Skip to content

chore(deps): bump the python-runtime group in /backend_api_python with 14 updates - #234

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend_api_python/python-runtime-d28c57c741
Open

chore(deps): bump the python-runtime group in /backend_api_python with 14 updates#234
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/pip/backend_api_python/python-runtime-d28c57c741

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 4, 2026

Copy link
Copy Markdown
Contributor

Updates the requirements on yfinance, ccxt, websocket-client, litellm, certifi, akshare, python-dotenv, cryptography, redis, gunicorn, marshmallow, reportlab, alpaca-py and ruff to permit the latest version.
Updates yfinance to 1.7.0

Release notes

Sourced from yfinance's releases.

1.7.0

Main change:

  • history_metadata now lazy-loads tradingPeriods

Fixes for:

  • proxy
  • stock-split price-repair

Full changelog #2959

Thanks @​amosli

Changelog

Sourced from yfinance's changelog.

1.7.0

Features / improvements:

  • Make history_metadata lazy-load 'tradingPeriods' #2922 Fixes
  • Improve robustness of YfData when behind a SOCKS5 proxy #2953 Price repair:
  • Fix bug in volume-validation of stock-split-repair #2958

1.6.0

Features / improvements

1.5.2

Patches

  • Fix yfinance breaking with curl_cffi>=0.16

1.5.1

Minor

  • Fall back to chunked requests when single-URL fundamentals fetch times out #2811
  • Replace valuation-measures HTML scrape with timeseries API #2851 Patches
  • Determine login and subscription tier via the subscriptions API #2845
  • Preserve user login cookies across cookie-strategy switches #2850

... (truncated)

Commits
  • 3d9d2f0 Version 1.7.0
  • 43f3021 Merge pull request #2959 from ranaroussi/dev
  • 686a031 Minor test fix
  • fdede94 Merge pull request #2953 from amosli/fix/cookie-crumb-proxy-resilience
  • 5c1f64e Fixes for PR #2958
  • c732994 Merge pull request #2958 from ranaroussi/fix/price-repair-split-volume-valida...
  • ba7b650 Fix proxy wipe and make cookie/crumb failures non-fatal
  • 0f29c85 Fix bug in volume-validation of stock-split-repair, that was wrongly blocking...
  • baeca64 Merge pull request #2918 from dokson/fix/drop-nospam-extra
  • 5261b4d Drop unusable nospam extra and py2 cruft
  • Additional commits viewable in compare view

Updates ccxt to 4.5.76

Commits
  • 2aa4d0b [Automated changes] 4.5.76
  • 74ad6d7 [Automated changes] GO files
  • 54f21e4 [Automated changes] Java files
  • 62cb2dd [Automated changes] C# files
  • ee31801 [Automated changes] Python files
  • ba4395d [Automated changes] PHP files
  • 1c84a12 [Automated changes] JS files
  • c60e7e4 fix(bybit): increase paginationCalls in fetchLeveragetiers (#30127)
  • b58c36b [Automated changes] GO files
  • f72a2c4 [Automated changes] Java files
  • Additional commits viewable in compare view

Updates websocket-client to 1.9.2

Release notes

Sourced from websocket-client's releases.

v1.9.2

1.9.2

  • Fix race in WebSocketApp.close() when run_forever() thread clears the socket during the close handshake (#1057, fixes #1055 and #1056)
Changelog

Sourced from websocket-client's changelog.

  • 1.9.2

    • Fix race in WebSocketApp.close() when run_forever() thread clears the socket during the close handshake (#1057, fixes #1055 and #1056)

  • 1.9.1

    • Add Python 3.14 support to setup config and CI (f2bc97a)
    • Fix close() dropping close frame when reason is str (2f22e2e)
    • Fix close() type annotation and docstring for timeout and reason (d69f730)
    • Make abort() robust for sockets that cannot shutdown, same logic as shutdown() (1904e3d)
    • Raise WebSocketException for redirects missing a Location header (97e34db)
    • Raise when WebSocket connect redirect limit is exhausted (be0d38d)
    • Raise WebSocketException for redirects to invalid targets (62ef6af)
    • Fix unformatted ABNF validation error messages (0145b7b)
    • Fix validate_utf8() crash on str input (4a8e6ed)
    • Store status_message on WebSocketBadStatusException (368aeda)
    • Raise WebSocketException for check_hostname with CERT_NONE (0232aca)
    • Fix handleDisconnect type annotation: None default requires Optional (20f3712)
    • Remove unreachable not frame check in recv_data_frame() (b684242)
    • Set proxy_timeout on proxy_info without a proxy host (68f0aed)
    • Fix _wsdump.py bytes annotations and remove dead code (5ecc6e4)
    • Export STATUS_SERVICE_RESTART and STATUS_TRY_AGAIN_LATER close codes (22279c4)
    • Fix extract_err_message() to always return str (e2091bd)
    • Raise WebSocketProxyException for SOCKS proxy without a port, correct proxy port docs (3c62bdf)
    • Raise WebSocketException for malformed HTTP responses (04f4d94)
    • Fix docs examples using dead or unreachable endpoints (2fc92c0)
    • Add pyproject.toml, drop deprecated setup.py metadata (8b34f50)
    • Apply linting (3b4ffab)

  • 1.9.0

    • Remove Python 3.8 support (EOL), add Python 3.13 (5f25030)
    • Remove localhost and 127.0.0.1 from default NO_PROXY list (#994)
    • Support IPv6 CIDRs in the no_proxy option (#1033)
    • Fix thread safety condition in teardown() to improve run_forever() (#1015)
    • Fix #1024 by chunking data, recursion in on_error callback, thread leak in _stop_ping_thread(), avoid implicit None in recv() (#1036)
    • Avoid bare except clauses for better error handling (#1036)
    • Fix async (#983)
    • Resolve mypy type errors (#996, #1006, 813d570)
    • Test coverage improvements (#1035, #1036)
    • flake8 linting improvements (#1034)

  • 1.8.0

    • Added on_reconnect parameter to WebSocketApp to handle callback ambiguity (#972)
    • Improve handling of SSLEOFError and use reconnect bool (#961)
    • Minor linting and docs CI build upgrades (981c00e, 75ba91a, bec2608)

  • 1.7.0

    • Renamed mask variable in ABNF to prevent name collision with mask() function (9b51f73)
    • Fixed old http import of HTTPStatus in _handshake.py (9b51f73)
    • Add send_text() and send_bytes() to _app.py (#953)
    • Improved typehint support (#953, 9b51f73, 8b73d00)

... (truncated)

Commits

Updates litellm to 1.99.0

Release notes

Sourced from litellm's releases.

v1.99.0

Verify Docker Image Signature

All LiteLLM Docker images are signed with cosign. Every release is signed with the same key introduced in commit 0112e53.

Verify using the pinned commit hash (recommended):

A commit hash is cryptographically immutable, so this is the strongest way to ensure you are using the original signing key:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/0112e53046018d726492c814b3644b7d376029d0/cosign.pub \
  ghcr.io/berriai/litellm:v1.99.0

Verify using the release tag (convenience):

Tags are protected in this repository and resolve to the same key. This option is easier to read but relies on tag protection rules:

cosign verify \
  --key https://raw.githubusercontent.com/BerriAI/litellm/v1.99.0/cosign.pub \
  ghcr.io/berriai/litellm:v1.99.0

Expected output:

The following checks were performed on each of these signatures:
  - The cosign claims were validated
  - The signatures were verified against the specified public key

What's Changed

... (truncated)

Commits
  • fa647f7 Merge pull request #39048 from BerriAI/litellm_/docker-build-failure-9f6247
  • 5892e30 fix(docker): pin apk python to 3.13 in migrations image
  • 91f1a57 fix(docker): bump wolfi-base for glibc 2.44 and pin apk python to 3.13
  • d0c8667 Merge pull request #38862 from BerriAI/litellm_/litellm-e2e-rc-1-99-0-11cfd8
  • da1d292 test(e2e): measure the select popup after it settles instead of mid-flight
  • a2aecfe fix(e2e): only the negative fallback assertion needs every replica to agree
  • ab1da05 test(e2e): de-flake the cost-header cache read and the router fallback control
  • 1411852 Merge pull request #38855 from BerriAI/litellm_/backport-38251-rc-1-99-0
  • f0ee067 fix(anthropic): translate tool_result document blocks in the /v1/messages bridge
  • 4b281e7 Merge pull request #38854 from BerriAI/litellm_backport_model_test_dialog_str...
  • Additional commits viewable in compare view

Updates certifi to 2026.7.22

Commits

Updates akshare to 1.18.94

Changelog

Sourced from akshare's changelog.

1.18.94 fix: fix fund_money_fund_info_em interface

1. 优化 stock_board_concept_hist_em 接口的空数据兜底逻辑：仅对合法空历史返回空 DataFrame，对无效概念板块名称或 BK 代码抛出明确异常

1.18.93 fix: fix fund_money_fund_info_em interface

1. 修复 fund_money_fund_info_em 接口

1.18.92 fix: improve Xueqiu login requirement guidance

1. 优化 stock_individual_basic_info_xq 系列接口在雪球返回 400016 时的提示信息，明确匿名访问当前受限且需要通过 `token=` 传入有效 `xq_a_token`
2. 补充中概股、美股、港股雪球公司信息接口的登录态依赖说明
3. 修复 fund_money_fund_info_em 接口因东方财富历史净值返回体新增字段而触发 Length mismatch 的问题

1.18.91 docs: migrate the Markdown parser to myst-parser

1. 文档 Markdown 解析器由 recommonmark 迁移至 myst-parser，并移除随之无用的 sphinx-markdown-tables 与 markdown 依赖
2. 修正 docs 目录下 25 个文件的标题层级，使每个页面具备唯一的一级标题且不再跳级
3. 接口条目层级调整后可生成锚点，文档站中每个接口均支持直接链接定位
4. 为 dependabot 增加依赖分组配置，避免多个拉取请求同时修改同一文件

1.18.90 build: declare all and drop the akqmt integration

1. 为 akshare 声明 __all__，由 scripts/build_registry.py 生成并纳入 CI 校验
2. 修复 from akshare import * 会额外导出 39 个子模块名的问题
3. 移除 akqmt 集成及 full、qmt 两个附加依赖组
4. 修正 README 中的 Python 版本要求、失效的仓库条幅与错误的代码风格条幅

1.18.89 build: raise the minimum supported Python version to 3.11

1. 将 requires-python 提升至 3.11 以上，并同步 classifiers、CI 测试矩阵与 ruff target-version
2. 修复 uv.lock 中为 Python 3.9 保留的旧版本解析分支所引发的 24 条依赖安全告警
3. 新增 dependabot 配置，自动跟进 uv 与 GitHub Actions 的依赖更新
4. 同步更新文档中关于 Python 最低版本的说明

1.18.88 fix: fix fund_portfolio_hold_em interface

1. 修复 fund_portfolio_hold_em 接口

1.18.87 fix: fix interface docs

1. 修复接口文档中接口半角符号问题

1.18.86 fix: fix interface docs

1. 修复接口文档中接口半角符号问题

1.18.85 feat: add interface registry search API

1. 新增 ak.search 接口检索功能，支持按接口名精确定位与关键词模糊检索

... (truncated)

Commits
  • 0e7db00 fix(stock_board_concept_hist_em): 优化错误处理与空数据兜底逻辑 (#7406)
  • e7d3e24 fix(fund): 修复fund_money_fund_info_em接口字段不匹配问题 (#7405)
  • 1b9aeb5 ci: bump astral-sh/setup-uv from 9.0.0 to 10.0.1 in the actions group (#7399)
  • ea5b388 build(deps-dev): bump ruff from 0.16.2 to 0.16.3 in the python group (#7400)
  • 8623219 fix(stock): 更新雪球token并完善接口登录态说明 (#7398)
  • 1248fdd ci: bump the actions group with 3 updates (#7394)
  • e7912a6 build(deps): bump the python group with 3 updates (#7395)
  • 8bfe862 docs: 发布1.18.91版本，优化文档解析器与结构 (#7393)
  • 7614379 Dev (#7386)
  • 02f358a fix(interface): 修复 fund_portfolio_hold_em 接口 (#7383)
  • Additional commits viewable in compare view

Updates python-dotenv to 1.2.3

Release notes

Sourced from python-dotenv's releases.

v1.2.3

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638
Changelog

Sourced from python-dotenv's changelog.

[1.2.3] - 2026-08-16

Fixed

  • Strip a leading UTF-8 BOM from .env file contents so the first variable is no longer silently lost when the file is saved with BOM (e.g. by some JetBrains IDEs on Windows) by [@​h1whelan] in #640
  • set_key now escapes backslashes, so values containing them (Windows paths, regular expressions) survive a write/read round-trip. Quoted values ending in an escaped backslash are no longer mis-parsed as an escaped quote, which used to swallow the following lines by [@​dchaudhari7177] in #680
  • dotenv run now prints a friendly error instead of a traceback when no command is given by [@​bbc2] in #606
  • Cache the parsed result for empty .env files so repeated dotenv_values/load_dotenv calls no longer re-read the file by [@​ReinerBRO] in #638

[1.2.2] - 2026-03-01

Added

  • Support for Python 3.14, including the free-threaded (3.14t) build. (#588)

Changed

  • The dotenv run command now forwards flags directly to the specified command by [@​bbc2] in #607
  • Improved documentation clarity regarding override behavior and the reference page.
  • Updated PyPy support to version 3.11.
  • Documentation for FIFO file support.
  • Dropped Support for Python 3.9.

Fixed

  • Improved set_key and unset_key behavior when interacting with symlinks by [@​bbc2] in [790c5c0]
  • Corrected the license specifier and added missing Python 3.14 classifiers in package metadata by [@​JYOuyang] in #590

Breaking Changes

  • dotenv.set_key and dotenv.unset_key used to follow symlinks in some situations. This is no longer the case. For that behavior to be restored in all cases, follow_symlinks=True should be used.

  • In the CLI, set and unset used to follow symlinks in some situations. This is no longer the case.

  • dotenv.set_key, dotenv.unset_key and the CLI commands set and unset used to reset the file mode of the modified .env file to 0o600 in some situations. This is no longer the case: The original mode of the file is now preserved. Is the file needed to be created or wasn't a regular file, mode 0o600 is used.

[1.2.1] - 2025-10-26

  • Move more config to pyproject.toml, removed setup.cfg
  • Add support for reading .env from FIFOs (Unix) by [@​sidharth-sudhir] in #586

[1.2.0] - 2025-10-26

... (truncated)

Commits
  • 49515af Bump version: 1.2.2 → 1.2.3
  • 8ac846f chore: add release runbook (RELEASING.md) and make release target
  • bb31c94 docs: add 1.2.3 release notes (#606, #638, #680)
  • f7b18d9 fix: round-trip backslashes through set_key (#680)
  • 751f8c1 ci(deps): bump actions/checkout from 6.0.2 to 6.0.3 in the github-actions gro...
  • f1937b6 chore(deps): update mkdocs-include-markdown-plugin requirement from >=6.0.0 t...
  • 45b9372 chore(deps): update pytest requirement from >=3.9 to >=9.0.3 (#653)
  • 72896e9 docs: fix broken mkdocs link in CONTRIBUTING.md (#636)
  • 72754a1 ci(deps): bump peaceiris/actions-gh-pages from 4.0.0 to 4.1.0 in the github-a...
  • 078325e ci(security): harden CI/CD supply chain with SHA pinning and least-privilege ...
  • Additional commits viewable in compare view

Updates cryptography to 50.0.1

Changelog

Sourced from cryptography's changelog.

50.0.1 - 2026-08-25


* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 4.0.2.

.. _v50-0-0:


50.0.0 - 2026-07-31

  • SECURITY ISSUE: :func:~cryptography.hazmat.primitives.serialization.pkcs7.pkcs7_decrypt_der and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a RecipientInfo's encryptedKey, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in :rfc:3218. Credit to @​X1AOxiang for reporting the issue. CVE-2026-69247
  • Deprecated Diffie-Hellman key exchange over finite fields (FFDH). Everything FFDH is deprecated, including the types in cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or parameters with the key loading APIs. Users should migrate to a more modern key exchange algorithm.
  • Added xof() class methods to :class:~cryptography.hazmat.primitives.hashes.SHAKE128 and :class:~cryptography.hazmat.primitives.hashes.SHAKE256 for constructing algorithm instances configured for use with :class:~cryptography.hazmat.primitives.hashes.XOFHash.
  • The :mod:X.509 verification <cryptography.x509.verification> APIs are now considered stable and are subject to our API stability policy.
  • Added the :doc:/cobblestone recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the C2SP chunked-encryption specification <https://c2sp.org/chunked-encryption>_ for streaming authenticated encryption of large messages.
  • Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT, instead of silently ignoring them.
  • Added support for using :class:~cryptography.x509.Name as a field type in the :doc:/hazmat/asn1/index module.
  • Loading a public key or an EC private key now rejects DER where the subjectPublicKey (or EC publicKey) BIT STRING declares a non-zero number of unused bits, instead of silently ignoring it.
  • Parsing a CRL entry's InvalidityDate extension now rejects a GeneralizedTime that carries fractional seconds or another non-DER form, matching the strict encoding already required for every other X.509 time field.
  • :func:~cryptography.x509.ocsp.load_der_ocsp_request and :func:~cryptography.x509.ocsp.load_der_ocsp_response now reject a request or response whose version field is not v1, the only version defined by RFC 6960, matching the version validation already performed when loading

... (truncated)

Commits

Updates redis to 8.1.0

Release notes

Sourced from redis's releases.

8.1.0

Changes

✨ Highlights

Async maintenance notifications

redis-py now supports server-pushed maintenance notifications in the asyncio stack for both standalone and cluster clients, bringing the async client to parity with the sync implementation. When a Redis deployment signals maintenance events (such as node migration or failover windows), the async client reacts through the maintenance-notifications handler (redis/maint_notifications.py and its async integration under redis/asyncio/), allowing applications to adapt connection handling during maintenance without downtime. (#4177)

Expanded command coverage

This release adds a batch of new command surfaces across core data types and modules:

  • Lists — LMOVEM / BLMOVEM for moving multiple elements between lists (#4174).
  • Sets — SDIFFCARD and SUNIONCARD cardinality commands (#4171).
  • Streams — MAXCOUNT / MAXSIZE options for XREAD and XREADGROUP (#4173).
  • Time Series — TS.READ (#4170), TS.QUERYLABELS (#4197), TS.NRANGE / TS.NREVRANGE (#4163), and an exclude_empty (EXCLUDEEMPTY) option for TS.MRANGE / TS.MREVRANGE (#4188).
  • Search — FT.ALIASLIST (#4198) and a COLLECT reducer for aggregations (#4179).
  • Sentinel — replica sentinel aliases (#4127).

🚀 New Features

  • Add replica sentinel aliases (#4127)
  • Add TS.NRANGE and TS.NREVRANGE support to the timeseries command surface (#4163)
  • feat: add TS.READ command support to the timeseries module (#4170)
  • feat: add SDIFFCARD and SUNIONCARD command support (#4171)
  • feat: add MAXCOUNT/MAXSIZE support to XREAD and XREADGROUP (#4173)
  • feat: add LMOVEM and BLMOVEM commands for moving multiple list elements (#4174)
  • feat: add async maintenance-notifications support for standalone and cluster clients (#4177)
  • feat: add COLLECT reducer support to search aggregations (#4179)
  • feat: add exclude_empty (EXCLUDEEMPTY) option to TS.MRANGE and TS.MREVRANGE (#4188)
  • feat: add TS.QUERYLABELS support to the timeseries command surface (#4197)
  • feat: add FT.ALIASLIST support (#4198)

⚠️ Experimental

  • feat: add client-side HIMPORT fieldset support for standalone and cluster clients (#4205)

The feature considered unstable and public API might be changed in the future minor version

🐛 Bug Fixes

  • fix: detect closed pooled connection without consuming pending push data (RESP3 + hiredis) (#4156)
  • Fix Sentinel pool capacity loss after failover (#4193)

... (truncated)

Commits
  • e013126 Testing with 8.10 GA (#4227)
  • 059d1e9 Fixed TS.NRANGE commands to correctly apply aggregators (#4225)
  • d486a0a Fix FIELDNAME alias dropping first character of un-prefixed fields (#4224)
  • fb93104 feat: add client-side HIMPORT fieldset support for standalone and cluster cli...
  • 9197609 Fix lat/lon swap in search querystring geo() helper (#4223)
  • 14714a0 fix: Fixed double decoding issue with unquote() (#4222)
  • 227280a Update lib version to 8.1.0
  • 88d16d0 Decode ACL LOG string values on the default RESP3 legacy callback (#4201)
  • 599fd75 feat: add FT.ALIASLIST support (#4198)
  • 71e275e test: add VectorField RERANK serialization tests for sync and async search (#...
  • Additional commits viewable in compare view

Updates gunicorn to 26.2.0

Release notes

Sourced from gunicorn's releases.

gunicorn 26.2.0

Cleartext HTTP/2 lands, and an HTTP/2 security fix.

Cleartext HTTP/2 (h2c)

http2_cleartext accepts prior-knowledge, upgrade, both or off (the default). Prior knowledge serves a connection that opens with the HTTP/2 preface; upgrade honours an HTTP/1.1 Upgrade: h2c request. Both work on the gthread, gevent and asgi workers.

This is for deployments where TLS is terminated by a proxy that speaks HTTP/2 upstream, so the hop into gunicorn no longer drops to HTTP/1.1. Only peers in forwarded_allow_ips are considered; everyone else is served HTTP/1.x exactly as if the setting were off. Each mechanism is enabled separately, so turning one on does not turn the other on.

Do not expose a cleartext HTTP/2 port to the internet.

Security

HTTP2Request built its headers straight from the stream, so nothing the HTTP/1 path enforces applied over HTTP/2: the underscore and header_map policy, duplicate Host and Content-Type, control characters in values, and the forwarded_allow_ips trust gate. An untrusted client could set SCRIPT_NAME and forge HTTP_* entries in the WSGI environ, and decide wsgi.url_scheme through :scheme. Both request classes now share one policy mixin, and the scheme comes from the transport.

If you serve HTTP/2, this is the reason to upgrade.

Other HTTP/2 fixes

WSGI responses were buffered whole before anything was sent; they stream now. HEAD, 204 and 304 no longer carry a body. Events read while blocked on a flow-control window were discarded, losing requests and body data outright. sendfile() is refused on HTTP/2 responses rather than bypassing framing.

Request bodies dropped on Upgrade requests

On the ASGI worker with the fast parser, any request carrying an Upgrade header reached the application with an empty body, whatever the header's value and with HTTP/2 switched off entirely. Fixed in gunicorn_h1c 0.6.9, which the fast extra now requires.

Full changelog: https://gunicorn.org/news/

Commits
  • 36f2a3c gunicorn 26.2.0
  • cbba350 test: cover the h2c edge paths that had none
  • 9885411 Merge pull request #3703 from cormier/fix-inconsistency-in-control-socket-docs
  • 86f0919 Merge pull request #3704 from methane/doc-wsgi-h1c
  • 5853551 Merge pull request #3712 from Rotzbua/patch-1
  • 7bce87e Merge pull request #3700 from benoitc/fix/sponsor-logo-path
  • 972dfb0 Merge pull request #3690 from melbinjp/docs/contributing-settings-path
  • 7b3f16b Merge pull request #3711 from benoitc/docs/http2-changelog
  • 5bf237c http2: require gunicorn_h1c 0.6.9 and drop the upgrade body workaround
  • 7cf0338 test: skip the fast-parser cases when gunicorn_h1c is absent
  • Additional commits viewable in compare view

Updates marshmallow to 4.3.1

Changelog

Sourced from marshmallow's changelog.

4.3.1 (2026-08-08)

Features:

  • If by_value is enabled on an enum with a None value allow_none now defaults to True. Thanks :user:GeraldineGalindo for the suggestion (:issue:2985).

Bug fixes:

  • marshmallow.validate.URL accepts a fragment that follows an empty path, e.g. https://example.com#frag (:pr:3016). Thanks :user:hdimer for the PR.

4.3.0 (2026-04-03)

Features:

  • Add pre_load and post_load parameters to marshmallow.fields.Field for field-level pre- and post-processing (:issue:2787).
  • Typing: improvements to marshmallow.validate (:pr:2940).

4.2.4 (2026-04-02)

Bug fixes:

  • marshmallow.validate.URL and marshmallow.validate.Email accept Internationalized Domain Names (IDNs) (:issue:2821, :issue:2936). marshmallow.validate.Email also correctly rejects IDN domains with leading/trailing hyphens. Thanks :user:touhidurrr for the report.
  • Typing: Fix typing of nested in marshmallow.fields.Nested (:pr:2935).

4.2.3 (2026-03-25)

Bug fixes:

  • Make marshmallow.fields.Number and marshmallow.fields.Mapping abstract base classes to prevent using them within Schemas (:issue:2924). Thanks :user:MartingaleCoda for reporting.
  • Allow required to be set on marshmallow.fields.Contant (:issue:2900). Thanks :user:nosnickid for the report and :user:worksbyfriday for the PR.
  • Fix marshmallow.validate.OneOf emitting extra pairs when labels outnumber choices (:issue:2869). Thanks: user:T90REAL for the report and :user:rstar327 for the PR.
  • Fix behavior when passing a dot-delimited attribute name to partial for a key with data_key set (:pr:2903). Thanks :user:bysiber for the PR.
  • Fix Enum field by-name lookup to only return actual members (:pr:2902). Thanks :user:bysiber for the PR.
  • marshmallow.fields.DateTime with format="timestamp_ms" properly rejects bool values (:pr:2904). Thanks :user:bysiber for the PR.
  • Fix typing of error_messages argument to marshmallow.fields.Field (:pr:1636).

... (truncated)

Commits

Updates reportlab to 5.0.1

Updates alpaca-py to 0.44.0

Release notes

Sourced from alpaca-py's releases.

v0.44.0

What's Changed

@dependabot
chore(deps): bump the python-runtime group
e680a77 
Updates the requirements on [yfinance](https://github.com/ranaroussi/yfinance), [ccxt](https://github.com/ccxt/ccxt), [websocket-client](https://github.com/websocket-client/websocket-client), [litellm](https://github.com/BerriAI/litellm), [certifi](https://github.com/certifi/python-certifi), [akshare](https://github.com/akfamily/akshare), [python-dotenv](https://github.com/theskumar/python-dotenv), [cryptography](https://github.com/pyca/cryptography), [redis](https://github.com/redis/redis-py), [gunicorn](https://github.com/benoitc/gunicorn), [marshmallow](https://github.com/marshmallow-code/marshmallow), [reportlab](https://www.reportlab.com/), [alpaca-py](https://github.com/alpacahq/alpaca-py) and [ruff](https://github.com/astral-sh/ruff) to permit the latest version.

Updates `yfinance` to 1.7.0
- [Release notes](https://github.com/ranaroussi/yfinance/releases)
- [Changelog](https://github.com/ranaroussi/yfinance/blob/main/CHANGELOG.rst)
- [Commits](ranaroussi/yfinance@1.5.2...1.7.0)

Updates `ccxt` to 4.5.76
- [Release notes](https://github.com/ccxt/ccxt/releases)
- [Commits](ccxt/ccxt@v4.5.73...v4.5.76)

Updates `websocket-client` to 1.9.2
- [Release notes](https://github.com/websocket-client/websocket-client/releases)
- [Changelog](https://github.com/websocket-client/websocket-client/blob/master/ChangeLog)
- [Commits](websocket-client/websocket-client@v1.9.0...v1.9.2)

Updates `litellm` to 1.99.0
- [Release notes](https://github.com/BerriAI/litellm/releases)
- [Commits](BerriAI/litellm@v1.93.0...v1.99.0)

Updates `certifi` to 2026.7.22
- [Commits](certifi/python-certifi@2026.06.17...2026.07.22)

Updates `akshare` to 1.18.94
- [Release notes](https://github.com/akfamily/akshare/releases)
- [Changelog](https://github.com/akfamily/akshare/blob/main/docs/changelog.md)
- [Commits](akfamily/akshare@release-v1.18.80...release-v1.18.94)

Updates `python-dotenv` to 1.2.3
- [Release notes](https://github.com/theskumar/python-dotenv/releases)
- [Changelog](https://github.com/theskumar/python-dotenv/blob/main/CHANGELOG.md)
- [Commits](theskumar/python-dotenv@v1.2.2...v1.2.3)

Updates `cryptography` to 50.0.1
- [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst)
- [Commits](pyca/cryptography@50.0.0...50.0.1)

Updates `redis` to 8.1.0
- [Release notes](https://github.com/redis/redis-py/releases)
- [Changelog](https://github.com/redis/redis-py/blob/master/CHANGES)
- [Commits](redis/redis-py@v6.4.0...v8.1.0)

Updates `gunicorn` to 26.2.0
- [Release notes](https://github.com/benoitc/gunicorn/releases)
- [Commits](benoitc/gunicorn@26.0.0...26.2.0)

Updates `marshmallow` to 4.3.1
- [Changelog](https://github.com/marshmallow-code/marshmallow/blob/dev/CHANGELOG.rst)
- [Commits](marshmallow-code/marshmallow@4.3.0...4.3.1)

Updates `reportlab` to 5.0.1

Updates `alpaca-py` to 0.44.0
- [Release notes](https://github.com/alpacahq/alpaca-py/releases)
- [Commits](alpacahq/alpaca-py@v0.43.5...v0.44.0)

Updates `ruff` to 0.16.5
- [Release notes](https://github.com/astral-sh/ruff/releases)
- [Changelog](https://github.com/astral-sh/ruff/blob/main/CHANGELOG.md)
- [Commits](astral-sh/ruff@0.16.0...0.16.5)

---
updated-dependencies:
- dependency-name: yfinance
  dependency-version: 1.7.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: ccxt
  dependency-version: 4.5.76
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: websocket-client
  dependency-version: 1.9.2
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: litellm
  dependency-version: 1.99.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: certifi
  dependency-version: 2026.7.22
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: akshare
  dependency-version: 1.18.94
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: python-dotenv
  dependency-version: 1.2.3
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: cryptography
  dependency-version: 50.0.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: redis
  dependency-version: 8.1.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: gunicorn
  dependency-version: 26.2.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: marshmallow
  dependency-version: 4.3.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: reportlab
  dependency-version: 5.0.1
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: alpaca-py
  dependency-version: 0.44.0
  dependency-type: direct:production
  dependency-group: python-runtime
- dependency-name: ruff
  dependency-version: 0.16.5
  dependency-type: direct:development
  dependency-group: python-runtime
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file python Pull requests that update python code labels Sep 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file python Pull requests that update python code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants