Skip to content

chore(deps-pip): bump the pip group across 1 directory with 13 updates - #719

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-a61051145e
Open

chore(deps-pip): bump the pip group across 1 directory with 13 updates#719
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/pip-a61051145e

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Nov 2, 2026

Copy link
Copy Markdown
Contributor

Bumps the pip group with 13 updates in the / directory:

Package From To
sqlalchemy 2.0.41 2.1.6
psycopg2-binary 2.9.10 2.9.13
flask-wtf 1.2.2 1.3.0
wtforms 3.2.1 3.3.1
email-validator 2.2.0 2.3.0
python-dotenv 1.2.2 1.2.4
requests 2.33.0 2.34.2
cryptography 50.0.0 50.0.2
py7zr 1.1.3 1.1.4
flask-socketio 5.6.1 5.7.0
gunicorn 23.0.0 26.2.0
fpdf2 2.8.9 2.9.0
pytest 9.0.3 9.2.0

Updates sqlalchemy from 2.0.41 to 2.1.6

Release notes

Sourced from sqlalchemy's releases.

2.1.6

Released: October 21, 2026

orm

  • [orm] [bug] Fixed issue where a Session flush that replaced an expired object in the identity map with a newly flushed object of the same primary key would emit a SELECT to refresh the expired object, solely in order to determine whether to emit an "Identity map already had an identity" warning. This could occur when a row loaded within a transaction is rolled back and its primary key value is subsequently reused, and could lead to an AttributeError if the expired object were garbage collected during that load. The check now emits no SQL, and an expired object that is replaced in this way no longer causes the warning to be emitted.

    This change is also backported to: 2.0.56

    References: #13711

  • [orm] [bug] [regression] Fixed regression caused by #13070 where using more than one orm.with_loader_criteria() option for the same entity, where the criteria made use of correlated subqueries referring to that entity, would fail with a RecursionError when compiling.

    References: #13701

  • [orm] [bug] [regression] Fixed regression caused by the new implementation of .params() for statements introduced in #7066, where parameter values passed to the .params() method of an ORM statement created using Select.from_statement() would not be applied when the statement was compiled without the compiled statement cache, such as when the cache was disabled or when the statement was stringified directly, leading to an error that a value is required for the bound parameter.

    References: #13709

orm extensions

  • [bug] [orm extensions] Fixed an issue in the instrumentation_toplevel extension where unrelated classes inheriting from typing.Generic could incorrectly raise a TypeError when using different instrumentation implementations. Pull request courtesy TomasCaruso10.

    This change is also backported to: 2.0.56

    References: #13680

... (truncated)

Commits

Updates psycopg2-binary from 2.9.10 to 2.9.13

Changelog

Sourced from psycopg2-binary's changelog.

Current release

What's new in psycopg 2.9.13 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.15 (:ticket:[#1848](https://github.com/psycopg/psycopg2/issues/1848)).
  • Fix parsing of malformed bytea input.
  • Fix parsing of malformed int64 input in arrays (:ticket:[#1847](https://github.com/psycopg/psycopg2/issues/1847)).
  • Add a pyproject.toml file to declare a PEP 517 build backend (:ticket:[#1788](https://github.com/psycopg/psycopg2/issues/1788)).
  • Drop support for Python 3.9.

What's new in psycopg 2.9.12 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Fix infinite loop with malformed interval (:ticket:1835).

What's new in psycopg 2.9.11 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.14.
  • Avoid a segfault passing more arguments than placeholders if Python is built with assertions enabled (:ticket:[#1791](https://github.com/psycopg/psycopg2/issues/1791)).
  • Add riscv64 platform binary packages (:ticket:[#1813](https://github.com/psycopg/psycopg2/issues/1813)).
  • ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 18.
  • Drop support for Python 3.8.

What's new in psycopg 2.9.10 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.13.
  • Receive notifications on commit (:ticket:[#1728](https://github.com/psycopg/psycopg2/issues/1728)).
  • ~psycopg2.errorcodes map and ~psycopg2.errors classes updated to PostgreSQL 17.
  • Drop support for Python 3.7.

What's new in psycopg 2.9.9 ^^^^^^^^^^^^^^^^^^^^^^^^^^^

  • Add support for Python 3.12.
  • Drop support for Python 3.6.

What's new in psycopg 2.9.8

... (truncated)

Commits
  • f650e7a chore: bump to release 2.9.13
  • 368c8a1 chore!: drop support for Python 3.9
  • 9b39e65 chore: drop scaleway build support
  • 2ca7041 fix: fix handling of PostgreSQL 18 exceptions
  • 5385c02 Build CPython 3.15 wheels
  • 1d32e1f ci: only attempt triggering documentation refresh when pushing on main repo
  • 433e7b7 chore: add pyproject.toml file to declare a PEP 517 build backend
  • 8fb80bc fix: fix parsing of malformed int64 input in arrays
  • f98014a fix: fix parsing of malformed bytea input
  • 822b79c chore: bump dependencies in binary package
  • Additional commits viewable in compare view

Updates flask-wtf from 1.2.2 to 1.3.0

Release notes

Sourced from flask-wtf's releases.

v1.3.0

What's Changed

New Contributors

Full Changelog: pallets-eco/flask-wtf@v1.2.2...v1.3.0

Changelog

Sourced from flask-wtf's changelog.

Version 1.3.0

Released 2026-04-23

  • Don't read the whole uploaded files to know their size. :pr:635
  • Stop support for Python 3.9. Start support for Python 3.14. :pr:648
  • Migrate the project to uv. :pr:649
  • Allow setting a nonce on :class:~flask_wtf.recaptcha.RecaptchaField (string or zero-argument callable) for nonce-based Content Security Policies. :pr:312
  • Add csrf_meta_tag() helper and WTF_CSRF_META_NAME setting to render the CSRF token as an HTML <meta> tag.
  • Forward keyword arguments passed to the reCAPTCHA widget as HTML attributes on the captcha <div>, with the field id used as a default id. :pr:353
  • Add apply_exemptions parameter to :meth:~flask_wtf.csrf.CSRFProtect.protect so @csrf.exempt keeps working when validation is triggered manually. :pr:419
  • Add RECAPTCHA_ENABLED setting. :pr:509
Commits

Updates wtforms from 3.2.1 to 3.3.1

Release notes

Sourced from wtforms's releases.

3.3.1

What's Changed

Full Changelog: pallets-eco/wtforms@3.3.0...3.3.1

3.3.0

What's Changed

... (truncated)

Changelog

Sourced from wtforms's changelog.

Version 3.3.1

Released 2026-10-24

  • Fix :class:~fields.FieldList entries losing the form prefix in their name when the list renumbers them. :issue:944
  • Speed up :class:~validators.URL on hostnames with many consecutive dashes. :issue:945

Version 3.3.0

Released 2026-10-23

  • Drop support for Python 3.10. Add support for Python 3.15.
  • Add native :class:DataList support. Options are declared with :class:DataListChoice, or with the shorthand {value: label} dict syntax. :issue:653 :issue:886 :pr:921
  • Add :class:~fields.ButtonField to render <button type="submit"> controls with string values. :issue:784 :pr:892
  • Add :class:~validators.DateRange. min and max may be callables to compute dynamic bounds; :class:~validators.NumberRange accepts callables on the same terms. :pr:787
  • Add :class:~fields.FieldList insert_entry and indexed pop_entry. The following entries are renumbered, with their ids and labels. :issue:256 :pr:901 :pr:912
  • :class:~fields.SelectField refactor. Options are declared with :class:~fields.SelectChoice, which takes HTML attributes in render_kw and an optgroup. iter_choices and iter_groups yield :class:~fields.Choice objects. choices also accepts the shorthand dict syntax: {value: label} for flat options and {label: {value: label}} for optgroups. :issue:692 :issue:886 :issue:922 :pr:739 :pr:889
  • choices callables on :class:~fields.SelectField and :class:DataList may accept (form, field). They run on the first read and their result is cached. Calling :meth:~form.BaseForm.post_process again refreshes them, also for the entries added with :meth:~fields.FieldList.append_entry and :meth:~fields.FieldList.insert_entry. :issue:922
  • Add :func:fields.enum_choices, :func:fields.enum_coerce and :func:~datalist.enum_datalist for Enum-backed choices. :issue:338 :issue:922 :pr:916
  • Add :meth:fields.Field.post_process and :meth:form.BaseForm.post_process hooks, propagated through :class:~fields.FormField and :class:~fields.FieldList, for cross-field finalization. :issue:922
  • Add Field._form and BaseForm._parent_form so fields and nested forms can reach their enclosing form. :class:~fields.FieldList entries

... (truncated)

Commits
  • c7b00fb chore: bump to 3.3.1
  • 1493343 fix: speed up URL validation on hostnames with many dashes
  • b51f66d fix: keep the form prefix when FieldList renumbers its entries
  • d1a3d96 chore: bump to 3.3.0
  • 4793273 fix: copy render_kw for each form instance
  • 1d68ff1 chore: bump to 3.3.0b4
  • c9dc899 chore(deps): bump the dependencies group with 7 updates
  • ef4e469 chore: group monthly dependabot updates for actions and pre-commit
  • b1e5741 chore: pre-commit update
  • 61a7614 Merge pull request #939 from azmeuk/lazy-choices
  • Additional commits viewable in compare view

Updates email-validator from 2.2.0 to 2.3.0

Release notes

Sourced from email-validator's releases.

v2.3.0

  • The package name is changed from using an underscore (email_validator) to a dash (email-validator) to match PyPi's normalized package name.
  • The library no longer checks that the local part is at most 64 characters because a more careful reading of RFC 5321 indicates the limit is optional and such email addresses have been found in the wild. However the check can be restored using a new strict=True parameter, and the overall 254 character email address length limit is still in place.
  • New EmailSyntaxError messages are used for some exiting syntax errors related to @-sign homoglyphs and invalid characters in internationalized domains.
  • When using allow_display_name=True, display names are now returned with Unicode NFC normalization.
  • TypeError is now raised if something other than str (or bytes) is passed as the email address.
Changelog

Sourced from email-validator's changelog.

2.3.0 (August 26, 2025)

  • The package name is changed from using an underscore (email_validator) to a dash (email-validator) to match PyPi's normalized package name.
  • The library no longer checks that the local part is at most 64 characters because a more careful reading of RFC 5321 indicates the limit is optional and such email addresses have been found in the wild. However the check can be restored using a new strict=True parameter, and the overall 254 character email address length limit is still in place.
  • New EmailSyntaxError messages are used for some exiting syntax errors related to @-sign homoglyphs and invalid characters in internationalized domains.
  • When using allow_display_name=True, display names are now returned with Unicode NFC normalization.
  • TypeError is now raised if something other than str (or bytes) is passed as the email address.
Commits
  • 030a63a Version 2.3.0
  • e943a0f Raise TypeError when an invalid argument is passed for email, closes #155
  • f90d256 Remove local part length check unless new strict flag is given, fixes #158
  • 98800ba Add explicit checks for internationalized domain name characters invalid unde...
  • 936aead Fix final syntax checks on normalized internationalized domains checking the ...
  • 8043de4 NFC-normalize display names per UTS #39
  • bc08faa Add one-off error messages for full-width-at and small-commercial-at which ar...
  • a1c90ab Split exceptions_types.py into exceptions.py and types.py
  • dbcf07c Change package name from using underscore to dash to match PyPi normalized pa...
  • 7c22208 Support ALLOW_DISPLAY_NAME and ALLOW_EMPTY_LOCAL in the CLI (#145)
  • Additional commits viewable in compare view

Updates python-dotenv from 1.2.2 to 1.2.4

Release notes

Sourced from python-dotenv's releases.

v1.2.4

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698

v1.2.3

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Changelog

Sourced from python-dotenv's changelog.

[1.2.4] - 2026-10-01

Fixed

  • dotenv get no longer exits with code 1 for empty string values (KEY=) by [@​ShamikOfficial] in #700
  • An unquoted empty value followed by an inline comment (e.g. KEY= # comment) is now parsed as an empty string instead of the comment text by [@​Noethix55555] in #663
  • dotenv run --no-override now expands variable references with the same precedence as load_dotenv(override=False), so a value like ${BASE}/suffix uses the existing BASE from the environment instead of the one from the .env file by [@​ROTl24] in #698

[1.2.3] - 2026-08-16

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Commits
  • a565c2c Bump version: 1.2.3 → 1.2.4
  • 4a7abd0 docs: add 1.2.4 release notes (#663, #698, #700)
  • f215c02 fix: dotenv get exits 0 for empty string values (#700)
  • 58f2d7c test: make test_run_with_command_flags portable and meaningful (#709)
  • e0310e5 fix: honor --no-override when expanding variables in dotenv run (#698)
  • a00cb2e docs: add CHANGELOG entry for #663 (fix #600)
  • f5485a6 fix: parse empty unquoted value with inline comment as empty string
  • 49515af Bump version: 1.2.2 → 1.2.3
  • 8ac846f chore: add release runbook (RELEASING.md) and make release target
  • bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
  • Additional commits viewable in compare view

Updates requests from 2.33.0 to 2.34.2

Release notes

Sourced from requests's releases.

v2.34.2

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2342-2026-05-14

v2.34.1

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

New Contributors

Full Changelog: https://github.com/psf/requests/blob/main/HISTORY.md#2341-2026-05-13

v2.34.0

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The

... (truncated)

Changelog

Sourced from requests's changelog.

2.34.2 (2026-05-14)

  • Moved headers input type back to Mapping to avoid invariance issues with MutableMapping and inferred dict types. Users calling Request.headers.update() may need to narrow typing in their code. (#7441)

2.34.1 (2026-05-13)

Bugfixes

  • Widened json input type from dict and list to Mapping and Sequence. (#7436)
  • Changed headers input type to MutableMapping and removed None from Request.headers typing to improve handling for users. (#7431)
  • Response.reason moved from str | None to str to improve handling for users. (#7437)
  • Fixed a bug where some bodies with custom __getattr__ implementations weren't being properly detected as Iterables. (#7433)

2.34.0 (2026-05-11)

Announcements

  • Requests 2.34.0 introduces inline types, replacing those provided by typeshed. Public API types should be fully compatible with mypy, pyright, and ty. We believe types are comprehensive but if you find issues, please report them to the pinned tracking issue.

    Special thanks to @​bastimeyer, @​cthoyt, @​edgarrmondragon, and @​srittau for helping review and test the types ahead of the release. (#7272)

Improvements

  • Digest Auth hashing algorithms have added usedforsecurity=False to clarify security considerations. (#7310)
  • Requests added support for Python 3.15 based on beta1. Downstream projects should be able to start testing prior to its release in October. (#7422)
  • Requests added support for Python 3.14t. (#7419)

Bugfixes

  • Response.history no longer contains a reference to itself, preventing accidental looping when traversing the history list. (#7328)
  • Requests no longer performs greedy matching on no_proxy domains. The proxy_bypass implementation has been updated with CPython's fix from bpo-39057. (#7427)
  • Requests no longer incorrectly strips duplicate leading slashes in URI paths. This should address user issues with specific presigned URLs. Note the full fix requires urllib3 2.7.0+. (#7315)

... (truncated)

Commits

Updates cryptography from 50.0.0 to 50.0.2

Changelog

Sourced from cryptography's changelog.

50.0.2 - 2026-09-30


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.3.
* Added ``abi3.abi3t`` wheels for free-threaded CPython 3.15 and later.
* Updated to PyO3 0.29.2, which fixes building ``cryptography`` on Cygwin and
  MSYS2.

.. _v50-0-1:


50.0.1 - 2026-08-25

  • Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.

.. _v50-0-0:

Commits

Updates py7zr from 1.1.3 to 1.1.4

Release notes

Sourced from py7zr's releases.

Fix multiple Vulnerbilities and bugs

Changelog

Sourced from py7zr's changelog.

v1.1.4_

Security

  • Fix arbitrary file write above the extraction directory via a symlink chain (incomplete fix of CVE-2026-23879, GHSA-jwx8-hv8g-gjjq).
    • canonical_path() cancelled .. lexically before any symlink was resolved, so link/.. was treated as the directory holding link instead of the parent of its target. A chain of symlink members extracted from the same archive could therefore redirect a later write an archive-chosen number of levels above the extraction directory, while the member name still reduced to something apparently inside it.
    • Containment is now decided on the real path: symlink components are followed first and .. is normalized only afterwards. This also covers symlink targets, which may legitimately contain .. and so cannot be rejected by name.
    • Archive member names containing a .. component are now rejected outright.
  • Fix memory exhaustion when opening a crafted archive header (GHSA-6pr6-cqpq-x889).
  • Fix extraction hang on a crafted COPY stream (GHSA-v999-q5cj-95jg).

Users are encouraged to upgrade. Details will be published in the corresponding security advisories.

Fixed

  • Raise PasswordRequired when an archive is opened in write or append mode with a crypto filter (e.g. FILTER_CRYPTO_AES256_SHA256) but no password, instead of failing later with an AttributeError. The check also covers direct use of SevenZipCompressor. (#723, #739)
  • Limit concurrent extraction workers for non-solid archives to os.cpu_count(), instead of starting one thread or process per folder. When the limit is reached, the oldest task is joined before a new one starts. (#630, #740)
  • Fix AttributeError in archiveinfo() for archives with no compressed content, such as an empty archive or one containing only empty files or directories. _get_method_names(), _is_solid() and archiveinfo() now handle header.main_streams being None. (#665, #741)
  • Fix intermittent false negatives in the relative-path check on Windows. Path.resolve() may or may not return the extended-length prefix (\\?\), and when only one of the compared paths had it, the relative_to check always failed. The prefix is now stripped before comparison. (#714, #743)
  • Fix io.UnsupportedOperation in extract() and extractall() when a WriterFactory returns a non-seekable handle, such as one from zipfile.ZipFile.open. The unnecessary seek(0) after decompression is removed, and MemIO.close() now rewinds only

... (truncated)

Commits
  • c717d21 Release version 1.1.4 to fix multiple vulnerabilities and bugs
  • c51e4f6 Merge commit from fork
  • f4204fa Merge commit from fork
  • 5c78459 Merge commit from fork
  • 23610d1 fix: raise Bad7zFile when decompression makes no progress
  • f3e4862 fix: enhance path sanitization and symlink resolution to prevent directory tr...
  • e41864c docs: update SECURITY.rst with threat model, hardening measures, and regressi...
  • 8ff8a30 docs: add guidelines for writing and organizing security regression tests
  • 0a3c81e tests: add malformed header tests into test_badheaders.py and enhance coverage
  • 3e37932 feat: add boundary checks for truncated reads in read_byte, read_uint64, ...
  • Additional commits viewable in compare view

Updates flask-socketio from 5.6.1 to 5.7.0

Updates gunicorn from 23.0.0 to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI ...

Description has been truncated

@dependabot
chore(deps-pip): bump the pip group across 1 directory with 13 updates
e7903f1 
Bumps the pip group with 13 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [sqlalchemy](https://github.com/sqlalchemy/sqlalchemy) | `2.0.41` | `2.1.6` |
| [psycopg2-binary](https://github.com/psycopg/psycopg2) | `2.9.10` | `2.9.13` |
| [flask-wtf](https://github.com/pallets-eco/flask-wtf) | `1.2.2` | `1.3.0` |
| [wtforms](https://github.com/pallets-eco/wtforms) | `3.2.1` | `3.3.1` |
| [email-validator](https://github.com/JoshData/python-email-validator) | `2.2.0` | `2.3.0` |
| [python-dotenv](https://github.com/theskumar/python-dotenv) | `1.2.2` | `1.2.4` |
| [requests](https://github.com/psf/requests) | `2.33.0` | `2.34.2` |
| [cryptography](https://github.com/pyca/cryptography) | `50.0.0` | `50.0.2` |
| [py7zr](https://github.com/miurahr/py7zr) | `1.1.3` | `1.1.4` |
| [flask-socketio](https://code.miguelgrinberg.com/miguelgrinberg/flask-socketio) | `5.6.1` | `5.7.0` |
| [gunicorn](https://github.com/benoitc/gunicorn) | `23.0.0` | `26.2.0` |
| [fpdf2](https://github.com/py-pdf/fpdf2) | `2.8.9` | `2.9.0` |
| [pytest](https://github.com/pytest-dev/pytest) | `9.0.3` | `9.2.0` |



Updates `sqlalchemy` from 2.0.41 to 2.1.6
- [Release notes](https://github.com/sqlalchemy/sqlalchemy/releases)
- [Changelog](https://github.com/sqlalchemy/sqlalchemy/blob/main/CHANGES.rst)
- [Commits](https://github.com/sqlalchemy/sqlalchemy/commits)

Updates `psycopg2-binary` from 2.9.10 to 2.9.13
- [Changelog](https://github.com/psycopg/psycopg2/blob/master/NEWS)
- [Commits](psycopg/psycopg2@2.9.10...2.9.13)

Updates `flask-wtf` from 1.2.2 to 1.3.0
- [Release notes](https://github.com/pallets-eco/flask-wtf/releases)
- [Changelog](https://github.com/pallets-eco/flask-wtf/blob/main/docs/changes.rst)
- [Commits](pallets-eco/flask-wtf@v1.2.2...v1.3.0)

Updates `wtforms` from 3.2.1 to 3.3.1
- [Release notes](https://github.com/pallets-eco/wtforms/releases)
- [Changelog](https://github.com/pallets-eco/wtforms/blob/main/CHANGES.rst)
- [Commits](pallets-eco/wtforms@3.2.1...3.3.1)

Updates `email-validator` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/JoshData/python-email-validator/releases)
- [Changelog](https://github.com/JoshData/python-email-validator/blob/main/CHANGELOG.md)
- [Commits](JoshData/python-email-validator@v2.2.0...v2.3.0)

Updates `python-dotenv` from 1.2.2 to 1.2.4
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.4)

Updates `requests` from 2.33.0 to 2.34.2
- [Release notes](https://github.com/psf/requests/releases)
- [Changelog](https://github.com/psf/requests/blob/main/HISTORY.md)
- [Commits](psf/requests@v2.33.0...v2.34.2)

Updates `cryptography` from 50.0.0 to 50.0.2
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.0...50.0.2)

Updates `py7zr` from 1.1.3 to 1.1.4
- [Release notes](https://github.com/miurahr/py7zr/releases)
- [Changelog](https://github.com/miurahr/py7zr/blob/master/docs/Changelog.rst)
- [Commits](miurahr/py7zr@v1.1.3...v1.1.4)

Updates `flask-socketio` from 5.6.1 to 5.7.0

Updates `gunicorn` from 23.0.0 to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@23.0.0...26.2.0)

Updates `fpdf2` from 2.8.9 to 2.9.0
- [Release notes](https://github.com/py-pdf/fpdf2/releases)
- [Changelog](https://github.com/py-pdf/fpdf2/blob/master/CHANGELOG.md)
- [Commits](py-pdf/fpdf2@2.8.9...2.9.0)

Updates `pytest` from 9.0.3 to 9.2.0
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](pytest-dev/pytest@9.0.3...9.2.0)

---
updated-dependencies:
- dependency-name: sqlalchemy
  dependency-version: 2.1.6
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: psycopg2-binary
  dependency-version: 2.9.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: flask-wtf
  dependency-version: 1.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: wtforms
  dependency-version: 3.3.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: email-validator
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: python-dotenv
  dependency-version: 1.2.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: requests
  dependency-version: 2.34.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: cryptography
  dependency-version: 50.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: py7zr
  dependency-version: 1.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: pip
- dependency-name: flask-socketio
  dependency-version: 5.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: pip
- dependency-name: fpdf2
  dependency-version: 2.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: pip
- dependency-name: pytest
  dependency-version: 9.2.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: pip
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Nov 2, 2026
@dependabot
dependabot Bot requested a review from Ayinkx as a code owner November 2, 2026 07:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Ayinkx Ayinkx Awaiting requested review from Ayinkx Ayinkx is a code owner

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants