Skip to content

Bump the pip group across 5 directories with 8 updates - #1550

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/docs/pip-5925d3de1e
Closed

Bump the pip group across 5 directories with 8 updates#1550
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/docs/pip-5925d3de1e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 5, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip group with 1 update in the /docs directory: tornado.
Bumps the pip group with 3 updates in the /emmet-api directory: ddtrace, pymongo and virtualenv.
Bumps the pip group with 3 updates in the /emmet-api/requirements directory: ddtrace, pymongo and virtualenv.
Bumps the pip group with 6 updates in the /emmet-builders/requirements directory:

Package From To
pymongo 4.18.2 4.18.3
certifi 2024.7.4 2026.10.18
dnspython 2.6.1 2.9.0
filelock 3.20.3 4.2.1
virtualenv 21.14.12 21.14.13
msgpack 1.2.1 1.2.3

Bumps the pip group with 1 update in the /emmet-core/requirements directory: virtualenv.

Updates tornado from 6.5.9 to 6.6

Changelog

Sourced from tornado's changelog.

Release notes

.. toctree:: :maxdepth: 2

releases/v6.6.0 releases/v6.5.10 releases/v6.5.9 releases/v6.5.8 releases/v6.5.7 releases/v6.5.6 releases/v6.5.5 releases/v6.5.4 releases/v6.5.3 releases/v6.5.2 releases/v6.5.1 releases/v6.5.0 releases/v6.4.2 releases/v6.4.1 releases/v6.4.0 releases/v6.3.3 releases/v6.3.2 releases/v6.3.1 releases/v6.3.0 releases/v6.2.0 releases/v6.1.0 releases/v6.0.4 releases/v6.0.3 releases/v6.0.2 releases/v6.0.1 releases/v6.0.0 releases/v5.1.1 releases/v5.1.0 releases/v5.0.2 releases/v5.0.1 releases/v5.0.0 releases/v4.5.3 releases/v4.5.2 releases/v4.5.1 releases/v4.5.0 releases/v4.4.3 releases/v4.4.2 releases/v4.4.1 releases/v4.4.0 releases/v4.3.0 releases/v4.2.1 releases/v4.2.0 releases/v4.1.0 releases/v4.0.2

... (truncated)

Commits
  • e2b0f45 Merge pull request #3831 from bdarnell/final-6.6
  • 90c4e3f Version bump for 6.6 final release
  • ec17353 Merge pull request #3828 from bdarnell/downstream-ci-66
  • 15f66b0 ci: Add explicit read permission to CI jobs
  • 4446441 ci: Run the downstream testbed on a wheel built in the same run
  • c2e24d2 Merge pull request #3823 from bdarnell/claude/project-thread-uzh2s8
  • c2d8884 test: Add pre-6.3 security fixes to the corpus
  • de32687 test: Add a regression corpus of past security fixes
  • 7848790 maint: Add pre-tag checks and release instructions
  • f14321e ci: Compare benchmarks with the base branch on every PR
  • Additional commits viewable in compare view

Updates ddtrace from 4.8.2 to 4.15.6

Release notes

Sourced from ddtrace's releases.

4.15.6

Security Issues

4.15.5

Bug Fixes

  • Code Security (IAST): fixes an issue where taint tracking could abort the Python process when old-style % string formatting handled tainted text containing a lone surrogate character.

4.15.4

Bug Fixes

  • internal: Fixes an issue on macOS where starting a subprocess can deadlock while a hostname lookup is in progress.
  • tracing: Fixes a native memory leak on Linux when DD_TRACE_OTEL_CTX_ENABLED is set to true and a thread exits while an OpenTelemetry thread context is still attached.

4.15.3

Bug Fixes

  • LLM Observability:
    • Resolves an issue where a streamed Bedrock InvokeModelWithResponseStream request that ended in an error or was cancelled part-way produced a span with no output annotation. The text received before the failure is now tagged on the span.
    • Resolves an issue where a streamed Bedrock ConverseStream request that ended in an error or was cancelled part-way produced a span that was not marked as an error, making an interrupted request indistinguishable from a successful one.
    • This fix resolves an issue where cancelled or failed OpenAI streamed requests produced no LLM Observability span at all. These requests now produce an LLM span carrying the input messages, whatever output arrived before the stream ended, and estimated token metrics.
  • internal:
    • Fixes incorrect telemetry being collected when hitting cardinality limits during stats computation.
  • tracing:
    • Fixes an issue where the Python garbage collector stops and memory grows without limit when DD_RUNTIME_METRICS_ENABLED is true.
  • Profiling:
    • A crash that could occur in applications that use signal handlers to recover from crashes has been fixed.

4.15.2

Upgrade Notes

  • tracing: DD_TRACE_OTEL_CTX_ENABLED now defaults to false until a Linux-native memory leak caused by setting it to true is fixed.

Bug Fixes

  • LLM Observability: Fixes an issue where abandoned or disconnected streamed LLM requests can leave spans unfinished, causing memory to grow in long-running web workers.
  • CI Visibility: Fixes an issue where Auto Test Retries do not retry tests that use pytest-timeout thread mode and terminate a pytest-xdist worker.

4.15.1

Bug Fixes

  • LLM Observability
    • Resolves an issue where gen_ai.* attributes were added to APM spans when LLM Observability was disabled. These attributes are now only emitted when LLM Observability is enabled.

4.15.0

Estimated end-of-life date, accurate to within three months: 05-2027

See the support level definitions for more information.

... (truncated)

Commits
  • 83ea398 fix(tracing): prevent quadratic query string obfuscation [backport 4.15] (#20...
  • 4ae3a7f chore: bump version to 4.15.6 (#20863)
  • 479a759 ci: update one-pipeline to 1.6.0 [4.15] (#20842)
  • 8da5bb7 chore: bump version to 4.15.5 (#20833)
  • ace9724 fix(iast): avoid process abort in modulo_aspect on lone surrogates [backpor...
  • b97ac67 upgrade pyproject.toml version (#20715)
  • 27e417f chore(native): bump libdatadog v43.0.1 → v43.0.2 (#20711)
  • 45e21d6 fix(runtime): avoid macOS subprocess fork deadlock [backport 4.15] (#20678)
  • 3c2beeb chore: bump version to 4.15.3 (#20630)
  • 779fd48 fix(runtime-metrics): prevent gc stopping due to deadlock in gc monitor (#20624)
  • Additional commits viewable in compare view

Updates pymongo from 4.17.0 to 4.18.3

Release notes

Sourced from pymongo's releases.

PyMongo 4.18.3

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-3-released/344145

CVE-2026-106435

PyMongo 4.18.2

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732

CVE-2026-96749 CVE-2026-96748 CVE-2026-96747

PyMongo 4.18.1

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-1-released/343338

PyMongo 4.18.0

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-released/343137

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.18.3 (2026/10/08)

Version 4.18.3 is a bug fix release.

  • Hardened BSON regex decoding against malformed documents (PYTHON-6110_).

.. _PYTHON-6110: https://jira.mongodb.org/browse/PYTHON-6110

Issues Resolved ...............

See the PyMongo 4.18.3 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.3 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52955

Changes in Version 4.18.2 (2026/09/24)

Version 4.18.2 is a bug fix release.

  • Hardened the bson buffer size guard against signed integer overflow. (CVE-2026-96749_).
  • Fixed connection string parsing to percent-decode each host individually. (CVE-2026-96748_).
  • Client-side field level encryption now rejects a KMS endpoint ending in .sock. (CVE-2026-96747_).

.. _CVE-2026-96749: https://www.cve.org/CVERecord?id=CVE-2026-96749 .. _CVE-2026-96748: https://www.cve.org/CVERecord?id=CVE-2026-96748 .. _CVE-2026-96747: https://www.cve.org/CVERecord?id=CVE-2026-96747

Issues Resolved ...............

See the PyMongo 4.18.2 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.2 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52896

Changes in Version 4.18.1 (2026/09/10)

Version 4.18.1 is a bug fix release.

  • Use an exact match for the file ID in GridFS delete methods (CVE-2026-88029_).

.. _CVE-2026-88029: https://www.cve.org/CVERecord?id=CVE-2026-88029

Changes in Version 4.18.0 (2026/09/03)

... (truncated)

Commits

Updates virtualenv from 21.14.12 to 21.14.13

Release notes

Sourced from virtualenv's releases.

21.14.13

Security

  • Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by @​rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax. (#3466) by @​gaborbernat.
  • Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, replace a read-only .venv redirect that points at a virtualenv. (#3466) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

.. _release-21-15-5:

21.15.5 (2026-11-04)

.. _release-21-15-4:

21.15.4 (2026-11-04)

.. _release-21-15-4-fixed:

Fixed

  • Upgrade embedded wheels: pip to 26.3 from 26.2.2 (:pr:3508) by :user:gaborbernat.

.. _release-21-15-3:

21.15.3 (2026-11-03)

.. _release-21-15-3-fixed:

Fixed

  • Add the environment's lib/pkgconfig to PKG_CONFIG_PATH when activating from xonsh, and restore the previous value or unset it again on deactivate, as the other activators already do (:pr:3505) by :user:darrenhuai and :user:gaborbernat.
  • Read virtualenv.ini values without interpolation, as environment variables and command line flags already are. A value holding a %, such as prompt = 50% done, was ignored without any message. %% and %(name)s are now kept as written, so write a single % (:pr:3501) by :user:darrenhuai and :user:gaborbernat.
  • Reject a destination that already exists but is not a directory, such as /dev/null, a FIFO or a socket, or that sits inside one, with a usage error instead of a NotADirectoryError once creation has started. A regular file now gets the same is not a directory message instead of is a file (:pr:3504) by :user:darrenhuai and :user:gaborbernat.
  • Set TCL_LIBRARY and TK_LIBRARY to the interpreter's Tcl/Tk paths in activate.nu, as the other activators do. Nushell activation used to leave both variables as they were (:pr:3502) by :user:darrenhuai and

... (truncated)

Commits

Updates ddtrace from 4.8.2 to 4.15.6

Release notes

Sourced from ddtrace's releases.

4.15.6

Security Issues

4.15.5

Bug Fixes

  • Code Security (IAST): fixes an issue where taint tracking could abort the Python process when old-style % string formatting handled tainted text containing a lone surrogate character.

4.15.4

Bug Fixes

  • internal: Fixes an issue on macOS where starting a subprocess can deadlock while a hostname lookup is in progress.
  • tracing: Fixes a native memory leak on Linux when DD_TRACE_OTEL_CTX_ENABLED is set to true and a thread exits while an OpenTelemetry thread context is still attached.

4.15.3

Bug Fixes

  • LLM Observability:
    • Resolves an issue where a streamed Bedrock InvokeModelWithResponseStream request that ended in an error or was cancelled part-way produced a span with no output annotation. The text received before the failure is now tagged on the span.
    • Resolves an issue where a streamed Bedrock ConverseStream request that ended in an error or was cancelled part-way produced a span that was not marked as an error, making an interrupted request indistinguishable from a successful one.
    • This fix resolves an issue where cancelled or failed OpenAI streamed requests produced no LLM Observability span at all. These requests now produce an LLM span carrying the input messages, whatever output arrived before the stream ended, and estimated token metrics.
  • internal:
    • Fixes incorrect telemetry being collected when hitting cardinality limits during stats computation.
  • tracing:
    • Fixes an issue where the Python garbage collector stops and memory grows without limit when DD_RUNTIME_METRICS_ENABLED is true.
  • Profiling:
    • A crash that could occur in applications that use signal handlers to recover from crashes has been fixed.

4.15.2

Upgrade Notes

  • tracing: DD_TRACE_OTEL_CTX_ENABLED now defaults to false until a Linux-native memory leak caused by setting it to true is fixed.

Bug Fixes

  • LLM Observability: Fixes an issue where abandoned or disconnected streamed LLM requests can leave spans unfinished, causing memory to grow in long-running web workers.
  • CI Visibility: Fixes an issue where Auto Test Retries do not retry tests that use pytest-timeout thread mode and terminate a pytest-xdist worker.

4.15.1

Bug Fixes

  • LLM Observability
    • Resolves an issue where gen_ai.* attributes were added to APM spans when LLM Observability was disabled. These attributes are now only emitted when LLM Observability is enabled.

4.15.0

Estimated end-of-life date, accurate to within three months: 05-2027

See the support level definitions for more information.

... (truncated)

Commits
  • 83ea398 fix(tracing): prevent quadratic query string obfuscation [backport 4.15] (#20...
  • 4ae3a7f chore: bump version to 4.15.6 (#20863)
  • 479a759 ci: update one-pipeline to 1.6.0 [4.15] (#20842)
  • 8da5bb7 chore: bump version to 4.15.5 (#20833)
  • ace9724 fix(iast): avoid process abort in modulo_aspect on lone surrogates [backpor...
  • b97ac67 upgrade pyproject.toml version (#20715)
  • 27e417f chore(native): bump libdatadog v43.0.1 → v43.0.2 (#20711)
  • 45e21d6 fix(runtime): avoid macOS subprocess fork deadlock [backport 4.15] (#20678)
  • 3c2beeb chore: bump version to 4.15.3 (#20630)
  • 779fd48 fix(runtime-metrics): prevent gc stopping due to deadlock in gc monitor (#20624)
  • Additional commits viewable in compare view

Updates pymongo from 4.17.0 to 4.18.3

Release notes

Sourced from pymongo's releases.

PyMongo 4.18.3

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-3-released/344145

CVE-2026-106435

PyMongo 4.18.2

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732

CVE-2026-96749 CVE-2026-96748 CVE-2026-96747

PyMongo 4.18.1

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-1-released/343338

PyMongo 4.18.0

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-released/343137

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.18.3 (2026/10/08)

Version 4.18.3 is a bug fix release.

  • Hardened BSON regex decoding against malformed documents (PYTHON-6110_).

.. _PYTHON-6110: https://jira.mongodb.org/browse/PYTHON-6110

Issues Resolved ...............

See the PyMongo 4.18.3 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.3 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52955

Changes in Version 4.18.2 (2026/09/24)

Version 4.18.2 is a bug fix release.

  • Hardened the bson buffer size guard against signed integer overflow. (CVE-2026-96749_).
  • Fixed connection string parsing to percent-decode each host individually. (CVE-2026-96748_).
  • Client-side field level encryption now rejects a KMS endpoint ending in .sock. (CVE-2026-96747_).

.. _CVE-2026-96749: https://www.cve.org/CVERecord?id=CVE-2026-96749 .. _CVE-2026-96748: https://www.cve.org/CVERecord?id=CVE-2026-96748 .. _CVE-2026-96747: https://www.cve.org/CVERecord?id=CVE-2026-96747

Issues Resolved ...............

See the PyMongo 4.18.2 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.2 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52896

Changes in Version 4.18.1 (2026/09/10)

Version 4.18.1 is a bug fix release.

  • Use an exact match for the file ID in GridFS delete methods (CVE-2026-88029_).

.. _CVE-2026-88029: https://www.cve.org/CVERecord?id=CVE-2026-88029

Changes in Version 4.18.0 (2026/09/03)

... (truncated)

Commits

Updates virtualenv from 21.14.12 to 21.14.13

Release notes

Sourced from virtualenv's releases.

21.14.13

Security

  • Stop bash running commands from --prompt or an environment name containing $(...), backticks or a backslash after shopt -s promptvars, set -o posix, or in a child shell that inherits an exported PS1 (GHSA-cx6f-vjhg-g3cc); reported by @​rozzkml. zsh now draws the prompt from psvar[9], which is never parsed as shell syntax. (#3466) by @​gaborbernat.
  • Write the .venv redirect and the wheel RECORD with exclusive create, so a link planted after the existence check cannot redirect the write. On POSIX, replace a read-only .venv redirect that points at a virtualenv. (#3466) by @​gaborbernat.

🐍 PyPI release

📜 Full Changelog

Changelog

Sourced from virtualenv's changelog.

################# Release History #################

.. towncrier-draft-entries:: [UNRELEASED DRAFT]

.. towncrier release notes start

.. _release-21-15-5:

21.15.5 (2026-11-04)

.. _release-21-15-4:

21.15.4 (2026-11-04)

.. _release-21-15-4-fixed:

Fixed

  • Upgrade embedded wheels: pip to 26.3 from 26.2.2 (:pr:3508) by :user:gaborbernat.

.. _release-21-15-3:

21.15.3 (2026-11-03)

.. _release-21-15-3-fixed:

Fixed

  • Add the environment's lib/pkgconfig to PKG_CONFIG_PATH when activating from xonsh, and restore the previous value or unset it again on deactivate, as the other activators already do (:pr:3505) by :user:darrenhuai and :user:gaborbernat.
  • Read virtualenv.ini values without interpolation, as environment variables and command line flags already are. A value holding a %, such as prompt = 50% done, was ignored without any message. %% and %(name)s are now kept as written, so write a single % (:pr:3501) by :user:darrenhuai and :user:gaborbernat.
  • Reject a destination that already exists but is not a directory, such as /dev/null, a FIFO or a socket, or that sits inside one, with a usage error instead of a NotADirectoryError once creation has started. A regular file now gets the same is not a directory message instead of is a file (:pr:3504) by :user:darrenhuai and :user:gaborbernat.
  • Set TCL_LIBRARY and TK_LIBRARY to the interpreter's Tcl/Tk paths in activate.nu, as the other activators do. Nushell activation used to leave both variables as they were (:pr:3502) by :user:darrenhuai and

... (truncated)

Commits

Updates pymongo from 4.18.2 to 4.18.3

Release notes

Sourced from pymongo's releases.

PyMongo 4.18.3

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-3-released/344145

CVE-2026-106435

PyMongo 4.18.2

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-2-released/343732

CVE-2026-96749 CVE-2026-96748 CVE-2026-96747

PyMongo 4.18.1

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-1-released/343338

PyMongo 4.18.0

Community notes: https://www.mongodb.com/community/forums/t/pymongo-4-18-released/343137

Changelog

Sourced from pymongo's changelog.

Changes in Version 4.18.3 (2026/10/08)

Version 4.18.3 is a bug fix release.

  • Hardened BSON regex decoding against malformed documents (PYTHON-6110_).

.. _PYTHON-6110: https://jira.mongodb.org/browse/PYTHON-6110

Issues Resolved ...............

See the PyMongo 4.18.3 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.3 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52955

Changes in Version 4.18.2 (2026/09/24)

Version 4.18.2 is a bug fix release.

  • Hardened the bson buffer size guard against signed integer overflow. (CVE-2026-96749_).
  • Fixed connection string parsing to percent-decode each host individually. (CVE-2026-96748_).
  • Client-side field level encryption now rejects a KMS endpoint ending in .sock. (CVE-2026-96747_).

.. _CVE-2026-96749: https://www.cve.org/CVERecord?id=CVE-2026-96749 .. _CVE-2026-96748: https://www.cve.org/CVERecord?id=CVE-2026-96748 .. _CVE-2026-96747: https://www.cve.org/CVERecord?id=CVE-2026-96747

Issues Resolved ...............

See the PyMongo 4.18.2 release notes in JIRA_ for the list of resolved issues in this release.

.. _PyMongo 4.18.2 release notes in JIRA: https://jira.mongodb.org/secure/ReleaseNote.jspa?projectId=10004&version=52896

Changes in Version 4.18.1 (2026/09/10)

Version 4.18.1 is a bug fix release.

  • Use an exact match for the file ID in GridFS delete methods (CVE-2026-88029_).

.. _CVE-2026-88029: https://www.cve.org/CVERecord?id=CVE-2026-88029

Changes in Version 4.18.0 (2026/09/03)

... (truncated)

Commits

Updates certifi from 2024.7.4 to 2026.10.18

Commits

Updates dnspython from 2.6.1 to 2.9.0

Release notes

Sourced from dnspython's releases.

dnspython 2.9.0

This release fixes a potential excessive CPU consumption issue. Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos, for discovering and reporting this issue.

See What's New for details.

The minimum supported version of Python is 3.11.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Nicki Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

dnspython 2.8.0

See What's New for details.

The minimum supported version of Python is 3.10.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Tomáš Křížek, Petr Špaček, and Brian Wellington.

This release was published to PyPI using Trusted Publishing.

dnspython 2.7.0

See What's New for details.

The minimum supported version of Python is 3.9.

My thanks to the many people who have contributed to this release. Also thanks to my co-maintainers: Tomáš Křížek, Petr Špaček, and Brian Wellington.

Changelog

Sourced from dnspython's changelog.

2.9.0

  • Decompression chain length is limited to 16. Prior to this change, a maliciously crafted DNS message could cause dns.name.from_wire_parser() to use excessive CPU for DNS name decompression. Applications which processed untrusted DNS wire form messages with dnspython could be degraded or DoS'd by the extra CPU use required.

    Thanks to Evgenios Gkritsis, Constantinos Patsakis, and George Stergiopoulos for finding and reporting this issue.

    See GHSA-45c3-73f7-pv4m

  • Httpx2 has replaced httpx for HTTPS TCP connections.

  • The minimum supported Python version is now 3.11.

  • DNSSEC now supports ML-DSA-44, a post-quantum signature algorithm.

  • The NSEC3 Next Hashed Owner Name in presentation format is now decoded as base32hex (RFC 5155 Section 1.3, RFC 4648 Extended Hex Alphabet). The letters W, X, Y, and Z are not in that alphabet; they used to be accepted and silently decoded to a different owner name, so to_text of the result did not match the input. They are now rejected.

  • The NID and L64 node/locator ids in presentation format are now rejected when a group contains anything other than hex digits. A sign or underscore, which int() silently accepts, produced a record whose text form did not parse back the same way (RFC 6742).

  • Rdata of a known type in the generic \# syntax, such as an NS record in a zone file, no longer fails to parse when it contains a name under the origin. Its names are relativized as in the type's own text form.

  • The SVCB and HTTPS ech parameter value must now be an ECHConfigList with a correct length prefix and at least 4 octets of content (RFC 9848, RFC 9849). The individual ECHConfig structures are not checked.

  • SVCB and HTTPS SvcParamKeys in presentation format, including those listed in mandatory, must now be spelled as RFC 9460 requires: 1-63 lowercase letters, digits, or hyphens. Uppercase keys such as ALPN and keys with underscores such as no_default_alpn are rejected.

  • SVCB and HTTPS presentation format parsing now follows the escaping rules of RFC 9460. SvcParamKeys may not contain escapes (e.g. \097lpn=h2), and in comma-separated values (alpn, docpath) only \, and \\ are valid escapes after character-string decoding (e.g. alpn="h2\\x" is rejected).

... (truncated)

Commits

Updates filelock from 3.20.3 to 4.2.1

Release notes

Sourced from filelock's releases.

4.2.1

Security

This release fixes the following vulnerabilities:

  • CVE-2026-112940 (high): ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files.
  • CVE-2026-112906 (medium): SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse.
  • CVE-2026-112908 (medium): StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold.
  • CVE-2026-112909 (medium): UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path.
  • CVE-2026-112910 (medium): WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL.
  • CVE-2026-112911 (medium): StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion.
  • CVE-2026-112914 (medium): SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory.
  • CVE-2026-112915 (medium): ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout.
  • CVE-2026-112934 (medium): SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its record.
  • CVE-2026-112935 (medium): SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders.
  • CVE-2026-112937 (medium): ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name.
  • CVE-2026-112938 (medium): StrictSoftFileLock follows a symbolic link swapped in at .filelock and creates claim files in a directory another local user chooses.
  • CVE-2026-112939 (medium): SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker.
  • CVE-2026-112907 (low): On Windows an oplock on a soft lock's marker holds SoftFileLock.acquire() past its timeout and blocks the stale break.
  • CVE-2026-112912 (low): Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker.
  • CVE-2026-112913 (low): ReadWriteLock on Windows acts on SQLite side files another local user places beside its database.
  • CVE-2026-112941 (low): SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the lock.

Bug fixes

  • On a singleton wrapper, AsyncReadWriteLock.close() and AsyncSoftReadWriteLock.close() end only the holds that tasks acquired through that wrapper. A reader that arrives during close() gets the closed error instead of joining the ending hold. After synchronous code closes or force-releases the shared lock, the wrappers refuse to admit readers into the ended hold, and close() on such a wrapper returns. Closing one wrapper no longer ends a task's nested hold taken through another wrapper on the same path. #832 by @​gaborbernat.
  • ReadWriteLock locks again after a release() that an exception from a signal handler interrupted. The async read-write wrappers stop admitting readers into such a level. The async read-write locks forget a hold whose backend release failed after the backend let go, and they free the memory of each acquire that times out or is canceled. AsyncFileLock returns from release() after a few hundred acquires gave up behind a waiting one. An exception from a signal handler delivered while an AsyncFileLock call joins its queue no longer blocks every later call on that lock. #833 by @​gaborbernat.
  • Fix ReadWriteLock acting on -journal, -wal or -shm files another process puts beside its database: a write could land in another file, a reader could get in beside a writer, and an acquire could fail. SQLite now opens the database by name only in a directory no other account can write, and through a private hard link elsewhere. On Windows the directory's access control list decides. Where hard links are unavailable, keep the database in a directory other accounts cannot write, such as one under %LOCALAPPDATA%. The lock removes link directories through a checked descriptor rather than by name, reads a link directory's name only when the locking account owns it, and leaves alone a directory with other content renamed onto a link directory's name. A database whose schema takes more than a few kilobytes to load raises ValueError instead of running past the acquire timeout. #834 by @​gaborbernat.
  • Fix five bugs in opening the lock file. UnixFileLock no longer truncates a file it did not create, such as one renamed to the lock path, and no longer applies mode to it. An on_acquired hook that writes holder metadata now truncates the file itself. A lease (Linux) or an oplock (Windows) on the lock file or a soft lock's marker no longer holds acquire() past its timeout or blocking=False, and an oplock no longer holds release(); ReadWriteLock on Windows waits for its timeout and raises Timeout. On Windows, a mode without group and other bits, such as 0o600, now creates the lock file with an owner-only permission list; the ReadWriteLock database gets the same. The soft locks' writability check no longer follows a symlink swapped in at the lock path. On a filesystem without flock, a contender from another account now waits on a marker it cannot write instead of raising PermissionError. #835 by @​gaborbernat.
  • Fix SoftFileLock, MarkerSoftFileLock and SoftFileLease removing a live holder's marker in three cases: the holder and the contender run in Linux time namespaces with different boottime offsets; only one of them can read the boot id; a process other than the owner rewrote the marker. Soft markers no longer carry group or other write bits. A process name containing a carriage return or another line separator no longer makes the stale check raise ValueError. When /proc/self/ns/time exists but cannot be read, the stale check no longer compares start times and keeps the marker. #836 by @​gaborbernat.
  • The async read-write locks record their hold under a task owner, so synchronous code on the executor thread that took the hold can no longer re-enter or release it. AsyncSoftReadWriteLock gives back one level on release, so synchronous readers of a shared singleton keep theirs. SoftReadWriteLock tracks read levels per thread: release() from a thread that holds none raises RuntimeError. After its heartbeat recorded a lost hold, it refuses new acquires until that hold is released.

@dependabot
Bump the pip group across 5 directories with 8 updates
5dc9b91 
Bumps the pip group with 1 update in the /docs directory: [tornado](https://github.com/tornadoweb/tornado).
Bumps the pip group with 3 updates in the /emmet-api directory: [ddtrace](https://github.com/DataDog/dd-trace-py), [pymongo](https://github.com/mongodb/mongo-python-driver) and [virtualenv](https://github.com/pypa/virtualenv).
Bumps the pip group with 3 updates in the /emmet-api/requirements directory: [ddtrace](https://github.com/DataDog/dd-trace-py), [pymongo](https://github.com/mongodb/mongo-python-driver) and [virtualenv](https://github.com/pypa/virtualenv).
Bumps the pip group with 6 updates in the /emmet-builders/requirements directory:

| Package | From | To |
| --- | --- | --- |
| [pymongo](https://github.com/mongodb/mongo-python-driver) | `4.18.2` | `4.18.3` |
| [certifi](https://github.com/certifi/python-certifi) | `2024.7.4` | `2026.10.18` |
| [dnspython](https://github.com/rthalley/dnspython) | `2.6.1` | `2.9.0` |
| [filelock](https://github.com/tox-dev/filelock) | `3.20.3` | `4.2.1` |
| [virtualenv](https://github.com/pypa/virtualenv) | `21.14.12` | `21.14.13` |
| [msgpack](https://github.com/msgpack/msgpack-python) | `1.2.1` | `1.2.3` |

Bumps the pip group with 1 update in the /emmet-core/requirements directory: [virtualenv](https://github.com/pypa/virtualenv).


Updates `tornado` from 6.5.9 to 6.6
- [Changelog](https://github.com/tornadoweb/tornado/blob/master/docs/releases.rst)
- [Commits](tornadoweb/tornado@v6.5.9...v6.6.0)

Updates `ddtrace` from 4.8.2 to 4.15.6
- [Release notes](https://github.com/DataDog/dd-trace-py/releases)
- [Changelog](https://github.com/DataDog/dd-trace-py/blob/main/CHANGELOG.md)
- [Commits](DataDog/dd-trace-py@v4.8.2...v4.15.6)

Updates `pymongo` from 4.17.0 to 4.18.3
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.3/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.17.0...4.18.3)

Updates `virtualenv` from 21.14.12 to 21.14.13
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.14.12...21.14.13)

Updates `ddtrace` from 4.8.2 to 4.15.6
- [Release notes](https://github.com/DataDog/dd-trace-py/releases)
- [Changelog](https://github.com/DataDog/dd-trace-py/blob/main/CHANGELOG.md)
- [Commits](DataDog/dd-trace-py@v4.8.2...v4.15.6)

Updates `pymongo` from 4.17.0 to 4.18.3
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.3/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.17.0...4.18.3)

Updates `virtualenv` from 21.14.12 to 21.14.13
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.14.12...21.14.13)

Updates `pymongo` from 4.18.2 to 4.18.3
- [Release notes](https://github.com/mongodb/mongo-python-driver/releases)
- [Changelog](https://github.com/mongodb/mongo-python-driver/blob/4.18.3/doc/changelog.rst)
- [Commits](mongodb/mongo-python-driver@4.17.0...4.18.3)

Updates `certifi` from 2024.7.4 to 2026.10.18
- [Commits](certifi/python-certifi@2024.07.04...2026.10.18)

Updates `dnspython` from 2.6.1 to 2.9.0
- [Release notes](https://github.com/rthalley/dnspython/releases)
- [Changelog](https://github.com/rthalley/dnspython/blob/main/doc/whatsnew.rst)
- [Commits](rthalley/dnspython@v2.6.1...v2.9.0)

Updates `filelock` from 3.20.3 to 4.2.1
- [Release notes](https://github.com/tox-dev/filelock/releases)
- [Changelog](https://github.com/tox-dev/filelock/blob/main/docs/changelog.rst)
- [Commits](tox-dev/filelock@3.20.3...4.2.1)

Updates `virtualenv` from 21.14.12 to 21.14.13
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.14.12...21.14.13)

Updates `msgpack` from 1.2.1 to 1.2.3
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/CHANGELOG.md)
- [Commits](msgpack/msgpack-python@v1.2.1...v1.2.3)

Updates `virtualenv` from 21.14.12 to 21.14.13
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/main/docs/changelog.rst)
- [Commits](pypa/virtualenv@21.14.12...21.14.13)

---
updated-dependencies:
- dependency-name: tornado
  dependency-version: '6.6'
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: ddtrace
  dependency-version: 4.15.6
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pymongo
  dependency-version: 4.18.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: virtualenv
  dependency-version: 21.14.13
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: ddtrace
  dependency-version: 4.15.6
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pymongo
  dependency-version: 4.18.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: virtualenv
  dependency-version: 21.14.13
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: pymongo
  dependency-version: 4.18.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: certifi
  dependency-version: 2026.10.18
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: dnspython
  dependency-version: 2.9.0
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: filelock
  dependency-version: 4.2.1
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: virtualenv
  dependency-version: 21.14.13
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: msgpack
  dependency-version: 1.2.3
  dependency-type: direct:production
  dependency-group: pip
- dependency-name: virtualenv
  dependency-version: 21.14.13
  dependency-type: direct:production
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update Python code labels Nov 5, 2026
@codecov-commenter

codecov-commenter commented Nov 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.52%. Comparing base (aeb45e4) to head (5dc9b91).

Additional details and impacted files 
@@           Coverage Diff           @@
##             main    #1550   +/-   ##
=======================================
  Coverage   85.52%   85.52%           
=======================================
  Files         258      258           
  Lines       18600    18600           
=======================================
  Hits        15907    15907           
  Misses       2693     2693

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@tsmathis tsmathis closed this Nov 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update Python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@codecov-commenter @tsmathis