line looks like a single-line html tag. Before, html in a string argument, as in {% call modal("<strong>" ~ n ~ "</strong>") %}, or inline html right after the opening tag, as in {% if a %}<b>x</b>, left the block's contents at its own level, and its closing tag ended up one level too far out.

v1.46.3

... (truncated)

Changelog

Sourced from djlint's changelog.

[1.47.1] - 2026-10-26

Fix

• preserve-inline in the js setting brace_style takes effect, so { bubbles: true } stays on one line in a <script>Description has been truncated